From b55ef5c838b204d4a9b50d9122d0ba3db3404ff9 Mon Sep 17 00:00:00 2001 From: peppelinux Date: Mon, 24 Jul 2023 12:12:54 +0200 Subject: [PATCH] cleanup --- en/.doctrees/algorithms.doctree | Bin 53977 -> 54520 bytes en/.doctrees/backup-restore.doctree | Bin 30333 -> 30876 bytes en/.doctrees/contribute.doctree | Bin 30167 -> 30710 bytes en/.doctrees/defined-terms.doctree | Bin 42401 -> 45302 bytes en/.doctrees/environment.pickle | Bin 77657 -> 77263 bytes en/.doctrees/index.doctree | Bin 38865 -> 39408 bytes en/.doctrees/issuance.doctree | Bin 29838 -> 0 bytes en/.doctrees/pid-data-model.doctree | Bin 117340 -> 0 bytes en/.doctrees/pid-eaa-data-model.doctree | Bin 145489 -> 147672 bytes en/.doctrees/pid-eaa-issuance.doctree | Bin 314642 -> 315238 bytes en/.doctrees/pid-issuance.doctree | Bin 286685 -> 0 bytes en/.doctrees/pid-issuing.doctree | Bin 286052 -> 0 bytes en/.doctrees/presentation.doctree | Bin 27567 -> 0 bytes en/.doctrees/pseudonyms.doctree | Bin 30285 -> 30828 bytes en/.doctrees/relying-party-solution.doctree | Bin 143922 -> 145877 bytes en/.doctrees/revocation-lists.doctree | Bin 30357 -> 30900 bytes en/.doctrees/ssi-introduction.doctree | Bin 39077 -> 39620 bytes en/.doctrees/standards.doctree | Bin 25378 -> 25921 bytes en/.doctrees/trust.doctree | Bin 153325 -> 154623 bytes .../wallet-instance-attestation.doctree | Bin 122890 -> 91013 bytes en/.doctrees/wallet-solution.doctree | Bin 48517 -> 74552 bytes .../High-Level-Flow-EUDIW-PID-Issuing.svg | 4 - .../Low-Level-Flow-EUDIW-PID-Issuing.svg | 1 - en/_sources/defined-terms.rst.txt | 11 + en/_sources/index.rst.txt | 2 +- en/_sources/issuance.rst.txt | 57 - en/_sources/pid-data-model.rst.txt | 400 --- en/_sources/pid-eaa-data-model.rst.txt | 57 +- en/_sources/pid-eaa-data.rst.txt | 57 - en/_sources/pid-eaa-issuance.rst.txt | 46 +- en/_sources/pid-eaa-mdoc-cbor.rst.txt | 57 - en/_sources/pid-eaa-sd-jwt.rst.txt | 57 - en/_sources/pid-issuance.rst.txt | 887 ------- en/_sources/pid-issuing.rst.txt | 877 ------- en/_sources/presentation.rst.txt | 57 - en/_sources/relying-party-solution.rst.txt | 18 +- en/_sources/trust.rst.txt | 5 +- .../wallet-instance-attestation.rst.txt | 466 +--- en/_sources/wallet-solution.rst.txt | 194 ++ en/algorithms.html | 190 +- en/backup-restore.html | 190 +- en/contribute.html | 190 +- en/defined-terms.html | 208 +- en/doctrees/algorithms.doctree | Bin 51235 -> 0 bytes en/doctrees/backup-restore.doctree | Bin 27591 -> 0 bytes en/doctrees/contribute.doctree | Bin 23049 -> 0 bytes en/doctrees/defined-terms.doctree | Bin 27579 -> 0 bytes en/doctrees/environment.pickle | Bin 62917 -> 0 bytes en/doctrees/index.doctree | Bin 27619 -> 0 bytes en/doctrees/issuance.doctree | Bin 27519 -> 0 bytes en/doctrees/pid-data-model.doctree | Bin 114584 -> 0 bytes en/doctrees/pid-eaa-data.doctree | Bin 27567 -> 0 bytes en/doctrees/pid-eaa-mdoc-cbor.doctree | Bin 27627 -> 0 bytes en/doctrees/pid-eaa-sd-jwt.doctree | Bin 27591 -> 0 bytes en/doctrees/pid-issuing.doctree | Bin 242066 -> 0 bytes en/doctrees/presentation.doctree | Bin 27567 -> 0 bytes en/doctrees/pseudonyms.doctree | Bin 27543 -> 0 bytes en/doctrees/revocation-lists.doctree | Bin 27615 -> 0 bytes en/doctrees/ssi-introduction.doctree | Bin 27615 -> 0 bytes en/doctrees/standards.doctree | Bin 22636 -> 0 bytes en/doctrees/trust.doctree | Bin 27483 -> 0 bytes .../wallet-instance-attestation.doctree | Bin 27747 -> 0 bytes en/doctrees/wallet-solution.doctree | Bin 27603 -> 0 bytes en/genindex.html | 190 +- en/index.html | 285 ++- en/issuance.html | 1305 ---------- en/objects.inv | Bin 1082 -> 1097 bytes en/pid-data-model.html | 1660 ------------ en/pid-eaa-data-model.html | 245 +- en/pid-eaa-data.html | 1318 ---------- en/pid-eaa-issuance.html | 236 +- en/pid-eaa-mdoc-cbor.html | 1318 ---------- en/pid-eaa-sd-jwt.html | 1318 ---------- en/pid-issuance.html | 2209 ---------------- en/pid-issuing.html | 2230 ----------------- en/presentation.html | 1311 ---------- en/pseudonyms.html | 190 +- en/relying-party-solution.html | 208 +- en/revocation-lists.html | 190 +- en/search.html | 190 +- en/searchindex.js | 2 +- en/ssi-introduction.html | 194 +- en/standards.html | 190 +- en/trust.html | 199 +- en/wallet-instance-attestation.html | 582 ++--- en/wallet-solution.html | 413 ++- 86 files changed, 3613 insertions(+), 16401 deletions(-) delete mode 100644 en/.doctrees/issuance.doctree delete mode 100644 en/.doctrees/pid-data-model.doctree delete mode 100644 en/.doctrees/pid-issuance.doctree delete mode 100644 en/.doctrees/pid-issuing.doctree delete mode 100644 en/.doctrees/presentation.doctree delete mode 100644 en/_images/High-Level-Flow-EUDIW-PID-Issuing.svg delete mode 100644 en/_images/Low-Level-Flow-EUDIW-PID-Issuing.svg delete mode 100644 en/_sources/issuance.rst.txt delete mode 100644 en/_sources/pid-data-model.rst.txt delete mode 100644 en/_sources/pid-eaa-data.rst.txt delete mode 100644 en/_sources/pid-eaa-mdoc-cbor.rst.txt delete mode 100644 en/_sources/pid-eaa-sd-jwt.rst.txt delete mode 100644 en/_sources/pid-issuance.rst.txt delete mode 100644 en/_sources/pid-issuing.rst.txt delete mode 100644 en/_sources/presentation.rst.txt delete mode 100644 en/doctrees/algorithms.doctree delete mode 100644 en/doctrees/backup-restore.doctree delete mode 100644 en/doctrees/contribute.doctree delete mode 100644 en/doctrees/defined-terms.doctree delete mode 100644 en/doctrees/environment.pickle delete mode 100644 en/doctrees/index.doctree delete mode 100644 en/doctrees/issuance.doctree delete mode 100644 en/doctrees/pid-data-model.doctree delete mode 100644 en/doctrees/pid-eaa-data.doctree delete mode 100644 en/doctrees/pid-eaa-mdoc-cbor.doctree delete mode 100644 en/doctrees/pid-eaa-sd-jwt.doctree delete mode 100644 en/doctrees/pid-issuing.doctree delete mode 100644 en/doctrees/presentation.doctree delete mode 100644 en/doctrees/pseudonyms.doctree delete mode 100644 en/doctrees/revocation-lists.doctree delete mode 100644 en/doctrees/ssi-introduction.doctree delete mode 100644 en/doctrees/standards.doctree delete mode 100644 en/doctrees/trust.doctree delete mode 100644 en/doctrees/wallet-instance-attestation.doctree delete mode 100644 en/doctrees/wallet-solution.doctree delete mode 100644 en/issuance.html delete mode 100644 en/pid-data-model.html delete mode 100644 en/pid-eaa-data.html delete mode 100644 en/pid-eaa-mdoc-cbor.html delete mode 100644 en/pid-eaa-sd-jwt.html delete mode 100644 en/pid-issuance.html delete mode 100644 en/pid-issuing.html delete mode 100644 en/presentation.html diff --git a/en/.doctrees/algorithms.doctree b/en/.doctrees/algorithms.doctree index 5cb9112628015d8ef4ed7e63c1e06b56ff62b3f6..bc856e35c3fa3b4a3903628099c5219e6b0359f1 100644 GIT binary patch literal 54520 zcmd6Q3y>Vgc^(Pio&b(GkOT>mkX8gAz!9^1ceumh!Pf~mkRXV|Q=~|lT+Hpx?#y6s zcQrG6caTJdl)`9fjUJZP<;1ccHmyjG6)9B0$g&fKu_RMfs*)^O3>76MTU4Z&4s9n& z6ia25mGAF)@6PP@?)6=TMfA<~bocc4_1|CrGt)i&WZ$p<^>?md|JhfWRaGmmq~(0R zT*)hD!ye36aZz$!)V>mfN=`F2f zrriPta+SqMezniO$&J&7FTN$6PCs@rJN(L%{|x_r>y;-z+E51`Yp6r^rVGjnUA05% zryEo&yT2-<3RXkiVlK$`uxwd|wotPGfvUVw%bTd4J&-HOrin-#_m$;E=V&lrs|G(7 zqGrgH=N@6=O+h)a(IEE>ez$I;`$cH`+s4pCR&@(#lHXWM6FopszD)3#O%6ps-R7rS;hdd%M!<)H@c8 zccjn`hYzPzYq2yuoJytcTre_s4}0`&#MyAJK6ctUJ8HYX9P$8R60E7$fhu(;$iET) zcH!Ua@$U_ws=rV%7G4v3fP^4U^Li zdt=Se8ul1JGAc|i=e4}-ShaoSSVMi>BvwzM0ZzEg4#zcw`e04Ww!*yM&Uba-zI}OI#BT`$h^7Aa1nQeF-cYkoG*nrAyHB<1QoS{n z>g8Cfw~|h@Q2ll?_+{BBYvrN@H8NrDl4hZ6E7cNI2d00aW?5RQSkh8ZpT(+{LdUR_ zG6W)}l~Zr6DW)Z-JoS;^2H8+jW~E$7lRR@?vjqMINsfqp{=}apWmbjexw_QYmGrN=jLg7po=3WaP=v+dPqHshSy3M~a)m zAd*^C~>p#(!KQ@$gsxi*R3Z)4=S-or~h5<|)F_!1+Bf$lzc zCcCIuGNe;p73kgP!3MD~m7a*okbR9ufMitBm7R-)$nekaHmZJQf>u;NXWzF9Mj{pS z*x8xLPBFsHaldu5b7eRmmql@Opoya!e2zi}1+NX43^C=W+8w0I`l(z)635qphR4?p ziF~QV*Ms*-v$Fv;%gf7Yxrkm3ia5zsY`bDrzga)gMvD;vtOEM z%MO*{4=18J78UBTv#UFHNL|IS(@v&6+nH+54wHJ}>`=u#c3#&tJA!)F6i3gRYTvWK z&KmSAD%4}=^R+w;Jkvpes0`r>M1^`i>$XI8;uQ#a1@hCvkl%0oo&|;?9Qi4H>tR)juq32sImLQB z-JZx(k`)QkpP3f*iL;`x_W0*R3`Lbkhz~>+^Vr$bH9Pyo_&_u1{TzL4Kdi%hA{NIE zofqr_QN=uV_IAzAlqhzlIM|u$zz&@k&d!w2&R8NlNeU$F-gGA2dUxvUOGtsD_ose} zQ2(NG!Ym0=pzuBF9f>?8DUhJMuo>Jzu@}PrlV-mUg*a+|7e-}-`4OZ*!ClzCM0N_~ z`OKX-HhVtkR7%Z|O3F$ae=AiPe=;SdD3|DAJ6_jVnYsDQg*RWw+=IvDci|tsbG~)| z?CA&64`$Po;}f_!o}NjMPo&4kXZF+Ix%vB=DC$%2me36KEI%UXN^kKTowcZrCq7al zG3SVw2ObVRPo;iRi&IWE?4PQODj|*3YC5aP*>Zkp$mI(#}nb6 zbXxV~s^MNzF1O;m6vatD1DtR4x-WN=MhT`XdH^R90n&sF^wN-c^>{f`!+aU5W?;rl z7h}bu9~k_s?x-G6Vl<}WT;)E zu>tP8yT%<9PuKR)?oUL^#%(q-NwepU2VjfP(%M2A^93?WP0DNdjj>6~J1^j*Wx0fz z9vRudtS<|1U(loyW~E4Yt*c-HR!)%$1|~)=SBy(d1Prl3Ns^612!A9pfPc<|FR(Tq zB~yu%JVMrf8n41n9GiOR=!t-nq-RM}(vo6m1x;QkDN+s-M~Eb1%QR~;agp${eAp>) zYAL6MxQNCEWcZS{`f7L_Oeb={9@U&bCOz1>FDASS?n)-wii)$n*YkjMiY$vj&KX#rOo zu$h8oxHA~P%p@Zi@{FJw!XJqYC^+g-u$s$zpl1?6v+?ZwiPLA6x_EwoHZL%XSMt)* zWD?qbQ>#>$!cPi+Qj#v}VLX_K@fdY-$H1kBjs|@^VqCs$V@lgXO>)ds zTFNEZ@sOV&+?3(S0OGUJ5RvQ&>U6Q^5#}@m;~uv&QtJop;9Yj6o+YM z!geYtNG_L)3Y!6xS(;3br<=#HZQ%@*J_I-JT!8wn)m6hoe>f5S5$37Po;wvFZtW|~ zlZK7zvau*(8m?T5Q>9IGI)u#o9iW-;(C}ZvLvSP!!5kqtcII?QY`C4RVDN7mbT^SR z62{{G4zT$1uzI^sgZ1k|f^nL5O;9~ZfjEV`i8KZ{zl17HSUwF@X&2^VCrB`B00pjAE6Xi_sAcL(7 zV9Nmp+*hHYiR)@V-9hcaT7f>yn=2`yQ}*>o>880-G-NE}$fbf39i*de5_mIE^%pi= zaYfuDRF4)=t$zt=)E)XC(I3p=S8vz_gh7yQmeL{ zq87ngmlDmNZ8_=BlWj4wL1b~31)RKwsQpW-*AD$h_)}ZZU&SA9N~>D~?>T65N&5dr z+BGVJ8Jnue`Bq><_C});UT6}sPdFmR<(4e^H$$N8tz%=e-V?krENF1n{`8xcQ7IQg zdG+fyf*3kGY7hB2{E5^0jX2%OYjT+z81CV*Fv^_c?$?tpm#|^iK<~?UuvvWe;D3gM08|nknEO^$NRB!^)kN zkOFqle|v!B78A+YGECfDmx~y{?5*&XWIT|2&GYLIUX@l_!qcnz{03~Wjg3T z#H+c`UL&Grb~TFn4>2&p^{1;wIz{^nxFYl}R%-9^F+DLED<3y)3d;vl1@K>oQ=CnA z1Cn+pAJ>4X>o{_`OkKm03X+e*9KfROdM#=@BfPdT@}a+oc8-n@i9=LGH}pS4#w5+a zgtBJMILpu^Yle*TiJIYL)_)MHYpCz{CKOeUMseN1QcO$ee}~Gfy-v8aMRkHAyVHps zu&4PL6bU-vSpQn<#1?WhW~I}!b7x|u;*+Sb>uC&n2?MqG6eA(3-pz2__Is8Cd9?ps z2fjYRk;_$!kFum4)neqNayd2E^uBu3ZjScHvM+N$jMf{g9Q7B3*L&S`0~45=b>n*s zO|owM70xH>hLc&WZv331QCz$GX-rG3lWw@QMRkKByVDJ<3)NqaLDAgNBK=^kbz@tg z8&c9;O1jV2jxC;cP~t#8#*u>4+t`Ps-FX{WAFA)=$mQ~O8%ru&KOW?O7}XCf-PBJA zuXmsy2fW)Bk$%Sk|6T=?Y@78X$Iv9}hl%rv`r%}b*AHhgLHrGhyU-xGK?&L2yEq!f z)sJ_^w8Wa|$AOmn6PLEAeo$n0`hmr+`o$O&3HssmgSFO=Q9MYTm^^s&jYp;X6CZPY z0kw9WkFAl^fr5OI(ZS_`JkP;Fv?pRAtp0h9T&{wAjwS7=Alr{RGe={*khoL6C-M>p z)M)*&R8{}B@cOTtl3+r5vy!~V&?GC#FK|9lNu11Lm1J{2_XswCq|GDPIw^@uTU1FX zvO6Wg;$HpLZtZD3lmt$Nqa;aBJnjYezLJDf2TJlr{+7HurX`!zG};qWVD1P}qo zvZQOKB#(1Ijn*GabM?0fum8F!2^J+ZD@l!^Nmi1laXwK=oXldCq`}cBu21s8n3h;4 zC2?tsDhWk)rzBX+tQ#>XntM^CKXjoa?UO!<$401t^Wr8sslAC_5I0V4q^Gw(#A{IG z`3wAM7IFJ3@2#*Y6)~HVzV;M)c1^jz@8k|%!OyFE=kdlk@^bZ1;wyLh&egfOqo+@u znwvj1cg+3TRqG4*Rg@68860*P6$h*&_9qtr)1QZ47&~tz^#9fpwP$rN%YV#l=l`2B z20{--UC6z>^NV@A9=W&CuNv@&vADPDqd3iZJG~W2o9(#SXrrx+wRie3M=rO^4zQ#h zhp^6X)iWr_9lB%Rs!!lNCuoVI`ccqWNT-i+-4$A`^=|ME!V{QSgL^NcjFYN zb^Rj_a8aVM-cEl9M=qD>%PeWfE){xt?t%)%_%i=-4q(yRV!53DTf%D__<;WFbdk@c zf_Lb69@Oju{#%A7*$4a+oKN%toy_q*;6XMoAfnw(@5v4d00NGzn>$Qs}t{KNd@V|a~!~;wZ+O#{ji#tP|hG z`9z&?GK%5E>R*jPk)RWf^{59J4TW_g z;!nH|r#StI8<4a+e*)`h_3JotxjJzTODaew4s!sD>I4?R>NCP?yKXvxg=WnOIC`;N=E1IX>$`yffPYf_r0k1w}sbx{X`^Y zLBMMaPO^yn0_PJ&#K|mHL^f~c9=!&Tw0ZPeClPUJi;4(Eb|)gUFsN6%HK;B`q znj7;g%)nPSH%4F?>oqs#X~1^Jr?|N>@8M`V*Ufl0Be4A_7H#DdXyqq4a=Am(6D(=x zp{e5+Cq9XST+Fd^V?KrRoKF3-9MzA4egL39!I7(L(7}Y4*t?mphCl~N11ID~e$Zd$ zsD2dmNq~NVBUc1;vPy>L#=MQARCjKS+dDr##4%z4^3RVr8BT-ZLy)Rz8$%m-HHUSp0l>= z=i$XH+1kh8Bzt&w;(Vfq=VTV^;hp4Y6<5FSi)o5=^6*^Rq8=VacIV;E!=U!YplEAQ zTq^UL(^Gnxor*`)SjCy0$WF&9#gnM7+p7lLbb(mBi&4;iNcC>=IdDh2-)XS*c8*-G zSgf$59mS&gS+t9-IokIPKgIzuTJJNc_eX@+JCKdFTIlILqK;Xg^*n==+>w664YX^YARMRq3}XJJsEk3o?j8%{@9YuUhutdduF z4sG>CqmQKuBx5s9arzenNZM)ajds0rU}_UbE>|+HWJx8-YrB3z5i?2u41<#_6c=$mQ7D|uVuhl@(JHP`T#9Lm zbrK4fwy020WOqXGC=BXU42lGyaLm68p=h7feJABS7fntY_fG1On5T?gy_2F3i7(4W z8DDS>e?zrIFQ-aMxoD}WN+D(87oLiwu#uPPe?eV&YfUcEV(yBODjJH6FPtKwTux1n zPaRAxXqK5Co(&Z;HGb#-i%w}~cs;oD8QSP#^7X$ymb9(!Mg2!F&vW#&sQx_;bA67( zTtA02Nb0@8^FKk4wfljY?XjTv^N?8;-?7kZI*Tf3fo1!POieXfYEQBOqQVeiR)y!E9`>IOKiZ5YT z)0w6s^q;|y>=CEjnCnMRG-bB8QT5K|FJb+TdZb% zqXVfd!uxzQ6?hek0kdV3nm&lCn%ME9l3iIOTiS*WgRM)m;hfAu(A${>gl7xIEXb%nbqxD@??c&$Hq+J1mRc#Z zU3?n$wUm-o04cMUvWOP4&?19~mu?-Oq8(N60qv&ZDJCf1-^Zu@ceoocXL$jgC~v8a zlY{mynB`*D@14GcWz8xX$ussg^D;KaTFI(fQ7z#gOn6g?Hkz=vn2R#{*;{Mq)+UI$ zn*DZuW=oZv>{7c6n`EH}VPJK-8(3x(BKIZi3i1rBqk6uw#vBT}BmDMX_*^Yq7VUd?~9e%33Ka=kwV0 ziv*-@kGdPiz+OuQN7A0LH!9_&1_l^=&`}d~VOS%kg=^>^R@Rb@q5^e-;f$hEFf9wB z3bV;81rut%M?J3YQy*1NsLQIVen5S<`Z4uGHG6v`Ee#MXvAtozXsE~S;hd`EE=d}! zxS>93Z>g2T5zF>=SDGZ`Gl3g>hGz4sD43xQT>Yg9rau457h6gf1~~n_3zc6>4R5dfa;^*S_-yPa5Dw3 zryxVYJ__!n;1C5TC^$~RLlm5+AVK>DR>VBzd=ERg5Ra!w<&mz zg3nU$B?|tCg0EBXH4458WV3f@V<`zd%Y1s|c{pHlE?3O-2z^9a~@ z{|)jDzK)<~4^cZg$a5I-|VK z=&m!W>x||)qqxrKtut!tjMh4%w9e?PGb-zh#yX?0&giQ%>gtTPI-{)4=&CcS>Wrp3 zqo~g4sWWQojFvj1q|WH5Gb-wghB~95&fwQ|g8ocR-ASG0_ta-$bkD))z67KDI*jhS zFuEV9KU06gEKdEUV{Tih{g}D!q$6f-x6u(ZxBYa)%Gq?BC5i_@s&=E7YPty@Ix991IncE-J5i_@M(h)Pa|4K*9++L+4W^VtN zj+nV^q_$_~wvCRMx$UAOW^QA2#LR7mj+nU}qa$W+XX%KU+v9Y^%_m?BW7+- z(-AYb577}bw~x~iGdFUfnYl4%nr%;^zl@K&==9NfJx2k3Mp}Q30{S4VUZa3M=&1h# z1@u8S{XG=WXF2q*Q9ujt^|KVv(pvp{6wu;1Jx2kphtXf7fF`x;H412Es{RiY&-!)MB2TS<(H z4SO@bUB-5S#onj*hVM}~{=-1`bmJTbf9wthH^P;D=YqcL6pp4HwMNX#CR_+F+V|?! zKKH9w;qRTfJC=;v*;!C_-ZE+!i3^txr-X0L=HDn5uIl^*kliTm&~r%I?g^mX=Q{aU z+M7r^;hLP7KYp6L?dV;SF0+#K1^kI_@({UU_t{9_kJ1csCQ{B&pSl?v{N<#AlE0bm z`*A0e@?E8TXy=kA`N2KWEjaz{$l*g%_rMRM+q;w3(*(9I0Uk~UxZ9}0b}X6v$o61= zlOODFhyuH_2e9|H0gD!O_Y;GU4>#^|d&vKWAM$geAm7jf~woGKEn_8lqj&NH3NH~Jy@L|Y*7^0H>?rZ z=}vw2AM=BKN)*_edjNZ9>%i)HhP&ONN19G|)Z>rw!~KXTxVzU7ZU>S21Ae&Ai-LPg z4{#51v~Gu9`)z)x-xLM))*hg8_)yYJr(XLSKiF4AfxWEALaI=_FymYgFPz>>{t(A`Fd@~ z+krAa+)JY1-q8bGzFynGL$33KeOeUQeLaAUc|d`;P_o(Ha({;(-N!|tlX^h6x7Cl( zmpeRs`FH%-z9`eY^c9er$gx3R^}LHl;nb|H+T-uSH=S7lrLodu+qoxgDMX zBo*TDOo+nPK}&Ao$MyzM*d}|xHr}cw6})XyrF^wgZQp!%^Fur$3gZ4AAZA)2vcW)- zjY4~bZ{|n%CQ%5ddO#T0h?rod<)@Z%T6>5FKg5bCh|@hl+}GNOW?s^lI}8mrKfGr| z!8_0cycip;xGmVB7yfg8gwKjXIMV~dxCYcJ)uj&ii7)WO`}d;Y9qa*KOanUhDJ|vN z_rUM*BYasD!b3eEJkZ($F;mmTdrdYyLRrbF?ScLuexUzL6wt#x03B-us>{Y=dvGIH zbNe!zkyMB;b3_cd&LjOEesH&n0(WN*;9@3LU>a*`W_sdK`__9SKfrrL0lcdRfH5M< zytNJ@`YZhK9uWoa?jGPxwe~!36wFDgtaTU)m-u0tqF~-52ByE!BdsjyaBJ~FewgoD z9ZY9>yE_qRt_P%2YlAu;zaDSjAO8hE#7_x?c(q7~9p+4Yg&*R76bNyLNQfO|=llE+ z|BFC~y-eatG}I1H_J76?@uvbI_A=8a5n_ku`P;AI_H3>~(p7ji5xMDQ7Dyt*4v)3> z@k87z5MnPg1QH>3cyWB3AL3Dg5PNw{nh0^G{h)D?AL3&IA@=grEfM0u_7LC34{=!_ z#9kiQBtq=qiZ}Qn{+d9Dz1;K1+-`VVd$e!H&+=pZeSsKzxnE4i*ulT~8b8Lb3dGpU zZAUW34i3&M{22dSAja7qe7Izc9Xy<0@MHYBK#cQ3F?Miqc3jKt;#`fSqFkJ_LNRvm zamM*EN&+!n5Q?#blk)&S#`^?fd{`*P4qi^4AEPV~t0L*L| AT>t<8 literal 53977 zcmd6Q4|E*IeV#-TAOL|NK}nQoiP1^4Bnr~r0U$t7)L)o@B#I(PkrWjxPdY8`_OQD= z+?{s!0MNEvxr*acy0sJO;yQNY){foEj$Tq%jqS+q`8_*!tjcxz?AWf|C{^RutsDEr zFMdtp$g$k-H~ar?_jc|uz^k4(*qfc1o$s69eDmAgnVqNle(O)aaS{8^-f7lUt+JMt zi^WQ{sF+QApja)`mz9due6D%ZyP8in57>i-ylPhKMnP%X7a>JK)yhRfsWczO$q`C# zX=O9(7O=fgU5?~e`|PXTIBn?hU&&^(k3OCs`rcE&jer00dr$pNQ{Db(QysLoomJN8 zswt`8-K1LC{WTd?u$to07tR|>iKQ7_TP`0lYcfF{s2Pf>7%NJ%Zg02bCCbrMhtxglR(mk-(}Z9B9y`|| z*31#uYQ_DNFDfOiqFGwCVrC7~YTDb%T19Cd@2f8Y^c7}((X=!R6jm#tv_AV_Z(lZ> zdB>vhjttu2$dQa{EtiLeGMUWni$?CwA&j9{iUk0EK^V@>rjlUO~01~}$2I~3Ot>LanOz>GJ(73!6s z=Be#qD8+nPu`I=q)?ymLZG{EDo$pBDzH@n8#1Dr7#8Q7_0`;vIZ>sqxo2sn7-KSc0 zsooJw^=d5DJ4h$msD3*c{HknJw91kMH8NrDl4hZ6E44CI2d00vZdqDpsjOw7KFc*N zgN|V-6$nH|t7M+2E2br9JoS;^2H8+DX0=ky6lEkp%A#VJlxtbZRH_yHqpqy2Xr2_j zb>pt!%gfVo@?!69M;@;hqp{=}apWmbjexw_ayetEN=8|emuqFkWaP=v+ai%?shSy3 zM~a)lAd*>DEWdwiJ|19zQo93 zp!-js$}cOH4C$2D1$zG(ut6+LWhbICWMAeHAQ?4uW#?icGW_%VjhbJXpcU0WuwB*}7!8$TkT;Ze_QHl{)zIaei;6YXkl z56MqtCj+i}&==pLQBVsjepixAw>wTqlOdA)^ZVWNR2lJIjSBVHxw=bs4rV9Bu!Dk9 z**PdpbYzFh@P`vo9g7O}*xA<|JEX2+*y$wGp6yI^W`{|=aCWF-9y`C(H9LZO))Yt2 zn(ExMz|IErEGpDv=bEnBnHFU`)2TgcN}BG}v%n6W542j)5I^m+lj)kBL!#Je9o&7@ z^;LOFI+Vf=ofpndFrZ)CB|FoibO!~c+Rk)}?ob)R*`Y$co^@R!J4(bobVqb)IxB3{ zVnwwuw8wW2J!PJjq9d1|!W-9}Dn(d2=6OTwaXFmoc|7g!fhR!Nh9y^k}R-2~wg~9opSyM`0E6&-&a%HE3Rh{R9eheIh5ZUb8eK zN`X*NOaE%u=b01*qB4Xl5Ebh6tQ!*9iB}-x706E;Lw>*UdlndqaO9`(t%p@9!jh1l z2Scxv6V*rbMwb#lg;03OjUOI6G55J7bCLBq@-vd()Y0``xLpFChhr z-k#a;;ePn!Kc6ym7!T^N-S=0}hM1$SY$ zB(hT?&u9MF-0Yd4Qz>;rDl2PQ{H@kx{K=J-CAmxw+wr=_%FQq2&i?Y*++BD~eh2>1 zJLl^U&YrwK`#?TBIX;1#3GK_ zttyL>TwbClsOqxWLc&&kHT>k%{TUG8_mcHr*n^u*guCFtJsVg7_f@O(kT}3=RnOz? zPqa$_n-ywp_h$grcWT#nQ4eM=5vJR!^F6?fwyIJo7#C{vs-+#O5`{`X1E}k5)zF1K zxZ{a%k2|e;eBE%*D;L^vo{!?Bp8?Ldc-@z~NuvbQ6+M6xi2!Lr26|~oyn4KxsbRj1 zRW~qWCi2=4rW)2M_h$g}zIDP3uIquFOa#mN=*d~?ZF8rpr+R2qr>hog)tWRh-hy-} zI2mf!Xl#J{&aQC>#nZJtvvT>V@Ow#P>djhaa(9-&17V`yiN?j^y_>HkiD>^UW zq*b|$nI1XWz^pF|Z(q=)5@w}Hc&)2o0#-qhN(LrItyYcmEd&g*K}nL0QV4$}GJt>D zgD^+12TL`TYoh?4yF@1V2^6f%t`k@92%?W&7wafv!-8Ba$3-2t~8w9gp{O5WBme2kh2FU}p%}DVn3|THgFx0h1uT%Xtc(Emi9k zjN&lOT-Z(}1glEP*Hu-ee;e~uW>238 z5V!Xg=1Idwb=g>!Fb!8O$EngbIvqmh{SMGfcxd=9;UTy!5y3nmm^*bcBsSd6RxtRt z47%IM83|)?e+O9nd04$%%tLj1BC07ub^4y8nVIQ{TZ6VC<2OnLNh#9o7-a zbS)qTC?$&zo}^J6D-+-XFgJJ&lTyA{?>iFfJxTRGIs4Gr`$AHfTNitvZ|e&L+HXcVG5}re>@C zbdPWVv*G(NGpwwHPT5x;rQ5>lk|ATELLn2B=pY^KkieT`slT}8qKo3DS$ed9YW-74 zqwdjvpZ;K$x_YDjdvu7o?yS~>SZyG)N`xzS^I1$aEmh0q>MG{*hANji@z9yGG@aDv z*=?CoyQ@4tgg@qh@CB-{U+;ks8U~@yBCj=6eTR0i-ft}#)q1V%6txIebChX@XxmAD zCTN?H4Iqm%@%{K^MD3qbz4qwe!Jqn~{wn@>lQ!KNcu)FTOVa-r(r!>0%-B>#F17<3 zw6_}7@KTD9ePXCJF0^IQzZe2#?-(1K^`23UVamR7!9(@3RV&|s2xf^|@)w#e$EUCT?f1-^Sg+4MicCzM9 z95!9-`i@X0{T3?E!8{Zs4M1mco)h#Kl6D7rCqUoGk*jOar@fouc+d}oKnF z&24aO?DUz*=|i!W_EbQ6A4?VR{ZIM%ekTWWQNFQuL4P|(E|>2$mNXsendk#GNJbFj z4-+5e02Zw+77*wk5?^==^Q`SNXn4HkY{{kK@kb(XY5CPa9GGM_XftKs(FXO!LVTQZ` zEH&^m4`TVF*SkYiw+H+Rkeo$CuH_u$JxJ^~)pv1iPNDl2gArY>hcT*DfGZqcwKqV^ ze+=B@G@r5iQE9g9V$$=FJG=WRjatjOJt7MK3>OVp7_~3X2K|S4H5WT;MAXbKMN$7g z21dC4bk#_w=zIZJgzBu+-sNL@Vlq}fc5d?rD#!;?1@K34inHlTwkvK#}bVL6WWK7ZwOqpucj5&rTSu@V! ze4=JJne}gm>Kf|%y$MBuqfuNpFdx$r`d^_k8?O^CZBd<|$nJDv5A10+21SBSIM%<> zIx$Rc#;kO5cK%eXRD1vxc756bFJYh-A7ms%)w>mr+kWroKpyRXSAehQIC8ma@f$2@ zs#=U3S1x4cTi(cy+O5(4SoUcSh|zju9iRT9@Op2WZeWUTt8RRap-I+_zrguK-EcCC z)r}uU6?KZt3GP0|gQwy17UWOurOm5=%>F(_I)TBILrv~KJQbVEwIOS!hs*N$ON zJ1B9WAN!Gl)7!WPNxSnlumV!Qnj@FX+g_GbxPIKl0Wqo{Se&TeF1+4>ejM^{TSWRD zhx~gLOe1a8k8=!7vVN3sK2blM%<=l+OqY+pL2;+j2RA4oyQ_0FimM+_#I(eQ=*OY9 z`xBS8sD4mnclv?locfs<6bbs_^n;Dok5N2GoR~a(^esoF`w|~>d=j;GosS)n)PaJ$ z!06!eK%VE|AlehL)KmXBM=n=EKFX4&D#-4m&fLftFC^}i?}@z30X15GEXLHoEWG}k zrX-kh-Kr$7F*M0a@?)G&R1zn%SS5LbqfuNXc|E2jHc3fb+M-HAk=-c?mapos#-K=0 z5~n|GhLXUkaFitJiO0eIkdlN`2TC%HB%Hp;1d?{=i)6rDmLr#|Bsa698>S==azKqL z2^OE~3&QKaX-a}=_pM5zGBn9bvWD}CO5$V|t0eE?XcSjTo{njWO;Qq-l5|dL;;|7b;Jmm=PHJzX7sSouTj}ZTx1E7jkh+x5u3jlN~O zKa9n_Ro{lwoI}_}NZQ>HhSg>I&-uIT>rM-;|E>CU0p{4Z>Tl);o#`4hmWt{7IC8n; zHb3a#Re9`V*SCZ~2T22GWsV>8-5k}A_GhdB)9>KO6#<Ayr9F5}ofM1Gfi4E}q+uxhJv_*YDitNq@#L7GU-^8G3^_?Qt&m}V&E48N~ z7}IX%>5X`-D*qhix?Ku75qWR^3kIL-In>WMFh_eH7VYUj<;dkS^|vgkAf32sAl;{k z))p)9^ed4o&AsTZwwtCCGwnJt$QGEOOLyF(?vr!m<8M(1}xt{=~1Lww_L~RDnOyVDPzg;#WB^M|&O?Nb2w6$mRCD zce12{bmC(iz@oLq+C}{%!fU%}I)O31)t~qrLzAo%U&Z-Eop3UX)rtSg(I~D?d^@Hk zHc2O3+M+r^k=^M8)`9AujX{y16OQ$7icTc?6FUdPIuY?FMsbSsR(=PPrj51Ho`;p9 z`VdDhS0}c!q=Ixp;s6${EtYudW5R2@X*z+WRINHO$Iv9}#95qA)CniESe+WSe z`Iwg2B%N?+i|PbLcBd0qPOHzxph(aO$ND!~CoaK#$I-d_r1>+kcOD-=eO-@YyPGcX zDL%+3;PNTn&w)GI`>;k=e~u%Us};Y&lBQ}!>vTI8TWhrcwBpko5To_R>RSCp;q~5l z)xbn|EF@r`+-Q}JuQ52uvhf!RecMb=ZRO?rB zw(qKG(|#fnIsqg7lHc_OAM zHc3QW+M*&tk==<1R=n$HVo)TAh|>`^Q$#Q~CP73#iE4Ypv@aqoc_1P$FhaOIk>@#B zh<3)iz}?3=a=9Y%QI=G=h`h`JF z!O<$Nh`b)t6q_U>E^Sc}p~&t;WEKYXY7B}55pg;~7b4O*sXKYbc|V(+G;Z?Dw_{%a z>R&=+Z}VkxiSuRHCn^?BCVZx%>wNxg$eov@J4w;be-v%y&HCA-xiKeE$@PAWLSPx2 zH8*Aru-)+~Zf?xmIGWB?h!sX)=TR)$%E!>kCPyxJXsWTK=|fZM7biY|f?Uk8b7MY; z^PEoo`#Gu~1${q2KgW@)YtX@jm)N_R&xSw;NdqV3C4SJK=BR!Y^l^ZGkt0_Gbh1i@ z=Ef{@l(??bM%o8sItE38hv%3-m&&~6^pswv(BTm^R&nMh z^3$;d6qO)ELxvMyVzQzec$jm zIUq*seG2t{ukd;YvawMMJ-tWNG3&FQXK<2bu`Zc-iQ6rRP^TTE#WIKaOdN z4UvuZm7XqbQQ4r#?quUZ7}UpOP$bBP(-AgWHZY?ud4=acqPA|w>SL(_$#{do=aP)q zIWR}N-f1xP_Z+!g$@sr4X{u!K`4?~6(XD@R2DQBcxj6j`&e{e-u~9Q`J)wwMel@}1 zBn!nX&L;|mlQ~`}dYyWEilbFrp?DysDKu&!M*e zT6k?YPbgyM=)c6^Bn!nWIG-pKPG+$}@m-EqafRYrF-@^aLgCUD6$*;%PADFRL476$ zMS@T`=D#UIku;}nWF#yUkvVm{aEkMZ#W0eljkeLQ_sd{vkRz8X6#XozAfdR016Z`S zZ$)iy5?K`0#a??Na#Cw1RRInPCtlg7Q1dLZU0V^{B_=tJVGvQfboT*Kc`Ez`@XvQk;H z)J(OMvG5B|MKai`%JjdWt~^nf%e0ugYGjrSMaCCSkx;H=Cda1^XBIWf%nr?l3Yi+e z^$?5BXl8glxbqp>=wkBCzdn|Buj6lsvudxPhHf*x!4 z12a2dU&%Ij^SR&|l^?!w|rhP?hLTs3TWK>5dSs0dAX|Eb~zgevt z1*OTZjyD(T#r8;{ZeXV@EAO6Ku!p^vvWB+>3-*AC9hJ~G%%(kxy%Xw|RyMOGd@df_ zLt?jv{&RAuh|l{frX?@e@Z%EaN_iB29zTcN zpLL^*UpuU7A-{-i7wN3oWS`u%cbBSFt5UU;(3#^G+dF8phDv=ozgDVZixk9+;4}7G zEsx#8mI28`c~?0x*a(WnK67|`AMP;$Rgz`pQ9YG4H!7^e7X%k6>5H%b2h*qi9tvog+s}@OZ z?7lj7ki-httD`6KieXfZJcOiJRt#`V)ht*|duO$7#h0+JqVd^E$p)KCglqnIx$*tQJYj}_?i*b8<) z_DL#f#Lu8s%wyM{lD399_4WvMz^UegD0>TS|FNT3U#{hSqXVfd!uxzQ6}XedfZ2*k zO&>(nOzikk&95z!E$u>w!RDO#a870+=xr;SNn5>8S$S*@Mw?Fnh+E6;UT0wa#2yA7 z6Fq?KQiL2k+?4r}RtCODoAw?$!ga7YD(z&12BrdwXz@!7dDZ_33mv6S1;e3H1wCL{ zvzjM%-Dr>0lvU z&u$t>sm1NiE|aOn6(FHkz=9&1D(=?1?(MwF#mwWxt)D`Es=&yVUN(Hc;q6 z7+9U|29_Cx$bBBWf;?Wl!>x(Vvv}Lm2a#eOZ z<2I&9Fq`E?>{w%37f=ONQ7l~Ka_k-_pU*4HvR2N^#Ul2#A^~aGqwa<=u-9_Qk+f&* ztx9F3i2=qQaMT1{7}khs;TrmfmA7PLNr5`Sa7Ixnn3e@mh1nF9k_k0Gpx&e2qCTP? zQ&&}0eV_WY`eF6iy1hG+mIerx*xs^eG}U|Tp@OOu&Py7sxT!v357#TP<+M{VZ*ALgJ>Lu?Q?0fB6kuJwZ8hlZnh9udvw^I`5%mMWU^%Lq#>Sxri zs9#dQseWDkOZC60f35yd{h9hxec)mYP<<3!PQh*puA|@@3UUc?v#9!B;7GnS$?7 z@GT0yPr>&n_z49+rr;M8{38X!G|&!Gu$O{86x=|;ehLm!FiyeU6x>0<2@39~;1LQQ zreKMJA_W!&Pf+kK3f@Vkd7Y;tW?pM_#LVm6bi~Z-Svq3oMUFBvFXl3{O(^tN@Cg^4 zJ}s}GqkujZt-nSAefCvXDWK0b>VHE4eRfTM8wK?74gGTz(DHhHjsjXhtAC9GS|X>P zqkvYu=&w;gQ`dEs0-ArS{|yB+PeGrcfL=Z7FHu167WAVO(8ELhKT$wW2lR(nzt|BT zkw~@d9R=(g%QP0U=ERWi;iYr5I2=QxC5y!fw!By^`-2>dysRbCPdykZanQRe%d|UE zK3qt{BA@m0*0S6)7uiGbj0)Hu5o2G|z64(=W4oDR4^Mol_oy5H9MHYHc^X4J_5g#k z;EKC*LEk|NN7KGpBjyDYj)E8M`|fI=^M#(sji|dX$*7&51!ZR}qmJ>mbm2%w_!eyb z?ciH?ra$Lnw}X51b4c3hIiKC+ej+mfE-)6=Op>m(R(5NEGtQW2!EnmImEM( zy$_`s>Iecj90eD+<6L7 zkl)k;IkM8rL&|TF7x=z;X`Ro(f$<9sr=lo#5BMR)*8wB=XcA_)b zzvTz}6H#FIZ46jxDh=$;UECwgFp_pP!X%0CFKrmu6f?ewAM6dHz+SUqV5d8q@lk%T zcZ&j>*)Xt&I)i?%K4OBC4adH{QS`@rgXhWp*2N1D#2>hW*# z!+ozPxcfH{Zi-0#9zWdYMZtY@4{#52v~EhT{W3q)FN%VCeGgDMd?;xqt=GQB5B612 zU~lLFEKjcm*fhBRzz_HDM8UnW2e^D~o6=`59p(0-b|I+{FY3UCfj!uHtd;n|j)?+$ z(}sba>J0W?ez0?*z>f6*mao^Q-VVt8a32!|_vRkp^7Yyj5Bcr2EtusW0AL61Y zh|@hlyrsPn&7!2QrVI`Lgdg5JM8P}M1H2d;t-39k(hGl^AL08&A)M&}VO#@h)!ItR zed3G!@cx}Bc!zs{7t?@_eM&2Z&OPvJ{0LtWh49uM5FTppftZhJ;=LxD9-*ui)XqTv zH$Tw-DGKP39)OOu1Jz|?xih$nFXbNZ-w*}vHZkDRNBXPy!Ci@@LY$e~djJzA- zGc(f@w{~v5X?}o{q5$5}1Hc#&W!_qfh@Rw!_kbvPclH2ps=ep=`yA53iWHw)v{-t_P%2J5uM{&*Pm9^=W>HPYHy0sYr+^lL>x@AL0iELfj(~VoHDf3_ryG zAP{0NvzrnPHRX}_*ZCp-sX&OmOo2&+nDU_ehx`zKAP{0N(<2fgrabTMyNuhb*@C3& z82BTK+RLl+M2IPGRIlNOc(p)?y*ximggDcA(72T!;vs<$dwCp{2=Q=dh-dgAo)QSL zmnRvC5L0~AWqyddK#0BE49EE4-p&@CoAEvT7=KkD#$Iluk};N}*gY(n8@S yw%8lXi_M%;$>CW>)xh@zmd&hTTFnCs_|IzoT2r=%inI>iT`#WQpl+=%X8#}Y9bG5@ diff --git a/en/.doctrees/backup-restore.doctree b/en/.doctrees/backup-restore.doctree index d84f2cc25e037ae123d81b317683fd5652f1b307..3d3547ee65987c4d975bb27722a7b1e0a05a5f9e 100644 GIT binary patch delta 5188 zcmb`Lc}!GC9LJr3h4qLQ7oiI50Smh*_aVp1CEx)@s0S*CfGqg-iR{8I*w}cr62)Mu z{jG_K*4h}Wu~yTPc-Mp0sELZ!RFl?dt%+%)ZKTyyjkcY6kGIZ~rThNqAIxKS=J)x2 z=QqEZdGP8H+S!j(YgOB}zWb%>o5VHNgamzUS$Xm7nMG+8h4C{AW|n8`IhV`f%uY<~ zXmGmPo0<}q+FV@wk_4MQ(QdP*bu`3t^)^Sm(;CmOaK(2tBwE|*n_Tf;`w}?U@@6*| zSmWkGSGmpH_!@WjXuG4aMFg#(BzHX*M*1V=Sz!})P0{ur2(XX9%^xArRio_t3iv88He zWcw1n4~`|5<2&9)j(BrqNlFTS^e7HWEEck zx#<&dp%4))R}Lj&d45o^KnwaD|1mj~6T)Yc2XUMW=h7#jKDeDe5m$PPew&P~@I$tI9ng4FQuMdWqQbl=Fkkqo`+>5RNA4!=Ym#K9Hv zkQR>%phBd8KgfMfD#3!+&q?NWymvf!Ll)}bx%%SU#){|6!_S{OmLa-&(pNmS#>Ti-ze;?NZIBTqqH0;Ed-bP2&- zLSPsFpy%!^E2Tfd_U-1+S(WlsqeJlJu-#eR3RyO2Z>-7hX_f0Qa3~5b~-iSs8++`Ia+*5 zhCMD|(GKXZ34zCRRAJQWf1w;z;gCN!7T=U%ZZH`AcqNvC=9S{dGRAKV1Fp^UWyJ)c z^P}*H0J;q7fn^AUdsWHeWb|Q5TsW$tKvfZmjWP_mHa(bdrIrxbHykpXwhFkP=PP*&+{k%GZdWrTf|2KG)A0{7#4QF9r3_&PSB(xokzx8hm@uE)r@Ec)#2~0$tV5$A z$QmV`AR`0m{vN2^XeDN7W=m=f$joA*84TR5^}Rkd)kesui$YUbN*+Veo0OV~sW+f% z7PE-On3ZBQOAM%k#W-0^tU}C34F4g#v8YK(P;{+s zTMg)27ITip#QDaQpgU~%k4!j}HThoZ+NI-Qdy@`5V<}G=iax=&iD0N*nuf;0))r6c zj!{dcyVUmvpeD*W9g1TKu^vKAh(1Y~iE$8T)1hfBrjWtF8Jn_tWCwi3jdHVr&&jl?A~%yb50QHDv!RvDt6K?r|k`+AYv>CD2bWr+6} zM2->{t6Uj)y9}|7LF6hxpfqT$(v0%_!;Jh_3|d=s_$wLpFhk8#K!xh|LVQ_~ z&-2`K?ni&2$M=zHkLul>yZTh;pNBh%CCCnW<}0Wl0xXf*K0IZLGe|f_FELIZXROcz zi!IC1dHOW`9KB6$(aW5CH8Zhsi!ca7mLhc3%fxBpCpwcXXqZm4@Wko-#LtP&oR*GP zJK~%wr=N4`hK@Ml1dJxx(Wt00X7&MN*5%A!w6iODE_y;IYI&7FqVfQ)Cl_0K>2!Xz z9)NfCjVWn3*areFCMj1sA0}5y);(JrJ>j7a zo~FJqc|v9pOWqUGoR*AV77d1v)uV~R$C}5L&M>haf2Nh=R#)oyM1&J_P0*J9y8mGs z8YFa*3km6l*|vn4J>*Y*W}`D&keUlOUBA6(Jjxz{-^;ZX#A z&i&AI#x?zGm)Kcyk*eluHqz1E8KxN*nFqo>xSC zifg`d893>gGT^$?3D+`>aiJari_RCiv&Ht678B^6qxL5{B&w6Fcdq(F*UApTwQQ^UpzBW)%*6T!Pqhr*q?Qvp93yCNPgUtAy4CRg>#ef_MGM+|~GP zPQQJEzS*tc?wY?h?vj?J@$xcN68B=bdjMRS~A0)Ip9}c+qiS9qk|k9 zkL@L>57sRzKxg`oELwul^!|s7QxNLuk6se!qo$D?I)twN?EG4kCn7~yAn6TZ1|1sc zP)CPyDp*E`{d8!h!wEVZr^9tR48gwzzeQ6_t3VNLVtAVv+9rmzi6L#m_5Npacg??-pFdX@N^a7V6jMWn8Q+@G)^wQSJA zwiPw_ASVDsz-(?O0Zajij)W(zFezT8NVuV5Hl^||ZXrXX*B!0|c9x<3uC74l1BxJ2Ipioz? znmCr1Fr}FIwI*a{G4mM=oL#F5rS<>60*yMNAY@$x%4aD{7>Y4mnVBe1t&czs7PE!L z7?fiECYaY)%qt#DsG{`@mqeiVS;9dNA;=h^)X3%12=d*^)aVNqW0J>|petp(01xfkL3Hg1*wIOs+m@P+Jy>Q@Ci$STx-bVwIZMyv2YEIZOeAiBpPMw$*^E zI822H10!4IGfXpLD>vZ19A%G(VvLtJlLlvJt03MHjypNb2Mi`b9z*N12%qE-Uowcf zN)R_HtoSO2_)$Vs%9U3Kg~BZOsnUS|;0X650x9u)B_=4Q*J;2iHQTRP?b#zCr%Jv! z6w_K|zy=Nz#$b$z%IqZLbdF(_7`FsvNm;PXfQvaqk%XX)Z&707atsg9~;(a*zWbyc)Hh^u7qLUnTsPi zhLL61lrZ%5DL9K`*jPq}GKLnWHJI=kjzf+W_ZJHsZjgT)cNc5nZbJ;N<1jT0#+W5% pr@Jv9@8{xMnRwW|OM#81h4@nr@rj5qPW-}^zNGDF7yw|-p-4sN=n7RpXiJsa%u*1Pu3$@{OdLZ&MCq`DmIAj|v|w90Ow_q# z3tK8-dAn({4|U6u#psN5^CKo^W=k~D47w$ATjJC$Tc&PVwjX9+$#za@@m$=v_s4#~ zN&BAnIq&&uZ?D}&_kKnh&t|-GH+(ANBhx-_X{n}bV@tz^^^VFd^~Of~`WB0Z3kC-R z7L#eXClCzv^_BMff?UW`>hqiYK5yl4kCAix28{u)kq-xr!#yVNE_Ywh_^+{2F1TYL z%4NEu+~Pga6BY?A?Dl8I8s$M%E3)dmUl(fy}LAz%LO>S8j?%4LBFz~hQXly1JnXV`d zcWaL<2$L594}X9(u(#HZj-G0q*vq>~SruB<${CBDG4*i!HBthP!!(E4KPu_lrhDQ^j zQT}G^QnMH3CpsUd8HvvHg7MdB#`#$F#&rly!pp5WaIl5PBQkmu=O+%niXWE2_*N6R zS`|8ax9GwKWpw@d5NT2ufSX58KTnZn3<6-B0%c^gFK$(7mWbuYon`RWCIdbpFpe<> z*xE7*<}M)z0&PwBl7RS_AvF17Wze{Y_ZW*xpIaK2_7$Znszl(@4B`rC`~p911H zhR`e(D}@@Hw-lpXXzkF+le_W=XkF#WH7yhuEa2FxMkZERIU^LzxtejO1Z{?-yk6WeRvyN&!}{7QZGS4l%?^F=G1DX$}5BKuj=%QH+T9HsVP^ z`c)>qR6N}PpZBTpZ2|E;Lztux6a8wG4vHPR)VEDqCi7)cCWRQ|)Todp@>!x>jIjF} zQ5BnB$)>LoOQ$<=Z+i|j@OsqBG8-5MZt`>A462Oym7w3QN84G2V-!uLv|_5!^DOZk zORSbc+z2S)$AM+&Fw4BoGHawTbV65l=+QZrIn6RvQW#pziJi;PXDl8gWjmQRkJA0!|4G9-^hg|;v&|>pk delta 3678 zcma*pdrVVT7yxk3S005Rl$0P7FQwVZ55?VevMDU?kGTw^%N`kt|F~o^nPz4#*&o~PDRe!DnDzYAllFYy z?|kRn@7~@g56SlrNa*R%3%A^hq05>0OI8iBV}bQ6@B$ucHtH8)(582MONQq)58HyeuJviv#i$cIC8}#Ei2(6HTwHap z>~TV$P#r~W*(pMCqUu}c)MHtG5m!;c*1u)AssoyL2Pl+Cm1Je^iQhTKk{85uS-;6C2b<)L$!UC~4q zz2_?4Ch)h$n_g)nWX{{NKUSkwO%~!nX1de3)QhEcBimII~u||g1Xef z-_fox*3NW|Sgp>7*9GF$sX8ke$0N1zh6EWQt1$_GsZD7OPjqKuN&Xu|0_Bm5>P4+2V(tTI_|Bw9S!Y|^e@mQb8& z^dIUrImL{lFDk^yD@s7Yn1;}x2btHaHiYer)e_8^)@qJu2aA)FeZ*kmt{V5 zDzHajiaEw2%UtYGpiyAz0}N(%2ET3Q+s$~UGX+iv%3we-?2s*Hq)UNw0`n%vJSW4H zcIUtc0&#^Sb_OL}7R)}Xz>+|G!4VlUM6^qRp9SJaj>rs7RKgP>{V|uG6+GR7H+vM& zh4an28DpuxS*M+j`TWRbZMp z#wNpL^cBL0K)5+#w+ykxt;f{+17m|_`bi#r#b0@211B{Ib7a4C!m#LJ8@jH|DwlY!S~ W_1$$cq_?NP%Ts0dvG~r(mVW^(5nz4* diff --git a/en/.doctrees/defined-terms.doctree b/en/.doctrees/defined-terms.doctree index bc5afa523822e041c2486da8df83795f1fc0749b..267d5c8a024f39750b84ddbba5d2baab4fbd41d9 100644 GIT binary patch literal 45302 zcmeHQ3y>T~dA2OwNq2hrge@c6vd1TEozB`_opdM3@^dYn?6ai1vm_g1qO9k3=XPea zyR*#9-sy}TAQWVsn#2h#ArPP-Bor<}oP;DKhVaM>5<&r0P$5(Z1qn$dq#z-wJRpR8 zf6sK!%syvUvk($oR^Mz-Pfvee|Nq~wzk6Oe^oFnf+7;|SXS-EZwaTTmTqsnGf?_qC zO$8%gD=QVd@%qNTS2dn$OgJN^ylNRWGp{t9E07|uYNdjyR2mm>a~q|%wUU+gGT4|m z%Ax1gA?F4!P8)svrRj9~!sEHoue|b2`1h8tyz;FLb>oGGI^t|NuUw+H_DKDj29?Sg zuF5Ea-B7n!OR_U6+qS7K)oehZBCpp97K-O=%$H=#LL{z-DstJq+El1j{U1wm{-UWY zvos@@%B5pgRVJvLs-|Ko=8Dp&IU8-cNKZ7>QFW)f-WkaWn(%9wvonrZD??z7iuWg1 zP?oidW@|>pN}HD5a5j{*iqbeWR9gb*YpvRnWotGlG%A6#f_<>JJDrxETr!`OP!GqB zNvd5gjgCr^bmx+pxqFn;w;p$cPYto#?%grR`{j}c2nWHMdM&6@cY*xt@ozW&-GqNP zgR0?W!z{~GR(e@O-J`y!rrx3+Q1_}6>b_IM$Y6i1O$N@DOJ+mn+0Y}Cfk)P>x2o%b z`Ziatfb1bcmRFVh#gvveDo;vUSuQHTm`-Q#Kl^26W{q54GxH@SS2Pu+l4B2)W%FX% zS}76{$5yq1tsavO&ImS!*t0=C?!DZ+T`D_rwq7oQuu&fkB#xD<;aquers1rwnOeh{ zjE;;llPd+SAiGlSteb48KWY)HXHWri9Iv*10iV@ z>18#=vSo=|ANdKG4MnnyiXjzbBtXi7Vp{Z6S&=G61^-BuwH1w%ONzzFlVNWQM4qi`mQNj7TnUYcR957Q zE!l>C)#*|S{kjI?)WHW9EqFxt`C^WWhrEEuls1aw_md&E#x7@I>bKoquFn8j3 z>g4PRYCG(zbu5!Hs!ByGq$`S@v8oE%EH@$rS*s{{JGHDpiXb&cB{h{hkak-EYNomQ zb2b@TAy4U0Ft7Ot#fhc_O)Il}cU;c9$>_ZUEzb)%UeZW3CBG<4j2r~I=j>vxtk^P4 zr+itU_nZS8#KLrXDr|@}O>c~zp z#Lh`kySdp4Iv;CEadfzeqw54m0f9oV4X+F^B~tD2Q{_Y|Pmq%1>u`hfbzMikRO0LO z{i$r$r)G6^H7ysRHAQ13twC`#w96TE@8nv^&Ma#%HyKzW1M!BrmUAOYrD8EBI;T0g zW~+vY-k@SZt*V9PCc=hF#gr@uxDgRP4HvlB45mPwoa;N16IL}(LvmB;gFaV%*cTzu z$f$`Gp-L&sQ^%>)!2n6({vPi>6()IAqf9wFH^gM;PF$~Zb_SqXlqqND zrr7MvBqcjDJvD1OHPcPAzz*H_ZFNFT{ET2nip|d9q}XY0+=bN@R(U#gxCc9QKXG>a z2L0xk?93!(caTv}*_r8KcPNj<*`Z9iW{r1bM+tQgy%s$+lTNJFVp%mYv{Q5rxn-V7 zgg175#kwPrZ@!rtobUEDOah~?{!BavOnhMg~`w=V%JtLli{U4Dc#8cQ#C&rU+ zsbAEQrweW6DIrVLY=?HV$WhP=iMxWEunn3`LVkP;bW2B0+V+}LN0PEY$f!xbTJ7_Z z9u|o5NZbNZrd+db?Z{4h3xsDAA zC?WfEq{aHQlcJ#Q5%&WOg)L7aeIP0rXJ;ZdJBO0#106{pilAeMART;0tQ|XaKjA(Q z6^yg9FE%^VNwG5>ft~3d?9lzh*_jsXOm<|alLbm_Y9XFDGZKhj-(Gvr4Jl9a)|!U&fnie(U5{wLMxzIBEnatm-3FzAd16{PpTs^XNi~x zUmTcErOA2Q#NxYRrZvT0P8()1gN3aOtu|x|ro3#YC_bedmXgx3#+6!CmQr%5NHeHv z*=izTy}lZpIrV<}1PCp;{15g#cUAX6cDTw@5gC>c6ytZ)>t3P3t05&^N+ulzf zs_4{S-b*>mOh=ertZ!|y zdr?_y#d$G|lYaU*@8jwlxk|$X(;GR!sg3~2Ap=?(FkXGW&eGs7W7kZ0%!HN=A*w+; z<^A+wK5&^Z{r7UP2RnjgI=YZ0Z9B1OEcQ{UuBsNQMm05cpb6=ye=|_8;aDH{-LY}| z+0(l@+Cv@DvUZ!bOsVYIlRnrYY-w#N4S#`*QcD#y{6^cP72E~5)T&&9r$ z^#xU$f>%lk%eo32u<}Z3*@R=%s$pJiB4C6yN-5b~4&V<(`tZ+k_z9MVQ!*W-#2FO@ zFEmcA3oRkPgoJ+qE8}w~rXM*z=Tp>aYH2#PqL|vUCNGtgR33gL#2JxiSv8rc>9BS_ z>Sj2-lGg&%gkybfgoV5OVsJ`kf|P_fU^6%8PNW`uaiHm1!r{Hp4&p{vQ2%0r-=jIj`S7J;jpw5?> z#4Cl=%E3-(hb_&ht^_9z{1_kSJ-u*p|CCNI~+!gTDBgcIm4+)o$ZFsmX z)l#mQrdIMDI&RR@%SNq& zMjfJ=3Cd|oL2|iLRG33hX60b|K)Sg}yDInqr4PVuch5(C*X0$1qd(RW{T;01l0AFI zN8G9_tYZxs)n&7sf>*9wYG;);(Cq*+{@X`0#nD861xIj4M+CEk;KbrWz}Q6Yd-;8V zrZ#v3^-Y3Uyx%?+;g;3U%Q&h#JEEE73BS3VPbmd*mSH15{LJ7V zrE3DQiBht7e`1Z|Se^jqgSnMgOpp9|x$o*&?t@hBh3v!U9|)Mj&bb~wGTmJ2VOA+2 zizi}Ym6+wtOMG|75*JvB7iZ^L?b}k@ED|ySVEib3N?v-X_uxNt*M@p5os&C)C z7QOAgcB-# zM&7D^5gX{9jW`>Nrk{ei!~x>x^Qy4-haBSSKReH(Jo zl&fl>z>nU#?uskU!*3U(R0+HlENT4A!{^SA?|1)7^9$_y?Ce7i&z+q;LGkAv$eune zE_jM_4=g-<+PhCzJpSzL@r5&IX6H}14k zT~A^1wKmZp+VCxw;a03zdF()O9gXihz9>yiOD~1tJ2*9U`vrD&bn3|T1!+}PD(-8H zN(o@uPq-|vNpiKS$R@oKLoO*VS7{(-A+04@sB$@%
{)_iimGWb|W} z2DGM8(ee`FY3~KIo|3Ulzr8JI(xPdspo48rN`~1~260cCIDc+&ALY4-4I0>bFvq3~ zmbE;~QaXX@aA{(3?gUG7R#`E;8@#9w)#MT;8&LRu3gtf?q9{zPq(0wm<0KVKRX>Y!kM+sIsM5fmXp8cB_>O z)&{C%|JjY}d&|=h(m;jjHE4atoGbTBeg^K#^ts&O@Ja!GD5L>-M zxKhiDu-PpFi}VX{+aLjeJi!dT|-+#G0h?gITYk+tO)9sbmYSLnExO^B^A22qM+4Hk#r&l+I^(tU?nAPFM zz9FP$O{x4hyrz#r_Ei1x-iDbMQ|e{H{i42c5JerEY;GTT$+kD$@C)+nAPRD9(r;Jd zNgVdF(!$V~bF|+ad}tr&16l-`-4_7YNiN++lVjQIW9j;UU-VD*QS_dYyuX9hXi|Q+ z3Fl>x@r+;mFZEIUYua`i{5(aUU_^9fgPnpc!R`ew{D|msc=^CbO#c@Y4qG4t_uB5? z^(H2q4Xm%Mf193qPQQV=3>eP-GyQaX5Y8sdt{SBk#alTVbJnGsi|r2)c(*^;y$ug8 zwj*EO({1YBI=_6MQZiQE;U@Y`?&y-Ok5eVed2~tF$`%_vu-=z@zyOAmT3%&O)hz70 zEJ@hNFJb>B2ADLm#OkPOTe!dw);6kI-ol<(*{03H*ey$^Hn82Zn5b}<{aF5ZmY%?V zP%Q0KiYzfU9an6N4@Q4bN-KsU+cxy>I)>{CJCXx+#U@>7)h{5J?g$BYhV7zh)T%AF zXsQN>W0YvaZOctDvTPO`9JgVV+;ap@T}=XcE6R?-?7<%h&0hTBomZ~}+;OToCw&TO zPu|v-Qn*s#lZh+4W5Ae-fFEc1&iw4XG@{ z)|xoe2b02b$wcpL4d$FVchEHJ9F~SOxgvS)dXg*lkYCqE`{w!k@oK^UEwTB>=5KvG zF8_lT&#T)ty<8yM-xL(g#->051@}d#;2xH=mk2((3(F;0sajhqVI>0xm?&n2JQR6% zgN*{oZ4pN%6>E?tI-|}VUc%{9#qx(-lFS+!es}FsE|hVo9f_zVr67ec*EUu&G1#EP*<<8G`y8-H!*dLE-MpR)-6X?J%Puw6kHPA(t>v{U zPHgfX#C^?_P~f7rq?M@eq^!uL8tVe4p(s!v%aE#yNoU$24?t(bU<`{Z>}(&QEI%Zv zD@j78eW`%~c>?&;_p1E%5^Qld*wg%e}r99ry}M+Dn<8 ze?mtIlR2!^)QFIZcwo*MC3ckLem4Ppw+j*-b4Ch)MMr3H*?^kRj1nmyUw+1*oF&Cr zLzZZQf`$eXt+!!H$&het8tF48zZ40c2-vVgiiKEuGyE1{RNNsKvm;7{rbck~8t;E$ zwh41lun(*&SF>?iUD>Evh+xANEDJInZfVRYIhGlPg8n}QE@bcZv1Jd(80bF}SN6VF zO4mG2;Yugs1@QO9299$H^k0h({Jkt`Po;Y&9RcVypb*Rq+PbQ#tzZ=5HljGvYd;+~ zNX?AbiIcJ3%^Od&Xmlc2htW*C9tJgin486eb2=Mpe&4T@P!*NHAIIcne z@3`y_S{!HmwaCEmGvLHTbs+p0ENS8)^624$+UL`P#G7N2NGoVfPkOl8&6xNLL;XaL_HdtC>$@LKOCK? zvn**(A%5ySjA#I32j7C`wE!}`WT~k)0$p!w4}7}(1p%_!SRcmIGyo71{CzHks1+l2 zt>7>Vy%e`r1}(l@&nhK0O}&UI4Y5wu6e~bK6B{(nsL-A0pr2+*dy3+lvJ%_Zje#UO z!0a3gZ)oZERyFQOK$AxjZMdQZEpK$l7m(Q65=mvi?7|?s-n1dp40~IK2-AiI@`G>9 zvWyP4jG3si5Yzv~B^0&!uGqDSgEjPb#;wgki}09hhyr~I-hF6uM}Yt1*x+%@hW-c9 z!GDA$?Ip^O4r59*U{r%W0$59kn!6N>#@*|-(tIf!e35B{7CaVvf?9bEU zKzlnaW!*{DVDFr!W#rPTyk;Ro6b!k+nqvZp&77jBruU3+pyjIbLq_;EfPh=q7h_8+ zPD|0h5La3Ut*V~$_-T0!F7({_#8qE6PN?U1Vgtr`Df+jf1O9iGw3m81f00G|;h#DI zO(QjAj%RLD!>1Yjc@VFC39b>4?9;9dtb16hWYg{tni};sB0$ffBRIdoT{xim#(=Jq z6`(nvz>xVrscMku7|>Wy&+(>R<)AH!1-$APXi4O)G6 zoK{v8ba^mhMu*xAE*G@BCE!oThL7WF^r`6Z(=2IEW%}HCl1GKUpF|*Nnv#}`(V&qo z;NA)j@gTXyY$J0Sg8L|IHv+nYRAQMKdC*gAfq=AzezeV=HCQ4kttEJ?*zU}be`pF{ zO|Wp7jGHes7wO9^??Ad$^aI`bC!t9HN6`r>Iu%=ra14-R5%$wb3ZfxV5;%w(GuvV&w!(}SiXCC-k89jZ2`!x5aR`<@U`{tu; zVceAUT&a1Z=tl_ppNv4iw{dX|Ny8f#52F;jQM#}%qdwjeH4)#JH|P)iQ>?b*=dl>@ z2ln!~v!!f(d1G##objnE>qRRDx-RPzBJz$@UK>55|=kH;_JAcfs)$tdnRp{@I z@RaA|^UEx0PZJx#@%NL+iTAzQI{tnN33@rAdayqc0YKPi6^C8uACK@<2zF=fC0_4! ztKb(S3 z52L7}rWgI1{%8c?UQPdA1hip}PJpB5BRu8R^!r)To;7`Kpr+dy_Kx>OZGSNW=r9r- zVWfW{E|NjlHmrGeajvame-~xt)*Na4`d&8@y-kmRH_XyWu=K46Pw_ULCGAp=nUQWKn6}5*|sup56a4A z0BL*~$VPz9Tl5Hc!z?`jmX1Yuinr)2X-^qwH-qG1Yj;c3@`VUc!{wht`5%j0{us5~ zJ*hV>;0^&gCv7(^@RMyi(|Qe&on`|3fw(&p;J?n<#CJ~zj;jmCdHca>eB++ABsTu~ z$1P!0AINcQ=+w4Aw)}=W-HaP8dAr|;_A|ygM}Ef5J9x#1=Gl>ID4@E|*#_4toWpGA zyl>FYJ6m`R`_BBlv&nMj_AENb&d9?(xMZc5u?v^J6^(DbKLT%g#Xon49pE;p13$12g=PZFRs7iOzA1<7FXHE@_p@e}@N27W*|BUGHWs;* zz@1a;oUL@IU8PpeT_T?woW|^I!|q_Mn!_AC?M1hc-}P<`7K&L+j@I9D`I1cDHuO60 z0THou9JO4T4j478iaK-i$__0F;WvNy~e%rh+R3ioU+>{YB zLZ2v52vMW%Y||>$nvHMM=8XboOYxcU8op0(wBg(kzL8T*(=c;bnJ$#D-okc0Yk7Pg ze!Ee#+vl*m=}uD?`Uj!5&NesSHt!GLXnNSWipp<+B-Q&=cEj1qPap%^1qI)z$F!RB z0@`+G7I07^Mw&D~45wCbFwEwQiJuXzki!J-vUaJV4m;bhzHj9GDCbH#EOBe0R<7oR z(1BDI!Hy8Xf+=OVoyCCJip6$ih^VTC!x4?#r83FVRXC^&pMJ;%pJWn(Q_fa2_L*IJ zFo(0I$)^iIFsn_a+{l%I>4~!icr46ryCY->jhE8>L~r9l!`Vr$xp)uUU1(Jo6-*fx zP~)3Tc~$&`gpQF?L2xQX$YDtir=0thb%t(? zIRt7p+jBwZi&{8EZ$dq(?pGgE=hRhIRi9B`t-eitUCr4MN=t{0u*A-lOIVRT>5S%8 zC4VucL5dsdW6l=rP6|Y2ZO|z>fXH4LTnXH#X99?wtwsSJY?K=hgSCA5;HO{jB;K^~>sCsb5#WrhZ%f z4}B9nDD)u;uAyKD1>+RlL_vmv{S@3u!R-{xQE-xiM<_T)L7sxgDX3CVrr;?Go}l0- zDfkHr-bg`%0y_Ioe+LD>PQkBI@F5C5K*1*{_&5chr{HrGe3gQ)Q1DF(zCpovDfll6 zwg9(2LcuNyc2cmHf)`ORO~DieSqko^V4i|g6ugvzM=4M#P$;NTU{dho6ug3hXDDze zcnbw@qTpEy-bDdBo{=5C_&4XLQvWRdq&Fol#V0^wb$Obw&&F z2M2YX=y;k@@ie31>6*HWH0)XRoe;`jhfsb9Liq^@<>w)kUseA@{U(!0^}DV(ZlU^R z;z&CnU2&wtW?gYSL|054@1-jyj%VnKiQ{8*#l*2lS457TtZ_yPK$KR(bCXSz?D<+PANmoo9|DLXxIQ|=5F>zc^a=^s#D!O9gcq3gg zalDPLm^dD#D<+P!bj8H+EL|~i%+VDS#}ZvJaa^M-CXTPAD<+Pwrz<9oZ>K9Jj&zK# zD~{}niQ_*~9Eqb&z3iH^HQ0cVJ#n^T>lbTnsnK#{sH?!!xu!E1=mZ(>6rV9?DGSQZ z!DR)_e1K2}5GJe=;3pNI~5H7Ur~^#S>|R>-AdO72mijp*opHYs%1_kpgP^zvTzRQh1| zs{GaHVBeDz*c%1}7GF>A4)){G!TwQFV0RA&YziL_?GE-U(ZPNxDX=#V3~UcE{;%j@ z|1&ADHw_HzO!u1IxjAy*;RQ$MR5&BT6BfYftH==`mE-A3L_5n7E)&guVxPKNM?w=$DcW)nXqt$H>o&DSB zVE;NPuoD9Vd#HO`d&QQ>9gFWI1$N)Sz)p7udtG#}*CJ^my{O4Pz(&*Bp2LCZ=y0c! zf_qyZaHDB$j~?=Tbg-wA0=vHtux%zN*hieZORgFnostx~R3GT}we}ZA7B7*Y32_1)oZ+7`JVGlZmx^keSs1KxD2=J8h0{cL@AnB&o5-jo!~d-{NRq!ngp zTLOKxzB|%8qa(fj@{qcI*`BA&tPfUkHVY>z=5)JRtK>_y0y+5>$(wi=T!XEQQptp% ev5#a=%;P`1@!E#$j26g^-E;S*;}~j7>Hh)ZH@RT| delta 7476 zcmb7}dr(x@9mhRq7uYrUAS@7;$L_L-KqM~e@|0JgK2bmu5_}c|y4^%Y5j8%DI8lsY zHT1VZqedYBmxl?y5K7GW>mVl>RavG%j&| zMB&lgeEKKF9(!`L>9>kK9?Q$6S`CvmSeE^HMKoHmM{@o|nyT2ND}OW13+VAfVGQTR zIk|?G2lNo#jwq<5ixhjjS5QP76nm5uw$rTvJwzReMJuU0poggAW>FJ87SLmTaVm~j zSMfA*4(=D*V=iiNJWn~}aj2RcW1R1?!)WJa$SSdfNaF{Y<)*}oY*_mTU&l>}rX|ix zo;OOIgnlMviWIvJXI&w$bld0$Uh;kX!kBL~aIG{w^51wgb23ZZ-wfepbI2uFT$V{9 zp}ovVW3+6{^-)?$S%em@HzXOvED@Mxq|}fU?(L?>FHAE6ztURVo87675J#vZY@yqE z31+TJ8WqhoIPF^4w8})Yg+vqO5`z;;*OA zp$FyAQHb6zNZhL+(KVxx(0AoH(a1R?NZdO_iQCKT=x1{17)0L?BwkaHxOA45(7(xX z9z)JOLE^O`N*q%$jfBHH)z*OZ5sPF!SY}!M6E`$u@L|4J@hl})8Hy1pW=8SP%FvLZ z4f3jL1B{-VPD*9qaR@KwB^C@W@$lKXl+2TX#3SSxUSYwI6&8{WGT;ORujAFN8C;#` z@n@D2(k??uM9MB+-kKrGE3c_0r)9t<1fS&P^(e?ooJR@ytqjGCln;1$JwudtYyM7h zR|afB@YlS&FBRn7USKBVe=?LLqWrx_EW1LsNHeSr(QX507jbaxd`e&MTLUEjd(O)4|jCS68=v1n&4l+u0 zkb$d%5)g_MZ<#bsYOZ{^S%cOBk|^xt3mOtf3UyBb>}ZImMUoqxufEEMPZ|Q3;Y7TA zIqbZDld^l&$(A%&U5Qy1!p2o*x>(3EUna{W%u8^Z4A|ha z(A5dvRjc2X{|5B37ppLESJxO*g@L<wM9c}p%iO9d!qr(mg7!BWe{C8STrQXx`K2$ouzCI4OIW&hmN z`F4f`JTWfUw<#E<H5$_U#*bxYPWjr~23f zvfPUj+zaaaVX18+>gt#NWJP^l#+v%o%NyO!9*nDJIT(GQ+02^ZfZZDF1>>t1VTTEA ziv^Mu1rO}H(7SkvoSpC=yJa||IXm&A5p3o0aPFnyq!&JTX+AjvmM!HZ+_PfKG(sXg zKX0)U((8G!)u1t+!(FMiu`P5p3ae|x+lZtIO?P_Ywyz{{5?%uTg(domef*Jqe4&H) zTkno!?K_;T?G-%l`NfXsh*9d!HdJqS>DL!5M(-)#IhEk!eP+7>j=#E`w&Ev~gwA>gVd+(n}|H$v5exCA%5F0=7Lb(bg9UCbtegZA+y4 z1@c}-w$TnfRJn|C${ZVxbG$mEh9vOuMj<{yExzhN z4pjftLb7?rB!Q6_45Jh*q>5+E78s^r7&fc~(BjI%m*~T-r3JgmyjNu&? za)@Uf;2ChJBSdAA8ldQ4GW@H;q{XOr}kNhh36y+oUv*grsd#% z6UpZpIRYb9ol!%c=HurG@oDPud9eOX6IsbKUJw}RY7Fo7m`YyZ8QTTM<7y0cEuK1L zB8PcKr@$De#$Y<)I1`7dfWh}ZYy;OoSlA7SGW3h+4FWJ{I`27 z?G_M6{0O#NW(OxFn_dtY=Xpj>FpQqJ^XM&s@j1`P4Tj-5Q9{2H7~k@YykHn>d+cNs zv>ff<`NJXNgny=jsaJiIS=$o{OM8<@8c#{#C}!!uH_8Q-0c?G__->gKQp_U?g7I?o ycqAmBOePC?%sd`b7!2m-sVB)g9?fYoZXwZ&R#ecyM^%$*7K^}Qc&ew=&0eL3Gb z=iYPXy^s9QeBj?dn=M*DXIk`9OQ*fnX0;fbZJnJKtHZMMq2=kN!yTPYyTjENd8etZ z&EhcHZEa2mvbp-g&6c0FS}kUy!_wJqclAYew3>|;lgZd>w>wSNW(&NWk(L-`x3?Nw zt&UEc+1V@whqqeImSrwr3sRsYBcd#%!)|e!ZPw+aMd#6CHaSejcAMGK=IRT!J4{xy zsnd)M5lyD%JDeTHPK(`P>$Je;jKtl1jGtfEB|dCeRmFRG4}TN3cdhaV4T@OduUyce z$TK?SLk)@v`J?i&2F1P|r(DsXWXEOYBMr)1lBZnOp#00{l+QG%G;?6-)EJwOR#m^J>be-1DgzMAR3<~ z<0rxyLoMvgT@y$SKIF=RXL6>(QbQUH=9I!y1|uXJi(p2!!LMJrO!9%`Eb*<&%>bt% z9kv>BVPS4Q{4_foc`gbYg?VdW)VOtE8$TL#tPCX2NTxd{1D?(=L7Dk*TmE$9A3*+Y zFcl=DcdH9d!1EK#a94pDjFZj4CYj-Up&4c%?r)Qu;p8L>SP&OpcoK>ynqfWS<`-46 zOS>N{TEt*QNjfBzG_nuj$th`RX|=Y_c9WxZsYQRI$-3BST5Qqd$m@S%vo6Jw#JYp+ zCAE+<4TVZqz_zk<*jxH3{Jl6G67NffkEWEv^zw8V|8NFa%F1Ea)O0vm_Bs3=jhvra z4;xC;Vb-)(*fJ#@&YsK$|MGI!i@Fw=+s7D!BhWTT2k$U0OqpDC6sYex|WKxf+K`Hc4$CeVVR1lKN zK&i!^v(MjQYqq=Ya%Cx(cHdcHVDQ#s(a^CqX7}rr7em23dlGzIRfH)V4F$8R;f}e2 z2v5v9?oU3$ndx`@U$S~}b{%Z3%z%bDGa;_Ij2{~g`B&>;b4e2W3M#6raD1j&<3hX> z9*(Yy;a?!vvI_p$aA5OOp#0X6!k6&5@jNmBb}s)ZO0~^3vM@+pRLO#|ErKKV5EdYN zn?gu(>%t1MHh5Dhe7mC)hqZ)P1;F6`dJ2+FCsAGz0H%L-z>Bvez|{I`IC5GCX?1!y zP(KsKE}B3(`Jw>fu)aQp_XYqv)&QI8(^!wNyyoHg%h<=em(Q2S2TYWyI)p^-fe?G3H$Nl#>K z4LrH9lDrzcse)Ayz^1y1{;=lBPORH>&I2h+(6}{&{U8FphJg-DhVeU#;ryalo+{~E zp3*_bm;O+7TMSPL6e&*%L`EA#G#cR4?bSdW4>#t)JW~%Vf{W&Q*mAo8YMUe_-83HF zXp)pV7~hlvZ#PTIb4?kr!0e$s-yFkcz)hB0g}!m-T==6!(z^MZURU;8#`Dv{4R!*e znk#uxAVta1Cmc*R67APP?cx#qnpfuV;!*rNDRWiGj1)5Ln#jy|T4u(y0xt~0tcc;~ z`9UJu+#nI{yGkmoY-@mdcVxo9+IrXxz}i;8)%FHB-#A&MIL=Q!$NmTdw*KqltHfUTInB2Bz3O`Pf|f)_d)VBwM}Fx}q6&Y_7qaC8>) zAEZd2y^LRzBHsl;baMqi7bK!b1r$BmSjlo>$MOX*)@fklV2-nrX9bG@{FkP~FYj!C z?xop~x2y+~oqy*Fw#3aG1#!y~nUw_C9oUM=!e;~v^{Bz4z8+wCGM3toz zEJQ@JN18*8UUP@LQrSf0znd3G-nnxUd~9!{hWyvoqbHg z{6eV6yaQ4oWmkT4UjXjaf{A!OcZ*c1Z|d95!T$w>+A{AJmw2@ZqBw z>;VrmyAOMnY^{Kg;3|*86rkHb^J8fcz1i)^#mBN>^JdNW%a7;4_9xu5J2n?U$rg>a z;)(H`hkG2G0tZ!cQI{CMo%Zg@ayGUh~66 z;cWS(%F2b%>R)B>GAU3Jp^e*DnI}YvWq~r#@#P2>4@Zv)qbvq{l|ny`E_y(t>-M$()zQ4#D;NCQ7~DPFa=bE1 z8)bSK9DFT>w|IFM9Lr!94=-yX8(0J+OOq32easBLp2bzKX!G%0=JJU0^-&@xGfrf} zcPC|Z$4?mHo>M*i*HI!T^isX-G?8NAmQzOf^J$ILcsc>t8&c|br$+<4F%ym-D+8L8r(H;dt^Gd+BAv@rbnTRFVhE8cOY zfZgs9XN$0hC5@bzR@6oDlEVmLNbcxq=UVsnRA@OT4W$2WI(%_XE2Zh@GT_=flJx31 z13YwIBb|C@0>9+7U3b2i4QjSOBHQd;oKzy+?0}eFugLlGTu&!`hwx;b2z>Q@89YHp z6CG>f_JIzd31N7@8V=oG1kb$R!wYmGSX_(vZBpdW{W=&|rHAAJ`HE8jDFXJb?Gf0R`~v6B3~`duO#zh;^sN4jv&LhZ z#+(u9X32k@N|#f4hT^c%r;>>1sBoJf(uw7ftl`+M)X~^7k&@Ao(=85DYn#RVV+r|2 zvl$YVZgw-mwTlV-YnhKPF&{Z!Td{+SW%6b=6DIk=){ik?(aMCb9xjX84FuKkT3CZu_8ITSp10V<&%jppNf_j zNq55UV8LX}LW6=U9Bpb4N|p&bp=WYE9T3CQ#i! ztFdCuvuB7WCUC=k<1qX|#j*Ap} zjAj;@4gLozwl^tf(2+mPVoZJ84;B8;7XP7Hgaw}&*|$>lU$0Y*i8`6h#*s2nA29D! z9?yywlVVIf)jm5!isS~d)i=fRRj|P;nzucZ*9%d#K9Gs!LW~C170xfLEBO3Rh~4C` zZVO=v;!vxGi4(1wKyjRf5S;9#b{iEzMSEdlMcc<6eU(wJenNchQO2B0RtP|2cZG z_eK2-*KvEJ!`9eoX>zu4j z5As5EFyw{kgvblgQIQv-Gb0a_*)L9yJYc^#M)E>*o+KdkFJWvKdtcoa&YsQKACDFO zCrq4j0DE}+OS^ZL*z9VRBZ#V1j;b9ItWf`&0FH@PPKMX9->V$Qc9BatsUC}926jpP zDuU(n%kk=96pK-#B3Yn1C6WaX!GspLTAZ~Gw1a%>BUxhTgrSIZVkd%n_TOYD`LJp> zLMQ(iR-G1gz2)Med`Y3>uS2LiyfR5c97SXJwJiLKQ4^zCv^%Dx(23XUutsZklT=qU zi_+5xFJ_6R1U_V?iYb8wE7CA07Sr`r3a0BLx3C8jp@!&KC>b;9Fjc+|Pth@vDkO+! zkNf#c_p>{m#pnXXHHgvINy4i^F)WI-*2J)6by5tAaRYhuToofn@x>UHOK^7_OAO1; z_X!l;OH%c*GEhnO9YrLIY)Oi*aS{ym9YtbMKa6D|WJpkpeC$NVNktRgPvlMt^>qXh z(o#GUd|eQng+8h><5{+v94}o)pg=@MV!q{r$r1W0k}%`~--3D5hoXj$kPfran9H0I zvK)lW1YajCBcwKrD=}<>Zyt8KDfk@ffMoT}0b$g#ku`(F+p+? zP4XQ;F)GuNrELO|C%Nm$BK9|&=(N9iW_Wk9oTR^SKM_tGvcRCBM74Z03-lK&0@2mH zQ8M!-qogpJk;}x88H6PiqpG9id=|g~H{j*>O$%a^)QA+R8mD@yT9P7jBPgC(E%MTX z6g^!nVK}rwb|%_Wxe7hq*uIy^osSi zS1h-^VzuoR?;pL&<$A$N!_zC?K6*uLy&|+;5m~Qz^XL^G_Bw?VExT!Nl=hX0Bgs+e zoL?tiT??8zTF){@yIl-uGc{S-gl~O8i!D}pAFa$(oAk`cZczL6YS-xaX5mAb zt-h&eVlxq4hp_qqB4>=sjJbBjy44UsKQWnltt(11BzUU#>?M8~M?|;88Rkx?H6n16LsWevT z$1bb?8pA5sXKMLaHj7qXDQL))AjV%@vel)p65ec-B&_*{J?X4nh;(qonsqJnJ z(Jc{cHN?FValeM>m59EP!5$?Ksxz~hqpM$ISua^!gbQA;cZ0+F6O1+zd>bJjd9PG@`2}5*)2dz%dWj`qoPQV0x sOIh-x-Y{zZL0|y&BB=?ZMn}y*k^_FC*1`xopdS17=8nQ~&?~ delta 8792 zcmbtad3=o5`gdNDeP3kX%!F){)shI3j4E!ftyG9ABQqp#lT0KNVi(I0owm_ucvZ#H zD(c?06h%wXR!c8MRZHzV-B7K%x4n9w=bYKn-uwIK=fio=^L(H4oM$=Poa5M8w=);q zT86TcrNauhzS5`)39hZwYYaM_Mz1sJG}T7Ep$b~m8hA_{qV>}oCRWxM^cs_)uDaf8 z@v1lJYV^7~J=O#3>nk;tHKsbFzMP=RQcWu3)L2s;?R$UMOQb)l^ zbz(w?${M|)(Q5IZpeui-p;l98s5cqw3|33PR9#h-!L-dg$*=vK^HRHZ{fp0NjDMXz z5Fe9=M8xo}Os>7bgHrpRXY!Fn=^|fq zP#g70@{K1PzyH{^2;YTv=P`dLL*_?+I?2y!I{fRgz-YI5IIK2kvWB zuqACFJf1lpKFpX8nQ7f3V=^)_@o#0dZjzxslSf`tXRI>R!{xLQa4)+FHfQ&Pi0lH? zcN;Y|L48gPTGEp936ylxLusxa&UQZpH@oWL)gF56EurftFtxiLLhxTaay|0O;Z2m3 z^R(>zwm0&|GWfWc3N$^(fpnJ#-=G?0UA|8>%DCLl z4T~F8^P?IiT8^R`C0Xu5HA=AD)lG#ZWmhgHCS_J0jI{=fo5@&SZ=GdLmd|fnU7X4w zdPEQ;yc)9YJMASO7_+!L46Vw;SjEHWAp;>|XB(6HOkG)T*CV3`NC4c_dksIBsrKIs6%#ul@W zYz#NJyCt7%$81PycVL4ahy7dCED=sTt(D^3Vd;G%JY5P_YRMgT=F2*QhttnkuX%66_r_j?IPGrz+VjVa+OUHXeqK)sjs? zi;7ts5iHsUy1~Y`>u|iOq>Jd>-cpJ`J4fC~XUN+gJQ@qfg-VYI9|bGF4QIb{{Go`( z`{PrkI1i3#b(vDM2V5RdEJb)gcHd$a1}zgyVaSA3xHWzN)E)_jlM}LFvd+wrk#MOz z4yH{I$SA!U+Lzmr(S{KCZDJTaDi`QkLk7&$3$zKE41)X2q%827XqLh}xNi@+qd%iz z6Q6`f72(nuVVJQpR{ByHc9I(=p$rA%3=hVaj$oXUK??E&-3%TG$={PZs4j2uqFjktIdo!BjH(NG^Ev(y;z$FZ`Kf#O(})n zYja_Pu?#Ge^C7WzAS}E83{0!blXeU3KJ~q%cZBwBLi-l3OKr-Bt#xIv)6^UK*PEp+ zp5%lCo_r9K>KV)j#?KfHUrtG7p1`JRr4C-)_U%(uER93ijVUadAeMxsm=K-da^rOP zYHAra41|NzqM)qNEOqkY>QMvD5n*}X88JAp#?P3+rgQaEh58p}MzdC~-fdPQTglZc z4)s=4KN6(bF|c`N88puB1WB{Z%nFHfY9VfR8GJh@0ang7OIFb#>U4H!Y)WLou(WBe z6yVL1;p@#EIyf(Z2CW0NloUJwS?=as?U1zo@}-)x5t zEbI#93(8=KxhGs(U}h;0xJWCZYV26*BEpJUC(6?kPK+pk#i#3NIc9sX&;Bs5CN^v z3aJ0aI0(1cppme5U@G`NC!kL@Wy6B!2vWAXv5_#eBpEEv3vATpObCC$q4C0B6Ct)m zKo|ek1va#p+2`C_G@AU|=1u;&HB6AN!O_9p_|bVPr{TEL1RpLJ z+|4U;V4z}_PW$lH^4*uzFl>c@daO)?b1T}e>R~U(NwTlasvxkuoWv%S=F2@pwPZ(VYbWU?XR{YtQ`mCe45%4(PEyNOr$hHv(RtLGT-eph?II|3 zZ5A9@Eud{{d%&PI$~-$_c343%6VkmbjRumjyxVP7IYr>&=o4qMBiC=msa z`$|6Fx_|2v&P=>rz^iI$vS?Q$+C3vgUwpET&O2-k7u#Pd0=!CyzU0pXJYjnrd*6l! z!`Iu@(t85mB~~ko>L&Ja!A{-n+T*+-?rhVL;l`36ysQG<#1nsNWL{f7#w{>^aEZ*PmN) zdv5_-0w;FkOse;0i?F7Z76fo(*}hD+#UZ$4UpG*{Z?=Q0_7_0bKA}DPKr!sw=YWQM z5CdQB7f_FH!lCW}hbXU;0(f50WwNm7qj)JPP#k(NAiF-DjkY3;JC5NldYKeeR^iEU~4*t%KzNwQ>eHVrwH!6w_AN;QEze?K4UB3Yd> zQx0p`Qo9U$p43av2GWS04KatgYf5tmmI<#OHY32p6>uaHUjJ0MJ?}_7flaH}RM+XhO1KaTX=?gVXJ1IJ-JCzFIUpU6t zv@dfZ;*@~gzsiSIr_5{z&Ltje_7a~}%f(c2|Dle44oLsRW9l7oxO-slPr8q;;Bl6A ztq91z(jWZp^I3prvlHjFxa*!cFBZ1|*m`j!UyI7W9>Aq&+q(L-nGq64TSj2OfXYb~ z8bggfL2sz9oKyox&pt__fq|+D8=~O|1icpmBhC$k2Ul`w#;3;)H|b23f$K^b3tgF_U?6D~2KkgHT))}W%>J4>}x3&|z zYgdzytD4BA?J*En0h(Hyv<8NmL*ew=VD>%l;T!BBk1w=`Z-=r#DE?NYz2Q+5^Mm4R zTIP+VNV^Bzy;%y?zlVY6b&>XSzemH&>oivk%id(M((sUFM_GzT$MJYqQ8{keLl&nB zt7e+R8WJm(JVIzjvu}8|Z`wybOt@OejyVGP>(zej2&s_{qggn;D9(2rFs{Gs zJKoD}M=v+X{wFEWIOmSv8BM>jl*67(_~{D=?(uv`C`Z z8u5;-?LzP+>6E-xkos#hJIQq&Cy((*&(`B%>;Z?pRIuc?D0ZL2ckNx_L?9n&RgA=i z?#`%4icPmaJJ~UepKC(G_?hKDQf%duoscr7tXj)V$J9qgiOXtBFsKZ;BSgA6M z?<=!g#c>6H+S2dj@-RL~@SGciOoAtrq{y@Y073Rsrw&+7uExWF4abu+r^h>hT)hP?VWU_3hYzCK=YIuaaPX@r9Cf>s8{#ue^|=`z~ximtEML zZn{ds`7KvTM}Eas;?-dB$NQ~u^@j4AhUy81I=bmXma^K5wfu#y+Q#C=*Z=^@I3#gCuw(u(@Cq;KlPKqv>oD|(QIVrk!a#D2vDkn&{ zRZfbot(+9yUvWwq?!(?@I~8|dwo!evBQ8%rpeOPztbsL!4gkq~!5S=ohpfT!_sR)h z)-~Y{C+_l6>>&5B-Yox!PO zc0`Z*F%<#$jZ%F5g%lA!-CU$dhfnvm4Bm_@Uu$c|rSjWKg(#T;%v1T+DPrS{33gb- zIYBn_Z1C6s0apYtbsOZ5cG={Q+2qj%8|UW$7U)S=z8I8?%VSwbQnNoA-7E|gx;dc_ zWWj_q28uwm+P)vyzBg@O-ynf!JHJs%ZIICP_aGLdC_yZQG$D~m-}6Bt0fE6RgXp4Q z?#l8AG+}Nq^S1G#eR7>4v9)2O z#dU0CgbCviiB^nZLff!tG~u~0#X-W1ie$&vDPIGQ{*T$oIR>zL%yt~uh;$DGpS6AE$H5Q|cZ zBJABn`F3;34maN-K7ix(XLND8xIKw&U9fKNvw}D7-CQW}Imm$fGs)-R!;N(qI zUXJ0B;lNzmq;&f71BxclYY>`CTO)pGYs3$2jdtVzwBq=<#uK$gDKldoqdzg)z;{$s zLXSpctqlzpNfr-A50npMS>l`rxX$CQ>Q|wwA7_}{fIkS0HMSQeY|+d&`DVVyH}fsN znQxHIe1mW1`+GAFax;%{GvC~sxdYAI{$_4|GdH7|ThZK5ky+BNp<)~DNU@@SSrhgaZJOeDEH!6mfv*LQ_)kN zfggFMk`d23k7>kuvg`s_d2_j-e_uDrr3 zFCoPZa$9A}Tk))87Z=s?vo39YYNydlw$09^%6IWB6L->>1lEjay$uPhurnQ+EJ1DF zw>9Lw1%LnYH}8ZI_~xx7B(gYmc4uKC>)M`ORZMDD>_$TxepN>*pQ~9eyP>!zF<_UJ zl}RjvT~Q7vu_xF$C8jfbirrSGb!LTg8qhSEii!raRh~!Gd^<(n*<3_yDN$5#Nh?wG zBrY$*8p11xL9gQSOM~b)6EBm@I)0{mH#$F+@ zpBVf-_JCk~L=65cdr&YA5re31Yl$=UtW%$WTVZ}b@2@jHX3%z~kI93`OhVWM%DW>2|qWTlL%9T&&xsZ|ltJY_sR=Xwk9Owk}<_UB~sfbURwI z?BBJvx^%M7z`81GcSL8GqhsFFYh~k_ylg^~*Yn_$B>Y5!|E4?}z9|_GV~u*&)$a7V z*;Mufn_($|kF#E3-e5p8q*YEc3l^|3+!VZJ*c$yBzRB3@?f0g$3O1AtYx1UZJghdF zn2Un7%4dC!IHj>6>`HD1zGtjKzlU2!E%T9J6n=dc`2hp}tkfp{j@)58a>=kP!m<3` zZX0)v@5}CBnA?J*#PlJlX=d(bhPf|i8X+--i}~phAL5Aq!Ej69UVa){3LjS_D}DMF z!=1`xNz6zIh(Boh3qo4rCb4{2VhL{+e2xsnP$eF56fxwl7b;N1HCoZP;j_ncP>qa7 z4EC@PaZ4*hgvnWlFF09MFjDlG7-EMjMTMwU1`>-QHd%~h&x`v|zl`4_*squP zEvACQ31_0#=5{(AF0TjaNF{OQMBCiF63wMTLW>{h7tMEU>DvfRlE9LLuD}G^5@OeI z=v5iRc(Gv#e{K!WM6bnR{j=>a-6}Y+)-6uhd5BoogD%PpJP~7O=!CuF&-&-te_k5LP*jzLbHeG31UcL|X;1q9O`kh$jIrQ+65Xs`f#R zC7fBjkgV${aS>`TGHfAPkN%pP8{JvU1$2!c{?;I3v~sRm?3yUJhWjewoe(&*eY%}w2EW? z0$Mh+%rAwpNHBVgIVF$DX)G02+!dm1w&F?}4RE?KoVhB;%)-pe@=V2zS zxhaP+V9X~1Cf-+l{t;5^-4hRI>f)okL>DJoAOC}rCXEs)NCLSdz&05er2<}TGR8;Z zKAiA;al(lu_hV>pPCy9Gwj@guWyEUk%MYr3t7*9?bS4QPB+8QtH|kO!@(y{)(TWkP z6=aD@&WUXNARW#&&+YpDfkNFji#T6qnA%pVEc1`*-`g@5SCME6Pe|2MPmDQI<7>(7 z6vv21M?8F^Dd>jP9e>MRugi= zX=`45|E!Kou?}L0b(kG7s6$3a4%WfR>hRdsiZd|*H*AHL!X56 zG7|Ezgfp@d&Nw7z|7Q@^TFBg%tEGHQxg|?^xmAx3|Ld)_OlYXgIbp(%Oei@gl>X%g zqubS*ui5L#9<)zb6Dsl1Pad3ug=|Ikt2hPtW{O;VZ;j;N42u$PRr2qg{cI^?6cqa3 zIrX9Q-u##B5785~xQE+BnmW?dlV&q%wvc8kX_`r6BaNLjt)yW|!;!{`8;3{PZhgk? z=yI`MO9**$UWQkin zi{`#2+DNBc=nVIFc9Fj0LSJZiTW8mfY|`;AZ|m+uDL=(Y=YB+*7s%*GNVAGG>7*GV z%^>{C^$!&>d|oixFBt6ShWJn2c9bGGA14ICnM~-cGda|`K|;{;Tu%kUHKy4U1s9)j zpw)0K>opxJ4F;ofD*aebSuMz11lY0#IJAMEaGzSV`v?XD8mRNGQ+Zg z81*B82?lttF9S8xgeHoxJTM^&UfO9veKetmBCH68aA;Q^^3sIE6d^7!As-I+Ytd^o z;pI6(T-?_uF&_p7wCED;d|}QxMx78id;xUqPC|d82{$N0Vqii8x<`Behw@Ge>|Frs z_a>njFg`n1Nh;Vg=r03xFofK}B>a6w5p)zm6PREE^*#-%q6rlgK^ur*K45|+&n6=~ zO|VjgAyKe&Gg~1vPN$P!jXL2=iMCqc#R3XZPVk=B9}8H=6NiFbvyR0m9!!N9OiD1Si3_ z??EI49!xoyQ6de9n+K>1f{~!}<{}eK$fXE{!4XuDFs?4BX7kHXs{GC($nr)Mi+~|omuMAX z6O}`vG1CqqqenH~FLeH?&M-Nk`x|cPTxkcw55W$1y0=ALU;tO~WboUF3HVQ{bepD^4-5 zhLGneIGUa5uizW=!$-C^mT9Tc{q52@`C!2YNmT~`!0QaYpO8mDoEk4v-S zUSo>tWTZKeQkF?rY?({V@0wnI@fwo+OxeeTBw?H;y_+izDOJL^JcXoMCnA|ec)+*J_3fom%I=i02V1QQc*;{ILRQ0NPdRDOfy`%+dR+)C zt0L#%on=F$S10af7PlVb%&Is%SD9xi!A!1iBW75DPU-ny85g#>9 zY!V@_!PtsE@`et?#vs4fg>{8a~HXOKVXLMpv5UnrUX;$pL}(w_ic z?+)m>J%(JI} z{{l&@1YE~oqL!u-aGc*?Iri>RN{UcaQwbRwPk8s967l1$fz-MpQj4+XaC2FXS!zI; z8j$>a9V@;@9my<>Cp=&OIq~Z_E)pHx@@GG&|GMI9YN!>rd^rq5&)aaSY9|wTuR)?F*xWCm+&fBtB zOztA=ZpkC>>p=1t)txG089pyr%+@i1iv$Zv%@+kaoZMiw9Dpz(C6M(^vBI{!z zL?d6<&m#bPJ{Q>IQ2?+8V+@O%qP?wE_LRS(~z*vZ9N;xVU?HzI)-yN zp_4-~%R$!9;e&OWC{aLqkN!GIp4LIozGu%-9!GZ6IjXu|EUD32lNp9 z!f&^KLyyKTGJu6{5l?FzKMv0BTK6Pd0roP5kMO+?|IGH9S+mi<6+YHoNi(AH4yoP> z9nrJV@=ekcq^^dINVRBIqVb}+1I=A%R-vgwQ;%jfng%pYXj;&;G1D0|_xQGSboOrc zPk1Sq*Ed^A*zoLS#KST#gkir0M%TM6Zu~7-;*)_h>+iJaOc5MCyW>OS>@KU`XHWLz zkZJf!PZK#TS8q5-$PxMC#v($d<%CU1QH`UltN4P^eH}T{;N}U|Ew3sAQPN-^zE!Z| z@daZy_I7UQ?kF5s+l_;MWiUn^?8Pxq#-jVWH}(#=ap1HZ*gQm10yyt&XwuQ7qS=C` zAJPZ@HV=Q^qx`f-+9Ib6c90as8MiLvjHj;Dj}Z=eYD+C)we*{y4SQN;|EPYPlG z{$%^jMo58x73OZuCUrdJZjSPu$doqH!$(V8bV}stMCg9V0vETr$ZnpplcS^>p#%ah zIR7Ijd7P*Gbd~~b+fAvF78W7Lw>!zNc*x0Fh&|0%DmCOCp70h&NH<2v1Q@oF%RJ>1 zj$$)P2|QqsJfMX#cs5ZGpMi96%XVOe?JeW=w3aAVYb&C-c&T8sG8?6#B9u9M>5lr_( z#k5I4tlRTHrg*>emIMP%X=g55>iU{+2~$@5}c*jbB!faNS_uEN3J7M zBX(U(VrIXMz9` zjf>?P?vhB1RS&PEw+QiBe0+K2_=Qmah?CX`jB1{-G!g@^DYgS;v`t_%^Nb1ujPZjd S^gaPGz#*bN3IYy3y5|2q&oS=+ diff --git a/en/.doctrees/issuance.doctree b/en/.doctrees/issuance.doctree deleted file mode 100644 index e70098baa60a84bc1276a282ea53eda303620200..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 29838 zcmcItdypK(c}F_kNq2g20t7dkB?^tf9pBxGWO5eY}Qq+wvd(!g_>SaOxIag z(DQaxsaftz?!IT;r`)~Hup!Tzx^3hY*SQQS@~T!T7)s5(h=-dfy`@#mw4cG+yk3pG zuMRrb`ElCFqmQK1>5GqMN8WzsckuUnZ$I-fS6zG2RfnB57nB7mwMXjbU8r?|GW){;x~hO3UKTh#$)I4fwv-4JJICt}SEfz@mNPqv^GwVGyW zdd*B5rsXETfWF$abEc(Ppir-c(hBy$-i~xS^<>U?GKF?Hd^n|A)yl|7 zDwR5tGctFKaQX)DH2l^ed+a?Ob^JSzJV2NLYwFdYO5FzXx8rXI{;tR04WMeMs2f$8 z>Pm&V>Mr$0TivaWse9DD>b}!M$l!q8CIe@6&TwU(4ZX5I^vZyGlR5y@H+ymgWcL%Y zysG49B`vSlo=j;~xugJNI-S9P?9R-b(6f2X$XAqX$xxJ9mc3AwjoGw0S0W+~&uaxs zJ)D}D5^M~zcf)+#wcNZtDm!vEAXh-xNPq?s$Li%et0$&hXTUZz*V!K*8D%Ed3R*$- zq}o}v-&H?g607&20Z#eMj{KwIkfbfCVua97Pf<*Ks!grHjWsovO@>iM=*ZzMa>LiH0Q@bj`! z(`qFN*2sjoOPU4MR_Ya49fZ71NSa-1^9m z!)z!iQ?Kc%f{X-6Sx^j<-l{68nqI>nsj@bwaZ~Wn%9S9@%X96_i?gK_d3$Ry+Lk<{ z9eE0@MnK-tN+o5fN=jLftM!UvGV)~D+X9hishSy3M;14QP9#-T4i)pe zk4T*8O3<}3%Xiyy$|j@t3VNPvI9}37bS19}6C;O#?mBliTU9I>rc+)P=w0W*2C*=i z9*>$K=Soh1WYnR`UST0J#PeN7T~sD$MfD5L-OFGkQZdfXwvOzSBJ7+Lt(!ej!{Fmm zQXCy>;^wK*U)OfzOC`SUy<0kZG@xdFem*Ui zpfx3ZF0DavH1x|E4DV#SVr7aN%uNQCNJqSGT*`V8l}f3U6@$~PY+I^sU^J+hP^)^O z*hJW1r6kF6h#L_R&~TB9&B|1Wle4`eIZ;*fH6%Npo(Q<=!@dZKMn+An2vw3yUmeG# zi4aNR`7ZxCRVH~=qf9wF*DaBqgX!^P*g-};**PeUcV&n25Zy^qiba`nc6Ka{9kQ;; zu+z;~f&JHv6iL*l$i4?qF_o@_O z=@cIgEoaE#Rgd$us}G(Mvd~nK=FyK}LFgIr6dwPG6cL`Hb~-Vh0!w{kN1iUWm8XO( zQL`P|(jrG;D`zgq3{bPo$ec_eOuC{wOk zH+5vEy#>O%3G&mzkkA{USzsu_kw_t=hgB)UQX-n=Wy^Wm(~+l6Qk0PWnQpN@?W8Dd zd&Kh)Ls83<$QXz!#@X4sWOfcFGX|PYAB>@62O%ANMywq>^gQ7)5LJw`vv0}lOeV$7 zWDIsDd$2>#6K7{qu(Q7-JDn_0V&A6I>DI4PVP8TPDEfUWQiSx2@(Ht)kOc~Vqu$(+ zr%o0qp|7xMd_l1VVKLJzbST78_pdO@Bg{`i7AW`%JJ6AxB8_}boH~B=e4tc{ZAcYm zA&p2 z6(g-FRxzy`r3@CfGPK%|DHw9mk|!u==vBo9MD>+H7lxPN3t(r|F43y`?GpGJ- zK!DJacrASvt3Oed05&Vs+Wu_-RSasES15;>=?K$r z)f0WdjJB#$%Nv*KwA9iHRf$5S+W_ivTQyWLhdb60?rE=8PcIwpta7Op=WG-w-3B<{ z%hfk_lST=q5;?%}jsR&x2DCI}y!tH8)UaR1vJLE*i7XpJRKs@4zYSo%Z<#QIayi(E zj$oONo;ga|cKob(cmG6Vj33VW?fBu>tNomW(^dp33HE4|YV$`fb)T zNk`9}48WFPOYK}5`vo$JEfqA}qi@m*-U6I7FITYBBO@Ew^<`o81x+epSBivXT?HGk z@`_Y6urX?0H)fj%7-pT4BpbyL{zzm1{~U*(U~M=hlN~8}h@|}tmcmaRpM2ohseqGC zb4ioZoMLE2P0m#mDUXdKL=v%Onzl?_bXY7O@iLs8%WEMnqOk!P!lW&~8k~cvjvTP5 zn)An{dmaq+RkX4wx@6Y$b4o@l_?>bQJAWik{7j`nD{^xR1jo!*bd$sbos%>+(Qebg zkXfLoAr69=0RR157?P_7=iyLC9#~JtWg%n>VzmL=DOkgB2K|@WNeG6y5Y$8XBas0G z$2bMcDV~F#?g*OoXXj6yIXkz6`2)0hkx9H#kme>jp&c?cy*?M7DF|W$oOkxZ$v32Q zDwJcqr6b1Uq~xA}OAj0ibUY$lLbkD`EoV!fm`Zc`4stv!5`>#F92r2I;t-csAP079 zM_}g(*jd`6>Py~pe>K=KVNr)IJ=o6ra-Lg*$^70ci!-*}z|tXm>X+=x9)ob2g)5GiJuHvA531&`2rc z4UII*A6`jp-+0?d?@2AgOJRG++1By3{<2wUle0QRqwT%eS3Zb6Ruv`mD5xjPfsM*X znD#SsKlSdsKl43NKx{-P<`xN`OA1H_6J_$7s3j+O>9cUR#9wo z7q#e|K-B2XCD#ZWt_4HQH5z{8gttpoR3Q{2%KV!pm$@NY=I@7C@a3cYsZgA=$sxi2IDrY8H4s0-)RXNE=ak26%~0rwjNmyM zDKL)=#8$(#NE&7MDyD|(a}_;5n|;jIt%x-km9T62vDEm8_dCJ2IuASRbI=UM%2qU( zGkyk09Sls%Fg?lQW3U=}Oy&^TF~Nx_UU?7I%u{qfjlj1r2EJ&UUJc@RUcCYh#plP0L$ccp_S|0q_Gs4fLZqKE!%Q&44WS z){K#(!5J=JV8T&CYO1JzuXgb5PMM%aI;ZQJ?at0eF3{I}Y97-dDeAMZl^X{rGGfoJ zDQr@lq@tEj#HeLdTCgp!%qz@vchI7mg_O+GLG{!qddnl~`EmZPLVNmK9ts24 zB3JA1ig#4$^pzx6FA;59%OAxL=yLJHwa2dkUz=&psr)k1o<7o&2OE&6id<-|)UY#P z=;4EFfuR|Mi8L;?yb{&f;r;uMRb;KYABUsJ%77fxGW1$0^j`T50_58umO9YtZ{Sfc zY5E$yzP0=n{PZ$B(I&+Xnevxny!A(30bgKA%YTfYDB)4aoA>WOu9$g4WAo)c@bcF~ zZG5##<5Co$Vfp(;pI`t>w?g$n`ZZsVBWm z@^X5ijTpU-bWxi3_N0D5Ox%w;>{{si#x=bOjS2@g!<0wxRxfUSme#VQJ!?2PCs%BL z)*XGAcPDCjYf>O-%O-q44*X)y2WU0oKBItqMpOW9jE9V8x0oO z3=W-VGcmK{oy`*C#~!If^Iwe7{C?N@FfkwLI&W_7I@i#MoqsBLH=?B37$rs30ZYea zUTB2x9a@9}S~d?;5Hvwk!e*|-ya6?H$DsY@6~dKY~V{Ng|!eARKOX`npUqX z!I-{l8o|>CWANm+$g?diGQN}+c`-&w(H6m4QkfSTX_4&}4xcRr5qwF&585M0)`q2c ztw9KTw#F4F7BFPP!8?3>FmsG{$FdOmM2BN^m?k#@|AG+j8Vcb>tK(A@Sh-KRn2M+>)ig|~igRhh! zXGFA8!9Bgo*`_RDv}$F8*lg}nmN{E^$}PVI-pVi1x4(0B+k}{cLo%wWmn;l{*P2gT z2}ccVstR>fS2>&Vwn2_0vc3<88D|5JVSXBBoOLGFyKr6`&M`*m+%5X zO}9*)zq6&N>sAe4@S!JQZX-Us4ckakh2Nv6M8m?a#quX z^2UN)t!IVMfm9YjXZy*>QHGmY44AE%)bv4A-Bj#?o`n|^q`DjmgRN89@S99Rplx#+ zJElr`WwCTiADRH-*K#da2Bs&@2H=5@671)|8WP^v=%@6KxRPs?t#sHGs&=CSp|?Xi)kr%Qov*v{I@7|Y4_M9DBXm`gQn~$Cdgi_BXnOBaUsrf z4oU=fBkt*S&JKuWH7m4Jn6RwpLT1sq+`NR5+d@{=N@@jv%>4^}oH`p!crdZNi8&KQ zUBT|zJRKBE&&xPYOw{hcA{{gcZSScYSY{NG{}aprEHVc?Y_i`s1B(zKJ+IY@5Cd)( zwveTOrEC{QP zxX>Ks3#+ySJa1{s6P;OzOC~K^&_p(wAt=u zo2p*qWjI5mvhXP6_cRw>*4N0UvzC&0Pxh*xS3jeERsD+kE%iP=gd)MZp#dc2aOX1sMtsP;i8TTPZk2!AS}ppx`_Oc?uq-piV)Rf~P2W zoPuAc;MXYlZ36>!xTJ7L5YF_1r`O5QSdAUPgC#$ z1s|q>_5Q4HUxR+Iyo!Pn1qBKoq_M#T3ZACm2?{<%!K)Pf6$O8Zz;=eIm8?s3NGy3g z`g}wEYD4{2Lw&2E{ z8;tY@BfP=LZZM)7jN}F*xWUM6Fk%~w)CME8!N_bdA{&gv1|zV+$ZIg-8jQ3CBdo#5 zYA~W2jHE`H2wG(1EHYvi87Yg5kVQtuqOEQt_@7Zf0U`Y&g!G#b((gb>zYih(iTaNE zb0(qcyPkM%p!R0sxs9%vc-}-;OgsU2e?)OiP-%YM6I7a3@C21Ubv;3)Pb?;=Y`AYb8^iqxNvyLmk3D&;V}%{^ zVrb;R(|MLO97BB_i$(ua&FK}02&sJIIn8X%YSm2 zGlFqV9$Qb)bGgoX%)79iV)%B4SGHq*{7Ym}Hx6RXc$N9Qdk!5nX5i7~`<{`gU`*g` zGB26v)_JTLY4b&?=`{o@dCRb|*RKd~F^O+z5L_%K}r+i#4((gly7&KJkVzrYWK;20j8}OYLe0dkr!Ib-}@u7WudC=6o z+{xfIeE>Y%8DQ9zQFpLkj}P{Zq`+?L1MFR0z_xfJ>JIsP@ge_hQjo9h1MKHb5N48^wSYmu~@MekvS0#&_kg}}mxLwB$@#s_;t zQebzi3|R8r(;e&`@xk7f6xjEy7}y?S{Qmf0e%<4Um=xF>RtPLy)N}{?>G)tjkrddSeSkgE+OhJHp*XzFJk4~6`={~Yej_QkyH*fx z4_bU` z-M3<3C%c24ix1XJ3he$qz{b#Hl_Y z9%yYu&sjouc(2EY_qn9t9qI#K8yWQ+1x(J>yCeK|e1w0I6vF8~5VmVT=HH_`ytm`S z`lVHVr78d2~nk%lHWYFDZn#_JQzFs|Ggv_UI0D>u~I$%oRwQ$WZ2RA3*oF z0wwnz-NB8;2PY*3?zUvWk$;cw;O>bJ?(U?(u_K_gCuIo}tZg<{aGxLD0T$u|l#>E@ zdmpVg(JGpJD-!t*=??Pg_#mHH9>~b%qN4#$#aS=55wRV;>$O_GVi&NTTQAX8GXh&4t9x!qBg@94xks9jG`B{Gp6c$Jsp{#=eas;& zjsRht^xq_8xI!R-WOG3vkPrwYAxn}a3%SVVAe&8eDrmjH#U!#_vMw@B6;=+IMeid#-J2`^r0~)HUk0M(HLM$% zZ!MiVQ^+X<>fT&lEvWewb+c67Q&g6y#-`S!9o2S}_eD)K;ji5WcAD|F&`Q8&Gvc3U zLS57|dQs123Xy!FxLMwr(lhGj`CX+LfWEs>iWQ1_5h%=NY-LUC1A7ldBB5tu`Da3) z!yC)cA5(k7qN_g!HtsqyolBq!s_q{wlN%WTSCCA5W>#rM#+U zqO3w%$uCC=D@%lkGpl-{sGSLQbeq`N#p>Ge@zhq^=BRYV*$yQIgf&^vfaBP>Hp{nm zbZ?e-l=Av!xy3(Z)R>Y<=m~{$b@`T-P3@Hh!s-|ZFd{J9 zNr$|eh^EwHQO$?f9Ec#OFmBTMi5j@~ZqFCu57+^4MExT!sITmNQ;Xi%)D-PiCaN`o z>VuA`UUfwELDCadsD2eO{Hl`A=$WN3v{3=<9@dKxZ8evI)&c8Jm5N0@w3O0A&_3y$ z9)e&L)eICwNY8|xE~$m05;C-pavf?z4HdGPY$&0i07@p*e1U4E)lepz!G9#m`igF- zf-BqCgQ;F#@1$PJN2(!r))t2yk(YNuo(ipDA+I-;3Kcaqq^>FHTuLo4^14-WK`?I`97XIfjcIW?mvA{n*VTF9xeS^Py9yp~bp#qgpE zE&|tNGvW4VTZCHyGSi0oEAP$fi8z(Rz=Zjb-kGKZrj=>F$G6fqDZTf?^4x2{OA-lF z@;+0=D0V=PO))vz|nmsj%*ACuMJ(=FlClHW|fMX zr35224qqoX4Se12iZ6}ubzvyn+iRg_b#*nOEJ13PvMUiCf}_JOx5B+sN~vP&q7HS_ z3Qd&7`)qza%3q{XOG{DHIgKi%qL$6W8&nGrt6XBS0%5ySOJPN^;l_Mnq2ZdrHrq2G z1352tMUE_LLPDbLkq!%2b?6t9qtQ?WR!mU}7lb&rhdXRYGQS@a-)S(77d2|sz|I2! zvC|o8Zwz+OP)+P~hTA={Lv5Jmq)~!JjT+c_Fc@}7yEX^u}0I}MVoE+3NB{`hDYT`!L zK?9B8A4>y0?1~dduQ`0GQ5pyhRmfMhem+%015q0d*Fe;$Az6>OV#iqnp>6~5Q-vW@ zZcNDnh9n%BB~0#NLz1x65Xs`r8hASHiYGTNYLNapRi%BLxX7-1%MRO`zTCVv9|(VFwiI(sjUMlM7n9c}HH9Cx3Jw6#at+D>)SzXRh# z6)4)JVwJF9lPvRvB}!KfM`t^RVqeA5LZqYB-5CuJEcF3oEH5ilA!gLIo0bBvh~-mw90 zt1GzU9Na033w-yQr692dZ!x=!)gM_T09(;UZSkiCs_E2jty2TcHdinORR`(-Q>Ln# ziRagIwA4}!sw#s@e_Eh!m8!Om4RG6C!9CBZdVb5`F01R+a4ySm(w`Qb=M3@nO;Q=b z)T04lhbw@TkO3*RDX%)aE9l6VDVFlcn30wZ!K!vWCH}O)9Nr?BR=)vbk`3TLq*|)<+v%<+m2xPX>nDYM%NwpzU&nmf3A)nZmsjgBGw$ z(50nV1o;B3YAKx1@i%Ofp5O~`;Z-GtOpjJ2kF2jER$oBUFtSp@Sk_gMfE8E6i+LnQ zt!DGf6$seJj8a(1FWTUjURvN!7~nT>GzLn#T~Ts{xcwrQ!bkeMX8J}foVdl3y22}J zUSHIeSV|4YkvKv~B5V~3C53R|vRK~48|+$%>o#1-Z!Kh)DsAh-FmQ0v6$dO-Gua;= zoweC2T3IwrG9&$p+NvjnQC>vmPnfe`K~2$$+=>duDa2FR0e}7@Nmi%56qGoykOG>zG%QQ1v7AGV804(Ot8;jf}9P0>7|8&J_7|? z>D~bPv@6ieo=uKiytEP^egK*;GLBah;gt?IXm=O%Y;MIKDX`vHaK5}2oJK;5Tc-w$ zJ+3hJlaO-;56|>jGA=Qf$=gV2ijqVH$9$CzmGO*%c%~m^~hE)_-GD|AU0BT+7h_pp2ZP@Mh3RK<( zuG2RQ>L<1~3%Rc`CgVV;02Kvcf!R@Mu!Wr^86YRZ>n`X(xTQL1z4ILDOzP z(T12mzZegz3CfOPQ$76IivOrw1rU3wBztc~(&!y)6Tn%(JZuoAM*GINpL88} z2aWq;@ATBLO%=Mgdh%3P<*0WvqDUIgd=qHItZie&FLxdB-8AByo`@15qiLk?rzpYv zjEqbp6lox>ybGS2p4coOLDeu-4YR6Y%1t*q9k4nr&$MbtC2h@@kQtb7B|oo~J9c_e zIEP`D_3rqRe}UqW`eJ$TEd70tSo*UiYHPb`#&8_D@w<>GmQrn>%7-qE^oRN}=Fk{{ z%OO2n_1eg;O#alZFM5$vf~A2Bz?=Lq%4kQEAEbYfpRPTUd_Vns^!y$+!hP6hpe*H; zoMs=$_f8?n^b!(nkwQAcyud|0&U7pv-f;}{(Gapt$umUqX>6UPrPA;(<+Cf$&H2z` zHkHb*A`v)*nG&?Kk_x4;(IN!zIs~UXOF!vTDUUBX-WN|&CAEh9%_4e4+f<$_`$b(% zL=2=npND7?=$CvD=sy!VOsed&(W(?nei|Rm9MDdp$~59 z*^RDbLPQEA{|ae2T&}CG3CHIH!?9n21KhqpmdeJLqfeKzMTzHM7Y_B6^0e0_G^nKY z)Ou(f^Q|V^TOFcnyo7M5q3mMloSrXgD0GRk%Iz^}Mu#WXQ(`&_=mVfd^`iFnDc5t%7gaM-zq ziR-@&jBDiLC;u9?9MkuOY9>|iS2Tp9$*-`Y$*|ZQzGwCUzKkr#14*!sgJs z0}uUn48478LqA+4ZVsa#wMOqy-UQ%6U;waYBApk;NtC$IQ zJTTnY6_Jbvg#e7osQ7zfugT848IN z*kEEhHmzZ7utGF8GPD>bb7i=fQ_PoOu*|UGiO>>uC!qqI9#%so|A@veTHsa*Q04Mj z0E3eF5myt4H5Edb+p780Izxu&jeIWp8#{ht*`kK+L21}j<|m=znx4k?gU}*5Sln4U z4sHww!ne79C;3LkoG{<}%z&uf_FezxQO1z76G3=G0EYaNp-KVV1*&MO@p|{RFQi zoHDSiDTBoST&Ss91l6utv*Pk@vEwTF1Ar8YM|*F%$z;yN=J{JJ=nt1a^{p{1@?Ipa@r1fTUW0x|dh45UBjl~oV|Pzs;=-9JX+k=UG&Sy;HR3yl8V3 zR^o+XX>ls7JDsU*E9(qHhNL32DFl!vlcF`tSmbX$sx8KO5FA^e z1ABHCiur72$v(;3Z=;AIR(k}EtQL;57Q8*8hesuwwy^EOY`W*1cY|nRY@2q~#5;w1&h?>99uWje(8`>MO=(I& zL!3!u5JM|NXNt8su9s;(wxnXElQc7V>PU!#CtL_+k@>}56mZTHU!!kh z7PoiKznZ2%Wv9&0fjvUETfVqCCM+4kqVQu5LT4~~MZ#jlVzuvtDNXANw! z7;7S%h9k6@d>@)A??KVxdJc#6?Vv8p`|(uQaw$Eo7dJQ9XF75UKPfybPDd&qlEsEO zjc=yGnIV1bvQL_PZ1*3z1O?Gr)Rc?=SpJwfDRgvw*x^)JM5}3)e=(n>aFgLBMp!&a zRT31xvuPr7GMb;4?g$9q{3-8o$bF_)>w?I8%Xk*5N${ zVIAz(cV(TQ8c+~$y5_ZX~!_u5!Mm??M@F~mL#l|02_$h)= z6mbP_4y-`Dp`_v^3I-W77$w9^=ps(rqns7XELv0N!ikVdgM*FZVNtVnKKMY6Y+|3hosM6$M=@hzh#6Mupw>d`a%oR$NSA5>g_RIbg~BEr)*l7DXN)rhA`84ic!aWEl}7Iu^W1jvQ0s4Q$^=U)P2 z2YbSk|G)&sTed`U#@AUxan&?xJh1& zr&?}C`md*8Uo9=k^&;h5(^P@bH=IpTIv+fA6@TV==$}3qaUl`5>C2|EG!9KV$XAmP zhz!xBgBFEa&=MAy4F8ctJC8)}HUg4(j5LyT<@ zLD`E_O<_dzg59Tmu*DNS23x+^tCZE(Wgjeh5oJJj8WywFZ+gCvz!Wr&F?Ts2?w2hM zcDLL37`Q%|LN*@qN24sc(2nq)vz$GjeDzt2xkK&ppB+!W8pm}@CB{Xh{cw2;EtnuK z*B}&~JYC)eNx^~K&zAS5uwS8sBXcp$5a%vpmZ0fNS_=Oaqd5JPj{hdS=tN!9pT~Y} z8(t)r}l%t3jv*Fvu?>!cPA&D|GPp2^z?966#WAjG-zZ1UmFWXiS+fx%IGjTp5U5b@5B za^A5%`QehEINNN}JHz%VnyeSr6{wMIy`D}}pj*3gj7Rpt9qP;G- zH6ukao2rlQS*d$bg=^{Ohe;ojHM(nrgmEiFvErLcDLuH8Te-%YTKm9kXO z-S||CtHeUw9VqIh4hUtk2ZoJt$=iL@Iz;0;n%vKdCU3((GO=V(Z)<7kXKTFdgbYW3 zyQx7A@P1oa3+z)U;1ldlHY)GwxC}P-)g{|})Cvan!IqW@W&zHmipyvwgY7>Tz@A%_++m)p=dCvdJ0&1gO6GQ*RNwmYl8WlG2Jfkg}H@=mH1

~)DN~sql`yoa$Z|VjUl=+3L*wKv*+1)41 zrD+@%7wNGjhV4_gobvkl!T| z7dUq~rJwv84OX5kit)>tdi1go3&Q*7K(sG2R0QCC?+%1Pel=^gUQ>$H3`bLXe2-;H zQN~iJE%@Nmls=52UVK>Xp!NYv$9&Wh8Y0As)-Y-+)u^MMW-#v#D?vkiwa>f(Hz4yXlBvh6;S!*|+E z6~1zN`!p!x;*6cP>%-p%Lf!Qtif%z4qBiv5Q^uwTKdzY*7VWOze`EBwDaF2EuAfu; zzBJ?M+L{sII%vkfpb^WOQ2-%pMtT`cGY&%@ev9G5Td7DgzulS1iUkB?{|n#! z&(OhF+>yPsBGT6KD$YBI=?HF6;u>3Vpw0Z2p2ZGHQ^9U)AEsXJ@PT|;FOLGFtqsTM zGYjkl2fD`7nuO!Bn26n9thGVjx?j;ew(%I{n1vZp!i*?kzRnRgmUY~e_N%^$12Q!F zy{YFUm?tPpaY}0ww2);P3oC=szga{qO6o( z9MU6d1j)&nOt$EI;2GZpfo#dCQ zUL6m<0DLDgi&#Yd027?xZP*u)>utkf9J?S*6(HBMuI0I6{JQ|zWySdSeUMB{RsS19 zToCF`g1W!uqn2>Mew`Jq>45oIG5!a%X|9HDKr-HGI}aG-VnS)dwnN{LBJBv4-R4Nh5;OV@*zI4ahz@ zVQZvHMq!6PFJ+ChpWWscPi(141KUQ-r)pfb3BqfE4qMEpx~P|!8}kGAjxarV$e13u z;K1(TKf{P)^YEK358tJFrIRjV**&I@PAhg!v21{9U$JwJWq&sfNOsZ17-bioUIuf~ z=fI2W3|w!6DaooYg?N^=TJMTop%in}Xg`lujaW9ySQ_n940LZGgoE%&AMnZ&dj(kf zxQ|)_OCM!LYihK}l!nuNaRv!CvWQU2=J~)=MHpY)%c&RhBp#LRth!FvQnCCBQ%vF@7kMBWE9T>#b01;dUqcT z#coQm!xl<+lW3RJ2sfqZuSo;%F1o729thvt@X8YV3Sj9eAGL(UKEaCCREn3x0^bzfxfi0N{>0h-Mg*Gsa@c%d z3{4JSoW9Uc(FY|o$z4B$Dq2b^g{fM3*WTPF6Y3fWwZK~R?mQTw+*IqS#;aC;O&WN2 zQLU%!s`a~o4tIYOMYo_@Q9Gb&Epu{Pn~@r%T2Dc3R_0Drs8$TtLAAb@1|+LiF-BRn z(#v3~^_AeoXBoHwc+s2L8=_iurRbAg22_>Dgc1aiUiabyX2Gg{ewnLx5t|NBPc_B1jN@E9f zyr0fv!bICRQi#Qc&miyc%mQ5$WIOq2avM6bF#lDCd7RF(3nNk2Z28wUHrbT-(4H1- z<=({QHaJC&ZOGm%A4J~O<00d|B%YKgUw1tWjW1uuh}c{n6!PSEPsRjvR;_B;4nJ$87n)8qLoSwyMGqrkbf*-7@_a- zUOKlVkDG9?+1EJ6y4+z*p8X_D^zaM52yY^9OyEt{9h{8bqAg3s0q?f_$m;zqxVc-VfMQ>(rh#kX9p`#tUfw3BP3}q~B`WgnhHxR;(y~+o? zvc$%Kr8OV5gv6Fu(VBKlaWgLfOvi3m!<8L$uGyXi6-CV>eM2+1oq)`0y2gWnhTeS(c$E}Cp+1Kw`? zCD1183{E<4k(Q+)4kW(A0SdcLCaW1t8r!x1ZXN|>CwmV&8H*$2#R`f6-l5hw<>V;QXjR1+`fbrt!c#`AD)`J zG|84Naj+Z?haq!iU1&}xOX;|&bsdYE1S>n+d!{u>K&Q?d)4|45!oCdqO2%O}b-cYi!0~HCe{C zhTDNmOZ$Swi^Z|ubhnCa9hY;glSVHPOtMB7V9FYuUIx?XOJISk3}e1DI@eO$tXj&!&u3 zXWKOxxT%kyH7ib56uYYEz;xSD4AiDEM00(bpS_;P)kZm;&Sqq(q;dPf>9~b!J%mHt z^+mdi+0WQe#@x_FOW$J+#j@o;{5<11IRGc|F8Y?2%72B`@WrLnI9tv6zUMPNw}On{ zuLBw2O5@b3?c^NO%i$#UR(P_m(4i|n!D#1A=0Lile3mCwoo;Kh^0Yc@W@(|go0IbR z78*2sjHB!{hN>~yyo-MWBH&%P74+j*xYeySOT)12Zoxluaq_)dMyRW>?RU^=33zW> z_D(4`>nJ--fnmeQ%_0gp+4F-3tL(WLpKQFDI&l0 zgt>{rJhezIMO4`C)d-HNi|EA#+hW*>AT3!+c$VQzPTsm>VWFxcLxOLs_+qsbWi5H5 zR3vp#r_55>kHFz0@#ZXN!YFi5NC`MTBE zv+4dffR@nxfm`qrWMi@!xY3(8|9q{JG|Y2GuFwf^;9)Y;cxrEm5hKa5b&EED(TvamxV(iOu{%-aJ?2Lh%GIT z5Bjs!uP2N#N5!;a6Bw-b^a4a`-YUD&KE`JGv@xYQMxGdFYTMY7o#iY8gn`&0kpH z+<~e-ouk`Pw8}iw%V6lp104rgQvuN7u8_R$f*{O)(Ff+`yCA3*XL&m%(Jb0J8Qm+<42lWH!B}O>#QCi;AuHe50d#QKzl< zKjyHHGWiy~l+x5l`W-jbS8Rfxd%w7q5(l$V+>!2~grUT?8m5Mglhs*}RL}5?aeSxQ z9&A4^R6tC0Ny)RwECoJ!LOK@aSXh_hwdxAJiz7r@V*3wSDdbVoH@auVylfKN7kR7; zyKpF!Td?o%F$Tl055v8fxE7{}e8pIauFmA;p}4H;d(p0vz!D(_tfY*wj`d!lg!sz6 z`_=^`bZZs%`SW7t72VeDci8Vw1potXt--P+JLQ04&IFa^8nGkRMTi*@?5w!dp52m# zk{CN55k;IGdSTZKAD`@h6u0bz=m>%1HIniCG zk!F$|_!3mH?d%A<-&np%Y+lL7mf&ESXY%4Wg`GjbnXs2^LCj5gu?ql#W$gcs&=Y7it?6~dIJjiI;%5A1!-M=gQ9ud<>wwcCBp+Kn#GG^TD|MNHjx`1abM%kaDb@Ek%d zFX1IuDi}P^3*FWNuzc&b6IA$HSGOH!B)s{$ZHJz)CA`v}AeaX?efAQ3H8zbV&(erx zUB-d%Ry8vBz7gE}G6uRYUB;!+yMwLkvI8wGM##@mi6w~D_^Rn%qoAd|7V*`m_KNv{ zT*lY817A@ewS=_4f)#bpUKPuw??nzed@~k}=*{Pq^+;$yiEAOTI7&f23J>DXI1)=U zIEUYW+sH9x@l4|^4<3cJhfC>TH_Bu+L#FJ251vAbWK|s8jbLafr78uU(P{-Ed9*`Z zBzd^}Eih73nSYxPPLRp_CXn|voMzHu@In}izLclb(sHKKgGSPjNfw+n8^^Wg3kz5$ zZfW6vP!;=X`0;|uH>0o+FM`Rb>?%Jxul71}B-kjJ>62#L$#()elAVf0W;yYUf?9Hl z*?WATQY1SDI0Z{5rGp`kLqTYA;=t^E8r&?SOxc6#v>Ri>lBzxuOg;Tft zuxUKq=8~MUG-2IKg}-&3x}6w4V&m58^-Y?v!l~=D7OaCfb@$MSWv7k<;mwD##`;cB z?iL2Rw|GfTigyQ+Q|Db&EKc+2oqJKI#py4zSiU^y`WL6mFXyX2hE3*%TT@oBuIudU z(3-TlYeHnCIjr!U2W~5k7uE`meq2@YB&#QbSGgfrm?`Rlt?IM~AGN8N`8eH4KpITu zoaewfwzagIv3`?bkZx`LrrtK}>o=l}o3VcLc7QDAFO};z@ASbU!dkzTAo-E88nu2SPf?^C+2p<>CWBQ> zT=wIOPtMwdqP3!UGMe8GH1G6LOQ87{RnhTr(yEfN?Og2}89>67c?hTo92DXj zlCml4P}Mp!Ze$bBH*l2JY~>L~E_q&vL?jsq!@wS}zqZvXMqy^DJ7#8kw~iRo z>~a{qrAg+acYu#x%7)@S>R^1d=Da?JGwbcAJv4IRhMIO+Cz}9x!UWvsxctS2C5T8< zk149KtL#_xw<{;W(@sYILu=f?six^!%_LR zm@`o96mRDAa5yw4LD0xk6b@hzj(;a8JjT!xfaAS85C-bsnSrWn4UNvn$(HhQ=lz#u zVn`l!-pz|yD(5+T^J!(i!w1x|cKBZ4>PYr^II#=bUQ8w z-7dGZWb;c(M!(JsC%gEIVzJ}M{xG8E7i|SX8X!#>2p}U{Y5bUINzQNb=P?*!ii&XR zU5`X$Lxf2}5(B zBUaU`MrTm*wu&zn4ZniMd}@O)Gn9aa=e7>CH2`WA0Sf8(^d<`@1_XNzELk=G#mCUa zA?oJP?{vhm$yR(Y-nv_s^7nwPzQ_<$H(R|6JHxUioWimmCFUWX5+~T_RdHGiNxCRQ z>Gum)MW-W>4!!(2f+rwn;T$0tuy>~dWAGZFbV`3>MiRx4RHqWT_zm@P)Yzno@E;$dsn%>X8ib^^|cIdwAJuNeR7lC$rJ>& zoXn2k%*ioq`i>{S$Xp`A3Kxj58eR(P#c(zsHokR+xhPoiZeZ5<2m*rCF0IVpkY z+i2vnba7z3`Bb*mKLBbjGZc6WlEmHK9Y_;7@1kO@iANgUi#n|}Ejt7<1Fbb_`^tM( zl{`(EY&{`RkeCLCj@y0Q5M7;o z!i*Kt9z<+pG+ZbKuBKuNC2qQBL*YR}+h$I&2T@XH$)6>4K(i<~!l7Eov)qwSq8i+h zM|RrWk?PzrwCRu~_Gwnvn`gy5i@IU1l6JFbRRyBt$sZI+ADoniSG3vXkz`!--6+5cSqk}rO8*>q-_&txhxNl^(GWDDzH6&99r8X@x z?!1!;kaUBgpG~g^SUqomMTDKYV8YXB6CSbMmnSuP0bmk_k2DBj{*w*cH|a|8M;NSI zTgtAt4f|5IXyaxqWnTiw!t<+K%AWASBtpZEGsJoGlPq@c2X)W;s6}qaTL(V-BKAMj z8D@1Hf}@f_D*IT|&Y>j%x$~NK9tC_(#xp)3k>URUU|IH2OSoM=!LGTc{aqH&PHWn4 z@elHIJ_av?{1X8AJAKrWK=#%c!qXh^(W+R}7NXUtHSI$!E$sXU5u9cwQ}Sn$pT^h( zn>ATQEfxOD`0kU-e$fY*GRi*)l>fYsS_0*tU`1;R*F8Mhy|0wd(>cb2dLBvV6qPqT z2KNG{J@}#zuw__21X%vK;jk=VjWwrcuvpNS&17gLr7w$f1ll9E(`UQQJ&9*pTWc-1 zB6(L0(Oo_N?__kv$&>iw@&c~{wQML*MUzinYk-bE3vplGm% zx&Dcf&^FyZ#lu`d+pOGUc#IPUp;|^p{7ZBQTSwS-OM4CYC3Vp^;rI_2R;I5#v2aJ zH$|f*0Y=>#Ek%{Tbv2sCNZ5FdhTx#>)HD_x^slv~K;bhqLOD>#2kos;WN!T_aI4Bd z_4e~6+4JsT>lzCVZ%oe@HDowACw=@7@fMG4?=wqU+Uke#*{8O8pAXn&jQun)_WeF; z3577b;)dUPuq>VMG)Wevp#?X5s$Zv7c>>+dm8eQ78zZ{8hjT|*sdY00G& zoavBVj4}n}xFhTZL4rXpsOl!)Lzb& z)g{6JEuJuKCH6^+%(Yd$sIj#RD~^Z-mx^4qEw^JT!A>7ol-cUzKusHmw`R^79fQo% zRtz#r+dv1=3@ITwL}0u{pm&d`ZBhNakMW8q+%OxYH}A`!eFC8M`=}-Izj|3wIsXgm zHK}YIckvb19YJ11oobMcx3sonRJUMWMjfA=uK5_f4D%-ebHYb031)XK;gvZ+=;fT_ zUY}MZY6+Db+kCDnWI>sAJmU@vb-l(ZGI9{Zem7~Y7>4hIoV#3-#osE34)UI?3~=}x ztY8KTc)Xn&+f{c%UV6|-GOu@#2#7TP{N^ruxa4~nr`k;ScAVebRT)g_tO%xnW{zij z+rlfhJO+@eBDg{{H&>F)V~gZ)i}MYyKSJ=!jsZuBw?xSz|8wA??_!AbR*sS!dUvpO z#{g58QbvEeq(&)a)**8Io5c5G>SC6(l;r2}*{72Hbsw<35R#k z2y{4oGF|**0I8N{l*j)mj6Xz(s1c2p)SWkiwr(JB=L|B`VI88GQaYyQ9gV~QMlFoQ zL8-JQBtA!ZPLK5!so?iYc%r+m~Bn0ta1t!XGe!d0cI_bF4~u5h8|*_IN_D6y*+ zhbE>%IW=G47ZWJPP62owxER*k5)4dDj)VrrL!IqCp|19haC_zU+o_T9k*V<6ks_uz zN@hw~8$vJSW8>k5{)EHUzmM47m5+{RGvN#qU&?_M8M5Xv$8MiZYJA)WH9kz~ zdqj^ zUvb(tJ~guq{>>*?J(Mt~e*A=6DnTc_S_O<#5%J}!s1y?2QrFZ84)J3xSDx8tHo}VW zoK+O$V`g=w>U3RYjODjr$Vq#FYH(DWJIgojaS& z(OxRzv}PO@O=ixBec|49;jrc-!kwnA?u_uwSZ}4Wm)<=prNDtgb;QDqj|gnA!V*p;eS*O~o^dXo@?1 z&B@he^AB{hTwKSW5VKyv?|6qJLg-yV=cpik-khN~?Nhj}Vj%RT*Z#0om=*24+9d_@}{ob0@k>FX&b^*%*k(Pl5qOpkW$7Pmc`@6l@*_8?fQe zUSirz4lW?aN8xA-?2AVWYnwhzt@C+F4JG}vswBmziwE;}}~T%2vs$Moe)arN}z^|k0Z^+MN`SZ^kg zKiNB6NG#=);$WYR&ZyQmcwq=j5XGVKiNVZL=EBU(<(YW4cTjKZ&YzqZot_Kl6R``4 zfkjp5SB}fk>1bg}8Scw0O?Gz7h1-ntzvF8fgX)t_;7iY%$x$_Y}e} zbk-#cOBlX?z*;6?M`{38<@Jv}a*M~{@90b69%I}kVMMlYl99Pou$zCh0_Gvsxs)AN z_PZhexQ~I0WghB=?diScOl9Bhq2Ox3AFTkqW_H{Ylf%7ad_u!YK|6!J(E*$ivBDxH z6eI@#2u0^<-Q|$nxCPh{N2;_*y0xCZ(aB>0Mr@5>+y`mIItUFm&^pN2V?>2MR?T}M zL?pC5g`!fxn|82&)fRo9>%$2c)_vG#u%Uc*ePn&2ZLNR2fAsof`(VfX^muxrV}4zo z?w*`VraDLT)uoa2OouW%k&30qQ}p+2Cvr1}Q>(a3Wnp1{a^&Pl-)Jf}G?PpWkFLbh zspMSeXzEHw&pIZT1$zZAI&WY$wR~l6tfb6cE?wzJ zu^vV;<12}|(IjhpxS+>6M>AJuyK`!KuuYlmDb00sYq8mB-T<{UHJd^M<8AYEqbnmr z80ye!W^%Th{w~GV*(flAgoe?byfQbDi*GS)d$0w~>c9pfwW zVyKfdm-WTD_MW+!HYa|40kaLnEXn)6?x z3Y|dUaCO~e)pvn$Yl3FNxRqwCF@F0t!MG(|V8OVBW-J)ru{|(uOEYgQC`JoYbu&#QlTQJ=d6s91`y@Qnd?=cqkcG^6YyL*2g zyNJfv1kXrQs?1Hg(}*vaX&s&chSLm1a)7~MBLXzfKC?j!!B6=>um~|wM^zyP-n%;% zszVH?wj5#zurlB@WlLTIAT>h_QI6Ki5JT|3f%wM))Ursk=z}yuo@ubbLJU1bg{!QZ zFW#R+QO^)V`8D>58_moR8W^6L9iQ&WjCCZYrj}Eq7YAnMW0~=;%QHRaSbQNfgUS0~ z`#k30B4p5|4r?%ch%e9&wXdDMxG;y`!%Ic`JNBE(3@_<(mz@ax{1}qQr1lMr!m`z8 zliIDI&d|J=)YjjO#f4=yMsFSwTu9(lc>_)`cGO8-h*HGP0=3z~g5y0w;RvGB&X6>{ zmVxh$DPc)!OH<7963GozQ>B^ii%XqLlj9>Jrw6WN3TwSlEGc5O+t_f{e1iMvMs8n4 z${+jF_}1*=mMh!dE8|XAH~8lmkz|2*ECBol??2)bV-|b-vVZoVK~}N3%gFs@VS*aw z$bHtZM*e$2M;?T+pCHEmI0LwD#&++|%SB=a%FRW(%W#pbv{g?Z=^q)6WFN`toIjeL zSxs6v{&ycZ7G4r{Rplk|{@oE#?Ik_6WiKf}j)9Z$Ox}N=4=?Ef6so*-6$>%J`z9|b zKrM?jFJ&X}W=>(BXt2S&q;o`tds#K_9)w;$ilW|L(rl%dG}19So9#>tv=y&R&E#fM z=Z3GOd#1+cCW?vFJol2)iCiK*W3GK%=%Zzi!F8tYmD$s7-p{sn<>A$wV-%5n zn_Hif{ehDs$y3F#u+pv1TpEgHC%cR3l^N!RSW1(8k}7L7(^Othtm(+1JGn~*alTo&5PWqE? z;&ZXl6?Q*(quxgPVTNLv0Z+1Ne&Ep?Y}bJqf56HX$s_(rPD2l-q{fNl&8%A8BzI>q zFEh>5qnnvFR~gLho1R8`oRds4(heuJLZY0`WS#MWU}2!CqbdW}`d&q3p1%ttd-F4Ns$p7E{lb-+xrod*1 z{J*g^^1HK}m+@w*)6IC_Ys|6bqZK?Y`2XhAlPtK~Nyd;h*E5T6eQ|C7SlDvvvdWh8 zakwL;+Lq64*_H>`-REe_9|FuZZTU+WVr20^EIfGMWXl88vP9vy57G!-OoI(33iCvT z2Us;7KReWg}zYT;a;>cxtYr zCq37}?K(}udB(u{sF}h)lFTlRET^XV41I0oO2=S9nVaZl?=d^4O$3Y1DgEW=&$v8% zgF!}XncKK;umvOy8Z9UyHm-4x(BGPciEoAo^EjN!bHl|OQEy7m4*rU5KgFvVv1AcByA?bb;&HlOR9cMm?fw~wz^D=p zC)gfDvZe=_jM3lcUdS5XJA#fc2&2D}82vf}t8PYj@6XGtVn)o(t1?$E#K}^09;K&C z^>KzIIjsOI7gBWt>-%kQEj0h44>SvBiaM)uruYclaZ&9|#kTBB1vt;a(V6;V08-PL z`X3y%m4T7qeUmd4pq53NKleczVZ3Ot!JMfCQQ;3+HD40&1r+smrm|Je)a5JJ$F5H< zx2;bNjc2d4&n(6Uw9I_x{9TYgi9;Nc?ee4sixg}X>wK#d{KQ)LI7U~I-Yuzsiq z(Rk3ipf%11gN`$ZPEtu4Uc|uj#)NQuYD>e6>3)RB;9rV&c8-p9T!?G&>1b+rX=x=| zT4bvtHmz(VP`Vr==;G*1Z%a>%%ZRldcMF|m#E>1Ea3DAhE`HQEZY);l_s#J-YuCd|+-_ntKW6KpDi2Y2xx!2=zaO=pr zUVUO_Y<+y{ioSR`g4elt=NLOcKpCEBiw}>Tys+N0iW3S}5$k6s6~y&!zMH?PZ!~vh zj!quvT^mm>T_5Z3U8Vmhd2W7ATctR_*wj+j*meGXtPjT>Wad-xbSkaP&Me~yfWnog z*;FyUj$;mR5&<&s)|J`$90CdKBm!yxBU+4iu;UG4Bg;L*v8lwmI-_M0{WDk8^ja#B z=`Bt+4Nn(mW+w7uLj%Q`VeQoNE9st-m(%kriRJc-iPXUL$)Wi|Z06jYIyG@=Y$`PzAJ(pqCkKaS z+O(%<(=+1mxBzTA}V8K3AVw#{50T)&b|yq4DD7 zj7zZ7rNYXUp}yQ~EVFjHe>u^eT|EDEc&s>|OAQXr zbRof{tK-UI&tzwQUX4y(no2H3duJ25bXRO;@}f2#Q=2ZeDPz|Mhl-2E$>q*)XQ8w> zcP_E|>Ocn^G*uk;QP;@anw*fA;YFDg=p&t%29`g1Kt#P zj^p6>Hi@|o&2NNpe8C*OV2)leM=zKoe(2N-=Ez|m$_wU*uOx1-IWnhPZ>TZdsyL)E z`6`^s?siD~SX!QmSu@k}QRxDduz6dHqTPROQ+wdrWJ{N`VjMi{hJ%ye>z%OL^ z3~nEhqL*|bi>hMA?f-zEIp$s~H1V^hl)KlYIMLx=tYZTR=(j`_V}u`A+_Z zdgO2H@ESufnlA6=N3m=s-;eU3lXgq_P`rej1~SE{_%vQVV7y5oUa~n}-dj+MMLn}r z*eo9g`btGTRfsI+**Q&#&GPOUB~?-jo8Pnf=<7CbY#wK{A207)QZs5^DFW5_1Hh^{ zv^<@|ANzSvQ8d4dKbyp#rF;s19V}+!(U=lnrmuxfc2RKo$YM5I#5I(v?aTRF$_EQ- zyoj6PqH7e>*~FVeg<@XM;gF?tn$D0yd-wA)AYiYq?2NQs$q#%7@i89k^mAwHt+Ym3Jl7SZN9E9a>fL8Q=;f@~V=?n|;MR zZUQHWHaE(L^h~Z)jN;s?EZys{S>9DDE{0EUmR~G?h^qN~HXqfLOd_S`fnyqGytrAu zEn6x&x9~v4mx?Bm{{)^XAL8vg^e=y?s9e6C#$N!EG@yrWHs35COevYAlCq?-Bds>e zx2l=V@*Vt`t!P5csTn$+OJ`W#9nWSKb;8d+Fn%ttF6wKW+V1iprBuw)b${Yj`Boha zbudv%=b|Rl0jcZ-zm`-<5!r5IZ-CiMfkLzJ>`h|W9 zYMyRn1%au-1Sq~gudJGXf>%9O0of{(;jpj)!5yvj8`G~F-7g-;W`c|!&PNB1XMI{CyN))xt^Lxt=fGyKeQ#wrmqJfg- zNMIY>J(++6uY?LFFCO64O`*^H9L08qGmYb?L14VIhYni^jY<5J$trZ!(bP|Da}td@@m)f7g( z0^kmV^|UuvzlI!Z?#-{j2uR$-OvlH@S-*chTbrJ(}t95ItJyae^La z>Cr=v5qb>LV}>4+^oY}AfgU+}r0H>k9@pvd9rSn;J>E`_O?vzgJ>E-?57Xm=^!NpO ze3BlYqsOn(;|uioU3&Z(J-$SbuhZji=<$E)@o)4vKxTIzJ?^E)QF=T~k7M-cq(>V) zo}$MS^cbVZC_U!sF-wmndL-ykq{q|rcpW`nO^@g3@tyQ|7d_rV59Rcj~}JS)%|$P(PPg6Ja*FK20gCRLg80j|{**6%;Hf2(8;op#6x7;asOx%Bzelc!w{N&35) zNSK2Eb^65w{{l%r6a2T6^pnC){s}#p;Qt@2Cvw3rn1cV8^ot38l%$^t{#!`;nc&}N z3jX`(*R3S@J53cZLBBpkj}NmCqyqk(elcZGq(7N5I7AwODT7y#MqtX|*GMDu-Hyi- z^mynn9{19NDF~Ic1XB>_NJ~6RkJr&Rvyli7ziIH^G}`mqyaGVShZEqDw;o114{K`m!bR zgfUaY9CFu#hzjg3ym4~^?qN>J!_gFu0d;&_+lR^2IxhK48?Vg?p0-QdO_Ozb8vkg2 zDVNf5MJiU&;eqM^Bg7pYTv(k}>BcF3|C@O!Y=9bOFd%_Z`?~1-Xi`B@uVaas$SCDq zxEcy`b|7^pSrGWABjbY?Y0Aa!faFtUIIT1nK7T*OHlk=40fy?R&HV^%EZ`%b2Royw z$3hckCr)U(n$;5#98DYv3D+{z9cjPTY@%%oEtqJ0t$#G$sD(z7*lIK;ucMwb68G4U z_%c-fmciP){A2AMwXjCot!}K{g33Oy_C$TW7HN-k*!XRWt(ZLbGybvnQ?;;1+P`k> zEu*pz?2Y)q9-=asQmvM ztp2rsto~&!tdcKMH&%a-VO1?3F=JhZIc8S6mbu}E8hMgxFFcn?T$KuEU~&CSs8!3R z)z*9ojGJ#=&E}U|*}dh634~V__zcA`VkiaYm;6hnRgQYIAhyYt`yTRbr+1^Mmz}P% z&<>`>uqd?|(8Ne&7}h>d5g)@%X@=pAhZogEGvxsy+#E9FS&4|1LD}pdw1>6^ns(gq zJMOImz%%Xu9?R#zMn#2!ecr&H^$%=Mqkz4y4q%`102UObg$Q!wu_&P9N>oq!&iDs; zvQZ$Leq{g#eykeg)KXZfLC~Ck=+cdX?!|Qw)QfwKkSqKYZ&H4Te_-F#C}1DhCSW@w z?cTutkbhv`+bCck+#X=VUA2Jy1^>W)vQfZ3v~9rFVB;_N2ljUx1#D>BfbI5X`S%{*puGC9tin%llGzL7ThGumuTK5U=gM82KHh9z#eN9u*d2E_H4CbH9W&( z!t{i@BQ^E$Q~tqyqEXsjxTk$kw}#Xf{e${+qd{ZylXeRSJ^ z?esQ3f8-z7KWG%NE!zfcmp8Eg=pWd>ZxpbP)d8$OsjWF3xcw!*{iuT|+7LhLL>=Jz zliC^{a*KapA88b@;W~hI2vD#fqc`XF`-iT#QP4%|fbP+1KO(tWBlz-4|FB(c6l|@H zg01LHw>AH;l^O+GTcco8y3SWY#;Cs+mAI0wvI-@R`7=Hzxapk zml_3IXC1J$RqK*05W zcO4Kq5s|GAcdf*AZxHWn_U*nLM$v}2FDL5&@kBKdMN*IFib}*kc#ky-yi;|6=fI;` zLBSeQIP4$7fkr`ix(*1P2&iXsD>decG5_F28wFlZ9pE_-kn?AFCGIVO&-jOMy-^UJ zsRP23)e?xkGX<<`vIS0cEv|V3`ZoW7eovzSeY_4pTdDy~D*3cGa6joExSwbgaAz9> zTy0DLS^vO&rcuB>Q3r4ii51vu6gt)2-s4TZFZ&1ZPa6f`lXU>-phTIsRzr#YyMOTh zwNc=`ybkaj0_1Y0PZ--(y(xLmG2i~oT`0N*e}-?+6WO@~bwJx)t!D_@B=!x4HB~|8 zh&QMm{y}YRAgF6~fEum_6q diff --git a/en/.doctrees/pid-eaa-data-model.doctree b/en/.doctrees/pid-eaa-data-model.doctree index bcde354c2634d9553180619f50d79afc9aceee75..a636f5a74328f1a230dfea07dbbcdc8937eaae5d 100644 GIT binary patch literal 147672 zcmeFa33y}KRUq7*>Zb+a3Ch2OYWNWpp>Mgb`*|II!)-F{lswe5mTAr5D z<|Q;qhBbqd5K=G$BtsxpqGw)w{OEAZt#*uGm4IzLMG zeI211oN93ZLic+4u1=mCoZ-6Nb|v5I0tyK7iAu2p;0I5Z=CGq0qF-jy?m!z=>iFx4OLs2 z`ar$MXJ>6+o^OA-4c6h(C0n^$7tWlq*=*0{+jB3Rk;r!fzE$@+Nxl}pJv*R(iNpgG zTtKz*gFveC!$AB;;osx%?@9RgdLY%QQnOv>5LTS*dikmHm-WhTC_BnemoJo`**FCQ zTfA05IL^+_ z!T*!LI&*<$u25+g1U|Rh=J`gBbf|Of+H9x4i-fqeS1ESOmuxPtOpTMIubLijo^))H zl)5xK!3jXHGYU4qaRjdGgV(sc*9Rwh?aKARjCss(Fs@Oo6giQr2e-~#FTb^eR1L!d zgeYatXe~rJtGNnm=pMJmv7tmH5P%cLPTEY=f}|Acsx^tze|mP zCh4EnA^q^=*UPz=u9vy;+hkIgDXH()B=w#qsqaQPF+%FMA;a%+?M9`sYX@o60d}`n zy0EqRmH<)*SU=wDb}P1Bp<)B+Q*Tvlura!P0|bPv(y(3Y@trPblcW!K2x5b`b()Q) zt;j(GXj$aj9qd)-ZH;CF{^3@x^ed7m$Q<7cvUvGQE%7qAZxnNFX>nGQcx^4>@gOx6 z;w=e+ty|`8{61H234DhTj{|vIMB;VJm5xF>l(;rfBDOluHM+KL)0QU`vr81?&rn7_ zJBUno;OjD>zR?_^K-p??*?lTPogSR(a_wDS(cB58XB&KXuG8W{XNe!!f!7**p=&Skz(v3{&4%5XbIgib0M)c4{swn6E5!n~1Hh>I zU_O&o38+>g`JSC*ZWMao0h;Gw318fiph~_|7BQR}(Wj!@xjNtFKy-2wA^lVgsDV`Q z%sN>yG`L?PfW6&rq{Lm62YXtM;WOg*1D6 zd$Zgw?3&$Xf3^Y}rviF;4$M2QCv@jZ6%aRbAc>mrd9!_x6F(4y-QApQoaVS*x7=)l zHOO~hTeXU%A%dM0cI_OeqK*84LWV06+Z+!-5^)~WB@VmQ=nly_XI%=djv!xTj)sAT zs3LDAdxvgEr`@F@lKlNs^m_zm`dbYLm8kQ$Me4X`oztNX3^bNHZoAWvIyi=`PNuc7 za8QXlPgtW4O4sR7$4E>|yyG#Z4iWWJrw#%pQRhj^)S1%G@|f6J9^;(_)H#Nog@a1e zv00{$cUrvT9lNtUcCXRS0_x!RimaZJiucOYdA()o%ukCt!^&Njy0TRE*yqPk2fv>> zbrgku-Xe9p(~>(d&{*E_j*&Y!#?+~UgGxK=DP8LDjCn{ky4^cFHLXR48luoS**KIW zv)9gQF1dxI*F}&RDupC#XcCh{1W%&VmmPslQ4*`jx(o}YqIIKjc z3%YdD8h`8X2F$a11qlrX+!sQnW8#6`k|lHe9~*?b!<7EzLIDyK``{HHWtibHz4S>e}&hd$rl&?NzwrvhVSE zJ16X-2en-93=!c(bx-X%rGF{}kax-C6HDmM>7pAE(TyuyV0zXjI*Ap0yUiNh{;*pD zaOcX+m%v<%L}}{0D&V&B&1fS)8mj9I+x{V z!~s41LPbRj_EUuzvPhd842cHwx-=lJn%IhcJ*CoBc(W+0WU};qey&oaO1T7)KX#G* zI=p~4a(x~cr&AD`9b^wsPIiY&D`?0+$^Tly^N&zW)lS(-Hba7n4O)fIHJ?U5WIKx~rZ$n61zGoNN z)ZQ=X@bPK6fqE&`A1Ww%B^0eqC?R%97qJ*3wv92Wl=A}n1qgzarjsQ2Y^m96fEEYV zoKy3uormUJW0xlpKy!W9tYdaqhrL$a0o$w4)%s4s`uWMgkg$JN7yD<4rLq(aD;SUN z6=F#Pk5;*M-40>6oS-F@Zo{utm`Q&t*f=F@%ugX<@SH9N0mNWsdrKv3OdDH@@*h&V zx1lkj#)bZ^;3CIi9c3~JtLJsG@*q~xpx?IOb^4UGLFR9l3UC5T_tg}6u{-VQ{F^gSk(qZC2Dn=XqM!|VoTBWH$B~jvCO-6UtN z#8!ioVB1!T*9YgIyB)gQvAdmgw_^mqG9;9vb&Xj48{{W$)BsQ&WP)t|y&pV_#b zzB$Zr0C1oOhD zw(WMa4;rm)D>Vh7xd-9XHaK5`PU8fd0MAowa3-x) z7iNU9vAw7wOBKF2E79ha45GY1|INe#{a?5o@~WIxtyM2y{jcz)969U8RY`!?(I&?! zLfkahZUbG!sA=97f-_--YuIopAY_{EptFM`^_B7XL(6#F$>0IJe`j837HYX`y=Ir$ z0q?Zi{Jl255V8fidPO*}Mc|ZrM)he0wzBjg>=EA9EZLST?QR(wZDTCH`h!HH0+IJJ z)ADU-6zBF^+yRhHVk64Rjb1$u4MdJY2zz*f&IuI|9nzbs@=0a;p2lx-aJa6kz8<_z z1AHW4IJ(}A>*LcK}O+zXg5wSv21@2!1Y?_H315DGrXYz{WA*mLv3Zi-((r^djasL zCjz?OhVrT8WaG=8DbY!}gT0DAyT0o&Cr z;`*afy?bC=0<)uyempccFn-^58K2I~!gbyi+jEi;J9-8rk7?w$Gakix3U5!v0ntlh zce;s5{leAUMVO!K+V}=K5<3K#d%PO6Z)K!?cF_uN zP{bf=r}_cF44z$C>u#i;2Dg!S#}-F~pnmx#Wm0}6oA+B0uXAMKm}gfTQ`{FK?d5y_ z84+-;-2@DY+tW@W|KRFdbq>8K_M%1^u&lfXk^jX_jooIU+ZDx^FgQiusa1avFa^O= z{*J*JnK_HsH*Qt1KRfuut9=8@YC_zJ`cfQ4Fl$rY4}{PW!Gi;o2jaOCj$!b$QaQ-c z(`X1!c5M)ODBDuxZpjvEbh{Ww=Kq-;wpicgr16bIrP?9b=b4*W^cC)JGfFP+aM`{7&~B7F2+^9 zJZf`miF|s=1hO8rLcKIYKVdz`l^FlUcZyKS=ANr$Xl&{ ze_G{lp+2SRCsdyePKnx6GHj(kWeCohfPi{?Uk6QDZ|~#7hp;R35T;@x#h*)3Fz`fW z<0(apV`gp0f*PD8>Um_0t1&6)z_ua>9oQg#f!YF!MT+ceD#CDFFoOrqY+y**FjoSE ze~3JJ^|BbFIDBO+V7`{F>cBX9>!I0^-o=Q+QHV&m1l&VQ2gjVE6mvs+b=qWBH0hTS z4q-Lv-pjNK5*t4`h6z+hvWv*ICkJDDm^p=w9RvOF=<42>YS?Q|r+6JR-%aP>Sc-!P$|WXUv+tmt|v0jQNDI zR8aBdmdKamI+$R~Y6^$?$iU#9^=J}DgYV7`Zk-*bzZLTX9=}&5Ju<93I8Yu-4V$R2 zP}FlotP@|EbS}gIPmsU8j^w)%Pn1u0;KW$z<2?>Ux{6wajsur8LX#^>elao-hTcP3 zAad-OnaOpEIS4DCnXy5-xJsQhJ+59B$GI|VqYq_nfKHWT^1X_mZweV zme*2U{|=dpRb4W_T|M^AESvEn?^=<>kV-;V65mG6cu^jz_9I*m6ftIl-ddEo4xId? z7dar6K{V5-4N)%Rk#3iVm>87IczguY9<1YztqGCT81!{fcu*w#qhz8wNX^>p5N>oSnj{sX5kMWQm zpDD2Yi3V*h3~nO;4o-Bs5QKI+{1+cvT<6spTG1{48Jy}|_0#afP|V}a2E>?MAKW(@ zVRoI|z!jTyFov#I{~CrG+z!pV2Q5f|djh8&+zJ2X_gg}xQ0ZR(I`TE9afDy-@{VR4 z9Nfch9b!0s3IUWad?EWtRpw>24Jqy-E0PO`(y<{2AC(V=n&uC=m1x3UCdPoFmzl^Q z(ZZW0HxWEnM4z2XQi(URaBT{we|+m8SykjF6|J=*UudGOB}z8D_n`JA%mH2laA`p_ z6&PnAiQqz)-y>En5hfRHM7+(+D3azQuQCJ_Zocc}s5rcx;wM=(C%}$VdfZQXm=c3H zI1z(t))8m4!a9(%M3;4bEWm*uQ(Q(HQ9*D+k1txp8+uHxx(hE)4?x>oB#OPxweWUB zWET~GC~m1)a8V&wh{K6@Vg*hp^w3Eponkl}QKKcuV2crrifUAj&z*}l9)SZrCwf~c zgV8szX9urJ*k$A8q6t1=Zy_O*hs(;t^0(?0Db=>gTJl&GG&bqDQ+2&#=7-Tg-~VebvvYW|e%eO#ItDEF5GLFkwGc zKVVMv#c*SpIswbnfeabdC9+|R_ZAJ^dx11%L-(GYfMObWW)(aq8d)aFTPza=5@S@; zlM&^tLKKD(n0VUP4mXly-{==IHXX~@Kq8B3(<(OllCt`5Puy}#_3Pn3Xj-tLTF6b8 zOiaawYGE%uCH={)?|w(V6QA_>2cd_&ZA<8Rg> za0(=8kYu?=52Fna9vDtA105j9O0pqwYqw!gXbiE=kbo71X`buw^PXN?utVq+#K;$^ zpr+!s!($vfV=6S@`W=rroDDrt0vu|f7y<~Cr@!LqXKZjY1_=$ogO6%oyszqrvCR?1u-G{K_Z25n&35iFvszxI`~ z1oB1`DW<;K{SRSet&=7^Z7 zH^I&?Lf&tzeL~g`_xNpyxw2_~jjRRhQS81Pgpn9*+--x%Md(}nOn=0$7PK8B0U?MWYgh_{WG2>s6!} zLM<1<<;G0L9s4GbIO-0`PfYvikg5l zBWiItHZ0>YRfGgJYS7kzLIMyTDbd!rkqqs9r|{ryZ0gexj(edg8^W{2{Gge(gB7mxdBqI;*mmY*- zUYwkW8UShV(VH){T|AoaJ&_ygUv~fQwXg@CQx$2wY2Q2Ce{E*zz6armD zBhYr^xhae>3I`zwQf?Hn)8Jxks*6_9Lo{}Q!$A9Bqzh|ioSvES3 zVu&x}PLfuN!0f_TR-kU8R}JAiS1psKRRMmmi^ZaP@65~! z35X*(vNRF?MjTK?_)b+@1?}t5z$Dt=K%g>~C@k8`fXlm0^srbJnwOzFWRQZgFUX<2@X0Spj084f&Su*3* zwYE{RS1&_O7f8wCy(nL%L%P^mpDN7N_>3)PdhyCxY)Nn6ddl=H^JI=~I*Df<(!+;x zHJ)PDL~hYcYFH1fqP8m;?bm?ns-*nf~yX{FDQrKqb!R^CCOSGJU{`E6YxTc zV!Kauz4+-TkUvcpd|Fb@NuBP-Qcm?y3<4!Jr5qrs;lTT^2rMh*DEzFH z!w;=Vxe)OFM+qs61q8EyZ-A7mRf?KY?n?lxB;}xuBIW*(pl*x=m2!V)0$)}_tOJ$) z)zaBg6j9l3F+kdzV9 zU+~UT7O=-Uhb))hYl8SJMI%7b!PF`G|{~w;ys65y4KMX+HZRq0g@#8!@4w4nYiB%YXKtNpsg91ZqOZs`dcKSejF>H z7Wm&o7)vGabBe$}j=6`Gfn1PC_69&PLZ)ci!0@y4X|*jl=rHVWn%)^3##>Gm*i=5Y-RPnjFUW zlS&T7T>cy$- zNH|$p-r;L!TryUn>;NN4s|R$x1Vm?VbgD0oe00J31@QeiGrdGUeHzad*2hp^A|G`O z4LI^6_#Nq9%kak71t?Q9Z1~3517DfE+j0=XSy|l_tghWeFDj>INYk+fn28(XD2yc8 zotihsacE!??QIhXuuPo>w8JKPSwnm5jd5E+TITvLB zAcxA|GuqV5*+73HI2t@D9SwA7ptkORpDd2bx<9X2_d4B&4Rm^2=acPoysgvnV*{${ z+d6GO_Fp4Fta(mhWX*H@(3*Mv7U0F-CFmL}OJ<*%5{BPGMm>^&0D&)^US3n0J#t2o zX3$2FW{<%aCZ*X!(A0>ZMoqsfK&1yv^rBR{k2D=C&1U0e$Wjj(Q{c%Bb+fFeHZaTu zE$ypU3yl&4z(@{&HrY=Y-u}2@KZPWVge29w!K*GAs)O6 z!NEyH${7`evQQMKHs%vnD83a)>?LCwPj8LHdP32qa--|*Xq~VKJ)vlBNQv$`vdX1) zg7ZKQeW3_VjhJ}Y2|grJp|?e$$cYQC#P&}~D5`7qNSAv&5_B!_qA{~m3vn``SnXCch2nPttdfZbZIu1|T?BPwB&f^!LniQLckET5 z(g#iSqC56mNz<`HahqQ5#j)b94HB>`)|)6K;ejx^pP?FxEw;9m*jz!+180kgRv`$_ znO+a7EY0A{f;!g~O+FNxOB0W*5ccN?VXGg2*Aj|or4vhA{3L-x>GLb3kMUyAw|h7| z5w3U0SjeJPoZ6V%*oER?p?-#pXgs;Kh0+tP3)2^^=7yB$t|M9()S~sTfE@aw6`D>U zTA{Z^(fSwSa!*~fE`Zpi33lbUi6PMnz-oxre?ov*(Mn-tMJs-2O|<5L7e7nTwZMzU z%sv&-TH(5yqIKp@MYKX2Wj9}hFHG8-7oe#TKaJX(1)$O!O!T5V_B?4iR~|U@43715eipy1mi^?KHRDj+aTv1I1b>2(BN)} zxq8+nRZD~yxMWy6l;J!TfhxJUI@>TMED6pGVp-m&L-SR0@V&g_RE65$p_0^@4Y9pL zo)y(M^K@pweh2zX`9RhM4MGazokaC}mB7w6g_l320_=adypW(B+<_TZ+ECFAo+V4= z7zQrs@N6bn!Y9@&M7q(KF-kX9c8JSpytP?9Rs<>rG|*7PkF#3a6?%GXe)@XM+>m4R z*t}YgeGtf@ug9RNk=z+`M1bBF_1L$N#ZmUhU`j`X`SE%TfYs1rKZF3WdW^!z@*;j{ zO^@-wi{DJpWw(?eFB&uZRP-3!5^CzPPXesc5dqpL()14q>c&V=5%PN`@MU*w38?ft zCVJ5w`Msf-%ZvD-HT_ivUR);VTHr-vW}jStodLf;6pQF-Uu1p_ zfJ;>v}2Gcz80n-UTQ`dx~j6UJi&PIr^9p40H?NOUX~bf`BYFZf-`N z8jk=nH7gwlr@s>FYuJwy4pWKaDg1RvhRF?m}34B?}B>2ynGjI7nS)TgJr17;1^pEF2^xCS6VQ zsmURxyhVqd@&XE7c#sKMfc(dpFc(rU;weZf?giP)Nh)@PuiX@+TW3|#4hX9ev*OYm zkn}|rrgvARVZbpZ5as)6F;l!;a!?E-EvVDHL;bY_8>F1Cl;DtN3O0aWe$0h;IN_;M zS+O4;xf{0|>wsf;7v^TK%FmM?rnnRbC$~8tcqOmrB*gF>ff&G*QmU=vHPRl(uN(-9n87a?BFrZ{(oFkbSMqpA|7a1S~ zSQmN?&Da%seaD^B04%jxkPx?%?1dlaWkk{q>Gs#*8)Eoe*6eO3HtQUDV@#+a#b)6O zY3cJS0>kQa3LmS_@k49+yaC)7C8%29K4bQt{DgJ~NlCwN%dr^Hc6Le9?M%n;v%`k!Dxsoq#ES#Qe_sCC)@aaxR(>)?v2KP6(BRRq@oL$1PRBSfGrVObb372vLpyQ;d8`@UBTI*Jzhal$lg^x9)ruj*qf$+Cy^ znkZxcCo;A%L((`m1cNAVbw(f&Hsj64a%l^=^hd~0#$+XzfHo-|$L< zQsR_3!{o@L)KjU$&%j!OIMFo|FqU_zz?nIwrj8(K52C~7;m@9b=&J^ zX2{tDD$C}?hjN-~?(99Xn!9(Xy&_;<2aQbLYupP>jkp4=i=l^TZJ^#=CVEj>a+);N z(0CWv?3ONrvz79M5Q47lP=&M(x{+qphojL^y2{qUoC#X7!n6YfxF}-9)Es$(-DZPx zskkblBAl6d77CBxr_z#&0fFPohMXN4h=>h_X4N1-fi}+t_UQQ9;l7f@xl0Y3!Y&&o zNI(swHG((L{MKic{`jG_9oPdBu8^UO^${&jvP7D)#Yv#Z+7M0E6*#Ij=%PUy@bOE% zB%+)WKTyzV5p;|JqvWU)z>plOf~feRHFETU92GK@@vICv^aYYpArGYd^CqTZ3wdBK zk>&MgMM*Jk&ok^hXo$%JWiraW%xPeEx>-lN zSMT&%zo8&VEcXD(STKw?M=y#oVM)F#^mDK49x>`=IK0WHH&&MAo%%yUh ztIBy!Z^q#x^?fAWK&8mZXKJtN*7E_9jbIkOR@~%X%>(sMA@uBlnj*yRas1HQ9^Zpy z{Scvz@g8TkknwI~j1J?bG!udN?o+?1RwjZ|8t=2Je*^E=naBs+{hB!jdaCq|gGVus z`ZYVx!8(a`?PV`qN3~v$L9@9F*PelPHnE-Jt;2Rt!reOLX2&@{2I<*>vQm{Hr8WuX zv>%&+|8dokIEkKNdVsZ+D!fpXw(FQyvMKTRgei=dm*(LA0yJfF@V{*+c|!UHT7MN1 z`l=v ziQ_&2Rg%Q%;Euo+QwmLkUw|vZ^)So_9tu%`+QLg2-82m3vH*KQ!4#p=!E#E}$)MPF zBxOFmHV~`0lJabT1=LcKE+3#2wp4|FsJP>W*vd0d-pPj9ATC7U59RH}ZE>K4qTuhi z7dJ0^wtwv~nWe?ov6)^=#xP!MdWOg8@C=`xffc>EdV*L%bNuSb`$}9deW`_VfHl#v zEQ7SghW6FqGBU&PYAfsocUzdX3Z8lQ3SB7tD8{M7-4WRl3b!hyFYrtvZUJ46yD$Zg zbC~BioQ`;nR;PuRycQxRR@UO}>{{H2#3dU9|H%@U9CeKQksE0O6*|U^NL2Oq&qSSgNr*?W>O0HnNj?@)Wis`ztgWRlS(6wWF5RX?ZNkq&i8)R(jn#8oDD-4`0)LZw?XFue+e;Q{S6{gR=D}!!b;8%Qdr<-;|Zu_{*)+3j#BdgM62wR z%L#m+7c@m{1vyYGC3NpldqqIhppi+@x@&?CtStC?pkC2LFDeT-(sZn7y-KB}TCR#0 z^%!DD@98(2OK@Dj)~mp6zjy@?M{=7g3R~;K9qY2H<#OtnW>U!iwS@fadHIg3S4BW1 zp?(|wsq}d->0``~RHozbBQjl_)0j!wbsWGteia$Ycvfrc_==F}KMH7>mgzr^jbFVo z{f9+vxZyJWM5X9fT#)Eu1huFq$HDn1KTodyp9nE4!$l;laPPZ;dw-CiZh?D^CzxD@ z-!(JCqcadIscY3&{7YmtQFz}WHB>~vU&FU1rS|`00&{k^zX#~`XC`{l-TtSfsfN^M zZ=utVf{P9wJb+D1yg*CsHg_;<3vh+9jb1xr3^O`bi5IfnY(T*W33Vw}invY1n_~gP9re z5A322uei{G3gyU4#N`f7d!f1a3{m9c0~2PgK_QOHT+P28utTXa6t%zxcfy_eP#EVM zO^}khv7RFIgCWk2kV+9x*l73`-~mlaN+!MX>;}) zu<@(coE?ybSA|2|AQuIgv#NLBR?OKCA;hdXD35qnou=`Q;=i1(>m0$U>4!jUjme1Ea!YPaE?S% zpyrLZF8o`9>15Z1M;$|bT}a2c5!Z!J-Y1LT;p@WJ!&fGcZI44!BOmeT>V5!L_Yo7l zs9boEG}Sn^v0BZWLJ64g1{*M&>az$Dtwn?QhN>JI|imrV4shW6O&!kmJ%)^#Cg z9_1@0fM-$u4}fykL@x$qV?jYR!2KphrPqaYM@{RxkUgR>LD$vy0aTR1h7K<8hi^=B z)_YB$#*+Elfy@IFy(pRAMVgM?P`?Z5ZN>5h5T+w}GN_9|GolQ_&&Yw2M33PMbM$gI z#o}#>KYR3zT~?9jO)&YSXvB%=js1qmK~gV14W7$D=PP_$Q3%q|EbC zGLI?6k024n?>!okW#up8X1u3aZvGH(^AC{ejUlzh&HLK-vQV8uo!4cW7lt^r&i(8s z0X-@w9?`sZC1BBo!#mnPzz!z|MvaYhuoMt()F19@(-I?1n+)pv+TRm7OY!YrKA!tp zLVj_J$O%;*)VQ;Sq8RFQDvxOT`^EK;gN_xy|6d|D>_JIH&q95T?tyJ>Pu3uiZUf$za*yO1uW0iN_GWO!tq;YaT;3rd#> zstt1U#F)@dE4m+nAYYws*Nk<&ZqiCguImBOHO4a7jmRsT#n8@-89_ zZ_bDB8tCga#xWQGFi@ZkxpN=ToK@0WXGb7Xcxc@OHK@CAm5=}w`uq{mk(U5RvgSej zZdd|8ncsNlQm5>jNmF)Z{>u=JuzLC>TZnl}PZD8c9)4n9sn3VsnX(dn4J64 zbC^WOP7Jmeq<{qGTvn|D&Kj%%p&>(qQaJ+)dGF9S3R^VE3K`RyvV}ls4WnH?MrtaM z;dJ1PVahR_QHU+^{2dbcm7ec3ffFstAmj9e@!~0iQ?Qr z)bk{xs(w`|Vq>iNSQ+^}utCd&6O5V0V1s@eJQr>DAY0V|VR_u0w9*Gt|Bbf6CoNYm zhhkf9=lr}KDxWP0tukkK*)G7jW%i;i6ekZ<3Z** zPTm565AZ*5$I`6%bY&G=-DRCiMN-Qq_(kAoackH)ac9_h`>wsxwKv;#={vVw+!IPH z4v<*-5>|@#l=f7mEAA<&g}kSfXM&2w{wd^E)?$|#SS@Qr2DKtA~%LTpLfGs-iOK*MMM-G@4mT%O8jG)MzNA9L!I^uds zHqf1_MO6AXOrS|mB{G^%j$r|1bh-cxboWZoQ4W#dyPIJgWsG+m0Ydjt*iQBjh*0Z` z1YCMnlKmeb$#w`A7&FWkw1KA5owuC9Ai`u$z?29ybAmb@fL%;fAeVg_Jg!Qepl(Pr z8pv);gjY9r0_GwZn>*pP7{}_zl)xP}UBc)WG8O-$iFKnH621q?^2YKBnI0QIG#p%! z6@x28cbvLbEk?Vd6HkoPB{GcbLhY@5uM3x0dzEgPh%hC*Rq^c+deYQV8gUmNB?wfR zGd09rNFYdjJCalA6DAO+r(c|cNRCaFINM?I{#Lqcl})i9Pcq z@0cJSOY)Ba$y+9RQIgk5Q;jPtc5^)>K2h=a+HH6VVhdK<@L&V4b0qzv-#}Ia?>B)q zi_1>~F5fV9T&}|9e2Z_OEzxW=@Cwe~gsdyhSyh5^ul$Jm(%js*3u=fxCrRKWM=7Dn z&?D&|05tII0J8Rt=BB6og3g8?!p@w5a8VNpmWbE8Pu2X-%plM`PGx_AezS>oyy;Xq%UeHKQitb3=bts>9< z92%H37XH)({w&r06Hx6lCVEkM_J^eDSb6sFkUS$KU<8^$3t6Jwc5Xc4EH*y_*xU-e zjJ7BmOxCb@StQ!yfX0y}+LPG%)hp2+B}+Jci3aXaRqa>e4mB^e7}w|=LdZ%i5olw9 z!gA}+0=GUyP&Fm7#Jy)c!Q>JP4BmXD-7Q0CjP@Jh6!Mm+YER286={`$uT4s;gbCbP zihTko7B$g}?(Z$qbgZ;`ohYrK$N>qTSw{3F!%Oo!Swi(pAj@L#bAUm6>KME%66!sG z#*rn|H(=*iuY?+qB|H`hwV+&-P9mW`gb=b4N(9GZPOMtMZT(guT0!TBc@mG++L@{*_+gy=VzXokg%Bo*7K?Rm}{~2ia3nqF|S@me%1sPSICx)VoK|H%Zr^wQ@`1W04vXHok_K}M9|Ujm#TG|`K} zSzk&R#Y!M~Mb6RhuQKp;Hx=uCdC!Q;0`E=5uuZ6#yCkKeXPp@8^3~&f7^V~3dvsnI ztkFe><((gPaF_#@G6On1)^V_tM;^$CJ0u6lQGo=9$n^8sd(`fdAmLP%>OPKq_MTy9 zihIbJ0&AvO>p%gFLo;B9pqEiGM@n;PKktD`DirwF7x%@>@N`zJ#Xu`#NRAGzuVfSdcL9=dl97e~*8u+CvI@U3fhJcF;Ejjie9#Uw z_+LXsd=X%#D&kI6TV;d)y$Mp#)5G7Iz@MesuLIRSXQCHX691Dl9jhdMR1}l4%*O`` zYGDf^9$zA$3TSXpA_3GwixdGBtCZ3Q5@2ya-EdVo!HR9ZUhDBXm8y+8#mBDZwD&k*$*cA>q_YiIdHe_hVB5Huy z8_m%|nfD1Yudz6wAx8+JI@+xKC|r#`4*yhzc395)FTi=PBfX3#u*P{>LWS-wt*>Nx z^Q;L}S@?eg;9s-~zXf??+?0kHi=hzuO|`;||8I>*3&SvDDR4{5PozvYcrC^hihiDv zI70l6K6JGdI*37fV?zfY!O+1-vte%#A%Stl0kQUQN764wP2_d&m{@ljPS}E`Y&hX> z4u=zZLk%`8P|QftVBn-Rl2Q0^n8{Oo5exhCh`nW8-f03CmWO{EcvwOUaQVrTN<>!r zet28;wln9&2vE7A==n>wx1E7m?cC06h0rSZUA4MC&~KHUnKpYg?xAvlX_zd z%>1l0kdl?cHsJ}N&|{<7*Xg3ftY z^_SqkgWE8R#`Ws2!0#`SGx<-zZ%Xj~@3P8DeJL|=V;nz(e?b!KR#4X6 z^j8Ot8|b}6lK~E+l3Pl$6OPnZM)KRoAc=PatkV5^77w-39ekcBDpYUhFP-lf-XxZ; z6h+#3PS}M{qcN}3ML(&bx;S54o?qDATqxAs@n9viR9cA4=N4jX{cANxcqJ1K>=c@- zt3oZYw6sV2i8{Jah6fJkZIY5b9|@GB#Xz)`X$Wf>ci5W}im7-i>*5mSx@~rLmP*$1 z{K0xTzgnnlRn}vP!;mvl33WpCZY%2#&8ypmYU`O|J$sN}^)`1BPG>9_+Kae?*ODpc zGHHi;=87y)|CJ&ybJ7ov;UtUOG8Q2Tpm>E=lOlu z6vH2Oy5K)BgTowcNroykN-&gY6rQi{)#N{5np*b&{)BC|MEM;)gVb;MS*IeB0*$Tn z4gACzhYCIc+aJHC(>9vhoqxr?&H%awHgYXBvKAw_5RYm3}$3nM|y^m-hEo zR}XW(#a=YXT?+>S9hJpF0G90CZ6eKB7Y0NTaU$6)+v>Rvnwyt#ACmu_-&(CNv=7p| zU2pmjD(pNSaRJgP!*-}>|dusyAp8%k5nvQ_ExL$1@ zE|;49aHPNEUMmUp?bLy1%jsKf?RVy#!PHtc%jXloW&wE-V9A!7;ni9<lAleTsP=ftuu7<2RB#YlB2sCi3S_Hjm>0oCs}AN1uG73 zdp^3JNZZ@R{AMvw;;DQUX}O-rb>iHbzp)#0yV7%K~JVLu#ByTYM;Zq*m|ZS(8NYwd7BVNd|_Fj?F! z7wUc?oJ04QwhB*S*hkb9v6Q{}~fJMV) z`(HBtE%uTz`;9S}jhOvmml5!<^W!UMsJ0@xz93H&0TFK`PKjSCe)&(4$(aDOf!PEE ze_{e~dYgpPkY~iVUK*ZTaRHBY^oKn|h>s1xdp@?dgxbfp#&yb<;10)vRYEUvn3#p? zEf0%VY)H&|*ufRVUIUGWFInb}GB-@}CJPWN5S%6u7~h7_>lOso(sfIC9#`R?$ch@z zKx5{<1Wg%lHzX5aq6X7`NGq~Z=@f(}7LU3FZ`e}@p@XPneNCH!>-2i?0VAT*}u=yS(LmDj^PlBgIn!3=nZ-)9d}vDuBAW*NCOO z_;)XVK%f8!ie-RqK9i2N@-A|MM!}Ik1{~d>fk7l&m#DDq=PdSAFxj(; zi4}Wj0X6YcFoRJX9NLejHSukriQ(yc7km^Qw3jZQcdc&vJ+98iPM`OeR!i-JNHpRD zHv@RlXf;mw{qo!BJt|S1=SND@VRPjMRlakToP~Oqrs8PIWvR8>QL#63p{l+Ul`s29 zKoz>+;KuKzmtMMZ1v(ObW=y~IiJPQB(h$m^DmZTj;WJbMz4i>lBd#?^AaMUQa5StX zQ;~$P5q1^h@tUx{6-Z|DjfiI_>02h=ibfJ#0YPULPW03P;o;ZHpd7(lfxqy6C;4DA z4ZpALcGaJe-?7cwZY8~=wa~8&kPMEK?_IM5my(s(yW>V#3ePc?Q-c5PMl0;LH7kWwW)~0xBlHUx%JJgJun}tE_B0o&Ra=tujZREZ@1o0 z5-UWJ!)TL)$=d`S8{@?Z$27JeyoA6k^Fd9m%jYe_E^(aGa$jY+pEtkU2)H%jw1dm- zB;AfIob=htNH-I)sHdCHNxE6}B*joUUlEs#Dfpn7XA?G*c1BI!1evLN#>qz1vj~Ac zEk@OIY-06nArMhhJ^vd(WUPArDv`9q>e>3-sGcqKQg*=Cn^+nuXc1UzJ0O9p@D9?= z)DCzFni{L;^sstf7h>@;mvlM2iIjIUv9`RGSWRwaQ{GT^wHy^gF0v5dAawYoua`+V z#h?gby-(D0!5wLZ1kE^v!ST*zprHRFSrb-9Qn$m=k(I?sgurOLs+4aK zoe>4Ch2x!22ZC7-;Og7yC(6vfV0C6IawCZx``rX!W8A2tU_8ezvFel$EoM`7-%ev= zyA|2yBYb16Sl&UUtP;ogr}#opM@J9oed~i7E9uV=60;0APmcMPp_kas1t)%sos}j3 z3-e2kpj#7C8C>#DPqyUxEM}ypiFnjg)AB8Y{5I53NuPdSs5NzT-=U`BPVdbF>jv;9*T*H~@8n-H31M<1%~BjF(N zq4!ArmF52?^UIG2SQB6zF8{kGTYi0ZGg96}bm}SZhov(%o43JGga3rMdW;6wOT7$x zO*hH%&zPV$)#W(lh%Oi5&?m~ME-y^1%Pl+>)YRpl1VqN_@;?v>Jgm#D&yBj=LN8@2 z{E3OBp|Ti(wYC*_T!r5w-AqZs-+`vay8Np~bop|uvD*!=)STc4KPUvFj(9a1jVFBj ziJBBKu-wU{B0}2btEXL}UdKbY7%_0LE&r3Si2!BIn*05JpuQPlaTjaS(=pb#6#iNo^VWcJVjD%>6 zYz-~ko`7IYgJqJSe?-5L0$OMxn7Cf zim0Tr6hNtyrBKJvNgT^e8itKcS&T1`#b6oRZV69`i=Qz~8)f!?HqQzO=m^VdLH{_I zF8XwrpnX`kjRM`-Crn57h|pPK)DAN0=O$xR{rQXx7osrq3>S}>pRb;;H25MWR>2)c zA~cI@(Y?Z9v%l$HZe`b&5AyD8E4!LJ*sLc#5OT1WUrqEd?*bxLa3?F^!TZf5Sab+u6J|vSuU#<~tVPDAS(A#Pxosf26 zK2i@mGl$FN$V#o7sU|#IF^4037_4ok*2~#=p&PCSyy1B0AQKma%;9u-bySP?E z+Qkx%04|oZ;KD=}>xW#bfPeQ8&u}tY-b_b=p{TLkG}03kf)Aii-gJEaRLI>3P7VV0}}_ocq9>&O?G*BP$f@LY+%R z%EeWopRW)+O9dAs>pYH9#T@mnzgd7-AXBj>!5;H@WI9n%|pDVCsuFu`PzCN_%;%6WTRn6xt?Ej z?j+qcNBl70jk=dTg~QB#R49fxp(SL5gmY^}2qHap>b^+S)paBfg9n+q&<47>w*uLD zFkJoF#GWIST3^oBqX&^%FjR0w8wI%Ki`F8oEW%uiti}Vyc?j2WL>=B(wC-)>Yp`ZQ zFa=3ZmZSCBUL+lIC2Fl?%I`eLuC9l(fn+_KCOoo{O!^L!tHIEY%iBmCh7VGH$6hAY z3PFOD{mn#qB_4>h3&9;HBx!79T-hi%755|6GG=0_z#QwF$?$$Yxw9X0m+OW2dVed> z^g=|an};osT3L_8fTyE}LS!qsEX0KDexc^9?%)k&qm|087MmHDb0r^erjoAxWY$qU z1UkhzM`VX{Btxlc)VY=NrMYS_o(~BAJnZo>1_MLp6If5+3*evBegpZg077mvj;Tb~ zeY2^?tG@Yz0z1c+}e-iQaPvF*$!RUUE`NpQGdO&wXk1XOVtydYS+C`+&Trz7jz&aJh5-Mw^n zhx7aWi~H?J*~69gqP}=#W#=&7_POc{LhqozQmP*&ch~%o1~;^jTrOX$N3Ug*nVo}` z^0oQEdcGU&hB_I(A#mPEY-72aTns=QH(&61`s+(;*~np!_i>TL4xi?DuQ%zfd$)Xh zo6S^tH|gpNp8cfPZ;yC8-o#kiNPcn5A$chIc=eYdHNRe_{_s9~epdVmgGaDl5K|7v zPVP;;d(=_`Bz$Rs8wtfXLp-@s7|WNRZem(D_MKw4DBSf zxK6>LD7Om*Px*F*v#s**lM{GSdZ=lOL6&@_6puIt6A5v=5FRTE&Z?mQjy?_0}yK1%INFMH*Fzw5k}<%0xv|8x9nb zScDAABVl)ojMoU#rCmeHbPf z%4Sx!xze@Na$qMBNxF8ng5foYG;LPO{`kh)UU)U#$S!l;%vOHayRaYIg1SEWet9d` z35M(LnkU-tqzi3#IM}Q%l{ZU!y>2g8-SE{GBEF4it{y3PL#@izK{>mZ>m=&I`4|VD z_fBlP<#BDSI34BfaLSQckFSI?`^&|(b~wn#!fTmOIOAz9FULLZT#oa44?~-woWBvO zd0Zan-d2CLPwOm^;*(4%s5PDwy5&#_u4|f*`N39$20krS}IuZ zcyh^Vig&ntYmF;)`$?`>Uk*C9gnHv(Kit_nD8bG6e!HAe z&sNN)s@E3k>#S^UyBRhr8ay7RT_Us&~oYPGqYNqbnO(A+yh+<(LEHFr` z1&THHM$2B0)Wy0fME~UqQQ7YO@O16oA04uLnPchfut(Uiz?E1&3jEhryUDoy*cjYK z4}zaE0^eGRtDh&6vkw={mbm&=6M)kv3pmZllLc{Z<``DEd< zfXLV<3x6&Wb@<7G^||rMf`wj6?Cal{SQ;8kj=)-bvhYW^3V%wvnF`YW3^Zk~VMa<^ zrC;GCt_rKs9!*Pq2!*B&G9-i$>SEQQUY08esjFLJD4rl@ej@KCAl_;>BtUGW3u5$0 zEMH(Z>PkZVA_lJ}b|G%FlV4rjOLSD;3t&&${0KK|bH_3g>~>`R^0zU`{6XqV6rgRc>Cerm%aKF z6J0=*@7Ov%W5Wo=Bi$g-ZmU+D%f7Ziwe4p|?K0K^1}Yy~lum5b#$*f7mFU23IFeNfVn? z!h3o0!4!Nyb`1DJhAtLKvEZKxX(FNMJyL%Kt6#T@l@+z}XQ)=*MVQ~%bfs^HwbY9K zd`3?)$$?lEZ^yWktX8P_e+i9PkBpTH6`wOfW9pT`sYbjq;{5uA7!l>P67riNab zL3AXM#P~X1Iu$CIatKW2&|{m$;0(S%)`3;*pbSiv$uff=Fv#-cgDHITB7xU!ruk+#XS8m`DphP9WR$W}D?+~tmd=>QmfjT&h9I>fjy4ahKh%n_ z*jHI@-u!YS;MSJ=f8laxCR=WOGiGb46l5)l+Re-T!#-*MQI_*K~qtFKOi#p`r-#f(hgr=Sf3jerG;L~4)`$>OG5=7 z0&8st{BK-^?<3tz3B2!yrpAggHmoSk6eiNH6~UGzU^V5jO=F-c|2tU;R#mQ|s+<;z zz$5-CjHd9;?-PiPSC;Y)B4>?v{uX)XH%K?*8K|-x&pSg^8}y44sRX0dstwi$HCC5j z&|nHuwc&^p0S`dc2CJQwCI4shOOBvhTk44aqF3z%Q$K#GJy23NLjCi-Z4Jgil%&y8BuLN8@2{F#ZRp^^}RwYC*b;41t9>1Ik2 z{ysD{)~cg*3dYy-X}m1;6J9R34D|KM^P~3yW@{_y5>c|I&DB=Y8Ajp9y9tcO+(P*g z(Gf+3DgnM0jxTThgeR?HWJS*1hCA$5LI`7;QCnmD4jZbUpkL?cxa%hz)65$7ii&-n zCyT|Jw4{E*QK6Bx2h>kE+7Qat2$*LiL}O%YXyG=^`Uxqk@L6H>+mX?I1g#@8y8e7d zRuxfVDpP{F^On8&s-)V6-uyj6B=*wVTK$B#n;Qx;xG zY8q1?07S+bQ~yCE?XWRreQq?SEc8-#=y#h~8mhbySZl`A-M9+hO1hca0sjt~8XHri z#S2UnKsxUF2{!-)0~6^N$O^LZ-*ky7J<>=zz+{Oj?O_xy`*i}NF%M8KLv%*;fEJF& zQ9t3+R^hZFlkUOY@CkyRF(s(sGk!M=)lbkb9HkQVQ>mXYrI|Dg8&&;;FOkJy8JpBk zFg?4(#ZW)NWFLiPPdtSu595WREQ^4Su&fsJ)2pBGfK}+MFzQ)k)GtiNsQU9687@R& z=ov0ASgD_&PDYgHArX=M7Ie~KLUTaBc`dztu-cQX}&9QU0 z1uiO?RKg88+MzOa-~cLEd$XzVL5Aer7s^F{Xg(ZIIKt2`jD;=ydljgMum^8xhHESw z79szAF+Ef_LKjD$+#YhqSM&8uWvkJFL^H*wTyr(JLG#-Kj(*%|Z72XakCKxTC35D$+~4%iG06LC6NWk$9~b3Li#F zg?P492&}J%gXMBESaT;?3CMv{j+-D0xlimtA&!IC?QP-`RMinw+XVJ{T>;8Ka`P9~MzPde6v ziDYssSzV9D9oa~1C7DXB`dVBdl88CV?s%e@$qOw%)P=~#UF(fVyy!_dd|0OdYDAP_ zE~ssgavTC(V#P)zlW~U*?G=u{{>45#6m}HiMR@0%aYfe338+~S;GD(P%;AnB z?aW?Fx)OWgDy~T|lT9Yq^Q*r7WWwXXIug-@cPoDw-skGs`DkOwlZvkgl84K&%~WRF4z%?{k3AP*pCIAz&GoA#dyFG#X1r-kRr86ATAW0$+ci2>+pqu_Z&qbTP~)Y z{%Cc18|rZM_;fi^a2LH<>3~ zT~Nm)5=rd`H&fAmH0bm0G?q7G^GR zuPwCqBRiW3??PiY>25A24>vZ;!CHQ!?#%6Vm%M3suf1G4bX;5Y*F)R$-Rw@!cd*n? zA2{b-<#|XN6x<3$4%V8RixqD@vK@@C1v8GuawdL|todVw(z4&>FZ4Z?g=lPPGvCU$ z`jt2o3ra2@22ZRH&s zwNfJH?)dAm+Qyc5FI;!VcrLcEzv-=1wquQ@a6H@=>KlRiYlXcfDCd*5mm~b@VWY6O zTwPm=#Z!4#ugD#2Ec!XYz873wNwuS?)obp0!qG1E_QRoIt=jkO7AuQ8)TX^@E*KVu z&{d^3&4p0?rnzv_T)1g2Ojs`Krnzv_TzEB@3$nYyKgL}#l%CeOy2Uxxlc9Kf29I5{ z^Bgz6zQyAgt~~<{wQD$FAq*2GE=b7;)!Zj4MVC@S14kH~>J;tOy)JzE`YYG*o`{yq z`1osvt{OHTuYUZ*Ew^l75sI-@GfszBw)}Sg@>W!GF{(b1DbA0fID$i~VdSAHbMp~? z^fklPFiu^LZ>?-WJr1!ZhxDgBUB|?9tUu~;Tt#W>|G&FykFldF<9%)0ZFjfrmKF-M zUAs`W(0g}Fw@+FqN(yDARcdHb#LMj5xqIgBeKC*jR#OxSa27@|I7AGJG@w942r3kd z0mDNuXoLh54KV^igJ=nehyjD&@0)w?KJMktVLJPVZqi@RJ@?Gx_kG{_oo~*anKSmM z9j`f`F6s%rzi5rxb9`m3dumL|97f&K0RlCGzIBJTFy0W{~P|QEBpg~7e~cTuX%u1uyDu; z^nq9#wxi`s^kHsr$P^uCkUq{Se{`)JeQI@zda7U32l1`#X9s6anc}r)ibbbTbc`|I z^iB0zZ9{hoZay`P^=N&nX|o;6EYTVl`8;v6X@4gKHS{(Du1O7>3>2T!@ zsue9X_gb`^RLTI(X)bwj~ z`sf(mal&y*_U7(xs!#L}^F(eY3r#6qfl^wRctt zr0fy}y+7j3xAzzD`<*ZcM2`MZ2+znB5&124UZZ|?nM>W;CPOXc&%wu3uBg-6H*DIa zv^oHt5BWamZe(RPA#FYAmgo>|basyEko^N07@+_v>SiHBVNlV9b|{7I_D^VM<`KVG zyn#F83|1rxn|!~KrXIYXPC*!kLkC%;Q>($0k=M*zN=v6{tq2H+^cG;xaJg;dGJ&Lx zc+-u-KA+x2=*H=wSXSLHo#WE1%UGbdjWd@1AsKZ0bB;S0&qFtdcbvnTL3o$ z?gD%dz&Qb@0oNltxDIe=I>Ao>=guHF2XGK@E8uTf`0aJTJ8cASF;F_ezRc>hIC}O{ z!0!RS1?OrUztO205E$lK@;F1zypAE3xNjs1K@W6r+O0Y3-qrdNYzKLgkU zlY9pjik^@3=Fh~xBk?dRKSK>k*m+XAWj+g9o z$qtw7Y_be_Rghb>S5|I~4L|zl`iMLrn#D{@=w4gt-d@MnU{zk6Tb;`M3)umX8NeV)=LsC6$lJX%+DM*S| z6_@)^YJsG*0a#`(uFA}FD6z~8LTgxNehRH&nfVt=EHj^k);t4v5^(1Nf`b5-p1(tX zSbAQ9{&Yg3mI7FWzK;@%(4$bI^@|C50Cxfo0$7+Xt_ss(lvtQbP%#!J+%&?%#MiT~ z*E%+%!l>)D>L%r7$Ps8H4r-7)SK0-+#Mqjk9c37lf#v&)xoVQeO^=ySS#8}sZja5C zqw+@W?lg6(-9?mJJp+kagOrt9Xq%0!lmSxxd2MWak1Yw z3$r=PXvZ|AQZp0Mw}d8hmeZHP^?iMluNpPENf#h>OdiZ-jT-Y~Y*97SS?Xrm5@sf- zS*@9}n`pcGMp`$qnrcon(L|h{35Om3o@^wYWy5yQM5qK1Ps2Xvvx)Jw; z84RkxZIW;F~kk*zjD8!K3CYqVHPu1TIgCf<&6FV&d)y1Mng z7G^yR!I7=kL>ntuZ-;{Qf+2)1w+l3^bqawG znf;qPxbXzV3uGKwMvk- z0@-a1$dX5CCH3;OJd*v!lzY@EC*q=fLIldE)l$w4B(xBRp0CdC+_>1C7=c}*=&j7S zQ>N0`m1%XdT3lqS7YQFji&V(2O|EH7_HuQyUy6(DvdQsmqBo4}&FW-tii_;>Nh2E) z#y?UgdtY2+J0^|ny2fGrD|NEJjEn3iCXMX+#$^AjPWIKf$gY?qvNTW8nCz65%DKdU z;v(A_f$Wyrfwhtuc9w^p#JXgt9v`nx_gHEgOX_seB+?BLsa|!uYvQ7Nas;{?6}%hL zYj>(s?Td@*$_P{y(u%}}uwEY60G29q|VLb<$#nQfz>%=YU^ftvsZ&L(%bsQMPXJVh;xCdUO&Tw~J z3^zw$xW2Xr($iEn-NeX0a2mt9XiT)EPBb4E(K8|tJ++o-R!k=q)9T%8*$=uxwd4eQoyYV5s7)CoQu7r`?l5UeAjoUMh3=!@#~UWkj{ zSrO><*7m&0D5xidW`+!fZ>!UMGcKCjBG9Ze^Hh6NQ-Yq*ZXC2NtCVw_W@>sAxlQmW zYWaTc?GYHSt92|GXXy#qgfKL^Nv1K?mFiSGW2AZ@0@XwOV literal 145489 zcmeFa34mkQRUm4+-K*`k+e^o5tdtYGU2auLDyf#Xb~Dc(bZ&tb`LZAuntbix8vJ+`+qVQ!8lwZ8 z%-5?-|MKz9qx3uB%;wdxv9W8L*)yMd>-WH)@Bh?Wf8d~e^4dZ9bm#Uszl*c>Y5k1{ z2vz4qg98v+2jx4Z9M?I+wOUOf*KPp{2=XzZAOU!tlX;PoB={2keZ0n1<$s+jv>V!o z9GBl}@Wsj* z(l{bpuhGA<1->ZMgqBdRNn=f^bT!fApHudos(KZ3rJY6>DsE)2kJdG zHs*SBuK8vc@Zr)WSGiRc&zy0&T+ij2SDG&tvfCarpBpAk~Rty;)WmMPYSoz8FF~Is6S*`%HHN-4m=JQ)_Az!b(*(FrD5)U|zjg7SPb%cL}=*)dK8 zf}PQ@0f{4U9dvH<1r9pL+D+l0Gio0*9E__KgaRi^b?4U6gYp|Cq-q2h5T=wpW5kGZ z#*hm{c#XNxu4$0>8sGYeKE$25lsPxVwcGEN#9ag4O}i zkGESb!Br9k7igbqLvX>uXz?{r5H6wSy58oc7Uxp554R6$gLg^wTHRIPpaHZj@J$JO zRe4vfUV}fll!a|UQ3V@EH-oBPzQIVnbnflN+*n(jGbCQqhkYmp6vk?NYg}sZ zV6)^e+#qW;KHqW|d5|KIntILc&3eXUD}ZKNQGcCNb)k^Qb^sVPAIx{EDFM?;G~cs> z%#BL#hr#kZq~MDy5=_aDs49ljBl<+_O18?kI8dG3KuABa4%9#@_{Y4g8tUAy5WwAR zz*3ec(-A}c{fTBn1xDjy`NN&X0Vu)%rcmc$Q|go$>V#D8W`i|wKK6!1qscBBJ*?75 zCs5$E!IU~msjZ&ST4mK%RFH;8ugL?2UXPg4tBmwoS#;0NYNXlO*%{+Xuxd*6?J)rs zjsSLf9NasuEw;vs0;rpD&_s3kzTVu+%3p|LsgzZn(=69+mFrFL26+jVRijYsBG_@U zqf;Gz`>56?G}OCAu8FZl8`w z>hDj`-w~MMFEt!gq0VCtsWUO=9S(J1puW_ZaCOAh4Izw7nej6*xZ@sdBI!Cawa8QLhF2~df3`=$beOH#> z9k5ziKpp&D)73*V@d1@OuX0SC$zf5a+qkP*SJldX_hcXH;O|4Hj%LtD98xDREWHB* z^_87KAH9QP44pbSsIs!2Fr^O9xQEoDy8~lGvsz@RE()DjokK-42i&aXQd=l?T?UDv zQdseZ25~uL@Dw_|`Ve#)l7>b=y1gHj3hFvTI_do%wFN^bR!(eEf9~CVwsb!87OAOw6t>kF8|Kd>$`s zjssI;9`BgPGc|#K2cwH!Bs$K+DWRlWS?U+sQo5=*I!6JHqI||o2@^xYET?qwR1D6y znsE5eH^&6NRUE4~OXF~`HIAnZ^rJ=qb(IW0v4ZZnDY{V^-MA(Nwr8zlkXXaFRo{ZsA9hIqZY>?R=|>G!)u|n9 zQUy(qDVmh4!9$?Qa+R;;n|lpBYUxFlXHmtE8mfbGRX4GMuGbXZ%Q9Cl4~*^>zt@ZB z7K^T$ogu*=?k#b z4OuB}IM(GM0V~hDi%m$3+Nn3Ux(INZ7$rB?Eb8!QzSPiF^eVn-P?RqC<wIr#{AuUV}%g@LI`nU6fjuz~<8ZlIr zHaHjx4JJ)#KteU^3-0BV&Q{^cqH2-}>$mxFp+Jpt5i)<=viM27h$nK}JP3}I7wZy= z2N)-}$7hr@a6&5JuR0oN-)Q)+DZ(&3FcdmWnbLt+GDQ}2y1*6>NTy&7+!?T6l9>>k zR)nCT!=L$5Bf-2vf+Kp?aS+XMy_~vvXwKD2JjnnW z-}a4p#=33TJ^BvVUWcyHZyMIG9SjTw`)5tDf0lSEv$2SVaqn6oo;1j4g=<#bkcP{N zMq251{8@*Y@>#>it6*b)3I&7bOfd)|1`AhKb;`!Jv!xmTE~9%pIwN{q=w}TVH4p1B zlPOre))Xs0VigO`yQTu(8I3n6{LNzC%@;5`hHUlV<2d}mc3nuE!j|NFEs}=ckud=| z4Vfnu#`GCqf%|z=xP1us>TDvuq*I0FqfSowyP-Zon8Ij0^&3YJld%6%G0FTAOHd^osSvJn9K1K7aL_pq-QCdLjosa(yBl-VmC1wJuP92mWF~pbjD=vARj}yU};@51@W}W+NH#BoY23Jp|OHY?n{q-r)jd z$sdP|F_G8()Op}acwzj)+S9?=S=Ryp?}{MqGTP_NepRwAD?fMJEw>mYUMd6v{3|~T zZOZ2>AHu&NZ@v6f<)`qUPhUPs;5`lZ54cj3Yn1h1eQz9+Pp?1%E~J)*iFa5O@8kLp>q@h}4LZB&D%M4@z5@xuF4#eV*5*W)2p2G1;B~ve z8L#6%@uzkZerd>a$;qpz?jWzT1vA3f*j_dQMS(AjDYSVhgQzm-w`?%zKO#F+uAJ8K zs-3I+Cj6-8hE5bLn0JL?*CTK>7qSA9g6Rr6*Ev*Q6^}o0 zjK>`e9w7U7Z$hIux7*$(>9su1t80hDEmYV_e%Nq0s z?NtO;93ueND=JHaA@H~z-M}p5&MU3E5CXs=@7GMlJMS28xGho1I>nn;?>zLlQ72@@ zchI@jjV@E=|3y8aS|rpie?wG;`As|Q^;bQ;6rZEZj-`umYZFZwM(7k<1-=Aao5Wi` zVDa<$db5C@1NZ~r3b-~`NpOp5_12zi7Tk^|Myk-=zzlWQRlFQB1_xHxT+b=abnh;Q zTo+MqhxoPdAl$B$2gEpl+dDz_SI=)|FT(s>%f;6)R3;H%aspgt1K7X{A#7-90Zih` z$X-sX*#?89h7&KkN^ollI)KwddhqBUA?$Pn*(w26jbpWo`bFt|15Z8rFd-Y^{R0iB=HGx3l@^q8jHaOhXZRsz{y{JWsL z!JSW_K9KjFunmLDgX~6*?nuM9yK92lL;aQ_Cn&CPO==O%i~F)jVm*%64S`{()W|MG zjZwPlO;>ecb>1~Uw;F?Mov^!=?_-a-VD>#%WOhTj*9gjM&voH?8|(pY@}Aaha4v%K zCEI4ajE_TNQwZ0?MfrM7$YV>qN=ic3>gMoYD|)Il{1V8%GY|W`g*1G%TN+-%rkI8f zS|GnoJ})!`5DOxqTebQQv9EX%iZYXTt&?gGl53|7XMFU(*pbL0-Yk~DOxLTLnH;rG z2+c+Mn**0GQ;yP$Z0e8%t64zP6*NxE||GFtR72&@&_wVEq-1^YqOm^_qT(IRPD{E~)r zsXGnc^ve!zm49Cbxp8JU;4-$}i}-0>)QCpLDj(5(*Eu2Ef5kmlKB^F$zP&#LG-iDQ znzAwL$GW$YSLjw!Cq%$Y*l_Vs69EIvNj1^IHLoT*xON2CH!ZKPMqLmX6zd#BusI1> z58-Znk$VGYb*J$U!H*m!-c&Bdq}tAo))e%4YcAO=p{3`D zCMR({W&eulmZ1LIk`iZ=cfLEqSsViaK&}ZH+Ce;4owT})*)C3hhPMnE<-~q3Q;%b zB9vi*noBZbRaceU!yUf5QsID(E*M!gBCENBj-=QlNF zc?KP9d3sG>{0OjK%2kT+ml{s8r@THudfHN6I0;c+kQ8yFX+I29fAtWk&Qekzp3~is zmv8CZ2}g=}9GKk&DbU*+k5jRbRW#Txp++jJY8fb%KLu=Q?#P2?a;Cxd2?N?(=-f^K z>>QI?kT7=={)<;14tRaNR6IiXI8JrG^2hL(rJBc67|4e^=-k_z4R=6J3k&rsI70`O zzk#7TC!u+3uL0#~kKwePJK(?kZbKCELhIn2--`Mq2-`bCz8?#BuyX1W-Mk zhFTyMRhIQWq`ZopXf7Pe#E0zsqPj6ObbrVRN*&H!F<%WM%0%nP9^M!^G2yua#^-dJ zN~dtwT8J@kD1YkgcZ=Z0klIVYgjTP$PP z4%Dlt_@S4TT|g5;(+s_&DVt{a>;M!qz%!!ZInc-|QC1xj1@; z4(GxM6oggaC4vGdl&9YE)YC3F|AO)Y5XwihFP}~a1$a+(&Y67pLtFe&*$IroF?2ZFZDiE z7sje}zOc^2(VTT8TnnELD_Tv?<-i?RBX-&p!#j$BNwP%ERO{f&6`%??zC=R!him+H z#9Ui6zeae$Mig5w24NHd>v!59OA*Eve;c`dywk6Pm5V|1EGr+wp^o@?0x1nTM~ft` zYuq22fXP%;vne07I`h@CN&3=Iy87G~5oW}@qj=t?a}4CYAs%+MN{|@U==lk6oWd(sB1V{c zel))gatgZ05B^-f9}V;*GWUFC0{#M~PQhPFSeim$is&q~z5Lt|#^{BE5CkdLi`Z!h zG1m1@NYPC+c7e@6bFZfh>t>uD9i7Jm+tE?7V3r!B72Ct7zCM z4^6F<7m|z>z}Eu@Hf{8JBf@vSa+Nf#WZ^HCSuCn|kB%;ov^P?*$`Iji!~tc5@6ff? z(EcW9U=!_cAW&JKPq1ju0xoa0(aRayca4t5l(IjDNWWi0`n1|oL;1(;qx^4e0MDX4 z2PprLjb04O);47W(K%m9+88x1H&gDS`YKEXRL2>~X8!Ijf@q`3K(V`=ob6rCq3NX{*l&xX?P=}2(c?5_0 za7V2=b0{pxwwhi8Q|YWf;E*Y6tut7qv;Zvo5@DIO_I9>VGMiVS!U_~f30zbU)1i3l z*o-c-)q0OD*IfyyHDyU}ka{Zgtnh3c*>sA`JZOdwm1^9@JS$6!c~dJDrra?!?+wyp zvoek$?ewxU1&}h%?(^E__b_acsib&|od+lYYB^je80?X%AgEg-LABiHY~agkh%iv;?`-sfHnpRO!$`e6! z3{Da8V6xH9L5h?Mlh2jaXRooU1@Ao7-zR5rTm~FZLocfpiUA5|IA%?puW5%`aFX0p zVjR9{GgbJ;qn%UXh>0^ct=ET70YT06AvCq3b|0?~dV@ZEy>d;%j%#K_MZN3y1mV9< zDb71{{fx%9r5UID`+tD0fo7aWh*`}@kzh3=e(6jzUWWDHBJ{9UD$IH~YRw3dJ5pu_ z9+8J6OG6D=0GO4?ovy8>DT{;@)<{uJnX`dEt3_6TYFQh-DAnFTn)cO{SIM1CIq#7k zASgF>T;z5Mkyh|f|q z0u=qap;PqDo1}6QKC7*5!r}3@F}=UouP}}F-mzLn`3cO3a}%bx2~*tiIfq+0)-hAs zZ+Z~{QZ)KQrZmyHxIX~A0F`dh){aiM=nhK#4T@4f3J&NM{`U~U(kc9`rtptq?rvkC zJ`bcu1K?>u<_WWht}5^2Y2g4_PL0gLhY%mu98eTlbAVquGY3&vhTlo3Wvw|G#pb{q zSU3Hs96puf^X5%Ex8u3r!R2GrT4JdEg=*6IHZaYwvXn^`*8>7+_W4bCo*0Z7xeN+q{y5YX& zy8tL9@&j$O{ml2k4>slMeKrtdiM#M}+Z_BckV6;m>1}GI%)8?~y}e;;@VK%yFrk6o zyZ+F<2d%;AV92pPGMx-bNteodwvyU z@%IV3)~*n5&$6Q$_W2f@=o4s)dlO|68uk5Yu*4wYhDX1JEy zKP087e>q1v-0M<`0IWd>TR?zVrAT39l_GxWOeww*WO0q4>p&K*g`IkcgDJ&IOE6T5 z?*mvB7Z2KK>-oC~>efimko9|Q;LEPqEKun^HhR$&`>mvDU!{139`42Q{aY6li`Tq2 zSxLeLVGKXR%Pp?;rPajB0!AJ<*ShQ#g7O?~w}pa#6mJ$(xt8qmq1v1scw~*RKSu~# z`8K#Mp{Z6nv9iRE6F9U!ze4(0GlSmU!{Lc?J*8rys#bYwYiVN{wF!*+88V{vt6#o%vCEi9YD20Z-=V&FJ*QQUA0bu+N8yF)x3!=)e68G zsMaqcK&)z|FtVx@zjUTrIgrIq5_BENqP4IOMYRfC%TTpGc88`~p^dhhABP`o`kRkH zQ!9Du^*3`sr3Y>FqAT_R(zLH?%_gGZv@0$^9q$%bZD{woTksVsR}2K>K_6b+z6dvt z$m1fCE84EYUG4k=R*!;oY^4AaNyxqg**KRr@zFkAou>68m`J1ivxM?cOXxU2!td&G zulroE>72y-EO6=k0G^kFns?;t_(A6`$hmsfrMz7TH*m?YZg>>)L=@hvMefYQl)w_4 zS)bwAHD4tLzpE=w_oy6PR8l&#DYmE7SKU5!l(L zaPy~_hxHGK7YekUQ&?f839rw=wPfY#h>lO$Jljc@n2{gbM7q(OF-kX9cgSqCUfQf3 z%L5gs4bafTkFz>k6=rs9a`<-4-jIFl*reW$y$8r)ZpWahmEP&IMS$K8?O2B}XZUfG z$^Lc>fHkmVKa2pec8tQv$|8R0%#Ia67T-nCWtWttELscuQ0y3-5*pgEj{&U876IC5 z+VqbI>efh574io*@MTvl4^;X+8@=d?{cX~;uN~ve%nKkUz)e`ioM99NOxhrpEO8`L zY1IELp?+ln{!;c4T}DN5;8X>zH)545(9z6*d3y~QPG@Dnz6!sa8Zf!@a1GemJ8gSW zXP{}fHmfuVz(;MrDA`z@A+yeUNwce=2&>`$BOI_^Zq8PNnf>w)-+tK}vXA}p>+RQb zz*KYl1x>p-uGg=9>=*QQXuqb3hz;L<`TN^10M@{MMGzp?eo+`%S;Q}$*{>4FVt}CQ zKo+fqeQ^7A2IBtkK1AF2Aaf7Er6vsORbw+vkG_czz#0{5#dd69&92)r(5hvl7hSj4 zNz=Yo?AfJw{K~ouPc-HCme5@3-e!T?W&*sLz6a->h%2eYz72J5NLd3)hk?dWcM;!Z zgLo`O1fa;l&?)kQQZB`voY(5S`ysg!{!gdP4pT{n7MrH;cIfiq$>3%Oppfk;mj!t- zAX4<`qgF7`C4e_2KLQK^U25Ijjy|;>0d#6c*$xh$6Z&J=4-pB|spF%S0h!*fcmbZC ze+aVq9#Ta{cZTbOEKB`?#iO)HIX(!ZJI9qJ)<~oO7UINebc!ac(eX=X8odG{@Kc0h z)@qQ^Qb(=P;UpIh7!7wM{{XNmI}+v)@{0s@Yb2;H|9czwvYKlPsPq{dy(pFbmNf0B z%hPXwO6?@op4Khx%C(2o`g+j~|KF%f5-&+uUl#5t!CMg!Y7sanUFMp@!o-+riPgA*qJHpqji^{39?$HiNtC6eX(i)KTMirKK*Og(wF%=Ni^J%$Ky!yzXoJN}0mwAV` z*7jUba$YFHCe0RX0Ka;f3(s&OL#49jKiqW}E;lv+$H*?s%^sCMKzi7cQXHI|=6wH4 znV*9Y(zNt1Cp%6=w+Vtl8{HS9G3}ld7gY9xYF6qHmTK zG&gfno*iI7#m6{LDlzoHr1LITfDqtam^HNHSD5wfw@U-C^lrhDyqs*GmLci7Z2Nt9 zhZw$BE&BwMn{}StF(%Ydaj#K3Lk6F@k?j+yb976B&a%&K5OwFe1~?5 zlqBK}4f?wPSZdI3CvO+1OYd6<^44fji~dbEFlJY24e0cC8@=c%eH&@o&!TsJTle}Q zB7+BC98EpFs9vDJibZIR^LeOhOkR1WW|MTO=kR$eC|smIanPHh3Z(`)JX9IO;>j+4 z7tZBGID4ZxV0oyFtQcwN3*T#{l+|iUSD;p5y%sLu8@@$+76x1eIIH6}btiH^@p3^& zvqC>kgoe#tdvtTt99u<~J!sZM8~ej#Y-@p}d2R>>G2Z%$Kr(FBi;b1iI!Nh{lA)|; zbta|XZe8E$hHs*c3kkjFr3R%UDdU#Kk$b79Glw4sUV=GvJc1oN>3Gl^w8g4MBQ|Ko zD$^zq;Bi8>3iIa3Yuqju>`P^?$cAuq^jUa#1iw{SDklW?e>UV?&p;hBKh?zMVDK~O~Q0aCG`8*eIs7)<|O;1Jk%lXh16 zS~-<8=?b=5Ev`O1>gxB$-${f^7dF>D=Q+F?ySLQ$l5zt=fm8R?0o|$R1EdYqaB*$p*Ch+X6OrL#4@4Qzccp^fz#XO@ulYGa%Z>!!34fqd`Nys1$og8yMq zKB4j{_>#%o!_{wCW1y`o-`IHs>!@FM^BnL=e#%~r!bv)QJqpdnFI;~b+PUO*TC@(^ zJq~B^mYh8P28sY+60gi`ZK2D@9T#?xg z(=rU?umF3(gDIjQ;d4qf$e{Ulq+~ulHjrO&CC{?~7Vwsma`*sGVJolDcRlWSVSV9g zc;3l{)gUfJ;e&Sf;`TUDLNoCHLioh)?eFO(v%-86pXu1$r~s^aP51CP9q!@NqrlOd z+!N&&H2ZT;T~{){%(WKk0oFx-GpGb*iFK{3&Q%nKZfxnk;E* z5Dj2=1~v+pd=rdB5jKA6;$6_7pN6Jrf1?cqShT+p(EfTGy_})lw{XdiYe*XvF8N9O zD8JtZ@GQ#j0F-~kMlS|sYehjF*f-c1l@>0cD{5GUOCab*9Hgx3AQ=YTJ_!I)S-ZQd zz2;T?1vIiLZ+~V3VV3yc1jPTijb4=ae?pq}U1r&<;3r*^4}ZWJ)aU;h9rf_Afs)`{ zha47NSbI7+J8O6(MB4fE2S68{Or(+Yp9x7>vw3=Rlft2RXvfKCt=CscFKZ>HJZwSe z1o4~4`yi!_ZUoaA3KQV00Chqpg4XZcJ^jU_8!CNNNuJkwJ+U(LPLP=|5d^Ji;Y?;4 zBx2GPyI>LshPTTf!@B8&q8FIN|B4@oNf+dKjHUE~LkW+;lu2xixdX-x?LP#EDZuYtAr+G>g%D!E232IF zoJjM#fRp2d6b_`>dID;G{*bJZLzRjF`=JINvm(FEi-z{2h7u^hmvnbmdrd(!ppi}c zA=;n=s|&svs3+LyMRh@uH0^6YHmO?IKUE}WBao_C@;lBe^;w8XTyG2T?6PfBgOAVZ z4M^&UX41&tA>?Om&8f{z84yLQ-;N)(J_n?awLDUtj>GpHO0$R3p`Y&PQm#B zjD!>E?SS-tgrM#~daWlIT!-H|I?7|j6Q7GWdPMSzC~C6uKBY9&RKS0OUu|mbf3Sf$ zyV}1M==C`pz36KHJJQrZYqLk~>1QAg3AZ}H@h73K*=Cd58*>G@eAz|M)-h2VqsJuF z+N{^$RSN}mB_WK&hUMcoHELdHliG;b6SoseF$ajs_T-ew+Xs?Trj}Bqb5dp~6V0|^ zJV-9fLjbxB50=Zh+k6eq`)I*`+P7$e{2_aN4s!;Ej$`mYgI@ZSxBe<$>U*e#P{vFV0X3e0XC z9lgY)LBhcW?7=X!Or#YGT4PS+<|brcjE>45u!}y&Ag9h2yPxQMfx5v zq@>~ko$H~pHri`#Ku7%{89Hm-&dS7lKqg*IaI!WYG)dxBq$!&-;y#2dFkIV!K@GSD zStW{$DP)4;B`AR!ZQf{uHk5N$3FyGNC+tY9y3DYfvoq;$2a=}9WDZDb&NHjL6Xf1w zHl||pPOz7(2h3;1czZts$VQi667KGMff%;k-S=VRm#@3~?S%0+K7;}8uI}=?6Lz1Elxe1a<4>#YnI91dO|D-IS($$Psh%rba0r&l*GxEmJ;}vsU?8 ziS85E*TuogZf+_zSvK5dZX418j2$mHQPm}U$PO6Zzw0{3|387Y-Np+-vC2HAs`#%- zKWm;)Glf%-ZM)Yw)T&~Z;WTFfYA{xE-UpJS&=jb7BhF0!gb_} z>8tNmRdDy2>67r2&28NXG_{H$_j339fV+>|=tcFyqok?9wvM%GHqJ~JU?ggDjL%F% z(7-0zb2boQh5Gve?bq4pX^_P%L_at`BizY zrn^Ev9}Yq(VznBve7nFU<;!pt0)sVeNsDq|WJb$G+PZ;QXuF-CC+ueTm5^e`BB>bY zJM~{{WBe)^!4=%09h`8g*_LszUX83A{vgQV&k|6qp>`&RyT&K3@VJJ)EX^>F z0&!@Qlh?lj^ymtI*ziD=fJK>zr>}p59gcUb8e3UUC7<1@Kb*p*kKz;-QPH2o{$H|` zX;J&DM{^QO$S*GrwI0kX3{GR=O%HuFn1>A``7%G$oM|nh|3$=x-QvgyI+6Gv0uKK< zA&Ucvx1N9+xNjk&9_myU3we=Hv0*&_q5D(`J|Q>LRL&#tn@ubA3TSF2xV>&4mf^kM zMlY%z&XJ}DR*H@0ccw^Cb2V3i;3q`9p@1%2`&O(F2D5kIyAo7;sX_i9ZK9r!>`j}whG9ZYm zvMa>HQ#LRYD$XN?M56_rV?0dK*ey?PXDrP`>E%AnHjc zY8~1J@4;+d4X>|Gcqb>_@Lbxg*eG*upX&lYRvNqL3dhN<7PZC1HJ7vpI(}F4J;)P6 zQk^`jCP;NR8Ho<>Mi3-&8&bUk$;1sRKL*$u2q9b|X0cG%bf^Anja5HogH=@geuB^! z#P3yoDWi>#oj{1*eM~bK9pQ!%PC?$U^1%V8C=%!m{~8kec;|4#Sh*XDpM1EH!Gj)G zJZPKJq<4%dLp8_P=Ug}s-goOQke2}eBijqr@x2HVEiVl>C$9`Q?=HE8mb>0`E5A*+ zg zQ9ILrAyT9}V7q}kQ#fSP-L)o%Y}PwbCa>)7`+HWGjEuFMvPS#Iftz2pv5*+)ww{35 zg<3bI2W@hg)x4?ELED$fp$ohE9UZilPj^o4a82Cr>0YAg{8O|JujQykF0~tq%7#gw z^QIlOk?Xm5f7a}dt;FMf?G`WY;f3C|bdh+;YTYp0Dv`V}`Y1a-Pw%SN;HoG7LUSZs zB!7ootE{(Mx+mS4Msx%3x}f)WUHCFRxY{%>i}!-z!FcMA(EGlOhN^@>yohrH-iE6m zQ8Z^`3A%x^QM_H}Z1m;{!k7jbfvco1%Ts;bcvQ305yELm*s^@1c+i6)*8gz?rgG6!v-sd5agRyK$-6&0{l0=abl~m9-q?HcT z_#nb-T2ldQ6!fjBa1W+_&SR-yi7lhh`-4iw@3+A*S~=l+kStG@kE!&y{L|g}1{pcu zK#p_i->}7mP>hbriKawTaV>b0E7xv8D(Q~UDia-~Wq@iyGeS>Va>^hT;R6H#_Phg9 z5fl&ow67lA(aO*3Qi>X!yujtJ8n>x!p8^^2Fp@7>=^ni z1v+eg`N19+Cx{~l2G z+UUigY^^A$`}|oO@|hQ36-R>QNc`8rf%@s8;Vmj~2)$Ct*(`yGHoIyNZ|r^G@DO}g$C{~(}2 zb?uY(rl<0P@q{17&c{1;J6fqFC7Ne!} zkQoDkXu?ML8~NbYs-Fj#d&N&)mD{7QM%a$+WwtBT(2?y%k-DEn4A@AWjFh#mVx{?4 zfRo=#NMUU(nU!fh0ab?A$f$=p(FUtoFG{sPAx-=0vxmC$86g3q&@5W08ttELAkJd*YkkwbgyHwt~kGNM6buqOUk!hQFyAs%!&U7K7ga4EUjA@SX&R#fu-GV0_}dmMlY(XevULX&{bVo zgRhg7)fJ=w9tsg{MGFGZTtb6*C>$hpWe*NKj;aJdX@iO^X?_bx^9dQ>zFCA=E?!Q` zQP|An>U|D|K{m4?0_9sc=s8JyYh3@L4R~qr?ehdkYuRT}`)xq&Gd6nBG^D>JP1#I0 zIIj}xd3eUP1vzhW{DVRH&Q}bkAoxrtYaXP#Ck=sYVLPIiY5sm zt(7CQ4y`8`+%bTyOS>jqZ}V9-@s>3UZIpYubx~VtN^%E&wy7i~8@RI+`#qpo!$vPk zu_|e5;0~~w>r1jXkRWKg@=(})pReijEG|GCb~bt?_Oy$H%9VmTQIe7mCE#Ox39Gup zCAcCvLXGhf5i8e~dZP_bx?*Aa3uFMT`c96AJd+lEzK-PKLlGBj<7&1=IFEf!pOMJb zxKfiV@-=Rs6rJbC;GzTHtkvPl+&EWjG{+%tMc5bkaV0wh@5pV}-N2xH-K}=RiiX%) z)sLVF-}zF(UX!8s5*cE%UBw$t9H7k^jUhVC|9t=+Xny^VcC@*^J!t4R93_MGx*Dm; z1cI_hEL`%oU(I1XgCgf9QmyUEI^Sut*cFVrCcHB)zt`vX%J*() zo*`V8j)$Y+xcj+q3${00Eza$RnXB5-b~VR0pQqKBFL+u85(tn z8esOMJz8kq7Ie+=M%#wq*`^o?~>nn^6DLYOx-$|U~J2ALL?nZ!!smQu1uo33*Y<`l|t zo}N5H{Eglqb(A`YNqT)#2Oq}N!Dzkat`Q}H*~4_rONxE5YNGPJXoK%GoiGng*>u7` z?M^3Lg8QVHzpSPOlE;kTogo7_(f{R0@ymix5WN;`~P zB>kX;y2X^MWn&90sjM|n%8bGNq32^nY&ryX!y7Zz`Z8TD}y) zpKA(r?MGeq0sb1ROOl}ds-E@XZ{C?{kK5yQdp%kMHp;F894JT$gI$3pid4Z5N~ltv zu*xg+qEvtuIxh?x$yPJn^*^~A67q#JFHn_pb2X4!3JfFU)pT<;5ITH~tOnKAe0?8V zQ+}fS>dL$=>6O|DVM}Z%{j5B1Q;J z*T|)j?ff(Hqn5G)8{xzfd>dO2czyJnEi?`zg}KS8(#lkRYa$*J!n4Jx=wxx+xxR$_K`hxU{0Z@vsy97bG<0Ue13%dtW**4U_tOB)lBKuRp6;;D>} zOO&gwv9U3#M@RU*<#KK@FRTj7>xuoaH!6gsaJALQ%!eoS?ZR8j8-;3SFSi(|uO+x>I+>@ro3~c9a@!Zs{Z^MMP8MpAL=7X4wuVU%*8DI6x>%sNgIL6>uBVZ_!{`^ z^jXj57NNr z0(NLOYnR$>p>Sz3AIN(+|BO2qn4WR_C%grBj^n4?KJSdz=i_Ghye}_LC2%e1=?(b3 z{+Wp>pC1kQ2)_%9qWep!1rY>0IE>SlWTg=jN2hyi&-oJ=;yet1?w=khA9 zL-N0o)y3*mb1z+L1=9QQOijbR)OIK0TOQ6G-<{>I%+_<)x4n&UDpK50Jf~}lcQt@l zPXI7?M0>!TUar*l=Zf|1NOXH`VyP%rucY?;tKON##;!E!4W*VU89tW)F$=0p0G7?w zBa2(Dl((4^wrZ`N>Cpaec8*{1Z{%ich34e!l2j-)xK?Oh$7kp^A6i+2V~*BhG#09r zYAea)S~6ds4GEq=b27G^NV}Vb+)5!>3$ zEAv~8cwpmtDPLTx^4`g5rdx6?>|Xa)P(ye6Ok7VkDUo6QxCIv9Z22e`PDUl<~J`>Zyu%T@25O^LcMw<(y1* z_%9*-2#`5TYz#;`Ru&0Nj;PA{rpmafGEl5hNN%c(n<~RnWvDLA&kWV2iJZQb^=X(b zfV(^TMq+UVLCTADd;*3%C$9Sciu3QVmx|eM^uesh?T`4ZfWL1Z??J;8BuZEdia`+& z@l4``{G%3`|3fl4lWWkiTXoHn6Quz{`;yCb1=ur-nwNUwQfCwG~ATiIfgKLQWlT1|Rg_H5a%ng$~;{aj}g0I+M z4Lxu{U>zN}L?)37UnJeEPh4o$+~=Vw6Yqv{0!-dudLF7UEvU=u65L`>?S=PZp52A$ z!t(yQH{{DCqScr$v&Sa_>+y;>5f*kz;cC*yrD9^P8Wr(#Y622Kmc$)+f@gCxvmTxd z&o7I)#bl+hw7i|Gik0-lvbf=!*@NAs1i$TNQqk>vbq#i(b5r43ERbJJz`th&d4QC- zwULgrx%66l!zYp%!nNpjA-!B7gD*)!ZeqE%kqR{UYRJQ-X4+|Apqxu38re+|KP0C;);&8K9foNXHsEU!cgP*0cd~$(cq$2Dg%%NVWl$ zK-w4G&QMU-lWRgT?VU*{Jx20+ld?mkEUx)G^u6h z1V-x>OLYRGBdhB(T7MH92U}<=j)M%N!RS9C90$?`8jb@Dqv04j8XN~xS1OK!45Q(g zJ^~ykzygCxcCJxj*^fKysbNxaiis0{XbLUyd6>Z}6At}HyOy}~k8tz71px{Pou#WI zzQvV!zfZcnw$0BM7mLlkXe>GdF$M^s(I*q(-&fy64@imK9O-$i4V!C6quOCAa~dl5 z)lNa39rVb(nUhleVW)bEN3y3d+6G5?FTC)=wQJCkh%V#hb-wsDM+HIzG;n7$)HNY~ zClO*cZ^(Zb`B2n^$Ej#(u)N3qffoF?6@ zXP~lw0-9Qe7&>34-?-t<3_=4-$y78kQ;YZt@%Wawyc$eqaH&n=N_Rt`I zyHm)W2=)>Rc99@_Xu&q0&&ow22FlDudO&fJw47B-AL&O4jaVPasF)yb&$J;m8h_9R zjj5M}Q}uXB^8Dt6==G8=59}p5NHQ=oo|WGRMEV}Y{DDl^?t>WTbEB8!pqIv)KefRc zYM&5TXI@eSx$wKBn=SGGPterbOG zmsBk@3e}`~_OUXL#~z_QqVBoWw3+vFq*GaVHD4ecVU@TXsviJVML%Mw{?Nl{QuAd3 zqcu;d)F3)N>fQ)P@L3sdfJmQ^ztHAA^GN^8lFYnLbVd}V^>YMVYs{z@(qCF%&-w$C z;mTAi;^qQE^2%baz8+{*x0A#R(Ud0oBoT6Vz{JOR-GF0Sdk_~0fmz`TpaBOV%`;BcW1eLQ%xTeUp4SI9&kj-t4b5{K5b0~4cVyCbn`h^9qj`4FOIrbN zvB4Uu@DNyMD+v#|^mzh_RA42sG`E^qOs-~9fpBKA z9FvnIGLVuWN_=vry^-?DX$<1>HZjlniD)A%8fFf3j&?2!1O5GkC#;U7VTZ#btE^BG zb~x-Xn%w*-fzg_)RBjNR9s_NJ;~nsJ1H%uH>XY;vZRTHaIobuu6OsYDwR=a$q5xv4k`Px#UyoN?ur%&;te1p%#Mt9kL=Yv`s>5mfBW&Xm*!viy$+W4XDAS(#~~9?i_Oddi^Q-Ly2)Uy)hH z7-@rYu&|ZE`F`s^+bRdG14XIg01$(~wO%xJE4m+DPy_WTgW zwKm&tC4^?haR$xyp>R;-FmR~;8vEaApZ$n{GX=&W``Ngx9PxmVJW(h^Xjf^bHO@j3$p?Auw7? z3zbJir^h!i!f^_62M*0=SXmQ?=&fON_ObpO83rRKdaj5o>1*I?}kI2>=%%JRr*1z4KLpd`-=Cf*2tLuNMc zS9JF&E)r(3OXRsh=%6f*>BEvz6C}TVK|(ZomWB~-uY_bx3pOdxKWyGegD>P1J|}`M zprBtMXdPP6&F8c7s)!LY^QzR73td?$OP8uhh{UE97}gQRy^C&8jm$M0WTws(PS)d0 z$q<;+qSu+K4(v=hDCl75OnnO=($|^#R++Tj&Xn`H(V244OJmJ}4c1UqkH9)}rs~Lr zcad(kR=_);skJjz?{TKqHufX?>sy|^_+qra;Y}8E!E!A#ktr5Z8TsU*7Ax~1NWBcr zRC2x;J-LW26NL}?nu(QUc_S6-{$rYM`J#Ye;Uay6aFEsivWqkTX%sDrF4Ccg(WLB` z35?b9GSwIF3NUSv%Z=rSVGZh8mn7bqc2woz%e9@F9YpH6^Iy(|l)5=N$rAZY*6Gta;Br_Q}HZF}BpCQa(1>5Zi zPeqEKwoMyt_J6c53J7SA$QnWa7`QIxbXTB#$h3_H-R-Zm?V-!iIT2I|1@+T|399*g zR*nlX7-o)(U#_TE%?UNWfaUX`7&ob+hZSz+N_tY8tHGmC1|{_l*I6yD@oF3NW{T8C zw!1tKeNnyi8&BSH3+&K5e0mmZ*7-K}TKk!K@AbmOny@mjuVt6mjp%CGg{u(wuVl*6 zYS15zXR6Wt{9be+;fpM+`J;=O@@gtpiN?jPNPNo+F##xJu&ABGd~@v7P*WeS2kMu8~=q+sjR48kxo9-byv; zhm?bz++w1Ql@buK{6tcKAcqjIHH7$5bc0(cdt8fWzykxCS5M)(sNQ~JpctA^4q|? za$zaCkMnK#0@ZM(F%_;hCO8-eXxA((Z6WQ}6P_S4%bWLM>51iiE|tg6ZNxK@jFnf? z(NK8x@@#_$6KOM-NQCAI9zJmk+oe+F)tDIBPo)A2tLfNvE)gwr=}bN8*-a%A_5HPU zc_QX1Os4m@{DtK5;zl|YjU@oKns)}~0%4vLaU4h;*~|N8+UrXT@X(1KEbV)5%X2C%B7;^!lJmH69}HgybsE2pzwMMt?0yZAhlTV zM3d!7D9ho?&wIm#b#F4cDD7;ldlP&xR89m#+Z(lzFOr^HPI|o6!rpQLVa(T(`-RX< zHD3+2GU)=)SVDSYHTmM6$)%dbZlRYt|sTi zbuqJ>-||-0@Px9~NM#la^$nkQAs6(flD^$!##7h_I>k9pbdB>Q!>LNlyPBFwbCpm$ z7Zm4nu*M^p3=FkOfS({2AU~TBl-x=ji+?W9jHUL2LWopW_-)7 z%fWOk>h`Udwkum=qwNnD=Ck>@FFqNsPG=^i>$&9KWNpSjI~&|~FNM~(1IzXG*5pRz z%0g{%e|0ySO=Z0k-e!0uF}=YF(bn|Ngtr!33~w)0mcu|bcX=tCU-Yh2x0j{zdL$p8 zh%NE6jo5ruTAkY6T1r(DQl&L9Rao5*a;0EP2nhZu*saXw+Ed%9w6vWN=Rg@xZ%?(B z=T@Y~s&CD+T}zdN3u$k8Z7RIv%}v)Ym)%)zty$hl!pU!5nwejmu1`j1;MJ$x{CXo4 zo?LA0`7@c)QZP3Y*s2BN$@0#0c*X0<%v{MXHD_8o>C758KR-Xc+l-d|TyZBh6BicN z_T$YNUv)}s?`tNY2)(mWKd4NoQK%Gay0>zU-n+TKF>`ebl9*NU~m(gt4>xj=ON z@?0f39fUk?K0o8%UY=dbMEBeL3>QtT@oA0^1d@SjV0C6^rJgF6lD=)xzncuqyQ2Xq zkl2?z(~Gmab@zONi>@wA%&i4ywu{ZUe=0mTU-g$0^R;c*@$p&E2lM>pRVZPZ^e)e2 zTge$Qm63w;$#$ZhO6>$!mgW=bQejV+omgunTIqf2Ox?7!H!bZ=OMBDO-n6tgE$vN9 zdo-3--6Z?^Y?8amg;#zVis_rx){pG6`)4hl(0Lf&_+g%~ajQ@5a7yt<(#rUu8%cYz z4i64KcpC(r;przRK+eRTFXL-Eec%0g?84g9!P(h9Pyh63rBZOE4+Rlk`ua~8nlkW4 zUbwaU`Jd(P0;CsRJG_h5Q-{ZX7$Pd~72!KT6shFAOQ^Z<4FvT8pkWTFqMfmUHXB{} zI+PBD1l?}{eH1u4%r}7O+Xh%`_$BxVP@_;Q=t_!{lE_-A9<`7A!`j>@X&l0Akg$^9|Y3f$OAm& z8+mH=cl})e#Pa3-n$JzSzA4wZhX2*bwQ2y$eGEXC=g{X}p2*v}tOHYcs%`o(55CBQ zX9^RC07C7vB1NGCJ$dpP|gs}9XN@;rgstlS>W;A&;qfMJKu$Mjyz*ybd^4{@Q#RNfo7c^bsY8 zi}w8%a+dxSdDanhU)S?M@UhLmd|w9Y1^-{iqd-eMC$`Gr8oY9V2eQL_56D*u$Gp>} zB0synw6Qqno06ua^@;VYu;$<04TX2-V|zlq+?*@c=#xe8pqJ_qn!WOA!^3y_Adpws zZ(X0t)wd`8yYY?O!d5Dj_xrQSN{aXRX3ClCX+9Aa>(>)ezs_kM2}Yy!32&viA8Jf* z_!d&0n7bH`@TnbsD!8(^y;xt0>_p}oZLgnsM<|r^%`Ze#?fCV0X?2M!wziX8yE+&0 ztcumz-fl$N*(<`4>u$5Wp`WdgNmZ^-RhQS-)9!RUoLx$_gVS@q-N|qv5)gy#LVY2- zH`lnl%;`4)Bc-Jc!8=oI<`%Mof3D7@g3;AVenOnDMJoPAZZW!+m*y(jwTOT1P%r!3 zT-?%~E4E%iX_UFZ%E!aVu&VE)$PG~{BzixKpdANdxa`qU3ezJkF*k@aA7 zaZP^BN4?=^^hggG!0e@-o8&%Xa$BV0-|{$S<+2&eBo%*ZH`An7A*}hMf^gTS4hhYw0*(1~LL()F43Vr2knIL5Kp$Rs8VCbzxv{?iE zVm&bQPW#IY!R|4%M!3MeZs*SfDZ;EMuIa-Lp{bDXJp$Z9fSY!{d&oou&6SuNd@v2) z4;}%&P*aFS(za4i7#TQJe+{c&cZ!u0L-1)d1aBsSZS8E*+m1#XN%Q%vE|HNftS&c* z3I8~)ssCRIjo289lbZUUwn1YWN5QFj;wbX`=7i`CAbob=IEsVtzF{2Yn9D{S(K<9H~9K}H|P5kd95LgQ*-3cME&f+M4k6gHwbhDm;ivRxt=3B;5I6hTJj?Y%u? zIhrOrA0-f5bC${uBIitY{t0F0H%K?@8Enf=SDktD=Tvlx(P^D|=Yv|C%g-1H1*tQC z$caD(pw7J0&Kk@A(LT!&bZ0F8XJq-O2V=Rpk+3qDL{XU;Oow&m?|l{7{4nP7uF+Ao z7V_w*vd1^7GygE@Z7uQCRN_QErc$2WoC>|B@_!6$Djg)K8Jfx|K%}p!oRP`eZ7QA5 zji%B;FHQDeZ-X^d-662fWdC1~3jxy2n)y`S`Jkz_sqA??&CWwG#&za(MazvC*g4Xv zEKKGb2}f9yd0F0F_J6;{E~+3ei@3!c!ibtI6$#|loTjpbNIH|Hub?btNH^;lY|Bzt z#dq^}N>nX(sEY508rRx@zTH4XNX7TV&jkVj72glhUt@pAKKl^?XYBu9$o{tu#(r}H zVr52&5;HTShpG7fL797uEj>)d_n)^xZ)#O>${wpK!(mR8UaNY`ZNLN_DV%4#IY>J- zQp%M-0Yv&*)&C+BxZA2apBt^JgI?NF_;VYqp_&kZb+#04LoWOg>1In4eiWKoTh-pm z>iu6Jsl6x_-(M`aEbR4{39nguEtfML09eJFw)Yy02`@Bxyk*38^+iNSRu#IE-9|XR zxE0^;b&8P_J$DRO*q4U6!n!KHo4?F*)D_>4Xl4U{MJGNU!Yp=)kc#hzg+^H(Q1Sh6 zLugB5+P)wm8a+$H2)AKYd|!47pA$hpfr5UKpmk_dVm_ahS4E7N&Xr)!ywzyFt_-kc zG`~WK#2$J(tN7luL1yYq;bc9|lnjA6Eqa})GXpzQ4zAuAI#b^Ui1c-)zFj75w=?B@ zZgi#`^wL)7ciUhMb*2zlXU^1}$c1ku-E6IZZ-%DU&Qx!?bsJB%9CgL_8vufZi}VYG zgRK6SU8DivQfz?DM{$fPtV!9g6Bw;!fJzyn(_;sWa6F2N?|cD!$w7qlxT)w=W6^ zXphJmK|j2T@28%yz2}gjb0VnsprC$cFhMn+&&qKj2E)v8Ib6|pw83B<57$|}xp~0` zz1a(l_jP$7`a&t`!ik#|-_0w&`$Vj|E#`%Q$S;Ok`Ndsv1+U-XWw=_@y8%_e!&`yL zjji4N)MCkBNW>O4d}|ZA>P$Kn%y4U|OqiP}b9wLb(%Qbbk>8``=&KD6w+?-4$-P{q z;Vr<;o7GCD5=}*RHsWi6l~foiaBsDu3z1zYzb|a05))8C8s5zf?!o)IflMm0w?V3c zi{-+6crp@Ccp}g*f@SyTcLb=`z5_R1x+}o%7oa+KA>CEg-W10fwLMg{uH>p4!fH)| zD)oh?T-uYz-a< zgmIft$|Tn-(K&tz>hMoAimUOmH?ft0 zr$oG=7~oP&dw>_QKz@-_j}K>3A*rxfUd{o3pqhGn!7FG5A}g+xtkP(gliG6zbs`;8=~q+lyigEA>N#eYNs@BqdH3mVy%-)fpeW!|YFnL?O1=O2?`Z zPc$@>;>3a&SqKNXP-8c>m`tvxcDM7% zNo}N)t+lOWjhwY!?i>}_ntid;N4pYw&% zu|(hsSB>mLHTHHqRrllDW|ksaBeag$k9+>y@c?Gr7S@{Mzp2 z*%_$2o?qULrl)cnmsi#%E0mZ(}Z;iip>1TSY#zvldS6?N6?3hw_)FR_DdwhFIM%w^m|- zwd%%FE}U!6)ECP&kEgutS)1|4^JRXqv0j}{Rf{10?m}{MW4oAYZRMqSX)0H#ayzZb zIe#j<5!p$?BOKNGyq9n9ta_#G`rd5e`fg=07p_%T;{Nh1b%1W#8_T-qrn>m1y$M%u z+MAp9=BB;5X>aV=8+F4p*=NJlRSwX)`u79uUP{|rb{@U%<~go^{qM&vTz?uG8rQhC zSpuAt)Yi>?OepxEc=#i*zkCe-Kq;Hf38~<&?6lxpTGWP?6aUa{U4hNZk5xVdMGP-v zk?y`##ZN~TR_ERGbE`2WprQLlrFgmz#W6_!vk1reN&=cPan{Jgw{=$wKXEm_y08j( z$@^#JqdHyD#&qnC_)+AdGPORC+&Nt>)bs9quHMw>$$qJ;6J$nGf`i7M3!VG1GQ2Dw zSi03+h1#s*LFEHL176|Uh0X)eYMe?3sqiW{>zs%0vmi2A{4z_v9BWFg172UVNQR|+ zj3MUbla;?cb;~U;98|s@XjJ(@m`|$wo%{_>E`OsZfC7y&G{{lC-OTd`m7jw4z_{|Q zowNCNvk66Kv-GEE=T7At5uU(1h;~j%e5)nYO432+9MH4f5=3dN*sMdL+FAi*Gs%f< zUOIU1!P9R$c;Vmz5r$~zbcxjXZUOD#10c&wEw0*t4|m8jWnuU&_;`kXY&S*tbXTjM z&*r%N7XB(7RNe>?jn2Krdc9Svw|Lzzmv8OdCGq)ItzFIT;xl~*@XcAN)f5`pe7#x) zlq4AM5&0WlejAv2`L@oPG8CCqJ|6F! z<97w16%;IQOWL=`3w*9!g7MDoaLpRf3R*OIt_t6rZZ)|)j~E@ivvXFcHQKE#UxRwS z(CVObyxl6grw=-hvOi?`X0zVRmSKA?@=aX-fLFeC(7C(bZW)j8Sl2IILsWheWTtag z9@k)g_J^*{oqG^|35W!5-I2rYgU($dS1Yx-5)afa@CTjS_}W3|z9v*EZWgiyz5%iU z(+GshC-U`LQ9$~f2H}S)$3~9BKhaPQmx?*LeIu(zDHCzH4~=MjQS~Wq8y| zD6v~m?^fVjMKTAh`tfqBD#B!^TU-tnQK3~nxO}Sf7>H#xtFBHJfvnU3p+9(6=N@UV zhKB@Yp;Q*(4~X#XVjU&_PN~YlI=kM6Wi0`r?jxV&k6E#vht~lJX&=j%Ie-UvFE2Ns zG9e-K-fA~sin9P+OK1W8Wi{|F5TJTqs1-pB6uodSY6_{H>uM)dQGT&FmM2S;Q zUy4#IO`=NIh#0*oNT}!(4Pu+<5+g#0ed0lJKs=l=E2g!@t_s}PytF5o6`f`&&F{ng z{wQT}R%|mDW`?F77%?ky(&VS}QpDR&sVDXo9;SXQ4rK7vd-I=R&PSJx@W=5uw>`^) zO(?dKi{iLACf*Xi6Q{+y;zRL)m=NQ!%jVE3}^(b2do2h12zD*0k#7A z01-eMa4%pt-~qs1z#hPU!1oBgbJdzl_{XXQc<|qin&1JzGjj=k1n8jMW@2rCEa2OK zKVv(bcL48SPVgQB6%icD*j=<`Y-}^&*MMIEZo+SG0K5b^3izOe;4gqwDM11-0T>57 zTSo9SVCzDHEr8zu-T?G1B8UKv;=_*szI!FXBY-b1Cg=uCR1k~&AXq ztQ$|mV%<0ji*@6duvje8nB5{ zhc~RUB&5lfkUg+iLQXw)__G2H;RR!BYU1 znsd+_mYO%AH&u|N#Q+wa@55rzIRfRWuOg@g`~Z*zun=vuh3Gk0EJWCF+!7+(h-M+; zS!>2zG_`=jAZsoPN2v@$Nk9Xybp)kyzMWM%Og&qH67<3>|d$mS2*b4xK#%*VpP^mn8;-I7TR zM8j0{((YogqG_L1WBH)-v?)`ZrX$gaFG^DqDz-*xPnF!B0obMtrL*sD+NnDnh(ZcVriGKjC8TOvvZ z6F0ay5wdwvPMn%)N9g4L8LtU-uNiJ$!w}=yYkTQr1+T61mTQ5gz^WF$yQ}Vk0kcpNTuRt+JuOz zuinuPUr@vcjbJiEiJJ_L#FPC&S|g46M?zGfrD+w2_TLGoiXO9mF%-lN58MvJ;-GcA zgKt^biFs1pg}--kVL>5NWQ5KS%3nMHRF=BLagyw3 zJ&;}RK$ap(Tg&p?$tw1pDc7n~_UWShIS-Uq7E&JQ^M_mlx=x*4hc0$kd0^+1z4--p zs#KgqxmBI)7F}fRNy0^FkqX)7K$A1sd)3Jf=^}ge>_pbz;zo9lI$5cU>@~AS)+LRf zR44nmF0#H^Birhn#y?jl`!ii+ubnlrtDVXIL7nVLU1V!!i7c&CIFtRSI@y2dB3tW$ z?ApSCHD4Ll=7t`BYrs{H7cEmRol2>xmeOhIEYfumspaZ)m+GQ>od>#W6r$_WYj0Gi zdc7{H%REq3C@cJJZoT$yb+TX5MRvIdvMRln$hy(ZsMAgAqFd*Iu3Bte`s_Y+vZgMw z^|MB{*?IUms804NU1V3x8rc?SvahL={e>>FD?N}^>$R@afj_C!{i80r4Ib#K^;(w- z`9JDp|D}tp-vikq3l#JySSaP3x#i21%cjezsg|-S;DKFzVI2`0aanv>sm`rV7q_4; zZfWPZ-Kx&*CSBYbb#XJCx$RKr_GMk%nsjmNcjh*#&TUv1w^h2hxoF8F>fFAii(9h? zZjFUn5~pWvgg=sqC!E9goI1s4bWv>aKrvWIkp}~RDB0`G@VGj|W4ai&dSF;Ah%t6Ichy7)-vqU3oGlCiO^LPd3CBEYoz)W4^;hyROux| zW0$|tnPPRla)DDtO=nQxOp9h%Cqn7jLt*o>7-9v0ji>Y;{@P-Yn8+=1Ox%qnYs(6_X9w zKoUqMfq)2;%j{7~^h z@tf1I^mI5Jer9R0;V-}DJMhnU{pHuZb0>bwGduC4#e*~U7R_3v_1Epts)~m*5iB9U z6TdCD94R(L^7*W@T*w0iTJixWmc#Ojw?vbXTn<0tzYnD%>-@it#0nYxm*q%wEo-l^ zHb=MClRddigg`x#$=W$PyJ7DXinrt=tJGsB-Vi??KTtfnsL+JJ9hTTRfnRe?1Z+Ab z{#cCJD^AMEJLyy|oXzETiU*TU%HA0{R9FVk_vQ-AxxAAH3ezc9TZMgK@1bzm`l{vZ zS6QG#PmdMPuO}NCEX#UwIotG9gGAo}e0BFa#6I({$BN=_9C-kt6#RG+`vr}vg4jBy=NyVI4gmZQA=Ej})t8;|aF%V!#V79@J5b?{tRA9{O zPlZBCue>T9vUY4SY3K8HHninK1VM#yMd!0sa9?@6K#0H14S+A|A1{M?@8mo2#br@^Ra;w<7DAq@82P zi$LDS2zmLqlhddpiEBZLSnGBqmACR~YnfpzBr#?;2u40u9Ix-dI|@;635F;rTVF1F zu?ta0i-+@(?5eFbHze#3aJD!x)ZZ5x9Ox(AkU3H4$8rc?=3E0cV$*vs4`^xh54 zbDxBlb|h5E_b3q)aRd7B)a2s2osU3tM)m~s!_&Y9VWBS-4X$zYzAAIPv$~~ z`u=b>qZXs77=K^!{2nl3EKFkO{<7FvHLx?NsJl3jg7L9kFC2AxaP)w}k&B^VwP8vZ zrc|qkb*n|yN-$FW@YT5^@%2Die8mZ0qvu1ty&5%}o15XtDt66kdL!&$<2caEO)&2w zg=D^I#eukKf+R}g_jGo9k^hiPuC6XB<8(1n$j8%JSc7&B+bR=V@gVF_ay1l*xNxI> z&}eu@vd#W1NFwK@WszfUHL*h$Tf(gxSG$leilZ@*2Pqs$wuD+;NK)S)7T;+x z_1|hVsKm~LHDaeN+)^LxV4$klX$!Sf#14(2)JeTI77Z$~^H6QrA?aEl>{Jrdl6TrG zV~2_Qx?_hHCb9Ffnz2)-oz)&-XSG+}S-{Rd>?|5oV&^Mr#!g4Qc&DT4&T0>JRN7g< z4t>|Mx=t#-Lt)3N89SZz!j4zDE2*oba(k$=3U=sw-Laz;`pav?PDj1u4hE{qI~`Tz z4vkTF?9iZcXPqdE9osMug+>o`gzKiY*iaq}9aqMol*}C=Q*)^nQm^wR8CV*U*3e!| z4!%5zr-yfer#eY!T8P*BQCLv>jPT^Pe^d(tPo|u%8=kbJexxj(p7G_UI!Pk09C~pH zAGxKF`l@ha%AkRI@Q;>2kCw%Wuhksts+R=9K%V_oDxbTmNFW-c?h=Rwl{@RPve@yL zKWwQ%h(8pn;LI!Pe+8TE;>cq%7> z>U0Y0!U>992rEys+CwfJRX&B$7;gO3NdoCp*y*y^Ss}}3V5q-$T5l@5kPRj6tuX#f zXCnBcDQT}plH_d1bxpo$V7zH&VW#PoaFd_KKXm8(Xj|{ZaCmev+}hlN!*NGfxVa_V z+}zbhe-4bF_n_#Ija$N;YiFq+^j3OW8an&294UN4Wf3z)h#8)D`BTX`pU>j*-Oh#` zJHHZ6XIGnWvDHMk4Nb9ZWF;S>-$RLX&JHDT#}(SNmqU@{DtS=j>p2e+4kR|+o>TEx zjR3Vv_CB!$H(VCnaSrZ`=7PYprpZaH;mxPlaQkC!3BZI3|+O9f@+(f(qA>Gd!?#tVhL_@S#U=2eO@W%7kAB4&(hL$In_PKm#2FfZ&8Og*mz zwzVv!U#(r)XYOi%8DsC=u&GU-gHrP%{%gZ}8EtNE*j`>C4Y*2B}>656)1&@#Qv zG*hT|YET2a3RzlM4kKQm$u5Lq4*m|^l@N2D(6~i4{g|4XT^yuC+$!aaU_H@LS8Och!ASZ+?_Y@0oymCjte#B zuNpT>!tH$-5+xmOlq4Q{(M>mbP{ABH)BU00d6x#G`$nax8AEK?O-@Xx>J`KTg*a2@ z>?GaOZP;L^Tr`=^5z|0rg_>LaLJ1D%V)WI83jK>l!$rv=^;?ESN2ePd21_vgCRxHI zAp((t#Sf-n@H%!b>IpnuWezOov)GFqkFq!QFKZcq*S_S2T)$X(>vbaF~#DD zcUvxmIJbs2qGj0msA}M*sQX6^Vuu8=wh1L*-DLrrCcq{sfK@Qyz*ZCyl5#pJ-oq>D zLJBG#9NOe&*N~0ok<_Zq!h@PNTEop@uY$YF-GSP>!1ep4p+38}Wk~3I%0mANX2$eR zjcJHWw+u70!J~;tc0Gg`-AK|;I31+VF39BHH8d>}n&4AN2wqVZf&qe{e{#Yla{^mp z+A{EHSs0&64`k2o1E z--KfK{pPn-?vSdC59DIB(k~k3NlB%;tx96&m1VJWKVc{1#1`#HWKmjc6rJB=GMn_{ zN~S6vg7xUcc8YhSa|oTasYjvxa^e9!adECGj!4|5Yyp9l*(NfRVP?l1VOJyeH^g!V z{C?vfAecRKu`~jxv7^OX#LcNI&OLsZ4qPYk@eso7lD6wp@g)-qHVX*PiOJnvrs0`&qITFK-VzINe~;SPJdT5ceOD2*Pnkd4 zjOobQATEs34}gmpTnwR>N6b!ZlAvP6oXf45Y$2Do2IWbcg4tb-016E!d7sV4@EqL+ zdao3mtW6nNxp0G~okUy-?Pw%gC<5a%*>tQB1zxc(@=61CE4@j<^gvQXE?;uNX@EsO zff%6{3}Vfq4?`m(bxu*LSN4=^u+|AWMBhsU#;gbkVIxU`5!*$3HgR7%MF~oT$zICt z$`N$dxpZvXI@#BI?vxu&iCnQkN%rB#sDXHjASc7s@kwe&QlA&_GwZ1t0K-)d=l#(Gj}e_=c? zJNe}Tt_1R7SS8|oCzBHbyIY=GS|lEnQiKqxy)!^AQpN!CIKxjQN!YX8qyZNRK*4B~ z4ncBjx_4}}^^{l85ndQN315uwt1T)E_oR!_WLmok&1r1TtR2B-ffNB((-tRz zh`-s9XxtjJ*O$Ro(~y(4b&^B(Qh|6frkzo{d><|k8lGYN4 z&jog4SDoEWRtJT-vNUL6K~Ta*!2d1o zKLriA>H}k>V)VP)wZK#u)HZD|T0n``j7HPh7;ObKczTI*Q~TWH(&96Qrk0w(8k?P- zvEq>pn-&0`iZMByUe5DGF=$TkJjQ~h06C3uBNpx{Q#r4EH-HMuWU-^gTbB#uGha+% zhq`QCZJ8gXFN<)eue&}kd=NR=H!Len;Ook=V#lb&Cty{}jI_kxlZh?PVn>k48IR`Kqgi<*2+rDg z`8M$KOBi-`&C5S0d08s{>+1;U!=ybx2-7HKm{bAkWm5S;GwCZCMJnS~FzJ(w3}Dh9 zxvq}T8dd_JHts|5hQt{Lc4Z8em!u2-O4b~mn4}K(m8A7L!oRQ&D1=7O0si@Yd}sUb zq+t#gSFQ~=h^Y-Nc858&ln%GK*;8*9JGf|wNYSw1r@!jK+L!eM2vNCnejYh6G7`J$RWPD32AF_a7H} z>%D<(JzOasRl#%ab8PC`x^|`by4%m8EEbIvp~SZmx(*fnoB3995|`4&gRInBnVzVZ zFtZ;{Yq~v7youI)JV6M@xj1p{j zY_ZSez}Ep6#lv6@s`Qii9$GyW>=99A8lYpv2g$Kk&N1)hxLOXscVU*-GqeRV*`8xf zP5JU&%H{q%yb%qz6}Sf@BJfagDt4$KFqHQ^&kS^H)CXELF|#BW5Gf}4qZ)q$ZdQG>}%trRU02cw zI2}MU2(2_hdz&sy5It^&!~~A#(DTw@wRx0Yg8e_jmQdYW@qhRKgnn($-R_f{+?kBD zrk5fE{Cr8g6j?^jgkc*zPhAt+grn=zH9=VZQn)5i(VvQ5xGL4dKjZI^U={48GvXU* zy{0olfN-pMw=YYp(<*1ETI_>+ARkf;L4oXpHP+N{LM*%jCqW|^(NEA-4mtd?kHIno z(n9wQj3O*^m*xZ4?@+iOz22Ep>-`_bw#zM>isCkR+@LgAj!G3iDLT`^?kCY3vfK47 zz}YSFVe0k1L_e&5as|B!hX{;CD=8j91_Vn&;rZytitE=jZqbXETIAhv!0-crp%MmM zo-Z!%%1@B^6QCvWr*yyqj!f4aiB@iUmGAGGiU&89Z(3<8ilh1qB9zYyC+>tN(+fzw zWbRX8Iq@?XK)NX8ZPrI!zZG9X?vc7{=J#;bWzMKadk5!)Hb zSPx)r?l8sTJ7(gx)srf$Lu2+VtvIWTdSRhKEGjfK!^06nSZ0V0rj$#wWaZ-NO^Ve; z6dm3QNa864T_S?T^Tq*S68|9Bm#p)3gxAt(p1&(lA@_= zQ}H%<6Daa`aSMxgJEPim0T4$%lIoI(%mqNM@e&P(fJg3XKNT27dck*~yO&}oiwD`N ziwAOfWE3{w-yu$g9ozjF4>9#^H2v|!5&Th!DcKba;^23RcX@LLci7!sEKNk%N!*Wt zinjn~`Rxo|Iyx-oE#8Ws>@B2OAxmlJjjRPd*|GBm)?2(TQDhh(;-ab*((XdUxkzN( zWJzHmnwf6?iAk7S=`bx`rJA8|dV=W3PI1v|!9;4`aJDHg6A06$zlRnpw~%4<;t?wg z75)S6l`2`KiJyjCU|0l zQlRZGU;VLqFo<}5sinF3QI=cNgP{7=R1ea*C{>E57?FsRvIA)b=PL;fk} zd5)G{MMuq;(12kGzJe>R7;?yowRPSGXj$a z=V(EvMo?o}?JU8%#rq+8kZrX{LWq?XiY+d0FS5J%XLk|~IwrdCuUzq7--gJ`Ml*tf zH}fjGiE}m>3JNQR$6D}OM@*y}Gs?1@HkST`B&rN44nYQzVOe5UT1m=o^Om-{p z;Poi_tG6vBYg1Yb@WQfmlFm9RXJogLxr0G0N^-Dyf(@l}MzUE4Ez^ZO%dCPAA1M$p z2Som>j00c_Uzbt>s?+$1ln6Q_PrT~ns9PQT5w^jlTvO0M679G-1d0>`o=a+-J!Gzzg{hAdBe zmT5~73;EWtp;*=~((b4cx2p)#0tMdb8d`{&6D)6ur9WZqY^CTz!b##mlGf9o-Vy_O zxN*i4jC=729M641H7BG35;pus3^%lzQ-fUY8IeKF-$N=lHDzHVBRm%u({lui1TSNx zh&#KB*27mihSw^S$T&8D9}}~3!i(BdVg^bWj%e1y9D)N>IY}#5$Yj#Q+Q^VZ#&aZv zL~YE7oOM(#07UpNkxd7fz7yWrEEKf+|4$^4FN%|0VyG2C7p!ukyPqM zmMDr?itPA4z+#c5O`_&n`*eX(FJFjdlWk8>_)sNm^;#?7;5cK{OawB6Qu(WKEXTO0 z1wbs0J_X7!27?67Rsw^X>Horp}yy#N5|i#qKWskD;ojU~F82$nQcgK<%Bk>vvB zLq0BL9fAPJ=I$M%jl2aZ$kQKHBm)I0@togqLx*HJX?fEU(j>uX@ysFUnxC?LSzfN3 z6WNd%9HoR%WX)GmzKtQ&$^QV z#|Taj!NS7iJ6gOG1r*llxJa)}`sPxauG3$Iqwj`xd!cAIW+xl2io`d=9%5HZiK93{ zO7BYX{<1`uw)Q<99W4rO|f7a@Ll!51alzuw9K! z%cIbTP0KabZ1H~>TT~{nVADTjyZ|=+tUsH+kdHYUVT6U+_7UDFN&GIuU1c;^*hhcC z_7NGPH%?i+8k>GP;x|5jTtYsgv!6CN6(ll`&o8a8XembTE#v9Z z_#O%_QU{6qDTp`CttP{pyER#gzshyg3&urfIA@B# z@`8bmF}-J#+~tK%?hIB$L6TH6SUUK2Sd-h~gV(LgR>Mue)V8tkmRe%9){RwOt{0Dx z*I2~0;NE80K{(7|T;8rYTRZW?$Xr9^bNpxV<}fa(* z>t(s>iu_#x_L+G_jyKy})Y6Ppe2FXghJu(V{6t5byFViY05^dAvq(Rq*r5+0j0c0u zAV3}SL@{?&;{lKBuoY49+z1IQ_gP`$0|780q5|KKre;)Ni#J%}r#<(nxZ^LZvp9~NMK?usrAWaZJVt{OfISg}A7{u)+=9KXt`XXI11>kSZg-87 z_yl2>#|k!93=uOBr$y**`4IAC;yz4KL#W_yV30tef{90IU@Gh(g9HB$y4DmNn0SJQ zV6eKj5bX~g6?nz{Sb|SjAl@xY5K)+2_$~V!7Fa72sXfNoM#~HtE#;01Hl+>0CAXU= zAgB1%A$>cGxEWlx>uR()JcPnTH#NZ(EXuBXFG^p5YVM>3L{=Rg4^gz8h9N2-Acwz% zU^$3pVfEj6o#sq7y@Kc`am`vikL@hY!LEdNvqru@+yTdln{QG3V~=Aix*Wie)%-ao zUGM^0;)_-G2+4Hef&35F)V$1ja_`7@ohH5|zuFj(Ie@=t z6YMO6@2m@%#h%>*BRAV#hERKLHo#spgLv^w6$7p`i1*A+q94QQAl_PZvWntOBuSkg z03+-qQuLob;k&d3xt#=(6B)Ec0B#&BNc0d?i7fwx*2I7DTA6b^B$osqKLqhuToLNE zo<<}pMHjIrd@5v)2vW*ZxY(n|iu*OZB3_!ntSLYjZ&E45dF+9OzeP|>g^*4c!{R*y z5w7cX64!PyZVc%c)M+%>TU4hx)INoE@=5kLvQq$Z{a-r@Ktx=jL7#mH@HEC}@w2q; zeIh)0LmuR5c6xqBc^YdpqBr&P7AL1%PycM6LMt6GD%{-6#8!{Qz$Y%EI>qo(xRnNW zl3BiN+bLtrn0z@(9Vz&xC?DGiYH(kZ0S}YEi0P+eh4`@d08jB$M&cWwALQ{{=13al z=(o#7BN=Pl4_WAQZuxo$d!Or*#{;fWS`82D*dN*eGQ8e^NIL_*DS(C%H`Q-IQ+9lw z@()JYi)zpdqFHKl@b*IGy`HTt(9Owntf_I-T6m~5Xv)CXm%V24Vb>o59;>k{46Sl_ z^kLVstu=T27~_u0bQbLTBaF^)&3)dVT`R^;nXA4ojR}o3!bELb>KwMz4>J5!Mz!!> z_-(1bV_Qn#@rEq}N$fGDD}_;+>{lUMg*SX&*fKsM;uByY9})55Mp?j1@r9HIcbE*L zdH8o34_D?!vGIS4F)lX#?jowF`*jjg^|yrI>$A+0Akvp2qRLfsI(S6Y7l^6Mh$_iv z3+Eu}szp=@zP@o5QmI=)9IA{rz1R5;EbqM~N3ZE^?}NVj4YutoONjFNs(7_RloB@} z453`lbC{3hyzhvw$R{BBx<7}b3rvC3M zmGnY92OHNwzw<%_m2DwUNYzVx0F`#eonkXfYHQ)s7kqQPQf`iqc>}AiJC})upMa`u z`wd|Gy`t9bS6;d&-iph%IZTMIGaN_Os-`|FRk>D3mRL=&G_T~*8xe4Tzg8OQt zc#kWn;7W+%2t1KF$8`hiupbfL;rUgG$gKc8DnfAz zXljPy40|p~7XB9I%M8vZa0xcKbR4Ts!Ru`xhD<&BOg^Q?#$Nvd1C5Q`Er?*o0%|YB zEVJDduUC*mvy+p(Q>Uz_d$KFho~7=V*3PA8SWyJ@9O)Zi4Oo$m5hQri`G?go7}$!& zBdJyUw8i^%b+&abouWkctc?s&ywc9Y(R_;>gb^0UL*LrM?fdjF_`?W_py;{~rocPV ziTiCFnW`w1V=XW9`J%1c4 zha40LRHrZQ99Q!tK89vSEnKRF#g0F!vsvEqh?_Fj@K}wk*MEeSPf4N9-W%1^LB&@2Zb2-9=jXGL=$f4kJ9d60oX)N`p|l+y zHds$KVKhQvnEt|o$wWO(&3If|d1>hZTnaPEUk6FH={}zc4z!y1E5JsT1fw3Eb64Ug zFo}5wqR8xxE;HCF@ey=%u@uQ##ZoP`vsA;;-LMp!wG2zCZ<3|h4~nJk$Ake-IrpHc zm!%Sa0r>06QMA1B9Cf#!9xI`yQGEOx{A&4p3Dlfq@0a^Lm}V|Vz(Z;7?Z7#FR{{EX zDP!z%@swJCVeo3nlHC1>^+-9fa9!RwbL)H`S)pWXF{+|jB`OAGuorfvJljRDK!Gy+AvZ|L*258@yPBA5@4wCUx!oS9|q4$=tjU+$m zsw!^NNsl=nV26u$9n`Xrt+4-wmtLX}!UouPdF?U@?;WPSrblsh0jTj34PQq2GZ&c# zrblfQTU4GMU}~XiEfs2oq2aPpisQY>By)VGVDhF|0W{dHNDPTkNHDJSkrKj+EmEkl zFjS3XJbC$wVl9j#jVnsG_~3i{2>&2T0eN#zUc$uN$HP4X{IxeeHRlf!dU zsg0#|LXQ)G83Cw9*m6T=M$aL{^8lwOzzV9dT0M&cmL+<=$BS z%%#4?fvw9Mtpky<#WQCT12dPmItJS8sfBaXm%6g~*8EyuYJND@Io*-$n{FP+$Ff_| zw(Q{Wg{!uGar{i7dv3j}qdPJ+(CVx5*uBG(WU%PZiomTT?BQ@$R+l zE2;6QJv7tXl^E!l8;&~@k@eQux$)(~V)D$D*xbg#xZT+{Yv;2=8|Pb>G{6++(b+E^2pWY^OxJ(ho{aY;vG&p)6ra*Xz6QDw5C@E7q4z-hoTo3 zS|bCa_RvCNvn$m(9h#ju6I*OcEKHu8ALwjLCeJKi+}_GJ_sxtX?X}+SXj{w5YkzO!v+`l>TzcXZD8hqlrS^YOk*{o4y&cE`-ZRJ3)tr89JCZoG5${OZ-#*ic(v zIz47bt_*Gu^q-qt-fZtYKi|>PJscT5v#>rm+`m5NtaQ(`j}FXj4}^NN=i&oHSK0=8 zCoVhb^|p(b#$wx>ecM}W-TB29dthzR)!u zcg`(NIOoPTyN0_*dJC~dXCpb#7FyVvSerc;YF{~jH96k4wmx^Iz3WOW85_Ddv64yl zPoA6TU%#~4(Koujy3v}LN)@J4+tXW@FRX7b&&_rBZnn=~>4-OPZ=D~H&ga{c-KqYG zY-;&ZYHndG);WG|V8TYj(Af5BzN=to?2GyI&_+jp;^N4V?aWP|xtKpcI2DUujYlWC zwr4JHbYAXgA6?tt7%GH2SNp@qIgS7vCqb1^vbdM3DUX!4dQR+WM`i#snice2w}r#S7eb?D+Ad@-yO@KW-4CYHdG~7_3vXe;nS(YipLo)4U)+waNveA( z$;yt?`JLrQSk4MN^OsPLJS(VVo|l!h_3)lL>M6?sJ0VXvpN^)JmV9wn1zD5l$k(Gl zBS+v-5LaKUFa_O5;@&TlhPxjZli^J}nGCI^kk8!2y=`SMx zQwtmsXd$oS8XIM~cl;8grW245dC5b1u!m*NXdKY{#_%8SlxeGqRcER<_6&iX139+3QR0*uO&T*iiX~!1yU3vR(|B8g-WQ-fD}Hmm8&!LAbVVic3=6$ilI=@_>=wXP_=FaO7PT3?**T z@P~z{RG4}kMDMqpwMhw)f{MgP#&T2wtIOn&w^cJ(9y<~*~=>LL&_01(B!p#t&Y0J~k!AYiCh?1d4| z(^?vPAy%obl)T|Q?*zbQ!+CgT<2J_?p;IRIf~`ng%=v`#{BQsai?h}bps82e)j#&a zH=0KhcOgUx9Mkf$`-Xh3Dxdd_(@Es3D5JL8IsLbH#p!I;GMuiysVE~_qOybjGB~II z={4bWT5m~|k>vDZ*Dlqm2AGEO9-;2`)3#D5-{n=rdaVBpjywgy6IvZt)#7?4vFf@B zWEcjDP1|c{)0f`5D}hY2mSNLw`AxDZ`$4g3BPI;!{CW&cuYo|uddsuvTc3|cmqI3I zrdrNE5!ZpnbBrmTlFx>gb$QVN11AG+_JO`N^iXRa3BUkmkW189Ga`U)7w=XtF5@l9 zHCG(a!VlvlHaRgpV>Lx`O|X`&3o|p5O)cS;h6^aM)I;S=LpUPPTbkLhhz_EF+XndF zU`^*kGq90+EW8nim!X+MvS}-X(2Wq>#p|I$Hfg8mpcZRrkiNe~vZ~M0j}4Cr`QpUR zK9Y~4OlKCJz)*T61hj<`n`fh93z4)v(vm+jJ2k&tI6pj{%WsCFW8S`t{8V*zy0xRT z;W1%%p0&4!)642t%~#nse06+nIDL6=I2&EKc-0zmHplyDh3j)`k%i&prM9V+ z*urpTC_yWXH^(lVyE@^V*|^lYmAO3M(LB07*M4cf1to_SxzxFgld_Oa^-vsk4?Aq- zdeU?n>fxjfskR{^drx9BAHo?ozTYM5v}4d@FeV2H##Me5=Iy z(^bTI{NeZ`#X}IEQ5)$GM-TzGT8OM7N8}*Ib?g-Hpp-T|q8`sLMzX6pJZw!4yGs~V z`P)WpLjf4Rw_@iEbP~B-;&uc=oqV%G+~M9Yfs+)uO57JCu5!uHV7u+E;7?V7ztsJh zGoiVR0c2W4aqKmCR{lgJxq70pZH0{i~|LPP9)rX!OQJ0{<=^9G;#S z-$^9#-+p8+n20fQg)ak8!gE-*Sd1V;Lp2-cdzr)hMc8Yl^i0hnq5`!+zH{B!D^QT~`P^*1#H@ z#bJ#{bFe!vI$?@y3}hFwbDB4rLq}1t%V4@6i^bS(M>Gc?klmy4OAj%aG`=mD_05aW zQ{)9+PG@VN%MZH0qPwj~zJR0=iou`^O}~(c9|lgz3F4{tu=|jR|51fVq*{ct`bW`} z-FSTTx<{>vc0_hMU7g08y>_J3WC`!Ma zrvGBkS5$BxC17YYNb^QmtHPe}w+UQrdX_h%?ZYFXf$6^H%`>R|*wWo%hc2~@&h)iP zvj=Y<(OVdc4%s@L&B{!8L4cyD{OKx8TB5$#;j-*W9z~=bMQlWPf#P)5xyoZ287M|NOfY1u@?n_j)5jF#^q7+jjp!lh(#||CRFt6j> zLXkysv0!uB`4o`GuK}1L2n_(n&dcaz7z36vQZsgz4yQaKiVZ+)` z#MaSD-LX3`qjLo+r4();Uy7@~61-+rS1%Zrn=-1>dO2H#$pmu-X6P4CCg|y<3Di6o z>TjQ$Tv~jFMu=^vBJ1>49|{VId3d-N^csNRGF13`fb+05NbdmhST7d0jnz|}QywYb zyq2vwHIc!JP~rf8ddkic9nW+RV&C{ZK*U>Q3)yn~Jm8ch;DFD3}y%B)!`sNMt@Tsel7@}V9OY}oQ6LCcuELw>xFnqxR zjc@3bDmq0OR-BHtgpd3L==V5qUWsBvo}i)gMO0wqCzO`vP)kecd8?}bMJRCZk&7-+ z%5gd4PS3IGRN!?;-hMRDy7i{9fwq8wPZ5S;+)fTldF44T?gnT@bsD|4Bh*iox0s7R zNfOm#A;F5{7bh0^!B|{=AqC?sn}Zn(GYH`|c)T{XhIXs;hAkE4QSSjEq=#C;ri0-J ze{60WE!L3}K*kuxN>Z>z7VS~-2SyuZ43O81oM;(@XE2KmzZ*3vJ?rx^s}ipTR!D&X z>(?hpioVYUU^Fwp>O-LKvyA61{)?m7jiZzUau4L-=Sk>;)UP+tx z>~to%m7F+dU%q(p((ZTZ)=*0u^0X(@lXL{e;S7ggYbL#hlh%O9frUuz z@wG#>mzdr}qmFDG+QF!2jJ+G@KOj&~3`{0}o(=9fnw9wD!>TLY9Z^QmW&{^OX=@oJ zNSSQtjYe&V3BFc*h*(kFq~Vmtymyc+Cq2^Q6pHxL0(s@SmQGj2-paK*W7)_`K142{ z5cB(lkQkbpP@TgyS?82sE#)Jym~(l%%@DWObL>{vj*`X1ljRB}-7`hbDfW zy1uXYl&s{lyKUo62o(fZc}B%vUD9%Qqk9Wh-o`d7+rllKuKJXBJnjDATa5Boi5tyg zl!`&WhmPjY^PR7h3+KIB&IcbWuRn^vz@>-Pf&w30`c4JAP6;UbMKgJO;>y+}N0Gjb zX(aQa@wCPMT$Cxd^n(_Ey!b*Rympkwx(GeBh)|!VDF!QAC-WJ0XX&5R{xTajAez$VQOB{E&el4!Q4=^G0Woa?8LHcOk> zY>y3G-i};Y&5vE3YMx7sr)Sra{j+ORmnRl7{gLLWTy$VKJ(ak)JvTQvcR3lGM+v~b zDK<`O%o*()?m)7FGck90aQu8`eWAHKyU=>3b^JocnH!wSU22<~m|h>eGJU?Kc|3Kg zV{Tw-KAN1}yx2O`I@K~fz{a_V{EDIV@$Hy{B_@0GZ275{?l54z5<9;JScmc#Q?dTB z=DC?mS1-pewT^8s4f$OJr+qR%IJz7gU2rC*a|_K|UE_0? zLWASm!y{eIsg>oqwyv$I%QJ1Gs|^i%ySi<7Y!#O=d7c4csEb7sCOo~S%#oDxYjm9G z*=na-k*Xv0&e_Pd4sQZ2OF4pEYU-`VX zn6H0q?gY2_TKs!yuOeu)*_s%s77bb&PRfHw5hZ#e!kB-N*};_NGII5+&#W(uvLM*0RRq>-AE%NapUaw3w=ZXXSSpRLPt+=?O{xz#vT0D4-`llx8TF>?fibb-x&H0obLT8n#1D>SDWF<}e>-?z zEy~_og_&Hc<2`7~RL6hw_4+(-sH=ga6??T%5c&S$07wzKM>GoLa?K?kndi5yTN&ivs&h1u1hxNg1mJG4FkP;|KN7y7r#haDld` z^wx&0A?$W!Sl}X#-&UE%3Xkh_``W}WuB}d)aB$-?0mH-*j6^@N1R+Ijl(on@@XS(w zLlK2pIdhanj%1>TDz?+C^{L>j^*3nBc74Wo*GpgTK2Sg}m)79j$F*6L{}BLSv7;5h zhdC`PFC)1B^^Q9NyMJq2!m&m#6H0ct)AK=tV(r&rZhj^S|p}{kvG6+p_1g)*=}H-V}`Pbb#WwY2XSy|+nCNR6yEuzm67S^+u7765k1cekgPWD+=!LP)(e3W- z%M0ThC`^^Oj91QdX)OG{-MtxI?{2<4Ki+(qU!F|48q>W_GLGx1&as)<*0ID8{<*X@ z(YNVbT9``HB$tzOL-y>M?Py{+GS)m58J`&+WaC7eJGSSVhn=wt@rC*G-SL^!TFb<2 zGBe#geh#l=U0t3V99-TW?hd!6=ewsS+d8(Vu3U|0^W&3eI!8kT+g&aEa%m!y-M_XITV8b6hk9N@CCd(A%z^6w$`XBA;Z+MJri?gcsN5f-GyNTi0 ze>3L?8?+VA8HPiVsNEduj-nQ2v)$4eZEL0By84BTyRik=zm)fvH@4uH^A=R9__-?f zLX8f!e>N>Tw?nPiQ{h1uCO>phSGtT?MbvrAnmcE zH=AI&Es0`3T*q4ckyDpfMq+>9Z-@iPM&>WFmE<5BHLvVRk+F2pAD*8f!j`WH z*RzKq6wL3d0&^*OU*ZAFAn!UAvGOSk2L(#B=H;^5H=+&|H%+fRAGS84YqPz*n=U@M#WFmMD_xzi+UjvgR=s1!2|cjHHV~jBF z%}{wYwfTAv-5J=?Dp$1dUR*)k*n(w?e?8x}pwbMScWdysj-B)ff5XtJS4_bqWXF0$ zm+GPlTqn5qfOM~NAe=y`gK|)uu<&VgHsfr~_012jHQN*U_P&LScFXv}2n&yxzr48~ zUr%*UT+DP{+FEFiw2r!hC1~K4^Miw3tnKVtd^FU;sR~*c z@H6;T*1Y7;9Gy&j)b(5O(MkSho8fqs&%&vUJ*kocwpN%sQw4LRl|I7P-+`va`p3HQ zj9zsB8Y=>D5)VO~lHf=vYU!dt843={Ufgi_v7nSr^Wwd!OAo8NVL_=%x7QA^anR5q~)IKGr)#y+fjRi1j966@Pd9)Y#X$ zXBXlMi#S?5#Jaj(O7WFgFU6L&Xn47OT#PNLP_d0d+&2WkKa)<6Cq76*>eN^-E&cVJ z7DtPR^Q+l(Ayc|wz;X+oYNm2uB_HGE&{sTyE}Kp)AKw|dn*`%KFb}5tHa1=2JMo7p z$;*zE_w6U>|*sPI< z1sKl`Cw_&H!7E=JVy*Nx`d|1Iux80GqiLmFU_zPc&>SF&|6+h{KTiuhp7;oBn)n6$ zVWPo=_0Gn|emfVS z+Z!9F>=k%FDc;?W&PVT3P#;w-HO#l-b3mAHLDSl3eV$-G7@(U0b7jH%vqZ(?i4O(9 zD_I$4$Bjx{#QdNb_u(HHq=HS%vaT5AHlGB^QV5df1W z(_J6}oC(lP5TJuKtqS{n%nbyqDQB~@>(Ub0HcLy|Sh>^FLc{wsgV(eOj>rL|y7A-@ zM_HfByG`hI8lLHOcX$w=voc?qh#MlrEwHgFPg@(}ZsqU#c6POQFELn8ChGMhAdRV> z1nek%67cmLG0HOWzR|ja?`7X;<(+-rXl1jKP&Jebf4^0IgYnAVXk|YrW8r%-VL-|A zE+0bF|BY5!UdfYy9P(ONXP8*$IiD4~O*_(y2J2LwK?uE8HtMd#74(G4mGu=>zk{)b zc08(D>TUab_#BX0zZC#>bGMBU%6>CIH-WNWV@<1yshmd$(TR{==vzjDJgVf1tHGru zJkp2r7Onvb;`MPGM>IUwhac4u&;7Qyr&5snaS1H}9}P6QM(}4Df=#)2i&&c!iwCe$ z-Q(X_kILdnNJSc)NyR%%F!f+%re|1C)8lWt$8E=|bA)&L)?FY}2@Jl(${WSxt5M>s ze_*gzMpJEkb*-d09$P&;p5KX(u=w#K%F)ETSBjs-_p(x)cdoA#9}U0-BIxr1 zTf0e!Yb3=v8KuR54XyL z!yb*{`=+ z7>rq&_4h89@At}O@dl!=c)st&N<80Vif7SFONa;1G$5IeqiJp4nTv$Vmjvi0PefKj?9uV&hbnfkH;pluSn7?FWt?QY_856M+YWLo0R0 zLHeuiGZ|nR!q`^JaBnm|XXR~RYJe%?jy48TW$0_;4u1{Mw%;0{O=*BLr5fN0CtO(# z@EpFE)d0M6bq&zQC~GpLpOEM6%4mQ#%@J=7z!8Emi#}AmHX5MKtpNm@O$|Ul)}{fb zi7`_?AeGSoTx?Zl{k>}d`_Qsg(IIGaOXjWrCEy5CCp-AI}iF zJ{q8#*vCK1npTza??>Xc6xb2=awbGPqO4h!2t@d?3YskRF`CYD*Eb9J6IB~Bh2^9Z zwbH3QdtB5in3AEGOM1qWF6znL7q}LWf@|;0WWATKH|Ae4YL+;1DtJ;p&3aU(zYy*; zIMXq&uGy1P8=@3*a&RhdACu!|iR1p9EwnOBwQ-y+o*J?69#@K9c<)0jY1o?P#|W!a zmjdR2@!^!6Z=xIHToeBxgq#5Ch(EJ-sAaL4+pA#ODIVsVLy2yF6g0$n;*OW7&HJ(m z_KH=xH3%-C_fGDjPKS!sI#e>*L?Pv>W1z@#FWukg@JjWrVRuXF+pu=Gm#Nra59D&w zM&8yJAM&G$JQTWXFTad8q?8UucOqXHhkE{m7PS=d62-$=dj+rX?IbJ$z^uj0VXB3X z=ZKGwGE~&S$CYQ;yP~0^hTm)BzG~+JF(JS5zQ?zh7F)w;8t|ww7yu`xNSG&7_66uB zM8d0B)2d2n&LzdwRiyv>svPE#LFm3tgX zuQbJ0TA7E1ej%WkesLcjIHZ*s+obmb(L2h!e8m1 zE@Tmx(G1@T5XJtQtoPDfy5y}i&7orbrwF2b>OU*=)nig$RYtp8DZPoaraGk+PX#8P zNApZ-DX=2BCx9=rXnCgvVriS}rbA+?4*T6u=OtGByL)tj$o`(Lyr zxMsVHBXm(wRZG5KN2`EJ?Nd42FQN+_V{S6IcL`o-E(A zh*-U3ZfE2GMJc?EM_j(11!w9$CyNI`gyx;ZbNFCWn0xU~8JnF8v1$vT5F+1;JlNeQ zR36`j8l-u?md_(2?&FV-$4`wXG6?N|b|-Nj$WLsdMJ|!$ztFV&7jM?ct7af!sW^ae z0az2u3Gyw(#p78z?PGXidcdMMZ5!`qtHcjg9%AnUDFHl+^;c6`Ca1ibI7K1@AifUp zn(?fOx0n2Mvi1o0y9xIqivAh4L2Dnw9Yw#}F?`nX!4mj(6()x;au=a}Esw7U;KK5_ z)zwxT9d8IgKjF@OJwsw;^UEZ4j7a@lfNsL*_-fX)s?iZ3eEvNcNy6pW| z+}{@f026MT;C^?2ZneQ(HGKZ#8fw4r`TrRl=3fl3coXIog85?sx*0HQvFptzqTMSL zz-t1GD#GW*CT)Q_FlEZ_;^uE@Y>XsVeRtLuuqeS{2hc|EsDHzUfSmRD0DzfTUL`Dl zERjkFQ&JsWO#!Rvai4RCtKf zdyS~9U=8(-_gW{Y8jdw@FI&^PCwv$Ksc3earMOtVa-iG^TywB$l-tI|GhMET7}s1O zlSyZ(j)j_@c{2t;+rtstJqoymntX)QidJ zMDQ}qh7&>gra}BT<$J>)bEl$Ct|SDWU^Ptf7ngE{$HQ_T<5I~_Aw9S@#EWJd%^u`U zDe-tT(HcyHS}f~W@qE1)QdwY}x|Ic~DMaEVL|(!WRau+YBt(i2hJ^sWHi#9sa` z*0h>IP&_}Ia!^gmts+%%x)DbMFMJ|n|P7wZ)wcCQwBoo%k+cZx^wR=B+tYH2Q&cYnx0)M@=* zdG|?tFDvhOXH(w2Si}gs7f>qe%C!RZ{XQu|ejxxM#rF7TAL0d-aZd)9aX_^Z9lU5n zh6(hV@{NA1O}-_G8-LFSpfd7}Z`>N>Tji$0VaCr(<(v9B%r5&JKN17@k$J_WIaJp3 z1(%Oez`BgJLfZ&=LVvwDO1zL#b+3ll@THe&P%_as#7%Xb#it{Cub(I zolHmY>XIsPyUpmYy_||^a>}#0%ic;D;Yx6%;#_#Z&^7Q8~uT zsGysyqCyrHtDo{y?)g;xlxyNeeG{Ye-n^*09mDNK6=T%Ni(0Yp$OizjFzUR8M?MsQ zRfOL9DTcVp8^q+QZKCo|1n4Hrx*uartD1EIJg0wvkp#s4g-8Af4FaA?elGw3CfrvE z?%xj3tv0x;dQQKfq4x8f{#$UEKObQ6Cd{uPm_HYwn*noWDJ@PqKN4V6;W-tXs*avh z)GYQrC^g=zIP3u0X!Ug(9|CgLNi?nGM=I4+Uqx7cG(b0j^M;Se2)(4XY3GGgWs>Yv&Skm?_s%cb%L`x2uyCO`^|JEv4tFD;!lSmdksddJf;q zo~L+c^E}1si?C@+Pf_MK7_RyUWu&|r69(KTMIX`xJu$TgJ~0t2C7xJ;wqwOZjDniS z=>sh8dexHY>S#eN8F?OVt(|^9y({{$Y0J=0eUtQKKPdWrJUIP+{+iH_mRFvBZVAC@ zSBr%BYLXBsA27=pd|c>j)3g#mN`Z8YEhCq4w+cK;dx zUQ>|1meBP10NsQj{TyprRXz3iD;(Eto^b2AijVS2?aFnxmmw6(-+y0q+?fdZ8bZi% zbgQQ3YeUGFPO~6a(pw;9?^f`YG*U-X$?ZKz;MqEMFI#e$QPK`uS=WML)M@;k2tP_e}}$97%|f4;W=M z3m2J{XQ+#2!He|12cHjNtx~g~jn*t54o6Dzp;{s7&CApLRHw5n!lnjIfn zux1>%W%H5sj4nP6$Q;z0&f|-W=zx<_sgs)fDIM|$0kC9({yO52->p07UpgJ)Q!4Qv z7#IZVxWBrp7doT?O}*;<8tD*$wo)BJANEa$_!LR2M!yc=sCN1( zJyE+3=?_l7S6vhO`RWiwKerCyw5u%PO$qUOk`SM%RYFvrp)NWE&vNJYTi zI^;FM$+qc3Hm}Y!(e!nMrhI^ILWf*oO{?mVP&pkUl?N0D?tgNH2nt3k4N_w-r9Zwc z0ESGkzn;L}sXN$TI{o2OQS3(v@hd*0xkma!psiGY z(1(4~A3pVfs?qPCcSXNF=#K*r1lIpwye9PX)gOv}ZvDY&S6RB765<<3Li~^q7+!g5 z2*%1Y>|K8ZD))W{bP}4RT)Fq2;H2zCQ?DuK#es>sHxTOD0(29oYi3QW>XZeK#|yD) zqMBw83U2f)&9FBUh1ZKcq@%+KtS8yMyH7^fQ}WsY=kEK<&Y-pN9K&4V7WY#!Pwj01 z{Ne}ijyS2Lld@ee10h!Y%dj; zX|m&qSL2UL1ZVk$v2=7N@hFXY6l2BG>k%illSrX!5tXG@5LRRF;N1{RQ@j=b#?g_5 z_UycYecp^@Q#)@+JVE`-=i1R#-(fUSAthsPB+eoVlw5FevQ*xFCYQ3YrmMh8OQ?-Y z`=)K%+8aM`dx&D24$@$nwr|C1p@HhodxolApK(-b8piYw)u7-|I0 z#QF2?$hz5d@SZwyRkJp-a8tY-wX3~2&&W5r5FXEm!yD=H#>K1!Wn|h$EEE%iDURpM z@v@9~)f^)v?MNdEZLN`%Hjt0(qZgO{?mo z=Z9zP&Ibu|`)yd>k6CK-PP~+@%VgHt4m0;+go@&aD*pO=#2!W0{WL7!LL5byFEK1R zIVx{FlRMd1w^f1FWmpE}&iy>h3}dzX&vP@Fr8b_MW9!-r&rMaKLxltM61wgu&%Kp+ zjxb-sbDSKt@EjZKd=*$rc&_pcdsinlJ*4wytX^q|5Swz6?pE8 z=(?Xg_jckr!h8wOadOncb8M`?sRC;W&sCnGF3N>YZ>qxfV$9A*oTPtBWz$27JMQuA zr9EjaXc|ztgwV8-K}$F>x9_(RSsDX$6Uyar*3?J2oHQyq6o-4W*~m6Iw^*q;UiUN? zwgw_7Md$j7KO5tuqR9dtwt|S=?3bAa(3$!Km_}vGIlkjb(Q$wP@VU!iP@5hi!{L%Zw-?*s4Q$J58KJEIg*edbhk8M99 zF}IGv;)xh|fCT(WPsFYqT>8ikvY-jYaZUh^6OQo}#$|{XxZ7``T0&4eC^X~Azk8OJ zeBh94I#%*ckM^1X3zYA9$OYbfTKDIxsVr^HE%grCQp;>CQ~SB?C6ZmA0u|A8ku^1G zdb*Z9+#Tk7RRjFp=o(N!zmu)JIz_3Sm!iljcgX>{nxpDBy`Uct zupmJ}wIDYI`Ruh&@H>fu-@$;}Ed>|uhy29z3`#WKkZdKA?Gr93miR58+lOQ6jO&j> z$ujr&e%I{t`vKTTNT}aoBnLlR)l`ojp89~djki;eR1un=+{KbUd_8Nq5_B2D{lTTB zDoPL}xvyLkJ@&r`K&ucGoYJ+(gzqAm@Cn8sHOPeWGbH}x0P5`jDgH&O;IBy)Jf8R< z{c&oHX^^J_%=Krb-MB4ReqPr>qOA36SO(q-V&Q@v9N7+i_=EOobacP>4{iYhEU zJu%eZ*FM)b6t?=ak(IpF()NsgX^5-k@UoL%E=1SteAr1hiHGUrGlT6R{suio#fJ1w z4#}(w_4J@|Wq4FANmIY^Wo#qXtE>Y-smnU}ly#-~aQaghZr-vSPvLvn#0B2jyyWDS zHfUOsgC2=OB@o$?=o_|!ZmdkPF@}K3%qaxj5L>(1bRQBI082?(2Z6R@#lxJ1N(lI7 zYzZ0VSxjA94wE|NZa=;jE2UfDIPiyCVE<;7j;!*PO8=g?6rPbqPwKgM-1o#@wk^)@ z(|+Z+R9DA%S*Al@6SJ3P?tVJ$#G>sRQ73H0r1U@=<8_#AVpa2wSh0{hcY=Pbtpesd zNuodQvlF~_y5TISELr#Nce#t+MvggIJgl;a=Q(|o@V=kekIRAE+>P~K`tJ-I<_7nI zC1k<(2Ec%M!1-^4xbF_oO(5=_tf`Ne#ndyOm=bVPu+r?*5FOb0nVydAGTKN5C*|-U zfOZNXS}BsU3MmKbB!@QysGfc%V`w%&#-sRQ`2L~FZ&9mf~q~1Y@umD zhth*+TFHE(!;6W^cM~e_5714Z@;GZ+RTn)!VwIj`nA`8`!5qPDpH#Ton?l$9yxRL7;wZv=$<-bwN9Ap3awi+By9%tX6L~=H+|TReO{{kR zualp{EVc36>)5(Xj;W33UR#9@6?pEO(RDw0?t6*n2=gU8$H`F(&#|%cRbVaQxym!_ zUAf#H@TuaT#li(+RCucRBWM*+rTk0)OqiSY`-m7H2+&Qal=riy*NIB`V}`l?Rw;jt zS!&zff6Lajm+k#mj11-o0aeOBq3eEb@9!s$BFvX;Z%&TNo6qDE98;T0c^O8iWUp3GDW}nOKY8vw#B+rC5}xDasD%ALT$Q0DaXo`A0Y~Su{0)c`pIuzC~U*j$8Mk73Q7e_ewmT zh8}Ujv!PLBLar2&r`h+?U>^2NXC|B8a76Hya`0_Bc|194HMTalSgd9XrH2-BRx};6 z8!2_t9q8q%=MupirXm^)uZhBIn9hWf_J*BA;L!RqJe4w1hz+WyLru$EWYxBo)3NQ- zRv||YO7ej&Ey1UW3MK3&y(xjPp`|5^6mudxstGf&_$fF#5&HBrzpgve+R?rAj83<^ zynp!7{^!>*vL^o7%~Z$z(I@%mZa?Je5x*$_qkN7t3Qf+WUgFx3MlV!=ZrpI+?MFEY z_+4J2>apG#0BCWet$==M1&+`oi&fU^wv?Dm-IlicJPIe4SN68_X8>v0+fv@ybg;4u zP&O?oeV^M>^-bQEvLBS-`PBfZ6*nXwXZ&Q^3H84%rR9~}mMW^g2s>D7`(LMjQ zeKqP|8TIz|YSeDWaK9QQ#<&)*MxA)MGKIabMm>U0)%2}kdkak~8MkEcnOyc0MCFG9 zbQ34%2UydpC+7gKMxDb*!ua=pHL4#C0>b^O005Y9|0KbEHbA%9;I8^=)Ut-!@71VS zaF~|@EZ&6q{RHzf0lFD5SC(1gOmJ_2QN^oKVpG-Y)hKY9Fs{qqz3*UglG9vmwQznr z8U*CDw*&yx#5#L@?@a-^39J`c(`q|x;r%z?bQ2k|@?=4`?}(e{!aT;zPaZt)e-O!} zad{pSB}Aw%v!v-t-Xhx-kzEA@!c&30EMDtXk@z$`!W?jA?|;D2xBCbhqgZ_0&ZDS1 z?CZR>YNzPx9+oaQk0X}xih3lO+@=B}X;{vgoLz{eMbQ!Ux;i%v*(Vz6pfF z{~$a+#Fl27m2QV6=~rRg6BO)3bC@$(W%!UR;lqP+^~XxS>Ct{|7fZUt4z~Nk+{)nP zRIIE#OhNh6q@Lc#&{i44H3`b%9pX^UUWRiWs&9T;Bk}JT66^N9nDIVbtIzvzG@sj~ z_XeWge4@h9ig)%oTJ7O|xVtc6Kn-{sntE-_`X8-)--i=uJ61G~R-AaXaM}lm(>_%z zr&XRo7(#DkqweZ~u{#o5ib#=vsl2^vXH`VszR#m1Uo-#}Ow@jeP`gxj)CQ4!SJ`6sN%FOp zzJEpYRg!$)g70OWO1yJ@CEq(40xByUak~Bvwsy1WHIjS+Z63+TiC0-JnVj}B#A%y8 zaCrB=v570sU`W2oO~thkKLVC->US;ldFB(+$WQzWe(+ukakrK%#_sltnRhK;OP4I# zyB2?ZJbr3CkwHoDXLk~R4D=*EjnUQh5KYB@F|LPB1-Kp(7cPpWi%$f)A5z_1cUomH zi0Dp5BeVEu#bu%5VJD^Ub=ifUCb;x{$@0JiUnn zwRMtyo5cuRcj8Axy+4kNE(Fh0$4D}Fs=>Twq8|LFsk5tHJ&z2h`)6mq?C_wir<)&U z=gxZFuMleW{ff_1o-|)2Rd^4+E4ksi+>XB+qKkL-QH5+;+D3-y$dk|1H+jFpeo&k0 z5rzOQV*TzYq@$Uw-E3NaRY=P#xnB`zGXuIg?X(c|Te_(UKSr8R%7!2p?Dv==Yl<78 z@`zsMtHSMt0Js$bYXD76f%S2(z*>0U&D{HEu1Wd=A+jhL6GCg5ix5wmi*+uW-h{+B z&2PpV8z(2GXHb*_890rN=LhINQ6(duhEYA%dx^>llLQP~^Km=HL=yjs#-gK;k^Gk4 zb(t=mie$^XF2x&Bd1Kw0Mz!Eb(z(j6#&IQIIyzrUt%F}I*mz8GnwKi}PC_+5)=}pa zx9+Sq4o(lAvbjc&TuG)~%FZ{D4>Tv!VMTUqh^nWm)Ypg2QH)I3Ari86A)J<7bBw(_ zTV9e!^5{XLmhSWF04yoCI}OjASqF(n^bmg2;+|)Z#f^nms#BW(h z@aN1b*X6;+*Y09r&C)ms%J?NqG@>o;_S+Y7xi2o=GkUb00E-uq7K)TFF5Pi@KtBvt zChU6xEWyi7b;jR=jTN@O#Nz|y+i37V5C9l2KJVoPg-V2r9#tUK$d-;7WwK4FQ8(G6 zV4rXm%Qoi{tE5cnUj^{UK6{`-W3T_ueR>r6(uv=qVcu8l_hd)!N`AVtp#=l$aESAD z!V|}m%6@);r*m_;o^$J}oa^i)TJhT1C9O)zXa5n9f=hz16GJDDEJV1CNmItbL3p z|9^X50w-5d?VXh@B!L7H!=_CjVKPilGD#*I5E!yR60(p4gXG1Tp6;IM?(}pIy<}1I z6mgkovnT`4-RE<8%5&cl6>-6Z=gK1bTv7BB5f>hcB9HHXPSw42>-Oz?t9$OuBpQBN z>FKWREOpMQQ>RYRVbYs~qoUD1JmxVH!7MERS?=WB!7Q!#DQM#^)kHHRPTylV1x+cfWml-sx5AMKVmaKx> zE0`r`4s*s}@;c1lBba*)nrSfmOH}E}JlmjG8O$OVW>~>2fe)s=4O5eR=JjCOzvE{^ zE_;gskUGZiBaFY%pqa$@ZCo{QbsZh|c0bFQ8}3V1_h1xBKEr#vU*mb{La@FIFJERd z=sh^asLzF$@1f~%UU<2mIEpaOdrPPNBgo;uT6ON^zU~Nsl~hK3+&P?=tp0-84*$K~ zvGeQYx$$V>mLm1>+_M36@Zq`X7<@Q+?g8RC!h99a33AlKbKKYe2EbaybN(Yp9drx# z+E5&UK}6(5iYM@ht{oz$wyGC;!c!(C8`zf$lA~AI%_(2Px|A}&htj+>(7@CePW6- zdzdo1qPn8iv%rnao43LG!@Wt2Db?1(>c^sM45Fso%Tv}hP<`?w&K#ik;ABT1d2%h9 z)+?4WmLCg?0L+ zhrlhX4g{g`fHB*R;|_tl9lzH+{Su8mPQQi_0(S=^pf-;=MBXQO?t0bmPrp1v;3V2y zfgpl-^>Erl#I?70z~Nk0Rh;HOf~LCstI9wSv3;st)hiHWjEBBeH-jDLq?wls=ZWPM z6Hy*osD%FVfyZrLy@C~N5C30vD1>#Es3Zd)+uaF2pYCF6%4ipNU9k>3Tz7P9{cL-| zCM>A7*4#vtCyQfIRX$5-DLHzD+_rk6N^zmW8iErzS|_%#VaUt~cqwNv zMbaR=Q|4zZTDBSDW)jJ4vKKc*1hDQyYh3wYB;mR@-3rGo6?H@U$Wen~W%fjvkMs-G zGjsx22QxKNf;Jg&qCAG8!Po$~``9O{y%GfmYpVy+Px?yynQJAEgoA%Aqkd=({zm(7 zI{0NDBjMoB0%W-%a69;O20SZwju}RrZbrE^mrmYa5qWzJn#rAGf~yAZ91R@&74#$_ z_IB{!hzf3}i5nOR_iGFQ(Bb|y!ToB3X7#}x=-_|9g4)Z$|3Pz@Z#S5{4)gybnE%tD znFh1Ju#gsN%%E54;FpUkEC)ZLP&fgJ*X@pVA^!T%qXij3Qmxp6WHWrE+Ig&r9_-;k;mkOT|kAv*KOZFjTg_6F~U0uui;3iFkhv zop^7QcjhPn^Bml-p~thA8AU`pg6s|)IM9k0E22n{gGhzee4%#{{-pn}XkXHXFghk5 zZqHVn*Z1Z#xrXSwI0NrBTo9p08>*pJalGx-o(vk@&y%qVzt{9+h{n1nV@{1pkZ{mL z{QPPHN40*o8SZieK9@>s9Yd)rYg3=cB~}a&U4Skjf_@(^X3=GBCNSQ&UX&{JWr@mm z#IMeE&iEgR?wOVGU`4fLB@bx9RWBKJP6ZLRhrL=P%oM5>2T>5J75)%@4t?uEjPOTA zxYz=VRs1D^2SeDN#L7Yy5a!>@8lepAkS}B&U!h{V$j4LJj+XO*ZYk2OF@vMoi%v*?c#e*0Vxt3bWZ^KW9=FXc8VAeI}V}z=IGiWAJ zHON&1&7Cii+stjvurno|O2+rGv7^#+a7qo%JwZlLR~I7y=_u^LJn0mX(Ro%RUcNg6 zUCcQ);7hUc#=*@a>v^SHb-8(^Zd|2QhQW{O4!~ zYTo2h(|gDRJM|r<-Oos?jbERmw1?5O-lH^+M4jZd(T~u6M{ClirZWyi@Q}Zt($_cl z^{D_L9S0kR>-$U}i&*VToJQ%SCX!+!VwB?fu@ko9Mkj&w(aB(~IT;$=&nP_uzt=QM zMdQ&jN}CyRwK8qJ zi};zlXkYSBvhX5YgUqI4D05M^|LM(3&JN8*c}WLUenQQ)n%;r5vug9x5OUwxYM^p z-@=sBd`lM%X@Oe{Wo|7g;b8ka1>4uIYQn^|TZ1K^r?F(UMDpdYc`p8{Ztixo%w~6P z+p4JTS&p_v+mz#_GIx)xfyW&+*{K3=c$yKn*ypFo> z)=kVB#+a}&{72A?G5@MEMoOGO)voFlBXx<#iGXj6loh<<5hFE6TTphkXa~9U8Wh`M zEo74@DGEVS&{g!#qE;G~+QT_&R1a63pN5ma1O{cz5GPM|-_pc&e{I`Fa~1}>tYi?@ zDX6LkVg0!(29_}zqv00QwsGMyS_g{9LqjiM3u zOST|=+EmM<1S#s79_G4HpO)HRoXZ#=;`VyFcIKl_c~(?!sA)XE4fRU=Zfh<_cpztM z5sh^P!rAcYyhHehrc6-&A){<9moWnT1(Vz+ujRSxRZX|aODx@Bes<$j7ZPoHwiZD< zwdjMhwLC?l*jhOz*;=Lx-j}XVOWnG@wU_Tc16<1Gn?hB6`99-bz8vyLOU3fr%F}E| zbe}F>>@>!)oVbZ?HDnjDOtwPVD_ZcnG7>WLBBqx{kQhTeJAw@)e9Aam=VwIprz;Ld zvC)X)e6}xIE@WjjIGgF47`(|eQ}+fHI~*i`Dd88_OtqOc_ZQOpv4id0mpnwi{9X4VHD=^V=bV^7)=-VI_wS zG3)4F?)gRpu$b~}=VKzC#8RVOXTYe^J5Cd0@A%pfD6M87;nfnC%&cMr3$~M79HRQU z#Q+i+Vqrrv$D6-Yr(Tnr=43x>UQ-oIs@CsrU`icBXJ}griP_g97M~@tXh|e@;PHG! zp3@p}tzbTsiornW7jL6G+)&AgLJKT!1aQa&$X|1gh*UC`z~Ma$4X=)C^@aiS1uHGR za)>Oo9Be#-%rYVJPZZ%op>Lz?fN5LqaGdz7BH^&1owan*AmL$uv~4;0RWR>zk+Stb zU?R{ct)h+l(na`nXgb+sY#-z(;#rENJmh7>X-&a+5|K+Py`CNEj)OVzj+Fz87$==$ zq=+0rE}V&IdUTqLBnt%$X&KM3$GkAs-nxXQ=s1k%+G{1Tm*aF2xScF*A>?s5NKza# zC^K;MhZxD_a3qoXxnr7L)I$CoFJ#@^+7UiCS;Az7&Zlx7;EvTwTd&tx@E`Phsxx1E|EMKU9z%z*W#wR`BDM$Fh$u(W9C-saIPh%8GKEp&w&+xo-Ay{8z++UdtdJj%9>Ju3^ z>HPX5rxd0sll)W>tn(1Y)8@C3XuhYJ#enfWj{D^vKdKD?_pn7I^9>y5^&hv%jf z&k^RUcutU`9-iaA76!mt#dH26NFDSw=H!MFCE>v(KKtq{9qRWEQZHc2k|n09s>(tjdHYBb zPv5-%!{3Mc9EkW&e;?`&u`0s354FnW&l~ppP~W22>mES~kbZ_tU)JZ-IGL9DCmA_) zEOUQBGIS;6cO(37n5o*lLpPCJp2<^4OBcAbU2j^ z&dm~ZLSDkltm4#~jwYyzj?U?J{@rit@9Sf zj=yl#MBi}hh?D7!`vmfM#Y;6Gx$noMrLL%vO{&1y@CQrkjGO@mbOCuPA#R^RGl{qq zR}It|y{?^yy6b8MB8fY(h*wPZtnM!dKcGCG_1jWA!e{}bf!Uy?fSa$m0v z0Men{4SDytavyQ!{!I|^pI*6tU95@__J5?@9rrRuCLzX8X!^Qxmk{a7oxZG3xz8b) zaSvmswlJ$&=l+sp=o`S9A|+TSzxawPr=Hhrr$%k*Kbo;L=rv1XWiR^ksdj;xt->TN!P2EJFWfK6F)a8Uz?8o9eW)Qq?}YdOc<@ zHw?2qTPYzo$oTOGR0_G94RE5%v(pKcHyAXN^6WKSHBfbIac$Ia$EK?bzQolO_`R9~ z4~naqkyZ=nqc+Z>bl$fb_f?|ZNjz>?Fh1(~Fyl!->RR3SsFu81-q^Gi{XWg}@~59X zG9wVGl$3zWpL=zpoC5``;F+|}A7t#*vCjP^$xbFClYku;*^)~*wAv_yHw9c zs2IJ~mO>hy&h6v3l?DjcvG`oVV!J@iuRI=9`K{x-N>pa6T8+zIxPB#)Fp68JytVA= zlDv>kSejqMZDunDBFm{s-#%(tuy9JH=eyc&0F<<$wlE;*VQ#G{D(0lR2z}G88%)dC*ikjA^GUpLWKgA<9jM6kjSggb--MaDW$gVW*`IlmS{YuoA z@RfyYQU&0nax525ws2epZrv9nTg!d$uEp0;ia9aY{}moN78XeuBAs zQ-kMZQv-h~YW#xnSG2GzUgrrgHBjhxioGrL^i5~WAy9+-zKM!R!8KLJf3ce^d@u30xvr_w#c*XGSXTj z>sxzUTO#FhI~rZ{JX@9-redx{Rb_gP zQSPp(9WsxIOff32u`^LlOeC7ww0oyI)g9O2c+KTKOgnx5jq5tjDOnoNGnLN=xxGIT zrQ)NZ*p8_KNTp%rM790-~wL;iK z9^5d^IkJW5$;=>_jB5Kc17u51pkbI37S|1ljdU^9dXV1iLi$LgT6mfv9omzXjrQS8 zwIKTlDb)hf4>(bgF?ZP_rM7sxqdtI^^FQohF{Wb;n22?PF`%(h{bf;h&!F{nov-;o;OuLX!PIHy+7hQ3^eWRX$ORTw+6B14adz&xvTnnqB!`Vh9mQF1 zzz>F;HD~~sj^(9<<<}WBlUTlys|K#9vmL<&$W;)_(u0&;U6jh|e8de{zGu>1r+QUY z(0`nv*Zud?oITm9%j#UU{VccjH)5onK*LlW>x;4dSxQIeGD7D^xG(=<>qBR&%vT4G zV>|NIQC3j-&B_%^+Phlq7ZR4Xwzch5CZY2=ogWKChLt&srlRuwA_uSg0Ua6-7_~P^ z?#x+##P2mTXNkso5FBUD;$dl-=%%gy8@Nh+VOths+KkuH-#sW8e!gFVh2OhyhMGyV z&8#4E7Sma=bI24V*0CwLbaDL@JP!!1pMpGW4GP-7Srp_iYzi(nr{EG)b=wxd4qJV>%*ta%2%gca0`TOJq-G)lIcmj| z55h)MtHEi5eHo)7qG4EUu%&I)8l1-Sv%wz1?=>~JXdJE$_G?B!ZT2LzOJ~wAcg+R@*wSh|>L|hVT>N0T z2R$8C-IkXdUVTBXA~Ze6pqbR!r*hRGon3iPA?bLwg-(v;g$TMf5l`ijpWS*3M#QtV zP_}kkRntA6rcJvyFO0}1rdI5gr_1!zi}QsAOYhS2bexY}HfZ0gG&pHi89@jo>WC{8 zf&%vLu`*p-@~$@E37ycZiO?%TC$zN}##&yX?~eUs@s&LNFlF%ywVPT}EsJS9KUti_ z?=@wyXzVSE@zzew{jm7W+D#FH)S50a0(1fEUZ_$Q_w(HKs>33SS5)n$B-*_8!{JlV zu^(PqKLy|1C1L%4QTufyf1__WBieAb^z>-{VoDL7tTd-+LF!0HIm`*3+P zo%Z#|4rTK(yt3gqMC40_hR2AUI<_bx*2xV!v#L`?t4Ep7wC#PRp2Ornne!$8jrS`2UX$@eV-Lo|Ub^PPv-WQmosW};6YyhvmTsIM#4jMF*Xex8nKqb48c6r)chWyNkd?8n+jC)@79?=@wcXzU@|c-R_B)&9+rZTy8zx(65my1;U; zY$@Bm%X8POhA-P_dR4MbqHSj7BqiGfQEfm3CH>`&&VyGF4}Qo4C^!7tlJy@UB*|9x zlx$PmoszArB-=FnV7PsljH>mW_G}?EO*CjG(KL>$21>R#Nj4T{rC6aiS;AfFjd<-l zT}tK4r3fw^;*KcAIrJ1_y?yjDFVZ%Y@RDsKGH*o2vN^HIfEqd{ZY31Y4;{rdq~VI1 z((q!Q`7lXC9BsHQJsQtX8t%mJHKn0w9IiC%W(4RW&Mgh3G<+e?U9UPq(omvJlZJw* zHV+C)`pYVv2e%OqUg!ao8-8t>`;QQcG*ox+b!W=IVXl^)r`^ndqd5_8HGo$~({@7B z>kXPoG~L8i1EpbSP+kCG&efIjzz%Q0Mvq+`=o5_k&;$r?!>reSmwLSR zOXK+okgwzSngT>L_7EWUc2HwDJ49J*BQ0}E-zq-D2+*a1djUxSazD>quNuAp@!Tp( zwCT4;1?~J7w7wRuq_yx-4=~&i*S8jYTolV|xG2UgA4V62N31-J=f`(*@Ow?Z6OF^= zyZMX&otfNJkbHMG&t0!NLVPFDR^_4~vf8Rk(6Syr+(CT!Y`uKwKZ2&Z{Hw}?W^s&A zyQW;en0a42Q1}T1UoL_%NB&9k9?`5YJq{gcZ z5YLRodFP$@b>Ve`hXR@JPZMK_o1yN5?avs{OiIyDGU9Y8>K3>< zd0$B6{g^>BsVzUuRRb+YgM;md(36DN`(XQrs9@+nc+da<9qvwo`#yta^}!u@u>F*R z+UsEZZ{{%n*w&BTe91JaI({v~WSm$`wd$Bl+$U z-aED$#O+#Y6E}h8qfmM|qf|ewKCR|-EhYUNN*&<=kLq_j_veax(@rTK+?{k}I}kaHl$f1t^`p@73r2@7YG>%f zSn_q6b8yweZ@CA5gi4`GgRxM3Ucl5(uJm^awc_`h;#V{dSNvXt0S(3PDxSMeiV+gO5^cKp zr7!CfzdgiJXLx{7L;MO!;?J|8h+j?!n=E#wbDs8c0aLcbud1rnbBQsbQ^pOF6uvmyp(H&`d7F3|9>lztQ#88GdyUN%!`ONnEc>6qU3+#iN-*#LbL|p$OhLa1Z{d zl!BKAW5GL3o2jyFxGR6|(NUcuRNuhe`p=*~RF9m*^SB^)hrm)zgY)b7y{5zyjl-3A z4>4K%@hcb0{T`$kA&Do^rb|5fvObBICXV`~2N-VgpmCHx&kkMUors4@I+2bdj`s`M z5Ymp&GSgSt;%<_xrPUE!ddlB65G=Blhx~n?BOaH^0b4?avpBWs*Dq_Kxr-~jS#TW))D z2gD-EWuWBd^2Vm1@P0nyT^FshJ!fc{wx@VZU-h??`}1FhQqa=SENENn1l|_KV)FiM zt&8G)#0gD2u>TzEk6@+QlxF^UiIu?zCW2uCtADHrS5Wk zU$WGi&MyMPvSyViU8tcv`qss3SwVpbNwsnfoxHVm!lK#2?&5i6FEOt26 z3v$U1^uFZPKsItvdsp*Y#?}Lp-YxM$IFsQBLD!Ye?q5_xpdz17K z@iKLW#}5&ox+kAb#Fy=lr&}Wli@{Lm?7f4WC8k_R4`$LdVLey0gh5w0^ksbtCrj(* zO2$VW>&Aa&4qf5Qu@z3IvY$P5&#jocG__|*-Q#GY#Mi$uX8b{vR>Um^*wBSfA0hE( zgJx3r+`v@>)zD?E1Jb!tvNu_P2et&YA#-UIIT}2h?n&~C8_Mz~iAzVLHUgb54qq^Y z4izdt#;DXxfJ&8x0Ow(~EpR8dG$H~G!aBt1lMo~OGoMbG98u=O+?W5b^-<=yTF@1u zLoNIa$Ua8Z!jA;cjfz@mZ$vHpktVFG1qp+$7U)Z*7H<9a4CK+ne>jcwIFZyBP@Wdh z4;V3ZEFk|Ss_6&+sxk^koO#x+>J^1k@icfep^z&)X@Q4Jve}b3EC24B4(Q4a~l;KbtP%4p*c*MjOd|jyo53 z!1CFA?;)?`R?7*6U3-`?Y%R7eckD*|U$^J_QF>QeK5R~@nxk!w=kB4j|Eq)FwD34V z_JVVCsjf_t4(9&QPGz+Sm0@oi~qn9N+B-e-T?7_Zhl)aM)%q1?gd%xhoiK z)-$iBrXQ-Tv9{)oi5ll7+`Wb>9cmNaSnq2*w%f~;X*~du4f!;@a>KzCA0Mkqtd~Ub8 zl#$1QusT=SO9)po*b*CqEvUo*g@j02U6 zDy%qA?nXROoGgf4hU*bjv0q?!KRuF)y#c?eDl$Fb00=1?YIH}Z zLP%tfEk_FbCAlHOu7LI%>dZhK55P)4wt=uWt#JeX(V603i7C25XNoOWhKa??S9a}f z!43;AOOpxPV!!D^Nmtq&d#wWp4z#9Yxmaty(7UKNzo^g?rv~Z}2V`>Q+j$Yg8rl|R z6=tdeM?Dff(RhAalpFDT%`J*(?6F1RVM*KQ?qA-%*uMdC^@UCBw=x3!b*faqZ{)e_ zRm0z+(0r=`M3R>p%3lnF1Xr z*FVp)>ua#J({OilR%MEY{6~33W;P%|HaX0{(X5qc6C+H>)AKRsL~J#C~A0ci#tVjXpH zGD3$|FCy)Tbk%7&mb$vo5HGs+q?1|pCsJPy#lCZ06kSE1zg9(IbPn^B6v0lpkO-zf zur^7~*b)^wiO=8`x{!49sSNO?&iOFy924Mei7n>j&)zy`Tt}R7GLPmzvHCb;z@?t$ zpQLZCO!Hma5Q(vIUF+I>A$iVD!5|ygQK)xONhcXkkV}>p75kI%q7|YcBQ~ONDJSi4 z3|B8u>@}{bUnocyRtiU5vwLLHqw)MS`*!?ZQ?rZ4;cE6yMu0!TrDos5bJwemkY<-? zn^~Cv&AvyiypYL9OsNbrk7Qv%^RdcCn=~IXNi#z2$o^B-a8Mj;$z;<=p8bi&g#e2mycn1)mAno8hx&+Rx2JGKQAAW|M7(4q4FP z1h_po{!sPLZD8<~4dc+(E&@mX%R%R!R}lA1V)*@0RUh|QFT;_2WXegjxn717#H)wXUP+vGsRtbH zMX7O`{|G}D?ev;!*;}Z;6?3)r`>3N9_uI|s_GSZk^#%DVLem=znn^U>%2fl!`3o)a z%ARqS+hV`&&}_oZzGJ(QXFXjiBK=RA(u!gy$WoA!g&MGKT@dEFf7zB7z$jrXce>eXGfiquO>=TpP8%Rj`+2>b=08FxqP14y z(F=idOSEc+1-Xo?28z~yki?_cFzQ1y$Jp&*B_2iI zm8#6eG@hT#$l>>zGD9@>kQui7#pBG({>|GpbC?m}FRGrqf)yhNqpG<|&*iduuwtM9Kq4E6K@J{?* zlMO{<4>sgsYj_Cl-z+xdFKk2O8;k&*x7e$)`z? zc8{DPLFD^mL*%n1Mg3A_%*Do*$KOYUe4bLoCZFr28!e5jpk+N$<+UVL-sJ(7n}Ic{ z;y*$th6pY;dOGgfK`qM=K^?V8Sz%7brKsvQAl>ll!nZf=&vI0?o9OY~`|W`Xv9I(HNVHX1A0d-Z7aJaNe?jDX zv?1~hL2UfhoP1A?2>Cq4hD|>0v``SQ9=UNN$&I&qz~SatO>X#)5Q@1`>-E~!OO&~x zyS_(NMC*EFD%%Ysb9;>~XNi20)N{FL$${9aQji^kz9 zj_Q& zXO5<)xoV(N{>`S{nn=ss=5sx1dJ&#N{kJ6XL}Wr7i)vBZ znSG^5U$U<|S+KJ)kanh|3Cow23t5pMg7k0`yatJ6PdX=@1oB=*``(2rP~3AKGGmg+ z*--AzrsEMx*w+NRfo3jjhJ|DVsCRhXSt>X|gxJ49x&9MDY-{tg4LDQR=C=^LJ=cIs z<*GDfx5Az-XL<}3#Mt1aa%APRFM%zmD`50~skLukzO-g6(Mm>$u64JEJvGZDoaO{s ziVI58cL^qem{a{{KdB&Z3uP{+hN0f~Cww?fn98u+_h0FVA)V&D>W}ZMqDHsVl=P@k zIm?-qQ@yCJ1hJ%USO(wR2$}`qUsa~T z5?8)!SM^GR^`9O$%6-#dSve{^(qPHQf1;eW$+^&w&j>qRk#YIi(=6 zGHh8{qa2-!+*@`&DbMadORvjmFWvpw=%u?;RO($dfaH14-)#2(jsg42d|Tf{Ref@A zbm!Zu+`bDojbk$Q(?OIa7FU>@NrLHgB-T#}xM1kO6G7$>>PN3C!bU3NsXTI46ydB8 zmKEpRf=QLuA2@;oLsk<$3?!)%oyM{pF72?Sy0&d!zjfm}N`h;rsD+jDmZN#jN>cxX zDWwa)=^99u5}m5xbg0l@5&0%ooIjc<(8sCShceCJOj-vwA^8tP2u&vQJ8yv*(!L8oM~S>-=#j3{ zAtXA3t4?kK_~H8P+jj1@Tt9$SaW!HEG%Mb6(^q%;UNOEm>=FycrP}Rjs+fr-=2fC5tPTlKtAAXQzE} zdMUxACxQ~2D{V-iB9=&`c?agaGE2xu_KFx%QaI!Q%~&`(ZSiE?)aFEaGE+K3rZCSB za<1kzMlR5g9CL(MqGTp7gVdDDNno99va^uvLDmjrgdeLeu<4HHX-;ObfS4*a%EYs(b<|+`(gkf#zjuTJ^q)9B%4Nda1agJPd--{xhbgYzWZeC64X;PNBbUHzt zo*OG`CdmtD;?H28jU~U9&=7W%M|&5%FX+qiA!&2ixpw15;S^Qq}}5RG-qTX+&^ z*jjD}>o?d6s8;nX(e6 zb8J+%u#)iD6hH};%7q*@xVcEOP{3onR=Vy;KTK*%>9n`9+L5kZdR7$4MGmA(sYsU` zp_3enooudm@s(mICGD_6^ltApR6y4xIdw(8dw?6PWbN*-xxMu*ZmsjSn~KujqJdau z?HmSNRlyUMWa39>?JzZuyBZR#nv&@;fL&8EiN+q1iHEHrne5*z$;4mSlIdv!l1Mf3 z7bb~Lz3@-OX?j(X$>s*6(O}-LqTuP6oV}Sj)r<8lH9D($S*YITtPR$xazkU!X};N_ zvQbVA>&wFXZkL_=@+l5rZ}r-mik+?f#8-1Jd4Myd%UwIi6uAYD%-_iSeQv*X+b$7E z1c5=3MCp9Fh$NG7?lvL1qJu{6NZ(=$8Io}d!pvgemY9_G)ANESt%$OOiJ}`vvzn`5 zvIsmw2Uhj7%7D0%*J(%=KQS9XhlmarQ#NA=IP1}k?TY)CQoe@gSbrZElCpghdc))!?Zaap zBazejdVnmwloQuxW9dG{h_A#?hNn>184y=@uYQPl;$ID#$ph*abJf6j2!ou???g`$ zV(*;J??wefxZhy_fDZSE3GTNUG^-Epz?{xsQc!#4bpDDt%y%11UWfT31oP(&nrSfm zOBi{;chI0$nbTP=%&>AgpN1qsg=B&}-LY&Zdve*=>lt(OB&I2OZnkGDwd($Ys)pS6 zgaPn6B|b`&_=7<+Nr~Ta)u2^(_3b!w;OEcsB6*~AR$JcvM6wi1XW=hOB#ZGvx}RO* z(wn5PA$e+ zS#Cj@pR=oLd$NFIl#R@vJ@RA)_q}3WU25ahJ^VCNe0|C~;%nVJnrxBOGKwY;8daM! zxQ)NfAWb3ao=l;u&jBwU=a4`SQAn1AnLbh3SCupU7|0^l+*&-Q`i>e9(8{AK38)?0 zin;k~0$sv=j3nI2+?PM!)Ft66#~&rE`6%HIARA}+-Y?D?oaWbPi2%7_f2($@;5pmR zF_Lf9u2Nw*=5N);X~KF?orFOTcc3rp+q{3A*3D+dM;+_Ne`QJ=?NMPwe74RfHdo$VV+Y2tksj#J z?2~yHs)EYg z54MWUIN`(CK^!(Rqm=UUdLVlODmcL2_!Ra7(Nf9*Cm27>$j0-oC*s zFi+JqXF``!+8SGAF2@YWuxZk`zcND~(9*(FxqF_4S`J$bV3+pKCWaUET~a>?YC!4* z`+Lo1n8*-X^F+R8$8Eb#g9%DI!JeSgP7veyOCz1QcM@?oFtGmeP9D*(<*GW(qs>S` zjeCWwdCefJ4jnylP92XW>vg>JQgrG;T13%szuvfdg#oT4F|XrEgP02pr)aMhYFVEG z`79yyFb`M$!xgqy$(&~8liq9jejw7ToAXA_mvJNC1ol|ppoWQ^4BVFq^uItzt?bxxQ zt206uC6kekemuaGNFR)>Z(Y(#hG5s8Z5!9Eb*)`>8&^JC(w#1Km*e}ArPg$Q5za(% zxWQmO%d{-YPidxO-PvSR%_mAe20GWUpK8L}OdMR$hsQ#2fI}xaMK8tnEO?9+8+1=~ zMAq01Y#mIQ;BYd#ojYh)<;I!J?ff}cYCal*y$MqlRh4-nC!m=pQx(xIy*t@r1J&|$ zgDFTu#hya5ITNXYkjwsu-ZRh$(O5Bj6^bB;`O&!wZKHD`g z+{4&7y$-|(a`WihzAqC_E!$v(0?A%aEYm%-K(a>ra0ZgeK0*p4LvR%{!{y8jo<}lw zl3WrmW1Z-zt7Pow4Cp5n`W=i!f8DQ>`Wr;*PZ~6n#_q?ss)w6S-y|9YmHiKTvfy5) zqFfZ*KSqThzLjwQzyJUp?t2OD2MwCl2X|ml+0zPYub{GL%whhk!Q^$A|C?a`vq3Wr zW`AKUH#Q$O=v4-l$pscxP#ImO%JzD$tmtJnhmA)a#aWB+gCS>~kE(vgLA65qCSkeB zpqa$-e6AX_qOLv{o3V~aBHf!V!HZo?_vT`_MS_h`wl`l$mr{MstdYfXJVn9lbf08n z$JUO>JocLJPIgCjs+Q19>vQqKArW2HVRclThX}9UG&W*~G~a7JXU9+#%l-ZN0^Mh{ zhv$pz*4>rWxQe{GYb|x1?=8goQ%GW^`j1>_x9>#z;u_pu!CZK=NTKO)!*_M%FdR0C z2AtAS#K%{9)$J&J|RO@}m47L@J_PvJZ+B-_@tXo(l0e&1PPW+5+G|W8?o@3K zcp%IPE(r;_nY8DC%UyM|wr$dhN%~7>UG_5qE)O6J&9g44RJmbf_j=9@rj1R3zi=;0%{9xk`U77evq)*tyc~I)*uqG zR^Ml~spon-J$&-5u&<*p_jp<-hW;x`BRRw({G83P&`w$o5`M98e8o8J}nELAYMH>?c1c(Z}nh9x9-(+n*RuLKQoVe%`_5#i46%%7tamJdf;4|VdGIp z(d{yGx~=t~n;TwT^?!%ZbcsPTiKdIVYS4zH@;p17QkGJHyGPzFm`c?I~k9*XmksB@Y$bkm0ilG!U^5+d5t=}cIc5z?+!`6q^ z;}(_cD9vU7uLC^E0Oa4l8KgKyEvky($WgJVmNjBgy@MvKTT~JTw?#!?51U2h@l2H) zm2QjbF3hK0JfHPE8kWnJWT9yB^!pS8l79k*et?eb& zJ1{Wl^$KdQz@R~Mm~S?iybkk^3FaFNnrSfC7BF;5B*oTc2EEF_Ai1bQ3=BeKzUP|y zGA3p18c|2>8t=gmhMe_91Hg1F|Aer7mq9a$<w51(h0dI7(xt-M!;Cfkuo3+37}45z; z+|R8Eg1sRXlk(?LojyM$`uvoK@Sjb6^!eaOhe&kErv_KG*tvw4wYJeyaTlgarT*gT zMT-s`IMAAo-j1o% zZjB5}&kI;X9DF99SE{1&yx=7$ptTaPRwkqqOIElDHg}I)uPsQfheyAW=|C)S)H{3c zAP3i#3+chkS|6f0FNO=6)gvo^MzV4;b?@45JMl?ofF>*bN01i79V~$xJ$jFoy&c7Q zVhj;wKOS`yzg~+U3{`%g0ld0O`8lB}W6(^Zsh6t;s{AWV^s~cpeASLCEQRUt6>p@s z+zLYA-SyEC!?cC9gn-3=cBuW zCafz`34?xboxZH^-uf?S-MoYGVPwAwVKV|U8807sZo?kITrHW5I!Y%0nql_`LT(9u zVF0f#UVcev`k6s9DU*N9RRd*m=T%!bULDz$?n@R+NIolGGoYYNK6z*qFLPKpi2}9Na%z<$QQgjA7)YUh{1t4zh4pR*?J86V zDlcDjPhOqm*;W_xd=6Qo?tlOGaP%GZ(s2M^jeshFSu2KkC zzz8tny?H!$z3Q+;z*fJTA4ztiPvL3HD#h` z9Ii}!JtIIDbZ!YD_3@2_Ro9+ygk+*ky_wY_z}}7sTGk^Ye?>BKiw9V43~2U({|H0h z>f+1@chKUgP>j3`fPKhx}?64o(WBa-Cs!g%=Zh(0E$a%y3kBFZC76y1S-qGQ6A2W*lALACrHw=`OrGzdG-S2Yg5y^O?+{h3_njsHiy z@i5Q9f4cSY#_?T!&0YPhEyt`eF#}U~?g~aQ%ly)YQVyR(6V{Ch34?B;)0g$_>VHG) z=0wIv9qYz_Woqijzp4x=5ofctt9pf$Ebur=t1F~L4Of}v$hRhw%PFV0^H=L}8vOda zy@TWqr_JVPkmw3%{ALIKS&$m9?uEZ?9KuQN#IM#9gTmHo%6!4`UFDRu_OnHi9m!&U zK37ayGTHMtTTUjK-u{HUOH8gCRrSd|PLtD86W!)9kq9!~lb^wLnrmmfFXGr2DOV{~ zUiDM(&L`U=q|_{3=a=!wJKHf`^;$Eu`6<0tWW4DY#2S0a{>26qkQc*fP}YzeLPCqp z1_B(#&+d2ih(~pG`3G9|7E6E)Mk2cEHimy_(N&H1;f$`5eT+nO)m;GDvXnUnOR?bH z28<&&J)dL5`LA-FyniP0e#W4gw1z&#RRb+$gXpTCq9+NlcXZXyQNi#)?8gQG=y3mq z;QpaOv-;o;jIMfCLG2Y?HFm2p%+DB1UWfT9g86R-%`}+(g@x4MA2;Y#Mpwy26;^bW zI}@q4dC9Z^pOVR{@{=w#$MqsqbvqN>yKWuVe7 zpPAXsZT+Q`)Pyt)YeHv~fEe4KFLi4Cji_-2_vJrqebhL<=c~ErdkK(zj5?4H3Z5H{ zkf@~%Wgx$SCamxIBn`8!CsP zmLV^ei|kw%rGs8hx3^8a8`D%oK5{)Xo@yVV7e*sna2lMAT-cvZbS7i5PI}0+vyZ-O zEfh;@x*S>UwuU<$MVs$4ZS>T0?IQJDowF4VX)XWU&(XPLjM<*Osd@Z@=b`gReaYv3 z%7oQ>a9RyM$>)BDru8PDo8wJ2_B))QC82wUIF#_rs&yQwYHtt)_Wf6|&hFgV{Q;oT zzOp`cKdchxlM{SoW0#eKeTF^_g{WEENSNx!TSsYl^68lBF{+CR%V5$`(ZvlV96z5X ztm|S4gRYAO`_!|}{*M;zNsN!$BBg4b`HwJkU0iiKr0>6W6YGg+*XlE)7vM+34gOUI zaO+~}SwhzigJx1JZR4teTKLVZQ03boGCcx$G-DAy(<2`!vc~emQuqklgTtvJ;$1w7 zzEZEk@%0z&NjRJr<}AOl=(ML?fJ?PN9m(hFDO)F{o-HJE$pc8htA0^JYk6anRKl&y zl*#hCc3=g+oJ2=6lu&1z{oVJlSh*h)@-=f5;`ZW=Ql+*IJH z`9o13Hyz(V*4#k;2atV?Dy_E(79JI))lgp2kI{s6r6pm|l@@(j-v)9lt(!M9KI&LE z{ws6nN^6cC($I-y&S@Mqb*6Kk8_Azy>QaBrk}(gCCQ88loH64MqTEpa*Z>>4@EJ!) z{GmZJDSW=qRRdMorK}~=xl*#1G)%rAj@%OREh{?8v+;zxn%Q(ul0%4LjpMdYK9`Vh zNzr+mNbBy~mqOMvj4aJis8rbz=(O5mn7G~8VxU1-kIeR-xvdPuZ2VbHr^k4r$KOJy z$8lv)QyDaa?#HMySb(XI)()njl!_P7gmq;gVbGNUeOaF}m_Y019L9&gq}1e?|H{;q zfqzvQK_bqdYFG7&Ai2fkc*{3}#5yqde9y4*r#c=p)P0@ue!X?0J{IYY6_d-Cl?&Nu zGAFKbIBow}9Ae!P=nhW?EbGy5sAw@HnG!gGbSvqP>Q@K%GkfVu!hP0JbKc-nL z@*wU*X88_eEQc4TJV@&F=;6>oqwOiJ&FN$Wk=t0fA#+o;E>fx!a7!bX~k3iMhmM>ei zylwH4WvfJM+$OfZUbb|_GW+Xdk-oMvc;MiU9xR}%Aca=RrIZmz^ieE#n^(>p*hgK{ zoCxORA^K~N_>;aU9iqN=?Cjvaxe}b!^c`MuQ{Uz2o3>rCXmNey;g`Kf{lHZ_uI#u} zeN{hVd2)yM;-AAz8jGfEQh2cLMa)Z`c%!>N5C4Tp zANG6PRu@Tyj8cAIGS^sd+*I|{UoNJSiB4+_F-;kA-q-+mAXaq`aQi#y^**?J=<&Nw zzM@p@v|lg-CiYnChd8FaZOOcr$h`GpMbQWPW-k$t@#!E(eaN)6sG6MW%QYc6SVZ!P z92(~#5b;F1{qggQi74cN-51YIEd69Tkv`Ch#nzg3{myR>S`P$vcGKN=Uanpq7w3o)-iH(m9b%Qx|$Kv~X z3;A*`(HYNY^97pVIc-bY7O#j`gGM7ds%_x^^f6o`xUpa(e!Vm!B+m6&Tg$ zWG;Hu&gz*F4(dj_Q%fwW6X|rjf)Q_BUmRt$I|yw{6GER;z$cPD>0Fwu?kZHxqpO(s zcF(-+$wD!o+bEyt6h;C?HR;P$>v$(D5M-{Z>J*iFVKU}A-T9wubpbm)vA%Tn(1>H0M;#3mug&-7Mjp%EX+#iUr$S4lng_z=Vk|b^ zU0q6JjxYn$LMK(SHCBw{W#Zt`L*->?>v*y=-vir$Kp%coZ>Iq%LSi&N5s}ucEidP#priU@y~$2w?nJ+y zHow#SR4x1Su>B92wp-L+NbirKzG$YpDdmgCeWY_e`Kk`cxHay9D)Ux_QEQ`EIv@(k z>>=6;V(YA7`NCZ(B=f-kC`!U|UywMazn%7UB!;}G6dzcGJ93BUEwY_@vr>EHcxR7D zzC^kgiYqJMm`8=40_?y8`NF=d z-f<_}aVOhxC!1|9RGWr4b5fqo<4!i^!$0n1lP>$?PBwef?AWRbzqqY*>?-1LQ2i-B zIdziyO*vAJJK2Dh;ll25C!1n9>(g-I`nZ$L!m$1CaH0CRlg&f=4xbb`?qoaeWTQ1b z?;ps?W=F)$4+yPGos&8@lSa_nkxT|aCBCs^p%O6d3i z#gCg5#hGJ{CR;KjgPC3pM@&$A;h0cum z1rhvlq8O?}K#X-*VQJK|~&zExfQqu9u=CPIO^iEi= z+}C-K+)0D@W(M7*@5k9vABAuh(cc;3n`D-QI*XkL(xp@8EZ9EcS-2oC)wV}1B$ zN~wUuRf1@6pfV$!>o1pZ&Vth~V05rDv0Unjt{kkKssGTKEEMvE&QvUy$YOngZh$LZ z8myd@FPFS~ILq~mtBXt-JX4t=`t=xJ|H0L`ax%@o2qdL|9y%-@tW3|wa=m3b+M$!Y z!OFN~Zm@Dn0e3kIiOxi_AIl5Fq#4U62mwOa0PFV`5Px$J4+KsFhiF2J>3~%Jg6@MBa_}#ro0Iq(U^Z7I(yOofi-^n1cOL8`UOE|ZwD}^=b{#F5 zL*k{*{pn&_@a9RKh^&cqX9*Azb7(lpS`55SD$@W@5i5YtR`Bz5S+lbzodtY&n{Ez$ z!Z^ibfx?PFVCpadil11B9kBldht8x$1;)wsf)BIlzI17D%gN_eX7nffJAoIZct`qs zf@d0iLl?4e_>>*2%(bKClKsWj{zC{R%yE$1U}ZMdftf4>KCO-ec45WVCPsj7Ez*<8r(d&au(RK zuhU+gHUOQ)eqxd%m6MBya&+LEO82I+_&->9LN-sFKdsn@gR9PK%UIS$AnFwUTm0E6 z&c7M8XT?)7%m=g=%MDm&6r%OMazBQcf!X2M68INl;0PEfALp|?TQ1BZNrBL3SG{x} z@ozRC6N_;IOC+!j&WaOQOd-$x+!&i>TRjlmn*Zhx^x)Jl`G@A3xlZ*xVV){#`i_j;Nrp5HI-@Q zob!tVm040WMbWMZxT9db)J@f2V;!g7R;H=uTBle$2Wl^YIB#HyzWU?2NVk z-oeae(AlxdRI96a8hvGch3wU_%9La}5i3Sxg&z8D4W4a}l{uqTI>A7)X2mb0^kSI~ z*Z}xr1^$U;)=lC+R^y*o=3P_xk2m3;SmwHu_>TklCzg5b9RA}v{1eMO8R0*Ei+^Hl z`k*&5FEHpN0$PrmdVlJDsn4W7mHKMx%c=WQ-%b5I^^?@&so$oaPCb>GJQg^ZNX2X_ zW>GPZisw8{}E~H`=6&tD8K*jT^*hxj4iY_YpspzBPFcmMN;x$yfnu>p;Vvve= zQSlBcK0?I@srWn185M0*bWpK|img;^reY5jS5uLqB1uJ=iUJicr{bkl+(bo%inmblMk?M%#e1k= zbA~OLEo9hiqT>DIQM`|e6~t@HsQBm!C_Y3*8kA=)$Q1D4RwhqH3Jk!^kXZtPXBJVh z4SbNff{Od7AnwTA54O#Gmx|xbL-8mTc`!mIOT}fUq9De}G~@b6<~%AsK*jA;teTBt zITcB&OgxqO_8BPtn~F!MtB0xhA1a8+GAA!YF`bJ4n~&mYDt>tmil0+4nSPi^#mAaZ ze3*&{sko1dZ*-veDixXKD0->rkD}xHQyquOd-yv_*Wr=-anA~%s}d^1F8E5Qa>L^JwA|ndVraJ zfEj*(nSFp6eSn#KfEj#%nR|d4dw`jGfEjv#nR$R2d4QRCfEjpznRkF0cYv98fEjjx znRS2}b%2?4fEjdvnR9>{bAXw0fEjXtnQ?#_ae$d{fEjRrnQwp@Z-AK&^?{9n3^Cgg zX0!ojvH@nWBg|X_%veX5sRo##jxaL~Fe42x6Adr}9bx7G4$ zOai#T7Dt#l2ADC9FjE|1h5&BC2S=C@2ABy3m;tb}1Kp1>;Rl%LN0{J8nAihM=m943 z5hm~vChid?>_9nn8mW`_rQQi4_7MoN&qIja3nBIpgxDjgr&51n36^?Rh_7j5!4WLJ zPNPpOz826Y7GF#06N|4)=o5>tE%b@S*ERHs#aAzVV)0d?Pb|K!qfacpZlq5vzTQlq zSbV*gKC$@v1bt%h^+o!`;_KV=iN)8C=o5>t-_R!(Uw@`gEWXB%!zUJBC(|buU(cma zEWXaCPb|Jx(kB*Q>**7VuO0M>#aAbNV)2!wPb|I;(I*yPucA*ZzHXsUEWZAoKC$?s zU84|R{E5ZaJ4uGI_-Z8?_BtwFO9czE-_a*hXPI?WoKM1SJ{2s|K0%*Izh%}_@hla8 zrGkZ9c``oTO~sd}m^uZ;G%8r&ZJA-4itA>fxSk3Yn`hf%^Ii1m43ey~ zsbB%Rn51YI72Q<)hKk=(!9uk{lJ&ahptzojPf>9P6_?CKaVZu1sW?c*vs8>d4MjT@ zE2#K9694h>E{b@dOnt!V3icom6~|3Kr&nrcYz% zp%_oaja1xB1q=8;(5KlX)}KQKi~9BSiADYY(5Kr;{J)WA6 zaR!P1v#4N|a65fsmGDja#46#Gh4{3Riq%xGa!ApqA5rlj6;Dv{Boz;wkK)@@Y;HlZ zo{C4P_$d{vPI^hFJW0jxso1{=ML!jPT#VugD$Z*|v5<;~sQ4ij$t5UysdzILZ>8d~ zr6?Y!V%0Jf7f^8z6$RqmkTRa6X6!RqsF z`t*W}Q0$@NDJuR(MQ#m>ek$&y;&W8|k%}j%=)D+4nu?E8@kuHkrQ$Ivj$DG`wN%_i z#obh}ioUV~pK?_6Q^CsmoAim5^_WZX=@nGGii*dmc$|vNIur>i{zS!NRD5$iimy_U z*?=NJ#m6s0@j)u?rQ(}ZjJ+Jicq-mY#eYz77ZrC?@gx<0q2e_gQM`hRcTn+8D!xy} z52!eAGm5jR*hIxTD!xF)XQ-f8PBW)bk)@)C3VP))^GYh3x1cze3N}RO;(BHfnO`$E zQn6$kiWVw9L&e9bxO6*;3#qu5imy!=`CIIC`?~X4do#>mp6dG2 zu02KTaf&r6H=3pO4_8y6M82)r?!M$NV=7ZQoVrY2j={=_xW1MZdr~;;CauMlHv0Y+ zK$p25DB9dqeC6N{xC9V|3g?2{4AQ_&sVQ)v9V)_uV0~>n^->eX6GB?jmCA~BWpRO; zuEW!(bSWY>w-K@>5%0T)VoI0okEdHBi9)QW6lq(!cb>TBj$9)Rx3?YSe*i>5SwA_U z!<@|TP}MJq1FPm(WukQTjjc=|TNwU|jaxTtBNv>*bqXg2`9?RNKv&X#i;i&(JvV{+ z&pd{|^k$zmZrToG%uPX6Kg?C(EOP={1Y_*wSf>UUYnV%9uDyoa+qgQ<99QQC;EGMWYA!Rx z*x!y7j9qGuv5SK+MrLor82c6)8}L{$P?FJ!0Xugck@WCANAi%?smPMn#gTY6O}8%T zZ#p*8*q4AAcyav3?)%ELEDx)EYJp8+F1I! zIhO7T!V+!T8^#iC`?W}cE#v5o%^*v3RCw&D;O}3WQ|{+Mlq1(l!<73Z8Xu>Wl{ZOQ zM)n$e)|^s*526&gz8a=f3mPA%ln4*iBHwHu8MC^h9&5^#MZwc zc!z|5z!mLnt6Jzi4mtseENeyLRL5RvNPXCt{H!@9?+C&q9pp8P$pdJ7OsvrFn`7+$ zAdJzGVZ#{PjK;?V#{OiEvEK(_jE+_t#@Kzw3dW}IGPd5QqN=a;PDjuUW9)-yd`$3I zlR3ub2Vsnk>Kn$`Gsgp)U<%Y#$mQ6Brvb$JpzFFh=1(4P$IF8XI72NLHxa2@I(Z+mii|Ip*FU zggFYI8g9&u{_gx6<{0~G5XLCXtYM73!;IHPA7hW0W9;D|j8PC?!x-Cw#s;f%^f5N( zDq~CbnIMc&h+@MSI}weK35=a#jTCN`0B6G(E2Hr-fwAT07+V^IF$#2T7-QlE z_rR0h(O;EUnqzEh5XLAVxM7Tm=Yx*{jAhL+mJY%g1x`1NG4aOcF@UjGn`7)1K^UU| z^M)}do{I~_*hb}(P2_CM7PQ1DSw|CE>)saP%w0cpYoJ0PKMU*jl z5xw;jJrF}&eF?XwIYqMPcer<6#6x0>C^d*PF$gF4urYd*a`iFVJmxE1Z8G=Y~eA@OhM{n!?oWyZ(t*^%UGg=Ab<=G|*B_Rt)~!1^`@L8^Ci4 z{q$B7zsKhf?4Qhm{e4)#p4I@cm-ql%o&4RGzSEv>Y+O%4RXA7HelQRDf?b?VBZ}Uu#sT{cDX;W zUo;2yuCRbTdzgT24_dQ7G6(htVF5d@0bnnzR;-p~c#c#((e~CrdHiQ{aGwYZ+;fHz z+yEhU@@`|ZX*#NgVm6)I0Jtj+s2i|qo6SKzFDy{!Hvp=E4HaDxv})Ix1KSZ6unQUh z)@0QJ*dTCUXb$e4u)sa90dUP|8?a^%ngd%73)rS%19qvuu6?~Zus4MT?80FKc9}o0 z?>7hbePIFH+yJm$Uid&_QzoX+tL8A9u5l5fauS; ze=~>fFJVC!Z2-E3)pkVYK!Ee*)T@ncq?xE1ijCA77HlPdy0x0ac79l}EeZ>^q(5wz zo5Qv~EZ7!@1=~J<*t*SO>kJFFwy2GaU|U=*OE~35lx}qUgLs=c zh_{3V;?f2{Y^esZn22T$1W1(+n}hd(u)td$5_su+|Na02{2S)reKjobRyF|MqFU68 z?vMNP=P%76{CQXqu4(|n<<$@(VS5p$)0`?Tc`%;x2lW5U0ew0wKvy>aXmd57nOLFE zAGoRn+D;Kr~3yr=;H zJ#+-C!2luJV-8+CEb!Je0N%3dm1n1kkEUYj08Rfgb1)Bw1?I&Kfa$Tvb;pWC@feIh z%f87R*nb-uu;Td(nd@+U1MqIECM#aph|+5iQO>g%?aAg3Af`qJ*AOzSS8@E2@Nsh_ zd?Z99bTxp4?R6sIT4(5xKNh}aj)i+e#KMajz(TYd3wRJCc`%9`mwq8d|IZx6M?wVg ziZDS8IItggjj;vs>?nh{vzm&uplK1;TF-T`^O@#|I1N>YU`lC{jbBQmEUtBg$kk-$ z0EN8V9K@v|f*1>vodXUNwwr^vpgSe)8#o`I4Y%)qOK1F4w$0%Mz zO9$+8USSUNb>YFh<>h0;WZi({gSVN(_~sB{+!QK|0VnjIHiz*OA;P#NR2WzI8x7wx zhwouR@Qusc6tkFjMm9#um!2)3jffziVSAq?EM01G!_ z4&+%O0-0?D$Q8A;3B1*oGVy2I)#lKy2oc&(HUe#Jk_K4xyUc;SGDIN%HC!MAOxc_{ zko%5aAOnoq0dpW<86uF^g-gi*bM`;XfqeVX3uJ(8_gQlw?+6jdSA`Y*<&&m>e0%k&8u$N>B9Tyr4L4iU(=hDymL0ruS* zb09AW5y^tc#DE8;^$hC>P;A(TIuL=?BKQsb$O*?N%fSp$`2QnWbke?10 z$N)R9Vh-ey5P`fiTp$DNy!V&``OXl5ygOVV1MIvnm;?E_5P^IsTp$DNydRna`TY=q z{B5{E2H1K3YYyZeLj>~iaDfc4^JeTdHi1q=)v!#Ur@{p?z|Lzj2XcOhK#m>PfLpz` zo(!<_E;R@8;t+vs4;9Fz0e0TMm;?EOqZh~ki)X(%ki`&zTp2DU11z4K&4IijL?AB+ z7svpM=XP@-|MTbtGQi^bvN@17VGQi?_${ffiLj>}Q zaDfc4cxJuO*y1?}Rl~A)wuK91fW^~d4&=fRfxI$YAOkF(4dy_u4H3v4p#r%qz~bpL z2Xb$SK*qxbGQi?_kvWhDLIkoWTp$B1o2QGzuy{Ub4&;A@2xKW-AOkF( zubBh+l@Nh^X}CZJSUeA#1NqYsfqZ$mKn7Sme>Vs6uSYMC0T$1kPGgJb6jTk%;(2Ab zlnk(V7MlYZ4H3wJaDfc4cs7{>d0B`+z9v*4+XF0~ggKD05P^JcxIhM2JpXDAqjq;0T$1%%z^wxh(NwB zTuKI5JY%|yje%#5ULXT3p3}{Nd=9FHW$_G#OUVF>XPG&WZ6N~r&TxSYuz0qb1Gzaw zAm1G-kjn!so|HL|$q<43cDO(WSUfK`2lAyyFOUHi&s)rad}D|}elJ`~23S0wGzaoy zM=y{87SDIgf&6BOKt2#IB?By;N6mr!_0bDtfWC?r#16;^u-? literal 314642 zcmeFa2Yg&vc{jX^%i7xN?Ym&Oc$=;DjJjlL*9)?WtuCwE%OZ_tt~4{6<|!(s29m%g z11~R#KmsWwAq7G-F5zp8lNYJm)#DKk&}CU3dL;^uOY*xlA;c+6;ywkyJWj=eCQ7BI$4;X{Ykr@7O-^ zZQHNeK3+VW4Q=Gog>2Z~E?$Qg;b<%o$=a#yr||I>YM+lKazQb`4dHas=pQ{$e3AGq z*0A(sFc^GlX|dr;um4{B^WHDL{`7vi6z z_~#|~=cPc^!IgA28KSk)WZTgPq7N3L4@H}!k3^40PmCPI04EDB0~BAdoZSw|VW>-^ zqszYN!_j?!`cckTfb2X$7LMBCwLmPKPQBWSB}1z=UHeVzDt`EJMNsH}*yeW3&p)}WyQ$FX&7 z7hllYv0dC($i}vdjs78{!9uA>EE3{eUA(?=JNn8TVRZ}y7!sIma3e(YqAL{`^SV=^ zkkTu!N{6f+SxngZyqyhfx)4E7VO-JqbQRotkLL^VH#q@tMg1ccP+vOvc69MI+tE<; zRSMNnf$E!GQN7`c>YGVVl%e`n#PA!TY$}#o4L}>^!0v%q9-?h$63{we{h2~OAG1~y zF$>x!nTc5tjJ%zKg0NyK>r%na|`DiSsQAZlrf)TNjb|{s%@@Z?CVJsjqW;X~%K2jX7@4(v%QE&H$C>UE;F1y`< zsKdpB`A~M%)|ML@b_h6IoEYlw3k(kQlkLc7ay?B=>5QF|i-;~SPuvz?v0C+8B zhx36I8(ajgNv8rWi_Jl91;|WG^;bNUjzz-M4hs|J!}v{^5|~z|`5xQN+@$p02g`G> zgqI`|rsRi}iU~OZePC*GF=^*RP@SP&0sX)leDD%l2$WY%O z$Y#`HG!>)I6wmGgBgVoccJ8Z)omB%ngNnL~11UHkTlKA;j~ z^?+`*s9Fg|svo{Ow7BoeEui^@4&3>EUxbQa#Aor73qA}b{bJCIlnghCG7s2?;M zo|0^{Hw%);d0|E5n4%^mWU(dKs&Tag{h~M;1C?M!iBcdZ#IYsN>OhkE{($&Si>be; z(V!ALFRBqcZNZlMUNP zzV6teg-PtZxMu9sNwV5~NLIVIWC1&SAXzl1#Li1<#!g4Qc&DSPWVHu6yd(?Qq3>E( z*U7|pDC}4@W2duT*eNycO6w}E+#cwxf*tx^ckF0`{?Zz;(@`(IgMq5@PDd5JLu1q( zJ2a@2tYa0iV;k$3DcPr;mYUYlBX}MGjY1jFZ3@i;vZ)i6z2Vb7V z(*rxeQ=K$4Eu_@@QCLuNMtE}iKdOa+CsR+?4NqEAKUfh@Pr33_oitIY9=g4ZkDOXa zeO0(Ib*7&36AS}5*eOER!j7s=woN<2MM5l@x4s80H)t4#a2agkH^sP7I8nVP3A zJ`gQTV&{0x*lDYe57ZTG^C4qx;0_rPbHfgOud@$C3zOJ6Q8RYh>xG?mAJ}QHf*tx^ zckHw)>@-%yP9+Ugx4mgsuzYu_^ov6Snfp`K!XaNYjuT6D(m>8V>Z29$R7nHXX&2Uo z9TYndR*_~ULk=8y@4{#dCw}Urf%GoyWJT<(kmoZn)ZaU;g~~2u0||RGh(FVr5dLUN z*sGxg1>134lW!UrZ<<+{X?hvL55hXD^l`l~14|Vx|Z&!}E@KDh22BSscFG*RQy#VKuO8& zCzjv_D}p=D!JW}u;Ct3I1&KAh`Sco2e@u}8Y*2t;D|J8V-d!VlmA8=(X;J(@yUWPRmv`T~*$kd+d^v965-tgsze z$s#doBb{9OX5^wOBVsYfVEf)fu zTLbIi3haDXHE>eY`J)E0LxNb_gc7jsihxZMV3U-YSm`xK~3we!RBD8fxFGwf!aI3b^E5FKE1nTNa%YiLjM?ZV|u5?G{og1 z!`y7}Xgrin29Tp0O1LSf{q)%Znf$wkrbR;Ie+mh~V-+D7APD*=CmcG*w-wa2lA0C1I+JFV}s#;<{UD-4ngDGv^$tu=1##UG1f-KFEk-Xgu{x zO)F+&%N0LSamDx1iZijuq8$n?N`Hj%&wEUC%1EU|Tk!z=qgZ6Scqcjs&{;b(l)Nq{ z?$;9+=bEC(HEqfkkUE%cB1aI8WF#g$M`X7KSXR8-Z~OyPPsv;?Q67r=aPbClHt5LY zjvk~f#c_N*fJCx{?f6u@V{)j!>G=5*1HHZ0knqAdz(?G_$wbWfN8tpy2Az z)QCtTxFAN99+>SPvcwXm(+PI1BuFa=C30!TZ=CgVve8f~m#4jo)r)j~{3p2rlnWip zmo>>*%Udj2IwvM~c9}-hG8VRj7BQY!fb)CU&gQXI5{$o!gm$_Wv&A@)EHSZYn0^3U zBpPA}wLB6CT9X77E8f7)74k5XE#&gnpxlL0qPL?FK%wE3ywErd&*3d8QzSjPV1uTe zL|hr|Xe3%F=4WXn3<*L&uK z6HbX-z!{TlKx|dIhLij=0s#>V+(B!91c~%ECpef3$RK7Xg`#u|X)|ice+#iRYECi- zc{P5f?8FwqG#LV)*twIIsRflhaYE5Y+1Hgyq**aHpkWeXO#()N_~xb$CyW4Rp5FBcFl&j({^+%998 z`Z96fcPQeCrA6XFsYM8pI&uNz;yM*T9%uLoB?x<#lQiHW0Vo)at_qOen(iGNZ9P${ z=m;+iorEvO_fpKEcC8Ln`7m+a(O!mxsgO;OQyA((42&DX6+D!1zH4LO(IST5r4Bo;ixrcCzrui z)6kQ)b(~my2+^`FYg%$^-_QVNwUkEVe3rxAswB82m1a6HBAAka-8h==ZL}I2&%vxW zHlBnsv8^Q;I6p9SJ`1>kUzTuc;E zLJN>^Ln=wg^IJY7@Q{muDF~%}SDoEWRtJT-u{3C5K~cg-!2c~CTLiap(+9>#Md)|u zwwswSm~9d-T0oiA42RR%2#Eq3Jh{ZVseNv8Y4It;QcFusR+}< z>E%4XLsY;*HA%iYG57AfXN~S^M;d>B}NQ z%}K}Sg-_zX@-@#&6Zop~tk?!D{%LsC^0rp||0Wk(?BWjLmSZ%Oi{%^yFCHnQw%o?u zDtKHP1a+4#{`Wq7`!CbPcgOz*f54ePvhWjNtWrt7=Anbpo`W8`rZkZ+w`{B1h^0{s z+N_(qxEn$AzhXqMeC?fjeS!1GU$Un0FX9i$v&FxYEGb=cSI6^e-yXOK>!E!@SmR%D z;zNn3!bhoy$`6`wH)E)3Q5GSh4QNUtTKv;e`6NSk)uUNOBnZyhc=;yq@1h#{a}&)EC|Y(fk$@ zn5#fs;-7QSNbHqO=ky=t*1m7(`5&ZYLTYG`_!fAXZzzuxm-ikQTJ&DUL=T6NhgD*k zb03?!vY}n6zV37jD2qko`b_-W30((@?#*1Q9En5f;(k^JtwK-K5}4VGpf#O4$KOC} zzB^6`$G$*Uewo){&@?Y=Q=dRN$ECW4aD*bMl(HA#sp&1oJ)bA#*Pz8dQvhElBNPvU zIj9Ow{GGIVDrO@xt~5YLiZ7zTTBX2zDaX~a`MnLZY%sL>a@q2%si|Myt3vM2!4m-& zeef~BK>7f#`Ez^eY9IIsthn0N*o=*z9)k`T!HSzkt!v=itOd z86UI#aak|!XH=fpJMOY@8ZL?AzH0|Qynt6N2R<(1@z+8;jzd0v_xXfettP+3NAiih=4E%RPf4L&1BzdJ82=&@3~w3ohzq4)IvS0W!zzIxc{)oe z0AEI0%8Q z<`oL7bcSS`4or|)ZKlNd&ganc(qOekl!E-b;ksushouLWB^0N_|K(%`+2;r#Wj`)mwK!R0wm%)hF(0a{a zgaF}4@lIEkR=ZWsP__66cR@dd7=nEH2d`vJjUdFrW7r8^Gj_Yn!7>!mLiaU{A}w== z80GdI2KQ4}J5y@A|AP>_+_GsXZgS=gN{8jJG~tt?Gi~gC9KE5t9p8NH-Qv$suV>=@ z@ctIcLN{q0SsOka74bizN*3pg@EbEI0i>s7hGV=A89RJp0wRFp^cr$i{1*FT(BrOYTG^^&)y3d`}I#sD%z zAy2bD;`pt22ZcuhqxQO;VELzXJxVg3>o;YW{stJY<}ZtDTz^e$XI$gDA8T`_DHgwP z2B}6psX`JKvu9}~wz{Yn78t~$0z)%A9Wj9O;=qu&akgaTqUjCF)kPK^>gXr%%z!SR z!18&c05E}nknBs|c@pWhw43KO_dPCVvFjO_E2xyuep;hu)c?s45WTK=6QT)}`MbD@ z#XEyhZ94#nBOllC63EO2K#uX^|3!G@q4pELQKT1q{eg0d9WU-@t1j-#<#89W0sjtg zDs0=%hiZtaze&^I9sf`K;l-5f2nKoZ+r`^TZyRp2v%5%|h_D^M3F|4|0G#EwGI#~( zpqRIKBYv_sam@<1l(wH{E$BIm?KiXD;^l=R!vGN%6`#Pp0peU-f!tu1!U8lio&3{< zD;8GzcUruFjk4^ELKKkY2@ox(E~E~Tt8RyNXq-L2_CQvGVG2iLjisuaIsM7btXci@`ASudqwF}`9KM#bwSGLq=@|Jf@} z{KcV8)MXDqp2+sT#Jya`{?R1sQttWc%X>!0rU%J1f~r-XhA1N zP=8oSmcVxLKByktwpt`5#LDhO7MHgc*;)K+w&Slr$9NnJY<6V!x3>&nNgPAX=B%)aEU5|6KZh-1+8GU$b8|4^;o))vobMOAxK>t zuKT!(z^epp6(_`0SSZb_&(iC#}x>; z1LFRx%mZKsUzZu8OKJFtrH`?zrnC^}ZIEek7ZvU3N~UTf7ArF@0RS$Q)7yAi;ezml zf2f`uE??59>JFQ{rb|CkD4A{=1~ew%04Z&eW}x&9L5@Y_aZa4g5fohE(<8b!)5 zLzZ8Ame-a-7VcZahhn#OaqW&8aleW%jZ3dCvq)_|0d zu#!$d`A91D;+7~1Jc`@#eSpOxPn%TDm5%8GqosTymQB7rLE%D`pw(-wfPt#<3jZq80$LIQkUmhA|l2AUa(-C0bJ(5+A~w&>3jQ<;>{7-u2_0TnY`wrpM2e z(h=XC`h=*hS*tHf8x`m#+<#?v+3Az$B}J;CooGyVd$E4pUevdKag$auy|F?^6Ty+@ z&0w6dvP|`3D%v zy^$xR?8h1MaO!ZLi&&}r?!t4`>!C?%V*v{P{|H-}HxwfM$AtwJ?qxc?^@du18ya_DW^miFAfK9*d&Zf`jU5-W=VWBoT!t)*R-(tA) zMze<;{WX&#azw9fvUo8zdB^wpv&nMN2mb=DanT32mh88s;NR$A5Y4dPU<~WcdP2hg zC*x8`_@gy!;q^?^z4WB{IhvAm5YfS_G$lz8Nhd5{q1#eONpciBrITTQDM|ML)pXk6 zxF03?Y~d928r!s&x;)o{GF5{zrE*uxNgv)!ivJT6c5l5<*(4Re>$wvUa?zY!B;Qnx z$lN@?&|}e3i{4Wq&ZY7FI0mnFP$4vGH!(kD@TR%XWWQO}zIoe`QT{`T_*I>z)RLULOvbW$={1qDe`&0x#^#o?7w96ou~25dFl z1Wav$g-6EX7i$%)%6h$ch+@VfsRf5N%Q57_9K^}(N^EmGdJxyv3M=%V#p{DOon{A_ z+aoO5Yzw*{Ybp3J0cP44g@tsAh$$66Hlt4tq_~p6AUvH@=Wq&>PFgJ#Z|^_?7LIQVS$xb|I3dTW2F@>VNR_sdX?()V zHqjKyu_p8ZI2(hfSwSOTEz4Es<8SvNXXg1h9y4=LOEXgO4oBt0UiBo)aK%dJZVFu^yx(sa&uY)kP%__m8+Ir~$>0`JJ zNvtm})6u>Vwc2SAq5$%6syv#&*|uu2oyTYnb`)Iu3i%YyEaUh$Kwu#myBb+h+Ap=9lx4_PzwcJXRcoPaCO+dZ`%@4^S2w_A%XR*AduMKa_2 zzzEy%5dEi1#xAWvijzQcJdC!;xqT8VhzAI&xXpi|HSu3ceaktXg-eQ*Z+&?Bt;p_5 zrjdL~8Aa?#ACJo-f|PRat&(x~YIsGwWdgINoZOc=5Le;}Ec_e1P>(E52gBkC1CgOy z8X2zbFx(i@EsxV^u)9P~bErMa|K&N zc|)GpX?A)}CU%-jEDu^Uw^_aSLJ@BDYLfJ-jWkdF494*(#}h$Yc*lfgc8d9=vh$bR z>D*M*nBQr_=Sc7rA9kPPDIUv+UxvAmyJvYz(kMv3RVg9KSmR!(Mwd;@7IeSM8OkF* z*C?Hc2Xy)mv4c#oHz3k6f!F#lIO1&ORcOj~(NpgED7&!~dO;-`j$6TF6{aPz+*Lbh2K>Pk1p(5v9;!oA7R|#O=rQbKg8&a2;INA zv#V$Nl)37w(znn^BTUpLQfDAi?`8P&Mzz>|yNT34GLaH^yyn_K6PI|_UYS%T`+3|~ z;SHY)u8oU^_%t}kMMK=)C@Xj=wvfu;7L#8z3;z~lVQ*#>a{n2|w~+gtB~?-Pt0bxF zFA2X_XPqZOq-P_k%29OMe^S-gh^fq^D#>RHy*`qv1Ycj<8L7)#LL15}Z(7v309Fp= zQqLj zlx+brR~#uSL`G|<&6~kf>+!>EbV?G(clwIwaMN9WG`5&>{V9&@$bYzUHnb-uQ%gg(Sz}) z>A$}V|025}@~kpGjDdNYM==C>{NOwWDc-eP;Xi-c04kgD_ zP2ah>UzQXZq{JX`&|UJY(vNFCSX3nIMA6ht))_82P+9m2oSPYJUJzz%a+p9?zJizI zK$e+$6Pf}}jg7tT^#>Xo`Mq$YI~GuyA!3>Brg%An9GV@U?43GcJ=v383HK~@x3qRH zJ;iD!pyx>60BgW%c#PlzIBkwtiGzX7a5R)!wNF~SUsq>a=h6wf=$^H4gA|Xr^Mp0m z8VEro&hg~9wqW}ny&L`jk|!wtE`TZUj5I~Wb+MFKKE?_H5QQ6gC2mwRK_U|HBnt?z zz%PKYk!AW-eic;sBo7yl@lsoX_JiW0I8WM{Mb zhVN`Tn^5@k8R7>qF^wNTWS>bSzuaCj-j@!mv& zr4py$@}^jQH2AH!Iub(tJIW}=r4d$(kz8Eis2bPxS}(N9Y|>Fw!DZ!~U8*J<`HQ|1N&}Qo zimgV)8oTZ}rSB+TFgA=XIi-dJC>%&t9d_YXx#`>h@6UcZrS~pw-ytb$jtI!Xe>V; z?+o`3&!%Q_7m~@&{=x44jn$P{VRK<4oM@kJ9?6}(*c~oREk@clFSlQ4Nu)O7Q?rG0 zV_UNu!=vG~#q$fj=)BdHSctT2o=?QXxzxnuWN7{Tblcc!TOirDHh(^JArcv$No{T| zuh@Znpm#KrPvsT^T^pIp9hds-j>(I?k^HF(eTxH|7uQ<{LSu`kPQ?diE^c-VwAoV& zXQnT7W%I51wZ7E+aHMm(BhfeAJdlrMH^Xh&!Qpe4ZTtNAsY3T$va6#zG&Rr~TW#K$ z?;LGi%}3HB;pk|7C}~d>+D2PbEtApiwXI93@vuEK)7upv=$IRh#wJ3^*4er7<-%g( z)TPMW`og%~**0tEvqS4=TbHBby|ZJz^R1^=dRI51ZByy_zUbUUOZMW(<>j*%+uMhy zPQ{}gv2>=RxiHbv*B)<8uM93;-pUSz&o8uw21f0nh4@BSs&hIpJ8>$q*cM-yJTpJg z*_KG0T0XzEnQ!i!8A;e{z1`uqmX+D;SZpTMn@?Vz3yjX3>BYnO>NW_Fd@T zTIjMnW)`Nxt-~#yfeUlvowH|GFSka9+WOMzF*|f=aBHCd%;fS$d*|8tj+XA>(CDd! z+aoXpTE=*ZQj~EJ070TwL@`cpg!e*p%{LH|FjfR1-t<`*2!Oqy{ z^XZ}Wj{f-hks&)aH+|}S{_NmXBzid-p6J?|xwzhWv7>!-ZEJlr7P`=}m>${a=o{%h zb9Q27a3K(1&##W0={lPk&W@ZvwHoVO4xF{8*C)dLD^p#$vG}Fw`TXUP{9HcJHM$y! zv~+~#M#8z}^K+5aGyUO0YkYDn(;VtcOfH{lA6U+f4`vtp77G1S zng-oF4eH!9zngj0=B=9t+zuv6l&joA`D&{?|BsNSta25@yhpPDmCDzsH&eX+efM_! zT^LT^qapu$(ZBy)a+QV`z^{0hhSnjsXC-%OegmtBzl9)^cWG!{{FjoWpW-_j8>d+n zfR;eJb-X{83#UYta8!p`cNz9qSDqO!Jlxkc91mU(V` zOzaBF1{7x$W+e6g%IlPrzuO%Uy@~!KLP-^3i}QuwLsNFXu=VU=K`|*UrnUpwiw@>s zd-wgRbl&-x$HH4#=H{S{!>167@bpFP@S3E0DJ5A|a@xPMyA)Pzh3)yvC`XYM6gtmS zp=~{MNs09oyOo^Drt|4=I$_Djcvbc_MU7me2{dX5(FAeq#mZLDStQQES_*e1ns|gQu%bYeN0a>gav+tbvXOo16r{Akk$@KR7_PBVR)WWmn3y`b!s~qI zf$nSIWRBX(z}b@9JeK3EZV1;R?JQ0T85^6ikADK;*?FBQ3wJd(YV2B)a8eA8lzr0@ z@OA$Z@GnvVet}8A)yWYWasme#pGMVZ91B)q7>U!Pp6&E3`x|^~7=_;keu7C%qX%+Z z?!A=0=Ek&gm3O**)??nigT)0vh!5mX0}k05Xm_{C4z;C>F(8hu^XIt56TyjBDt@bgk+FVMJuo=cn`xu{@IeN?_q@Or3bA=6w}y9EMA6S`jQY z^y0#QzJSW~b93Jj=w#>WmPmR~o=d650>H?FU~dfI3>GHRCbh)p%Zte=*4f22R@GHY?QvyX)QYICND;)PhHI!`Li<#`(bu9$eiI~zwij`W-g zi5F}|;#AHhm*)q4U|4Ll-h-y4Ca?a97p|#1lDG@4bhl$#o^)SR(o{aMx{}^Ab|<~B z@{HPQXZPRO5xcWlE3muzrt*wviOM7TGym-VM^}X1X}x86Mv~o&T|2a?8ekf#bTf6Q zo5_`$`L9cg8nwE~-V%WslR z*$;|Mk77cf;jjD9^a^NYthX|ozT>&*c`0OaW~yZu6mo2BN;Wjb6Y^crih(Z{f9jp$ zz8~mYLl3p)Cwwq~ndTBU){GpWo5jP{i_3Uya?OzmwD42dlTA)c&sa^NToYVo>)g!D zWK&D9rQsY3GWAf&(*X7f^w?%LDDs0S<+cG4IJngLzziJa9t*F?;pu1=l5E-x;OH@c zfN?TV$R_L*ZP_9X4Kf0_NUrs1`my0*p@+@_{LfwmSX=I zPOSts_#4xqJT`;K0EV%95dAUABCZxBFwLrcdZ2sEPDIn8)`^Yv!R)};%A;T+3>J%K2O_Q!_nol;n+lMczX8oP|J91 zC^wYMXD;>)bq*zSTNjd3@u5_6(B5bs8S1l!GvT%|H13UsFJJ5not>HvwGB3pZ4Kr6 z&!<<1l7lU*W8ZK(a&BrPd^x>7+BTjDr!FSKv5tg&b}%14yO|hGj;}9Ivp&}9P--|4 zZacHSoElFov`uw{&(5+5F0^*9U7S9Xxj5L}yxf{kEMsMSlJQ(22|Ssk-aCrkq@8>P{2XP z@?lRu$Tw%QaI#~=_@FRN*Z5ZO{58J4O88c(^YJR`Jo-TN!Qug^&#;XP5QmThw^|6T z;+DvM%Iw%K-a?n!@XC5LzZlA{=J4`0h3-Z%s*1dg*oFZxqHx8|8HB7U?h>^_R7@GC zBtqTcnqDw2!|6jh>D_g?|_K4^K~wZ^sw$-)>|sn20g%3O^>voC$3u z(jh#>%}>K>q4loDP(Z(~3ee>Qe~k&3li&-Fz+rh+!!g5~IM#EFJONPfnDQv_+fIB6 z8iV``8~s^r$(p*)Ggdic>?1YT8Me$tIGE~2=| z)la9;l8@{d-Fouaq@B&BQ$y_NVMRE4{kVyB>?t3(fG_hY(07+!1%{T=e2rydiQF}o$>F(f;_!-&C}SC= zwcb)iYt^W#UuUYcf54fUvSEMbni#;M^Nw=_o^ikrfOtMfK8n*X+F^>b4BRhd`!r`h z2YuGL6zo`-PRb$?Chf@S-~+M~HGc9T29wUW_yLyHB~NpCnvXipEoWeTz?8B#l8V;8|;RY zRdBGlpj5)RuIFtcAI)vK()VNeXypxbK=L>IGu^LArh9z_rn_>;P)tK>s*P#B&(vK` zcdYnpGG1i0Hn&hh1yxFD=nFwR1Smw5O(%Mg7ZwQ9FDL20*fSR%;iEVljRxu72ya#R z6Yf5NqfO89M!0==Brq`D*Sv8Gr6F6oTkODvmeHBMR_XTOeI$A{V=+d)PG_@n6P_2K zC@O!k3X_(ZFSfa?xYKyA$pXes1Fs+Q1L{+OZtHljk$N%356YD~D3MW-yAgs#GP=o4 zioSYSl6PS?SLq8(hD)pq9ya&0JSqOisyEiE;OkYe?65!oELB0o_1K*!vD6O{iV{a* zhnV{fU`u*Gk04SsZ@9_($f!o)|DeebPTzIm%`B&jrJIxFQ)(JN24IdLEC3igFY}Y( z3|PuZ&DdGmobuc#HUP1eV*n%Di0BWsjY>iAHWA9Ohx&V`t&6zv00qT6i_JW$)yQYJs9e5pPO7-e2ToC$W|(pr1$(#Qb^2$ zWGqtPour;LlUpS;AqKky9us zb1u06FUU&OK7%b9!j*GpZMF1rKE#sAa1MmZQ5cW~4mb)?^CgwTx8KgwGuCZsHiMFdT-Xr#W=k?biWeNXt*#ke=*jQbON}I(g>Y;D7hjOfnDR6iw zFGf?^Aul{miB+WXuIcMadrMD!t+7uiEiG7mlT)2biXK)fUUa4u^mg<{3cBN4X>x~4 zMVH?jqlnv@{1=TFUoWRbwu~aF=eg=+LARhcnJB*-D-8y$;FO5BXZR7MKN~&1bUH z48t&TYKEn*D%m6M1ZYKd8ojn{)5j}&$;FS7HZ666T(8K?xRFI7+DV1ILiA z3Q(ks0%sYdWU#2QJVNv20ORa9o&{FOcmeBICrFCEc^`~sCRP1B=$m0YxAV}cv6ud! z3Z1nzw_1Z~ylvbt3c8Yu+hbKbJ9`-k@9F7GVly#u#=dy|{DtKU)1C91)5}A>53>`@ z)78!|AI1jfG%FW@E%igKgZO`?bT28-SJj#ovENjM*fs8lf6gUx&PX=2k`GYWC%|Go0o)4C1X?;-72X-rWl0=Wt+G2{1Yt6k zqfIejPS~L}Z0>;>gp`p0X!Y_%GXw)Del~`Xw74**a88}ea6;Q%8Xt<26&Jp|v(ht*UgZZ8+tnKjc-^G*{RQGQ_PdH9vfj}$u zv#09Mkdjoln5^z_**}DZz-2FO;N=O5+oAD~QP*dRPssW`I};n{bx=WYb-}3Es|#7~ zZ1mDHl{YbAWg^_t>8MJ1%ahIzt|cgciMY`$L8%z@hv|C2b6oP3apAmI%l_b3E8CCa zr@8j9T2R)5TZ$=vM<_m3zi1{;OdQuVDL|CY#xC;+Vk5a1jVCSk=c2rDOFwA!$IC7> zid(FUuv3djFKTqvisGW9J6uw(*hNRTCR)-z$0Xg`0~06ye?}aJct&x})xgSNrazPE z7jJr{G=1rf$b%fM65joUWZmOyK423!92IOYIO!-q;5Oy0B@~o%-%N8W!seT^Q&4Gl-i*i7&~ZgSm@axc#s; zH!~KWZN+th7<|&~P(0Ixn-R_SG<{=9fph)z(PmdAHrgWt7q>#^R`X+*r<&*Dg73`t4X_U7&!-~&W6g6j7cO6nUT7WLS{}p=4}$UB zRDLMV#!1I!2fAnG7&35Qf&g~hn+UhgZAFrETjJit#`4+O0xoOhN86^>L#=ZKHW(Xc zey|xZZH~`e*cyvp*cy)yw62^Fwg%2__IA#kN=&w|uVhzGtp^4p^OMcJ&6gwD_^H@x zY;1J>($v`O`bO&fDjTPLGCw%F92s4RO-$z&nm4<~=Pm>W$G3(@x|&lf%X4jAn^PBO z+D2C!8g_SF+wkxz4q@{A)`wv(7D<`#D>W6iq;#i7=Z2oHw!0PAbEMrl9XS(U$q(BX zQSfy#kUZ1fI?~!zh%V0#&$eV*vWpw@Evtj`gA)Vsg|+hgBs;sNvTUOYa<+Ul=cS+_ zaVbdXl4~-0O-8TD=yO#@mB-#)#je*F4*HB~w4LFg;)kR=-=W?4s?mBDW>5hS8O))` z4=T7Jii@35uE1g)D}}^K{tK#+A>@&=8l90Fyw+qq*v=d-xaoMY!VyMl3@_sTYS?yn z+>d%fAf2fDD0pGDxIn4hsj(_(cZ4d2(3H9E(-mU-yFrm&5lvI-qTga-Py%?96R&!N zMISH;cU8gkkT0s}IowuxSP@Mw@CHFe-S5&4*5-6y`MkBbum6`R2~PL5_|MW`MWSf4 zH8D~x1GGGalqZfNGxQjz#Uk^A>1xZ!<=37{E{wDcgc27nr#8+7M*9LSD`$Gs!S>O3 z=Czk|lLL$6_C#=XbC#~0uzup6iFJ&Gf_^pfLR&k#y6~I8Db10;h!poHaSisVTxxJR zLp{XTMWg4b&h}y-QdEJ-*&cs}weAI1s|7K^+lq$I@kvn=S#y6iUg# zZwH?{XQ2YVfAmV#)FL9={`+br_Wf1Z$YC_T7fqSbc(-f3N8?JO`-;<5gGFmCwLE@w z`ZGSzA?%Gp$IS*8m94?3t$Cw^$t3x15Vl?S{8b;T5J5P#idQh7W3PBtsU42kT8!2| zdT5qIO0!rk$ZhY_BJVdU>ySDnYQ6+hMrec95ab*;DRB74PpC`>h39ZO<7?sIdfD*j%1>vp6xVieZfC#eGW~Tyk}hH zUB-9!fC75Cw1!eSuFZq|7asr%iBhgvJ@G?3n79Tx(i6Gy%%MghW)eXM`QLS~t{p7T>CN+5Yf+5< zY$`@)+JEugcp($X{0@aUP1*G!rsSuQgZOLRMK0F-2Dv0Pi3;$$JEov9$w zmGF8rm!PsK4*H>x;EEx+2^k1kdtD^Uz|}(5KaT6|h)WK5{5&w{l5yKwI|!0E!P;Qg zM4a<&(U{J15>XsUb&k!!|YH)PMA+6u>qLu1WTq4AmV zK{igfxnpatc{nz9F1j#(wmUkLT5Fk@O=PB<$Isv$tjo)DgM-Uk!`;Ew^nCZ!WLwA9 z)TPVOY<_(5ROe`5V5_TzA1F;^@|#n!D0t(M3o6y8|boW77A+l=-OXGY__IEzuvq@(=C>4&<`Jk;7s4jcaHd8mW_Hd&$g z20lI1(f?3af5XGvTAWrjJ{lfo)=dn@{+k6n*r2U=xG)$9h3)1*cNjG%o9&j)a9b-4 z*VQj{+%*wQKAUHj*F^AJSp=0S&R6jlY7C-%!}RE!L9}9z$MY>rf9T?^bO5o6O!X8( zUe3~ByBR`({Owghrht!;m_2s*dJ`%4QKz^(ENFp=YT&u zFD^u*%L`|67iThw3rXusum7=Qx2vFs)|$uqFN_VG52w$bO{~rK z_HH=%;0n*GkoPlHkXIwa+~tMYry)4lg%K8;m)qOgJKCB9c1s7|8wN6B&(h)V}~AI6EQ@6Ucj?B@vH@u0NY`g zo*_di@WgjIp2!tq`OtC#MWy(59QuMig#mq{18pp38A{+Xl4DA4M9dQqIS8GypiCX^ zn&VazDI?DV7UW`L2D~bUV1bx`orl{I9v9OKv4+?)U5;~-l7Wrmabpz>SOj6cDh#>C z9ofEIlm}q2IF^I*#`bEK3TUwdcx*gby#x9|0J3ZYCpJCJ5=KCSu6C(AUwE603T)9a zDC&VqwXL@iu6ehr`iVEk$jFAMe&W?wM>GDk3iCV8X8sUOSv2EVg=mI@QS=1Vt2Dam zKdkv>AIlSwRkge$j4)1N@Lo-AvEKi$_7yFB07npHm#>K+6Q+`DN9?S%>}KV&D1yo| zaNeyU-a2-?MEM(zPQCI7CZRi$AzhM-Ds3I((F3x*Du8ed=?yACam>P}(b-IFbFOcG zc&*u<$hY?`oVQ!X7e-i0#QepLWHg!To;aWBys){@9BLhPBuLP}D`y7>yI9-VwdiQb z@%4(NPh2fvEB3kVR_`;JGFQ*De%Dx|$y=H&i#PKZwCqTLo(^-|;ZYyhn_~Fz65RWJ z=~L{2(TCuQVAJ&s{qb;gpDsK-j3*L)8o$cgmi$elnj;6-?$GY)wUUdK(Jpnk5N8wILa3mD9bWxx@?jMxyGEg2T zP@E2A@qf&~vl9LqyV*#dmcu(SQo2<_hkeqCDL&*2e#u)et%@r>+msKM`X*kGgmlxwn9p`dAzE=JU$j;u zRbP`FdxA8OwkSAsF`Nj+lA`YXJ+Ik59=#6==!N*_DE<-3 zh(DEiFY6tk-T~1&z=t#@pj z%REk9u(ir=m3=Z*;^D@|K4P;*o)%y{G#vj$LI$sPae%ebV)V=Sgm6Z@~8hcIAWA%Qu-k4oAABjgRH!>%Y&?JR#K{l zap8}(s&8;!*@LX?2jwh$4<_`<_-}V1MExIRrR9}9{l_7%g>{CBb@DDNcDiVB-Ns`^cgEv(~V)l!S?Z{xF1YJJ8B?54Dh5XyedM>m18UtvwF zs;OLw5~3X;y~MYSOYx|ND~<-2mhc!K_FITS7Q|EIHnwPZmJdHFPuTg8cS)Ge`G|zp zfDieaTqF4J7=lf`c!OA*REzttQr+X9SPyUYB(x$8&a~n!CYXA#3ez(zsOj-H-Q$}( zn7(xf2vrJ$FVS02OuiZ=zWNe_-5X7{@zs^m;&@c`;COyJM9Sj*hnU-A9bts5sKuM{ zy`mQ9o$IT`Uxo>N>V?PH+D$@SAuY}!uZ4BSh;@#-thj;}=PJp2hTUuN+o8p&vWa>X z)K!&duxz2qZ!w!|>CO75TgnF(Ot~8;>M?gtg3)}Wb6qcoG#(A1nw25SSvFODB>yH6@!~{)N=-ny|*&#nLZCT1cYqI z0;Jw#)o9f3dX(>BqnH9w%3dO2nkHllycVdG=H$!uW=@lW6GXx9W|MlauQm$a%l+T3 z&bH16aNDRc;)1=?vdDHQ4uAHe)C%JMvaH9K1MbSUUqI{~|KX##_U$yJAUR!o0Oc-a*vy-muI7QTG7HB?FbZ*S( z$C|S7$0ms}Kk5Qfso)rl>CO7P*UR^n>SgiPp{shn@ph%2?=sc1=%qEp&1mYA%!kpm zw&1{dLghgp-2^K4v8GkE^kgqiK5*%PZu_E4GH-#mQz#W zFfT39Gm*}q!b_`;tTA^2i$!*YasN|TPi;g5c_41gPU;VOoEA2Yw+<9KnxbV^K~v%yfPM` z&1nGynoSEpKh|aerin2_E+AE~09mxq82|4~5*0idY{}?WAONAX`FJwZ+Bg>lSEQzXvtiVJ#o#ml# zmhdO)HDn6QiCEZ5r*<82QLA7^hH@_HxlTH$r%i#twRrqnM`tGMy?ia0f6k~`7Rd34 zq z1IS0zEc(7U<(0GWGKZ-aKAs~!{@=CovG)wSH#D@>aC=qU)$BZ`IrlEtURrIPMpK_# zjc&s3vbSuTDq)^b+3BO3Pzi0UX;mXM=g{KnDAN5MRStas&x2HXDBHQ=xV?OQjj#(0 zVWyt%TUy%n^l}IAvR#g(R~lj~^`@7wF9Z~`FV4*aht!*~O?od7z313i-qY4b?^iGN zO8VjDKjhwRq_b=6vc?3ZTUxEbW~+}0hedy9*AIBbZ@Q5{KdGzm)>*3dn$vo1V`C$T zI7R^X5|G>%OlMb{@K^e$3%7_XScY#0h{CO#toPC!w&Xi$nghl9PvIrS()!eYR@keD zrM>b-yVEGWfwQJIN+*01uf+09YAvuLxhMe7QM}R78fZp>T@2h4plGq?q5!yv{iL`k zz-k8P9ErtxY(%D=9LnDRU>wTFW{(2vvDKX!HMXV3E;Dc6L#Qy#8^=y9GJ1hz^mPoW zHOQ#<47)dPcb1zsSIhRxBoaKC>o$(iMMYJu`96hKK8@Nh`oM&#fp=jx7#=bX0xe*xkZ(Dwg}rukOa z_WuuKCr2Xnj3EjHS@#20Ep?N!=$9J33+>5u$-0WO{ zRa*dskojKZ$?h(x^7t;yAk9?*=p*CN6XWqPZW+90JKh82$Kz;`i`)DcnwI}k zdTZq6GtjV996*Estcm3~#TKIC!7P34V|ZeEz@j{D+#^<5K{=7Zf26qkfs_J%8P;FT zXqlYyO5zlW41l-}c+Gs)_|s)S9j`qD{!YTZ$fBPl7GJJ?3}+VoPRDRr$4`~Px1%&U zq>(!a?do}K0dQdjZgjNOPRFZ!&`*SOHy9GV-7k~W5h8WoM>pYgTw+bDIvqaJ=f4*t zNw{6p=ih?{)%aGx{VpE>m~h(!_qLC2wZUCAeg2agYPa` z2FzORmfj~K=@kYbnN1W@34ju>55o-2|5ZhBd7wQ42?LwY}Gh;7yx6%0AGU1nNej!T|uo7B3%7T6mo@ zm5;5&U{FxuAxdvFqOyWD)H~j59iwVE*1WxJP3xYBVGN|g*)4X(#p;y<<&NQ)gH@y4 zG7g^Ua7E;}<_eiiI-AE4jhdd_S(L%^r9K)pjU8tOWxyRnTaW7wEL@I22-~W%v!C&a z87d5p;wG30kNT#ZFws#=2ygc$kqwZ=plTrN_*ie>34IpxlUEIzG)Er3i#XCaCMX7K z!lK---CGIuVlp~QID*-*BdFZePaLOmZ^UD6Rn*CqrN9%chzaVz%kAY{Q4(RfmvO1& zr+^+@JK{yNjb;yurj$iIj?o&-h=*9#k>c5UF{JXqICZ@hsi{Pwq(lxfM0s2Dnv_WK zevvQN(c;XPYYDd0DPQ7+I%BSE3Y9U@U7j(~SHcpdmr17ay<)}$?`+D>-7IIWd<|p{ z%$y0YmdKi@^jXn%8B6nNOJ3K z7%}O~U4W{PIl(QRw-^Y2;;*?;+{r~cI0S34h^s^JF055L1Zbnx@Aop;y(LY!n(y=h zuPMuMLetxQbQ7}t-&oUX4ngtkY$}FoQce@8iqnmd@m~(*?9TQ=HW84u0*2>DP*F%- zSYbC*xZMP&*KIr{8Xxn4RTEWfgsKnM9aVR$G~rV+opiBYDPs3%mDkzk7=F8W2=9a2 zn}L?*a((x^3`A`LOZDC7@x7wHbreXg#4NhLJINtiVN}l z>bS@K>o}m=$PQjKGQ$LVP5nkc)~4SQ#Erl00#F70#s#+q{pQ_N1kCt;sd7`dfZ3SK z_9K1@KeDKpbcZTNz7U5o3fK=)R7(Y^kZ+5Mk&SpG1C`{{cyJ#3fRj)-xdJMbuq>%q zGJ|ZaSYBKXLkwho21&WhsWYzG#{+kBjeHy|c#AoU*3M06RGNDWEzcGq-QIopo9@xc zdic`kG&nnuw&@HgG#+zwXeJUizzR^|qxsi{-b#Kn&?D7_IP3eL;8 zpQ=+dUK-@=kU`E&Xe*Hp;iWxQ;&zMCUq?9=)9A?N4tpzQwBiGUCI+&E0ST6|^SE1A zQ$ev)Sxm)O8I>cvj0(ERDk|h*vHB?=bIzygr(BUJ>KhoHcNaz7=@`x^su-hAQB=>u zBOe6F!l^4QJn|tQtRn2zPcp=L3y8^8TSVm_^U+PXbw9$IR(0!qL{5JPBMFGz3y=IB z8u;9k{I(AOOt>!-+`r+YTWxSxjhuc>L+uth{U`r0f7Qq0O_*OrFn`%cHv?vGEiHCB zKjdRn5jhn?RmaFFY8Jb0l#bq`IBXx^jsysi)t84qgDd$w?=co}=IGt+-ddyJF@^#&Pw!@9FlqVS>K^p5-rjmfFc5luydG|Gh)l+ON?`dnp>WlcEs=KANbBP7aRA{NYPQj#`)y|40(fg^E^8HkV zqe_JoOZQWGe6P5l;+@U?6ss@7rY+w^ncv{J>K~Mo@K0{zrCNk8_3qTeU|)9+(f zgnqQV%Jg&Y5IF5>(GagC4H0qyqryIy>s{{|gmt@}jk=?wb2`{7xX1DS8KVjZXdl{W zzWrBx@F{lx=mTC;k-m=5^i?0-gd+ViYg*Mj^|%`x$7!Aj>p6;#@=EP0bhn!!6wBXq zZ*|<62zfmrn~WT)?PcS-8sdo}n(51+UP%ZhSt3wMxr^Hrld0vg8oJV{kQ54 z`m<+4TuLQ=iGf$yhI}30E7}m=xxO~!`unPzdSOHU%Y`&o$c6~CmD>>duxB>JrAS&e z`W**4Yp0*G6SdorF8}mvL(@|Ctp4j{cx!$_C5w)W&827_+C-}@XqzMAD{9; zCSgB*(S{%Dq2&zp^Bi%Do5B#An3o1e%t*0;M=GQTJv- z-NQb*3DiBnnpU+b3ndXR_gmyWgyIvsTL3@!!Mh`|R3etL9WMjKr!kvw3SQ&|pI+ZQTc3Gk zb3A?{ZlD$SJ@3CYQ3Y2CKkIOQ?-Y`=)K%+8sY|e~5CM_S0aRw%>`>!UENu_u_LH zSaNgxZTL%VJok3CuHEq5TQR~8dG5XFx|clnUBq*Q`7)m4 z&xgYs>GH(ItOaG9 zOwWd@_}lXiE)^ks+6R}Jtn=T9b-uIitP>`WUX&0GQt8kKs2-dw`=PF~)K)*!F$69~ zSKL1Q5JQ3)(|hIKu0`fF-ZQ}pmX<**^Z?y1{t2uOw~H&b^wjM8Qz&w_9sd~`W5;Dk z9cXl3dnB|$ZL2K7otGhXOz;H9j4DHVk19ioqOc*bgeV#8xT!3f1gY@o17?%5i^@Mo zYc?+`3oy*vO`IjXZG$NnZzH+*eufg$Ry(~rhxOqq)q95BTOWTf()=y42d~yv@kN?1 zqm55{^d%oyFp>A)33-3zqnoftpJz?0+N0-2Wb6emx)P4%O_-%N$MP1oE|Xbnb1WM$ zf~WeSiofm=v3t>VFCELb6Gsu|%N$Ei4sXFTxs#3c&AM~vUT$ViGurO;2Kp>!sg37` z*t&MZa|4W~<_Jy|>#>2JM%TUMxpxrH5$4Nyj+3Jno?~P6RDsoDPPj(&o?-Xqq^5^- z-iXx;?x^;V&Uc`xPvi1!K5$}+?>3R;wLZEDK5fRGYqc`=4B6R34!;~U?fe5GL{*inMHN6amr|748 zHPz9GUs9sS`$AN-DrgO&f}g#KO!S0(Qf7RFQKU#tg}(UR1&Nc0ZKhL0qP}66J;BhA zA(!~0_wmm;sKT#)9*=*~@msM~;=vu;ZbV{X9fQT=^WXte@W)FscIDtQMz)_NO(>3g zg%6Gs*>V>cmmy!^PPc_>4MFW-(2OVl?pj)MfkUq8NZB_%TFS=)<$E4-f!CkZ{rPIV zwXG>q-$x=f%f>RTpVMC=-Sq`f5lyF9Q+2jprFtKam3-tS{Uf`V#6P73nbYoXwKh=N51+)gRDa3Az1 zo@Y?1@tS5U(`=u1XtDTbfNmF#r9G}Y4kgRn<@#N-&u4wGkI+!R$w&@VZ<;u`yDEAjFEmbjsAj!Rzn&`3r*#}yMqTrOSMJK$Mbi$_@ zgVdlCD$fxA!+of;|3~;2nS#F{Q=k$EnFSg5G1niLcjLZX<#`<&iHhE@;TaU4ro+G| zr+TN5Ft`%#S?X@C}{O(Lo0c!rR^#G(hxVx!R1(fxe#8n z^TAlUNjyv^pBZcq@HglwD>k4dIUsLcsHX>wBg4aLNt*gcU(5utUS%B!N?q2$rK~H> zhuxn#a4Rj#(Sq+4FD~%T<{>Aqv_aF79xTx)R05GLiM~M`bYta;y__Myn>mG|dz`J^ zY`O;*7XV9HSqFi(BgKQ9g~|x{Mu>#mg%nd)mcyh?xzmlW#Y*WE_(|Xor@-#bytb_J zoiO*FI24|dMNjG}JI-_BQnoG5?~%N6T&kmEye!k9kBQmKGIu_ijzz-l>)}|?ib(B& zHpc5P31U_Aj99Ud^X>%wSX%|m?WDlf+cjp_xQkoxxx7XLfkuibQ6es8*AzkWijo{A5ICl zDOqWDYKS)Md{0l?cA0IYl9O_H5I_e7kgbG@`h`>s<|KzV1gM^VCS&2I!kQ@fZv#{M zmUto^rdD`E0B$L=kaAnOyq!F0r&5WhrV@NQK`Ew^@>Cdpb-DWI(fyStJ z#uA~;=|JsC#uChq<9TFec04ka49oL(v_8}Fh$WlZNu2!NcEOZ^A0ip}ECb(LMH>p# zdxqUxo|+y@KJpS}f~q~1d9OlaFo!m4{i=s)xWWwLHWEEH)J93}gxtGVuajbUlkCXG5r8b^hXX`RKrZ%3-R-uCj&%GX9_mby+gm{iH zU&eEs9JTNq8*8-+tYtjsJ;Uye%bh--D*hQPTrh^mQ^g-fE1xFir+r|;6xtspVtmj? zH(^qKf;GKLOv>*w%5xo3W50ml|blppy z`!V7r6AL&LZUxl%}+WZ%n^dDt_ZnQVF;_aV&y-$pEtCr7Qu z*5($A)oh{bp@p0kPDkuUx;p7h^m5d53E>S>kqw5|L=iPiX95X(-A*8JD7lPCrOXs! zgQ|EUYFg$(tG2bAj%=N@3ONc;QVeuy2{BDnC}Ah*O>v|REiGZBNG!y&nlJ;)pF*G$ zsZUSxFahE_YOZg{=Ck}8vlxusqS`1pX8rA-H@wCe60^g`7&n|nw)99 z_?07#UZ?=wIN`q2jdBw3+e(S5$9kI&pv8%{0{Vp>9HB=RtE|^)DKVKkEp2sq6izI! z;%Vtm1Ja78rM$BlU}XoOY+5q;OLKPbiXOFmF5PDnn<_{sDW>VH~F%PTuA zRaAWeBv`GT6HnU~x3{ZJukokI8;}YVvZ3fue6fBdijE%fOcYn^i!7lQD&OX#o7g$u%$io+Is14usskel=imL+s4g_{33r=8a3}9=4l^`H(_S)z)kw-X29&Nv&5dD!N;iL)hHoU^?Ef5oF<&> zif8X{!r~;SIofLF{4^T)ho;>fq5y_-+cpecYM5r(Gr0GcBBHtC6T?Hh%6sUr|9S&o-TKfLzeN1dMJ_Dq5>mnc+Q!eU5KPb(Gm5! zI(H4(E5W#=LDv=3s+X2f^`s|e=T~}|FQ4m46Wl15$M#*s8a2$g$Y91Li}b2H!%%H3~W?sHO4!5P;Iu^R68d zSUT)&J75pJq7ShZNpJF<*Ift7;eW{Ldm;WgihmrT2jSck6l_OxkTaPc%?&B>l|fVwLv#%$m)X?}91SE3a=V&{t=O`>KQqZ9m`Zk-JPaGYMkGf%Eo8y3!Bs@c z{7dESRXeLP`u2PtB};QYs9wXe-ftoOs@P$>g+OAWnUJ#jRTdM{$dCU$ekeT_;$baWjNKU(GtXKIbjYHkYtcu>qbJ7WVN?x&&363v zfu8smF}gY)qN(^V#_`YzAIC%Dz(uii@ljvrL#ms@v8;GNL}w}*nZ<`ZmxYRtnKYE6 zeXPGJq~(=u0tDL3glcB%fm@-lPNAu(uzsUdVJ$p!J&*pGYm%`* zs4TjS38l5nRY=J-7wb$my#bAJlAnw>Hcn1V&!8v=Zs0UFo*kh7M3sza8cy|C?*%F= zOd2p~%}4DNQ%U?Q8jFrXNAgp8$6>k*Dv~enI23P0<&C5@jcUQ6MC>v<8pn}*`RIHp zwGMv1VB;~#XgwwQ<|xKZ*dbD~bs?PAT|ORSP^O8*jo$L+KGJsOvqe&_B{+?S4jhK6~j z*k5uxdPn-xc^g_Vuug|KTPHkmEUDYi_w(!AT(9Sxwkqe?JBe1jc6M1Sv0-94r8t7x zj{hEzfKlvn5Dc zM;t&FF5ofv_|s)S9j`qR#hFC%Z$$Ft+Q)dDk~QAK0~I?R!(|;;BAMkS4?^_$W%tr# zmY3p_&ppObH1$$6<;g66NaVfWM>i3ozK1of8lv`*%K|Bj^zK6868?f-A@OW@?Hs=Of!SqOoIfMJs&Vd->Ioph4!EMTO`0@*_nLLkQO z>ZV4nAu zPWwlY!+*8v+{u029sny;Mt$5ll9#N0L$e+Ed%J(8QR?Hl=XhQ^$JEDje+;05&n2s) z&KX&r`yqG^n6KhFL5_NOj{Evm0IXF!=RbnfLDzGy4aE@{L_{tkBwOZ+BScPZRTonQ zLq*a;RqHd;egqQCH)tl8Y7(3Vre`1OQ(I&D&u8;ojXerev3S)sIEj z7(`9^N}lp?DuE(M<-go@CB}Vi3;@<4 zPz+awNg&8U8kLk$ShtHfyvz=PTUs3mg7FArwj0MC0(Ue0Zl9Vv;ww`hAasky9;aV+ zn48NL&bb&Vq|EY!iCm2M!uBTI&IqW@V?eufV19(>u2&8J^vg2@PNK~f2qK7A52rl> zuD#v^4(GC};xzveG}Yx_RR)5H?NjZlUV$KgVtf#SKDG%?{>GBXmq$Qg`C8Vc`}`5B9rZANi3iDWj} zOE*LWu2Y)-Ges~W4M*DC&_+=lX;o$EikmZKJ?ck3Y z@T@eW_A=shP43p=I(eT2d9O5RCU=gPbJf6|qk)6})zp)|L)=~6ncqhdXKQ81vQqbxWakP+zhe~X z%6695*p|wjSv@b++y8KH{*p;5UJT5NcX`85+4@cZ;m^W4@qPp1J;PJ*pKX1_d$+tZ zhXBmEbiW3oF1oa(wPkVF-UX4ajv_@m;Je7W0(sX4@`Zi4kQ>h0Kela4V9YJ;j0|PDeVnvh^DalY!CwJQ)k<_nMvz(OCCnoLplP5DvOu!>=acsMgOm z!=2BF^XD9?td}vAdR0@O$Awl55H3KMD1v?;UChE|Z6+|iZ@n;8>dS)4cEqpFbq*Fvj=UI_>`R)wqV$QKaz7#8O9JzU9J&$9c z4VUkvGcIxs(VZf@cT%_lrr} z%M=S3fK9Ip6=;niu4>YMnV^)_auZk*E`18~q6Fw^)-lHJx!Ff`|MCmA<~Yua5-)={VRhT;Her zSj1{y;xtPC!lWAJfts07O2=BqY$*-J0M>1jiM3A7V01sDbb6DIQ7Rgbl~H;IP0djJ zpF&mLrplNYr4rq)V>!VB^>FXASPB1AFZcS7FnmQ$H$Uh;nWq}xP85)mY&_Lbl4_?p z6}Nd%(Jk`zMb5biHybpQN_+!X4OHT}d|lxr1H38 z%lWLJ#9dom>ljaX<2?-nib+Y+h6s6UNt@fs***z7L}p`e7W)k-s*~yW;O4&2$@KFs zur8Ay6fi$3~R!QPX`3h@+W5m}f{EaYeIqJ7B&$-*n>8e}#V zqcRs|`yX#!a&~A=q8VMZm~X3+n}VDqduSKGtgUs$0*WkR2TBAElvc-Eo7kMBW4Rdb zf_wAA%h9?*T^7_O@COfluq~r*LwE#|5(T^68;Fx=w;N{XZsp+=JJvoo%<*W4yWP3N z4Ts^JyWuzRa#L|NmCHti#RaA9o%05<92Q3xxss*R=9y9%@Y}HXhcgmDutw84S4}z+ z7RkwNUs*-;%A0I`D=m5zmz-&F+r46)>opy{R$az=A5f)ly(RWYk2`%!_?BX$G~d!o zhPA-0g)+OAlyI>99fIv^S2bbc+O3Ht&(v75S|a)K*BlprRX2CLSx#biZtIGu?OBet zMq8ERr80YutU-@EYO+%W-l!{e|LQ|U=T<@x(ce_k)z=@OzFvp!yKC>499s!tW%!Sv z8DsucWsH z^;}gD){St$l=$$=nu2xJyhcigsdQrINIS#tCdeKrUPz`>LsnRvu4xpFuwQZkrB9n` zd6Y(N1gI4tKLv!JiiU~eEQwiT#gmS@v5S+u0S{h z73UqoKlFd&m48S)6>k6LovmdhBfwuU$+Mewp1WSvbep``(hcTkH%@gS(WYl>5wuf_ zJ~&&;^AN?>$}!2-a-3Me()DSnTi3Vt@_o4hF6HvwLsj+V`&ak!<&Zxt70YicPqQ7- zeY$wD(->3KoqSeAcx>54ER(GudB*~JU6~Rx^CHGeBa|3JJUc=gNb)Ju**ZTXqCZ`6 zb(A(5Q97UPi9>8eSdO>Wv1> z7p%1O$|17EaKT#wX3cii91E#gz;W+VEMZ#f&owan*P{PChXlpzCDm3qM z5!rf3U{at_T16Z8rHka(!F008*gle@6wgvD99}@P`=5<#2>Z{qkYWE@~lvk{7aWZfy^rn=D~6UFTCd4|uHZqKS~l z%3Z;4KWU}Uxerb6tgJFKziRQk(-Z?%oEB`QL+#ufTu}l8wik%vCzh*?8plse-@~iV zTEq0K7X9#b%t?2_$Z5`~JoI<7TB|toLz9)U@4EQrwuLK`NDdd$$>I<${(qVpR%-29 zmRIju+%$I$mU)u!Uvt+Y8tcnwxVx7BrU4BP_x`~AIwrdon+GRJ=~_iW?X9?zySluD zuO%O5R{yB_JE1ukA=09=XLXL5Sho!eG%PxtEN&iy4@-A_9X(DrEJouV#eBlVa1$jp z+Q%%QKqgy~eT>FEik$?q6$G_98%y^ozSw2J7jk>Qoe`%m6z4%kHF+n4yju;L$@9}q zTs83g)ZiXPiF%R{dnZcTPZbOWM8N<6ovo(;?z};>`rr<{M=_+J_PR&$4s)2_YA|^n z=Ba@BCWB@g%>KI&>BU}e(5t*hAs1Cx_b37rB|S(}lYHitDCz6;vmuv#)c{Bx>5j5$63gjawZ?-uPnh8=MTbCw>gWcQYMuX0rv>q$N1#IrPt zB%fiTq~G(rbRk$@WZW}M2E7NT81;#a`wKO#H!^Ov2*IpI2;1y>fZQ~26fn;Y9p|Z* zAcy~I)wz@VdOQGDsEqo!b0iZbojD(?b)I`-OE)2)yTZ+Y((U)cHUIz#6dz=mkMj0S=~h8 z;5x>E?f|C^kynrQhN${S)!z-=pT4M^Vi;^9H$)h^iaW)8{CP)5^zlISYq&4}Ve3Qm zHDh`END@!qy#L+bhx#ND@gM#^)a_zbgmWKih0C8e;`gEM$Lw{Fpae)iL&lf&`7}9T3&Y!GD3Ki#J*+-#f7r1Lg4MQ;l9@osWNPMTtT_xA zLzEm*5!IKwNBGL@xkSW&coi{+IoS~;-0+pz3F$=ZqS4k7%P@UiM@Wct9f2?F(-9|P zouA3r@fWU|=o@JraRT1BPf#AOc&X+i_i>uE)D<!dKcGI|pD4VbUm{|R#VFG-zu zxvy6R0O?TfhP-=3xsSSXzmJIc53k(6BvwTT`#&gm$GwcvNr>@XOkY>-5+Yr>p}#Rc`~j2d z{RIOY=pyn(K;82O&7^w&Z>}1s-WTkmceQ$~2d8*PNYQPGQIklCr(#(O!RsaWta3-5 zQnQu9#%WP-hn8}rGPAl<%Og3Rk!p{o`kBl97-1DdR%s(K4}TugQ9T=|p3Qyv4_hCq zd%LzF06VfVd4O|ut;Y6y?bQS_VHcN5#Ffo$ z&mycqtsUsMgu_dt6!wpM1@uH-A{k9eUW#@fka4&D%u7*`AIbS>o@gGS=FEz`?ycrv zMUh)cG>@p}RTns~09?ANkf7?S0$|nIju?YQ_`S4Z6DI~x+*;J>Um8$mH z)$3{YQe~Xv*-8nyH!yzu0hOxbIs=^O^6XTg@-+s{q&&NZs|Ko$&903a-LdKFB46T4 z1b(mNz=PsSW~7w@`lyYwD9-y<(tVX^cak1AEEpek-O6~r>S-YAE!>y?u=Nr3$d+l;w@lw5BL2f~nZ6-bg;J2i@`o-S zZGY(Fn7*zDB}BR&#FzEy!PBwMA7bp(vCjP^$?)~ytZF^zxobME#a4kQxK*H%p2t%y z!yt}hsj8oehs~odD9-=_CmS@Af^s5P_0WDznFr`Tm-Sd}WhcCe#dI&u&g?{j?pvJl z@*Nvmu6vj2*$5S*x6)EbBh$Hk{5IbJ;W`#y3@kPY)cl774dOaOQ|2+pca^BjR<)8Y zd(rhPk%Up)I_0fpSC{04bi&g78g4VIXdqZlP5Smx%YsFxRC>Ov)doOG8|p#^gnF1= zYl@0FQJ40y+I55DGzcuBd4;)NW-uvf7}%3?Mi+|F{g<;&sR$@_0R!kSFdik6QPmY( zRVUzilsB~8-P~LYJ9OKkSo9`cnY!~P9rtMAYCQd=aQq4bEJ@N0@N~^chq`XkO_FoB zCqj^@iBt?GBFSY>#7QnOVm;(K3*;&?Pz{r-rMWp)PJmpOZQo?w=d8NxzE(@(t}nRT zX#(C<dC*3Qg-%nR9^BkMW2Nqclw-ELLKaZdt!O zvNKKh{7bREekJNl^p%Bcr~=}nax525F5tKdx^-WSY$^AVcP+jKDdzaxECENGh_yh5 zaU>@bPBonx-=(>GQ-kMZQ-l6e)c6tO$sb@zjqfvVh#K8Qjgbb=CL~6!kC1ag$Zzvx z{o(QvWxdVK$*cSQ2uVMu>DeY1JwqVlb2M{rGV+XUGSXj)j4v>j{K1uEe4a5wWbCR< z#*l!siHI@lBjVX0;-7h{{!sZ4@v7$LOo^5x!I?|b&4q{~u^^s3;M?Q~X>~*{$>Zq- zk=|r3S>RDqT{2}l=m1t_F==i_ z_PKN}o-NA^Q|?4nWjx0ych_h~nMXvX7?s!9nJ6bF63uM5e1|&K9oOM_&E?%pJAMC6 z*L9pzvNWD&DxVK~=RZOimA5}Z6n!x`SXSmV{RW990#>{=o0VGnMY<{a5V^kilbnv81ueFJ1mPQWnC35)86#74T9YCTAA zb|HNqQCG3cDOADGVm^tg z*5?df1X9m5XeRZ`@m$rz8LUfdgR~3Fs3&X&0k`M#l`E)%A>3^S0O(G^R=~a3pjmxz z2c})PTtV%XcHs(hm@hM!ybkkXz`Wg{nFh1J;E=Y&G=pAc+6B45!b-b9E^sFhj5V@25F?vQ?MWxoUeSxAiw-q@93as*d%=*#0b~qjM?H`7hj; z|FHF;vqk2sBadSn<*P$hQ2EXBWsBRoTI?4RmbA3C?o}qC^EsXG2t)B%GQZ=w z>s7IxBV#nSx*)n}SOg)lb1wTN|Mu4_kwR_HPyi`3swZ z^JqXrNq7!bb=wx}uP%Vwfu<`Ann?k?i>n6dv)z%S zk28L7aA6FI2{r&j@4x;Sg z`2|BOE3CN6wHjULDd|RkisF$~|B(yq_MOzexQcR|(p-3)En9a|mgq>12P+_{s^e)8 zczJSQ9-J%2=c?ITscF4e&8F+TEs9@cw5#;Bc^#!>CXqsx!OzP}OTs25%S3XooI-YHT z6IEV_z_p2ZDo^>@t+!xAJlg_fYqwQ3?)fxrxP0ThhDrPvYQPgZp;v;?&7l+8+6&WKUZ(Gk{bcbP zo_?6Jc$wNwEv}Zu7|%}@@21~t%3{&jTNcw>J2m&i;x}tI1q7)z-OC8j1+06aN?9D| zx$9L&L>4cr+D%EcdF_Y8r=Vj$yrg~#zNt|Pw)s#{{N|uwo1);&<`jJQXi>0wKWtNQ z9C@Z}=^=>cuj_Q_aXzF+hX)*Prq$Gh{|K5k^{*-qmxV*Pc2%##<)`_y$hCZy&%$~? zgN_s&udbDkCk3pI5WNqVH{!IfKXxFSkI^d|jzdJgRA_jN7)Q43qKH_B8+Jxjr;1jO zGM{PN`$|2B$-gw`Qw+sBg#|`Oh!zw!TZyUGCJ(GFovl`ZtsG~zqj7wA)Dl2ByyL@0 z`*0o~%05CmKAh6r%sJRSP0M)%vfKzybY*IvPd^zNm*+9!^p)gZLppiafV^iLG?P-} zEUp@8TpAo1uBVxaJ+!q@Fpu@cuaIZ0FRv+AfM}}zywbzm1K699R4JNO{ zybdrY44P>$`wI)HAzp0It2{E4iz>t;LlvN^$>7X;X;PBI#%p1#H`5P>ob_%4z;rBM z3@pFHpqa$-+qi1rin^xy?RXIztUanlp(*0+Eb$J&(?cgY;=CaGyuZiqm z+Ds2n6%bcN9nnjD`ioG~U9+@x@!~GWk=cgurlAz*-As>+_U79ZdzNhdkqVw9r>)xE z&+YuhoqXdBL$KmJ!xw1Px13X0z9`^P?SGb5ThDTWHO~WoN&wW{|A@vO`yU>*#{S3t z&9a{P3)@t9)&RM3|MMG0u1<&W_dl3k)&9q(t7bh5;`vK1ebruqRr`4lINa*9zEyjM z@_MdtoI}GEvdponoKDc$OCg-X+<320j7Qrg_dztq^V@hYpx9GXivOa#KMv-ZGxMUNwBi!}O{cPoj->2I?5oBC8FGpk+OLxE_3Xk_T9B z3}}4lKZ4ZJZ)Wap^c*u)>hm;Q`)RJ0lBGIIfELWjm@|M^U#=T~rhNv@B$`rOHBiZ} z$1YEM%aETLkuT)R)KOMuNDA2*ptHji2cU{Oa`bp(DHcy96Smtj#2#&~dXoWWb#!e6 zx^4&^U8hOuwxYFlkwdzzXsH!sa~sb*G}(r6m27LTmTef%Pqy7nzt@y)qOpf;<6&zk zRr@zfw(%D>>Aubg&;^!zWlP!iRi3+EHGJ8I=~c-#iMAP)9y~4DU~mmB6R7H?ua7Jp{Ee*?ZeBwl(wNnFWELC^G0PXn-foK z3*OA>DBc1T&!%QU=Wz9*xP~-bR#O@-=9!O>G^C>qx21>i{G{PJ`n{$!6ph1`hLK#Xw#&jAgaxSf|CBSO6S3?;K79+K)K=9c+h`@P^6){gReVN z-biz`q@i{*zhX|rK?8VoG;IT#UT@G$qUl<$8Ym4rgYp6hbFQwG2X=T1ZS>e>fn$Rm zBQTIsL?2<)hbBOH8&;W|&LxspN0)fK_KWfS1jv`@_nHDkH1-f6_I6NXI6FjHY$Gjm zO5Z9z%m~n>f_ni;0rEATyIwVX0pht;lxWj$j|$rPFKB%&T#B`Dn+F(fi0fMmJ}!#( z8ZL_eX0(qG-+9E!V>~~;o6_#XccO8)d^ej0G;|=(qN;8?W0d$#qOHnB0kYbvOVF|& zKHLsI{A0a*=s$v{y8NrkgJyAzP`j$vLGxcdPRHxI#jJ*_99PQkOXi}|8KCZ{%O5C8 zncpC#9~|e`pAbo@j-mImQ|G3}s|*l-J(|ut@1S3;1Z-C3vClZZt4!aCF(cNiMV4dS z{k2WoxB;7fT1=^ns_IkPHO_rQca0c6DKjk*h{gVVu9(!1qD!>VP}gz$Xj2g@pygCOgBq8=b*#0I}Fw`Co833Te z-3hoKG-y^I+<^z%Pb;Xs4z_=54)d=KCa=TX1(=^SXr{regn8;T3Nvzr8cB_Gi$SmQ zU|TM#unxBAQKncto-7tSS<`sBsLohsv)VLgWu@NFq#B02b{bW6TPkj>=y;C-@3Re> zNxYxLRRh=9_3%}3-iK&+zD!Q34#q=-)lV~rA#OTmP?R0$@OTJEX4z7B5jC=4$s1&LgjD_l%0aI7K%lXxno$2=m zGm=>s>=`+e@QN}0Sy`uh5_JDQL+6i(`shA-;@9Kq-i+l;teWEYEc(5s_!W)A6~BvU zKtu7nfak80VwA+MM4K*t@nwDDw+9?G-2;po;#Wu#f1V9R{BlCrWU(`y^R$=wPac{4fr0aEwqLQ{J zdNfmrxQ-Dq9Km}7_u!98DR?m$3*KqkOqFHBUHNm5j_MRp{TlApe+KoTdh{fo#|63D z1(s?`yf4x3H6@;C9InKBn91UgU+eJ2gA}7A@g&-GiH9%ilXz)x)JHwQaEk|xqx^Yx z_!93}dZ?t6(ow|e{X#Z`v~5G?s1>%jnE3VXKS4k_JI>l=v%Dae{DAi*HxjZb2eo%KKL?-nfTVXzdLeSB^+IHr*mY+2x>zu% zt>Y?}j}S!#F75Xw@euJ+b%w_e5zpF_PbcC__s7#Mk%YxyROhU{L!2e1Tu2XPUWN(l zxuPWuy28Pi^(mYz*3BBmM;+_Ne`O9|;hbzMoK9swd+MG+nz}T#XG-1UXrjc|8yPeH zAWAFZdIN0e!lw^Nyw0GR6h5!vs)1_gV%7oaTq)U`ERYAbL~29k(kOB?csAXWIX%0eLLVYMxA2e&jL0tR6n;`B*~k^PxZr%Vo% zxt06!AGSWq98n9pLUgEw?-Q~QQ?>AI!E}Gh=xPC9)>aE|Uo)NZ z>d}9DSx4#%D31m74Mt2I3&?+oYWl&ys*J)BXP&jIdPU*9+T%#oHwwoJ(y-D!sNpKp z*@;e3I3f~7(MtY8g4zDXBo2pzUIOEAbYHX7a{8CH#eD9{;BA(S!I?`{^%$IjI|gU> zGn{F$##tg>QJ}rTe#%OiuyQv!PC)tmG-8MEP?n|`@Ker~pqye6O3a9})1ETY5hKt@ z#xRK+#ZLb^21@4eu6BZxLOG9NteGwAEvz?RI4L@RVhUsdSHX|_w#lNv!M#z6zz)1#wnR2Z5`?KIN#Tw zO&947SEM_JjbuK@or^nQ`E0)TfLC&>cA&6p4-C#C)I4t~?Z;{@3Y&atJsGD(&)_lI^Wt3@a;^~gbl@yI%{HHAB?@+I_pO(&UX ztncxxM9Ga_X1$yd;4h)2dAoz>u2&7;N#+@$EYUWj@{50fRa(WJ*Nsa_Zu{m8_j#UYM=|iAP)3N>PbTE9S8ap zRWS6xKVblX4);F+?#B(9)dzQA9OyCU+faMOflj8M4Pl-@RsAGjb*{2k0_LL)nrSer z?SxMp=sgCQlyRVPQH2!;N;%}oBkk#9Tdr`eKNh~y9Lwzn=+Zgs8en;eK{JWvMO-y- zMSaQf(20EhZ3n;j%(i@)Uq;OyP#M>Sr_EvLuBRu8lLfKMa6N)5_6zLp$0MnOL9X*y8`St)R}=e9w00I@CL%(wC*zCADt;)1*X^$ zI#X=6GE6LLU*5HM0qwBpWoekO3+y*tkaVThvDX?H7-&hyaqaKN#FrMEQ<+b#C%`J*(?6F1RVWDkw_b+c>?B57-^@UCB zH!}kKb*faq6`s3ZHT*3K=35mwD$zEhGM?B#nedW&nhF1sVR4CNtoGatSR!6j6!J&Ld*Y zxoz|>fje{?-KLt;Mi(^mSG&4&c{QX<#)J9XW}>EY{6~<^&M5cVP`EE?=3=?qQ!_sW z#t_!-c&elL^*8i`q5bou0lYezUIR4!!l0Q%)6ckSpk_Wun%REnMCeJ%(4LE@`|)s@ z^t3@C5~La85bLOmlMyj&)zy`ycV1> zo=5YaSbdx^=u*$}Pv~1K(|p%fio{sIre$@$kes_iFv$8f2=y*1=_KO`a>>%dVt+DT zv_dpw#72}{%1JvM!_^BZ_8QmJ7YfpamBLZi>>io)FrJ@gUroQ))a;^hxSD-CBfy{F zQnPR2x$9L&NwZ6|&8SQu&AvyiypYKUrc{QRN3yUW@*QZ1d^~Io!_5B8GR*i3dzlZK zlkat-LOx8d$}qFZSN$TNq@ZS;B}PLaSc3V~+QP?S#obECBP-6YvVk3!`8c|{v$Dpr z*oGt2oMxSyFDn;^Bsg7O*;B=Yg|L;XJe{DoR+B|#5msca7Kr4zRkh?9s|t|%3>Z_l z32lbaQnm_SsYj<>3!S#WgYn(UR?}(zBMjdtBnO#zE~hh{@H7p73N{g@;S{^3l6sHR z&xQu#qXw|+X25ko*?$@|lPLQ!R}C}}_gcrX4hydtk0{ApniK^Eldd_Q>uE+}xfmU$ z(&K;WT#?L5{>kmH=_r+w#ZnBL4Q2G5=rN2!++P`SdR*;9o`oe1^f#L(z9bmYGHw=K zvzazs2PkN8z-tdqf2jH|YGCli4WQ1}B?3GC%&+sx>%c3237uE0ci>=6ITMRJT{6oV zJ0s+h@koq^@%#+8P4s(B!%Z{}*Kpfoz#h_YyPW4fCWf0to9i7oLA-i6?e*ZaHV-&z z2y!8n{6`qRAjjLSWp5GwW}2(DyQey8S-;hsZf`PxS6`6V15Gy=G?T)6kgEm?@0VLU zboPU@G#0yahaMA7_3hh?{OIXYk&^wSkwldCeJuZw3U79;aTNOQVD#xC{8+~{ELrNM zH$Ts9^>yIpA1Tf;42$#ghXa=_TE(pW*-@wD8$ijA^DO))TpuM(MC*?QibrNo?2$4M zi{Sd%LLBZOjz&^1O+H(k?9l_5fP)F!2welRpd&ZVmL86p*+X|6#tiKYlw4Kzez zwbGFDB~A*7O80RFCwS@TsC5Co#f_^S6!EmB+()d$b|)4MS`^V@|%OMumKyV#6k%b~Y%8SC8Cy6XeF5J>YP2tR^@7M+n8-sP$Iu zSr;mELwl=sF8yF=Zk$O~>oYfQ0-8=YXeQBg3Rev@H{M~ndU2yNvO_#FONW5X<#IYf z&(4aJy)6;>maMp!N>9?-L1qOJRt9qfPUns*kkbdTW0YlKKOD=2B);fAKpzlsW@YbH zJ<)yEET#WR9KeNG+-kMnBC8aFUR;83fCZDd9JtDk<$oJ`n$Ttk7e7`yQzC0@A z^Hj<<`81_0h*yu?cnjo4(gO~+l+@&g{|MnI<$WbjAHZ`oSL>WNv#+E?{qyE@`?CSO zx_Esn(DVm`W)e-$a@9bk{Ob*uZ;b4?q$9ext(|fol>537#9fN4&gXj4c>f)N{hO2Y zAY?)ui)u021b(D1+1E{BJ6049v@=p9v@b0evLYP>^l%e-4HC(obWS)4HK$0JD3*F<&$W-e@oc`yRhtGkr0fmFN9R)K5|crHNf-$=Rs13_$S z^I09i=AzDSZv(r{pk_g)V}0ya*wf`qhM__h8@xhJIr!`=U+uW?h1W{0eS7z zUhJput71e~V@i6AsGQ}D$}BIcD?u!&86 zMSc+sTf-~EQ<6$ZRkqiAKMiQOJ3e%EEy5M))82OKpl z2%#GNN6;(?|EerlY6&2yH@36JISVTOvZjF2svTt!jdy3FiuBe{YbY(h7NfmU=C6J=w(H+k;?Qi z9-I|La#je-iZg7HNtM>0Ga?6utR{RIWW|MMI#t2xP@(?;@=dHbe>72`kE7Y0nP%cltb=RE)1N12FqzC3 zCLDFtM&eJxq4RdCn5bG4UP&Qzsq|h*C5yf2hFf6%xS0+X+b-XUlIZ66-&u}ZMp8S?@BKLM0)NgvBT1aBt*m#i8OD+oVR3g;g%9s#3&1eV_St8 z3vVaMoc=sEa@OT+hEgU+XUG%<_zljLywKnW{rurceI-;TTmm}97%xZ42M9m3qK2lvz=dS(N+BB*|OCPgfF>=xHxlm0&z^1#Pr#U&s z0%EGzGJ|nd>xjYhr8C-|e(xx;y_)6lU|ie)jQg;vM{Awgf?L2@k50J-I>i#=q*J~> z&XJ?;dr?Xw9V?}pn^z(&P0I4DbO?6{%LS(o$LX*s*&3dgTq05;ImT=HnF4OQw=@lIIo0g{qdR%*>hpa6l=xR++~fUsb;I_X+j` zP8h%acLt--HhQ=m?$&^PEfF@J{!&umii?c*w3ks;7QKC=x)Rh}F#$>s5t;*{t+h=# zAUy6Pes9opVxzDou6I**{yd70bs&%Dh% z)`ox%(CmBF%^Z426IGvDFW)p!7DzL)5vOx(SubEE;k895BunK&j<&kFNU~6%M|iC? z-I0E>t1YF|*1~E>I(hM&C?ypcNS9KPE;&LcT#KD-vv*;)45g$UTZrE6?S=~Nnk1*L z$agp4hF0>g2z=XgG`F|z=hixJyQwJcEeymmYsU!SstTU4BojY2YX_`(+}e;})s##> zC9rEsCeheKGV!oAB$NG{C7JjOTQWUsKoWU2{u?HVPQCCY6Q)-snQU&L^cl?CRTMmq zCTDZxEHBo#)acCWWubbTvN~9+$_cKav9 z_SSydt2vh(;LPZ9>(0?dZown-Hu9#Q+i%&rQ-l=J0Ej6{=gUP(E*a-;6QU~|IdVt( zK3m9;j8hP1<`Qnfq}Wu?37)hf$~jCF-8h=rTm_Rw;ORQBs-Fc0#Fe~`AzA#yYycf1 zI$TWIj3MBxM>l>1jBysvRbQ8GsahhAaqN|Bjkkq%P5X~m+$8rC2dlnn%Dk!SyOi}b zl-v84c^B2)=**$Kndex49~VH`-blUCW*G?PcwIj$NQ8DWsi`5n}ggxEWm^Sh{mA>2a-0O)Xk5^%r8pjmxz z2j+7Ayn@;*m-AibFn`uy@;c0)0?eN>Xr{sJFJa_S-#&w0WiDsAFvH5_dMWQmgJaRMn9Co-_bnr^Kg0iC-8rla%-wR}ETqyFW&! z5B%&|UL=i_9&5|RpGcNs=`8t+63Jq`knU%{xb!9|YzT*c#ER#weoCgf8Ak%m8LK9v&Kg=v6m3r3TcLr%WKmn`$R$>UO4opJSx%N zyhm0fcpdp=oS1y46k8P@L&78#F9Ga0Ua^vE=DRU9`mLvs?_-<9QAy;zCf9Q*hS-{x z$U3rHl2^y*9h)RQPAAS+;uNT5xe2K)KU!zG1!dNzuC8s#0-dF-Xa4Mw$18O6E7sMe zHcs6mPcy~W$E*Qg>*mp9i=>uOGy!N-ZKiV@f15#?Lg*f*(C)d!i$^#lkV6!bC1H-5 zsO+oC>3$4k5o>lW9#efs3a?fE@ETYIkA6dU&0LK@WVum-TJl zKZ|vJJaYV!+rB)s_JK$z?-Lwn7e?g zi3ZK2h#ALKJp_J}=4`IqR$~Xout5*>=jpm@v55OTa&w7`G^8XblLx=pU}*(ssB1A5 z%Vwc4tS41P0Ez5WY|(}5UF?&27pfx5+z+*iATx4@A11T4J=IMHETPl+ZqWH0LA>e! zmL@%dWu4^IPT`hVDLfEGaYdRo-g)~jv%oy6Y0iW$rL;A+$ed3zfML_5aermHKA@$A zr*ii^3$+|BG=N>&KQCc;iN1^L2SE*pUTA->*$fjILTjFsv)OU)Zo9z*rJZ0;&}k=# z@%*KcPTYGy+!YM0zr2%2^zB?#r+KuQ(ooY4!dD8CMlo;bUX$CC9rUMf(h9;Brx z8t&H{R|5vPlEf_Wq=}g48cxw(EofPv0{IdU+Rp>lfza9{^NV?4;)#`6y8{UBAPKCk zv?Kd^TtR4wtSQ8LN|Dwjd*yn@MYoR-VGmOy?_b0s7!xC}wGkulZcJD=@+1tpk%uqq zTccmb8vOv{!+(ux>&AbHX-1xZRe8-yoW0bp>UGU(gU2z2?=>qcw8^?=mHCY$0Acr9 z@(WurPPS9QdIO*s>FO)yJNpv(c$Wxua-2(8=jc@?6V+z7Kc7WZ9Ysh(Kqf*tU>!y{ zI_AdWD1m>?N4nOoU(>N8+Od6IS7!v*C6keketL8%k-j>zwqeF30yJOD*aALOKu0(G>>kDW;`Sem*lD>&_;lYCci;7jULwKhH$(F>zo) zA3YF4hc`IIDS9cjKN5ejQX{=n9gX#8W?J2paXWUXVU-K#1#aihwNmS02=*jQRTNdG ziJX9DnoLy$w{-4giv?86$I{HYp@o?^Z)nY~#o7Lo&y6nQTj=rjYYVH1?}H0Wc~>() z+8DaOCCiS9nq1t7np{J;cBx5w+0FEjRJLs^7DH|QQ@!KAAA0lmELQv_(64=BmYjiQ zm6s!!3_Aw38x&4l@B3YLpli{N?b@()$J$6rTv$WO1e`mgL)^5pH|ZlijE&Q7B1VwI zMc;sZ6*#rD^eBaN6~Qvy!wczZv=3)Um+T{?kS+>yVrCGx7d;P0-UqoP-ljU%QCG>> z_Z!eps@L~068+bKPU?RLso!bPOq!iTT-C#2rf=5_!n?jiJy~$CQSl}U?t7_15Z_9; zzi0q}4)?==`wIrm>VrElyz3_lYOnCF$IM~=PlL(pFn$SDF)3XmXG18K`Uza z*?e(4k?u{G$e&zH_vT`BpM!EeW_$C6bSc&6%;Z=s$5RL+$IXuQ9a}mgbJ%}{^Yk^Sy;we~J=Iss1Au*zG&1eQ_1tBcZwQwhckzdDaKsDjG6h%1V@O^qI!|Z261NBsj81m zJM}AN?d)1qQL|Xiv(U9jQ|8!-M;%oeUo0htDwC*;5{ZYB?!fTNXjEeVrOeZM56-Im zRweDqhcdI#>lErMk?*5$yP?cQ)U+~*zQCq?s4^bIRF0*R(xy}TfplqTkbfSC6>>v^ znHQt|be*60AN`!kpkj zNXY0Zdk%EXs&3Y{O*%12f61)Nen!B&0J317bxEbljibBQb7l>1)02oVvmZ9pZ!{gE zyU}Zi6o;wP_JCMMW3n4v(#US~O_;Fmw3RT-sEj9;QVSVhkJQcLc8}+7+^BS?HoKkX zQ}h0wXsmO)x-1NFueecYQbUQMU@k0AFme;-qb`lyXpsj17`!T)QOwAnH*~aq7ijI^zWj%+53NTmD%Zi5%>Z7< zX_5ip-@l4TahO_EeS#y$#G+c-h(&cRCahaj5(c+Lg|A1mk`pT`Z%yUHWrmlJ(oolKKUFLmB$NALFD^UqvUJUqWYyd`5qrF@>N?@ zHu*G*N)WFeo%TKGw2TKFZdI!3H2)Dov8eW?y)FIsWGvi+8VK+5}2@VKS>ze_7lDyG5g8m4Lvt1-S*S9 zG@qLGlV}{S{qz<_fRX)lBd|I)_LEILm;Dqz`5g9>$75MR?5QgA-YM&8J#?RhD!)!d35W}`_x818QQq5j5vQOs`BA`}Giav4TwB24lt_xLCWBsOV31r?AqECfoV@3nx{W3!Icz-DQM<+u z(+`H6b*lkjI+h;;mTxg=Cb4`oR}EZI>k+Q%NWe-d2gE%G%k7TnQ_6vrO;ZZ2PVA$t z8>+4>k1BNLY?Ce()*fK2>4%NP?~W0zP3RQ+JJtGOZtX9cq=O6tvFCnvO%Uu2shE^M zkLvXKDd=+_58*$X`sj1VXopC2$>;x8EU>fsE^TSW^KBQTN~Qkd%7qID1_oNvv0SVr zU+7)fn_pPyiQ^SYx<(?IK)2x!(HM%~6Ri%@9qTiKlgDJo+TO^H_2`XNJ5~w9jLNtL z5w)E0Ep1q}>ntxB7E4;fV|FdRmV@IE=tP<(u|(~v?){qsoq(8hd8*dTu2XP&h{ai^NO~h zSv|7yXONY@u2)w2k033E_i(R`9=*rP-j3pJU29f7B>_M8VC6lR+lF46Z*!_W!TY|3|z^jXwCxE8=4Vp=rd@olG zl*yf!ZCSrNvNPS6ES4w@taw)dTdxv*1?h_mfY!zB1(f+Vf!h;X z)wM?&C7EbbZ$`BUu(u_0x^!klchKULWxra_Wj;c) zm4?+suBFu5$IMCjAp@9ob@D5q>Q;kh5>>Zw)j-o~P;GZP6A#BhRk^ui5s}De0VVjM z2WdI!f^duTs{`bZ?vxlqVu$^-J+_|^ui6w_8T`d7MAk!TQj?I~uqKQdDWW{cMA04S z$2ul#dB7$~5LC-=aZ96>i9y(TzM^sX?PVlp?9b#nZ#)Iwc!1~NKi&FxH5sUQEUGNeSD z&DO5!6;d+E!#!MANQoM*GSiX$Os08LPI2e2)-y5m>zR9p;10)T^AnWliqLpp2mNzy zYP`A^{{C?kPI3qRYCZNRY^|ouXB^*EPF!t2AQai2EcWMf#iS*ZJ%6+1`Tc{k+`n?heQ*axSN%*u?G;`1 zb90ysR=O*YeHv~ zfEe4KFLi4C1=NUgU;e|^M~x$UzM6Z!y@c$;bkBE%;JGo`^EH$UJckME4rB>~zURZ2 z_3imyz`EJR_^4yu_^(Wa!rGO6CjnD7TlnilUe zfL<3i{|BVK-JqEiHgDysfujHQtHs+Z;zd#%;F8}^ISjQ7d6cPc$C@Y(dO6+RR`G&M zQ<1WR>zVOX`v~6pjBKXU;B4fA{&b=<8H;t|Nzu+eeAiMamR5B+vf6D4cRGqTcQI}B z)N^ej^<15^6%J`F|J+xobIBMddG@B}@l~FO&Lj0DpSzCq81K~F;WS8yos%&K)9QPtic3heu@V4dB$v(E*9ihX5$?0$_(V-F|z=*BK92m5q= z8VXT=B8c7LrH5#E@(VQ8!&Dao%fzH(qKg|!I6iG_l`fVr=(^Jan1HpqUg)i@0i_7Je@) zRQXbeOpgGMW-P*Idhmf#)>wYxi9V9;!QoU9@j@Mc0OCjqqMwVtMRI2O< z>a^Noc#>Nhp&5g)9yuxEIdfYXh}rnFoKBDNpvQl4|Nc{{j~+*qK}}_F?6$*J8BC(7 zkJS#Qp_GcJW5T*JkTB@V0AJRp3?^XROkjM}v2OfVrlt)1tI7xxasE`hs#gR_$>Vs- zH-f}EF!y{}u=2+`o)y%6o$`LYb)!BO>5dhX?MusrY&4k@S2>)vzxGt1!;?Xl^;kGm zv>1}iWyA^4tIS_gNn`tUA?uIk)rYFR6(!1gi+oHvr`X8h8V+-(U*z ze9NA~G2#tCr6j%J_i}s_4m@4l*BVU1jfV~4u~!u!+CA(;)KNA>I6F-D9Fmd7WY5u1 z=DFLj_;fX6F9zpfuUH4Q#Wh?9x_LGkYGwzz4{#XChxnAN&fE?k#JnwZB6Q}_lkP1SVx@FG7g?>GGU5ued{WQ4Gw%+r%6yEv&upA30Z+}_ya`ivjh{J# zYHd8a+^t})oT&Ui^xTb%`?GIeIDfX|<_zNwIkYb@?(keQ_$_CUX?5EMf5bpo$>_u% zVvTB{lhen$qZ9XCl+5M_gikJ-%NP2HUi*`g43}=B&SD@4jn|Q_fCcV zPCj=lbWvPhDTdQA<#f9^q(PPBe3G%E$5@iJm%d`k_5Nk}EBV73V- zrl>g8&GOZ&^8~QGMMNUp=3`aN>+T&V9(B|uJ9lndNLgYcix(}5Y~47O)?A4qN25FG z8K#wySU(QfQG}ii|j-k7BvoymDq>AG*ez0CVyH{@Nq{#22Ll=xh6q4(^*Pk+T}#(MxXX zyBxl0-5HA(*G7K+nh&WTxN66x9T%yu>PIY3?wY;y&oxXMi?L`>Iq_O7Y}X)Is#YcD zY=lwGH0z=QTTvw z_JV+nPX{^bL#C}o)#OxPt_jJ(B9c$!&~zR`A|9mMAD>@LL`e?VeevAH(odFKlI28t zpoP|3OWIY1pC7c|2<+^}^>;!Hab_x?a7|(kEiwhT1m5w&AmK1wBA;TTsN^0K>0*C2 zhSh4XUI8s}elFI>>yRQCBHN_gh^(jQ7%7!jo*o;FB#X(u{&ZeL0{5ED$75M;n=VDy z@ARtBo2M}?fng0vgVG)o81`CVmS*KFUj5~6lF$pY`QCg>aleu&j;>IPEU#Q7o(z>9}CQh_`Mq zjxpLDgti3=(C3u#iDXYYmxke8g{nEYjY;3`nX@ffDCTqP`K+`@+6f43(wD2&@eVRV zl5y~26}fxKYRq-Y)#m<{Iq}=3j5>yS z)UiPE>U?i*^s(HXrXT{^tYC>$^FX*-SQlZ;QD$H)bf}Uov0|JaCk`GxR9+@+ z9Zz=Vd&qVG=p&EnZ5R+i5@UhuO=YRK#|GKuT$&69N+LT7c)pCsidae|sf=i+a3g6p zLUP#}7`xv6`3Ql&KOe8Q?ZjjplL(c&OR=j7+hjf^Mnj71j9pFmMoOygQAhXcJSDzL zk{T|usT`<-hl6HKL0;qdOMSLJ31vzulxxlDp?EOihNQh9+#rsHFo#?Rv7EKDwbc8z zG=+;>n}w~88WCyD+VXNvigZ+etT)+7$vdfEPn+LqeyW!Jd9wWvn6_KkUr6tdQGL-& zbyLb0jr&OFdh%5rz_>N;0hM{H!l<=TEPW7#WcC2Ig0y?quzbPJ6y@`v{~=Jq@?bz5 z<8P-u9f`$Dh^e5YYB9RC&Ammop*JhLM~*l56wGJ66HksH;c)ILkR3RXFYJpntzN%& z;STC|9+Ju=BSkok;^|~GpH9T1^n`hl!vYiJmrQ4iEvp19R9-XnnxVH(zxOEqPsFku z@v|NAvk5VB#LqV8h@Y*Lj%8imD&`JY6wdv^oFjfV3Y0tIXFK9&vn_^d>yS>Klymcl zpG|r4kNDZ7*Zzo~&E7XVcB{fQZtESpiZ~)ve~M2|wWNMizSJXrHp0qCVfToiO|hKy zX{2y{#Ls47*#38VLI4H8*v3=4BN6 zb}+M-%E|GL(5uwfH@QrRJA>OpfV-mZzmN%1(-lJ=pb6@6DZSGo@=oY4`l zs%&w7{~=irF`{+U4$5LVeY}ib&BP}HlFVs@hs*V!EWUBh(juhQb>*01zFdeW zhd4qRVbe!frpHCVK&Sj^OJ$n%O*WlN4sEGSE+$LxJQs&5Gsr<)F2OO}Q{Z^Y1ij9+ zE0(38o1wQ2iJYSuMA&YrOzEYY<#e==FHjd#aBR%)h|nL$ijg|0`+fB1RQV?b2GL)~ zmGbdU#N*)C;t*&1sLbri=S#VKDe3rSA|SSMKY)8Xlz~`er(A)c4czQXc|2 zi`3s~;+tfaLpzI|1L;z#lirgo7HP^foNQo!F|Cm7&lgIa+2sCYc4*_c%G4Bg;_}al zl^Mya)1^+tik6G&+lh%}ce$7Pn?4XLa3~!0n~e3*H&aRlI$s4uLxYv+>0E!gL`N-j z07e)cs!S}GdZNpRDyQo|bS4Xhe4#TH%O$e3zKCuFSG+V-IX+)5dG~OJ>larSnO(#) zmFc2ikMZ>%T#YLyVE#oyQi{-n^Wve(aoJd|w~W&r9OeyG#wBw@l@kkeqqC6cOeFhh zdC@Rw#_};jfB+lB`uzn8!MU2A38+k`sKh+Z1LaqhacN?x;}YdQiYc_1j*!Y<;8tiM zM=nO{=6L>wFqbsChr~;r`_sj=;LYPZDYz!q zodqBebJTE>wHSDvRHhL;MOp!Tyh1-8Cu?^0q_YGcy-;^DKG8VEWC4*yL|}B7Ac`Mb zhz;0(5{J&fq9Vr0^%5Uu(|zgE(B>1)t4!}t_IDCqDA7A5!3R9k@C~kI(fLz$s509Q zm`nB-Tlx=BJYkOGhj zTBtE_>^?f$NGD4@JO-`$g{e|scHt1QbF7;dQKFO@+Bms#2C-#dr@cCD06L5PV3LEC z6N(3NIP*=VdsA8ZKe6zHY#y9Ht=LCrSDjatX;~KuQ77`>;?GWT1kR{EBc6)Ue2Dg9 zxe=Bbh17aqxu1rZPP3zvOTxbp0|$wL@^L=Sv*p4}ND2yocGXMwfq%34m{^PxSRxVI z&~b5s*7yOUZYr59(I6+qsn)*EWFMW1b;c42x;+5_GFX{`o4FmWSdL1}%ETQ64VO_FpX#+gBrBGxLAP^CU7Hmx{x4c%m0ms*gzGPOQ6 zkV>U)N?n(Ff9kE}%1o^;&SSZ9Wn6b*D7B8RZ>5s)ebF>=@lfi@%CvIM`NcqGrW8$4 zYF8wTIy+XG zYIPM)Q(u|?pd8k*%9La}5i3Sxg&ur&COzIBD|23}bb^6o%}T#O>BTZj$p)Z5n(3cd zX4xeEBTE0oGVh$if80p_#4@Gh`Hu|!6U)5nWd5T>|HLv+Mfi`$=${yyKGYk`3mSA1 zfR>}CZclwQ^~KZ|QeR7bHT8qkcTiNv%qX`ESQJjQgCW<*I&P1^g z#R3!;pjd%oJ&JWGcA?mTB95X9ML&u@6xX151&TMKcms-eq8LK)FDO2M;!`N@KyfdM zdr&-#;_E0LLGeQrzeMqK6n{kVI~0FI@qZ|$!E~5{;uI7oqc{)6*(jExXhqS1Vik%l zC^n+lgJL&|6pAE@GKvC}%sp2&QSm^JfN6hE6o z#iJ;?iTs&P6f0*@0d~opL03mIr=qw8#my)doJ7Su6uVIwoRs;>X;l0xibv4Z4^eyz z#Z#yi&R6L8~$8)Lp0g4xzsCXX5hfv&#;vp0dqWE$L6<q~Z(|pF@>TqxkX#RD2P|X8gGU#koM|Tof15rQ^&?P<)R#Jo9Z7Y)|tIvdR?j zI|5&YL9b}AhYNov*#eQ<{-1>AhYBkv*RGM;vlo( zAhX~gv)>@I-XOExAhX;cvm4Ep@GzJGn;m2p8)WtxWY#*!Y&FO%b&%O*wVAhXUvW}Ab|GK0)6gUl*}%qD}(B7@8x1Q#*HL1v3VW{HE$4hNYP2AK^GG7Ahc z`3ITww38!>A7qjbGPw^jsSh%l2bsi!Ox}Y`+Jj8igG|!Fa_SVQkB_EqC86~x5?c3? z(0Z7J)*~deewlhc^+%RislN$vHSK8P1r}GQ;1i3hbMcAA)e?MSadja+vAEidPb{vk z#3vS4z4*l9s)SE0u3n2zEUw;!Pb{w9i%%@BK7vmyu0DrPEUvzSPb{v!jZZADeu7Ud zu6~VAEUuozCl*)Z$I&MiS0~^Ti>nvo6N{_)_{8FBIXpq2VsVwl zCl*%+@QKCM_4vf%>TUSM;tG31A+Goni>r4)X0fjxNAX7#&!AvomYPhTK8xb>DE^A#Zzx#6t$=J}0rxI^dNX##Z$X>!d}8r8fKP8Yfr^7D7R{hyF^aFDcnC#lCKdZp zu$Y`>i^+H5({xDE$tYN0&V|(6f#Nb0KSA*r3KpWTh9oV$h>HCvK8E6U6ia4P(S{<8 zVjqe>qWCk4rc?gCMIVZ1P&|o(MRpR>`VJJI zMDY}gU!(Z*SyViS;PxA@2Vf1q=B<AWGq6Nj>DDFYAu8oRIP<#o+y(p$Yl^u(M6<8NOm6lPlAH`YAshEr6 zODOI|5nn;YUKCHG_$3Nfd2^uwFF~;Z#X%I;p?K~2_=MsC6kkTM8me(EiUTPA2?eXm z&*Iajmr$_<#nUK$iz2p)ia3fpP<#@_6DXcUapg;?co~WhqxdL_M^XF~#VaqQ;#DX< zjpDN?SS7FNpieOraTKha@53in&VRzEfs3d(fa0ep9!Ifv4HcK8_$7*;qPTA@6<cihb*;NTRqF#p_Vqh2o1S zCU2x-9E$lU&Oz}36z@fW7fmyNL9uxg6&Itxi+-6N6vx8wn23T64_s2ulqvgUCXeF8 ztyCO`;=L%|j$-aMD$YQ0JBkmXU~eC8`(|ceN(FzqVj_KFdAfTNePY@9z!dt#lCXUi zeS$PASB`V;PhsU$jze5O@3?4_Bffzr!m1~BX3lT0cjj+tKik)x&)QpF{&JSti$mE)$%@MR2Dj-`8QS+VmZx7?)FbaxHkzm1^F zBnU+tn~JX=+D;pP3O6Meg52_9;HK0Ra+4h>lApl(+IHQgCW_~Rv;-@aWoydfvNW!~ z<5Rj65nI>@Y)1<0-GkuKrTgRQmPn!y>nTNAm+YM*uC!BLk%rsbZt(9CL_rxoIeEj$ znQu{5zl05}nq!rT(xG>BWddwp@=C1VvTiFJZ4L)1xhmiR-FOVHpMQforYq;M3Ftrb zP5MiJVoAr@%C+Q|g!_|{YiHAR5sS$v^P-R^lhSXJ&moqLwi5al&51P0zaxw0S@-XU z(}j(>-s1Dzdm`Q6!#C)6qf% zf8%sa4rr2d!M-vHgksU*bYXK^$sBK21>p^wwTAKb z?`C)#lXWS%bWFy!DRq-Mr7A&`!lt%iN}WWF4LH0tki+*N8%dN+(AIW`1=>JM8%rNE z$I^#`u!K!}!&t($UyBFWJPz+^23ewG!efU7fB%~~<-QU`Ik;9DrrbxV@exW{Ig*rR zWUsNGnN#Y~AWFgY)i9;bq{c@mbskT!?&N{#*AY?C?0)(2q>M+^;PYz;L& zEHKt1q(9*U;t~JNftAntFBdLb5gySvU)-Rjb`sWAl zkSOeLSzGIh1$cV{Cm@lfEtDkHu~!;aA2ud$Hpk?9f-s4LyoNEEp~i>B3cbr5W1kDc z7>*1Z#@H%qd{|)Y`{o$?P7ua$wAwJn9z0wy_N+O^o({qoj-VUH*axWbVZmclb{bpJ z$52&YD;h`j4P)&0hYQBeHpkdmK^Q|wL&F%`PmK=?9($=d#x4lL7{WXn##n|L9~Kz9 z(i~%#2Vo4MFAZaC6E!|8Fjh9lSRn{w2nT8yW53>Dgt1{+p>iiMtUhc@_RZ#)yDUkA1Yrz8cnxE$g&H3g7<=3tV~+)4 z3?YgQW9*s31!MnbjOuW{9 z7+`F%ImQ+SVGIGm4P#6^6?_lMFvi5w zaDfy2Fm?Mzf1*V_`*ycEXrCV*XsISE27h(~0IsYJ;M_t#9%bUU z_xyqVzB#bp2@BX$8UXe}A7HDqy!+Dkx8@-KCM=LoZ2;u?)gWhkqp_GjK_~4pHtQx( zRX?*XU|}lmJ*@%g{J7UjI?>v)*dN%l%z=GzSiqh>LclI*Y4r#8d~;xzhXw2zBLi%d zj%EFUz04fg?O_4?;t>NjfQ|F!z-Ge&_RJ9jw#}ci2hD-KJ}h7(BL-}{Kd`r&1A9wY zz@9Ziz_tag*)N*|`^B(;oznoY7gQ@&%QBoRRZq07B~Tv!*c{v+gaz*05d=3tNd3Va z+-JiA_v{A1U2Z_#fK_|!<;FJDWU3m94RuZfpc>dv(Pcra_8fCy=Y$39xeWkovT6y~ zAaGx54(JRLV=D@x& zEMS`(0M=~P25tvFY!2?fgaz*W2Ea92wE-6L{pP^l8y2t&8UWVALBV+r{WrrIIA8wT9JW7(1zSs4u$BDjcKmK*qi7mc4aF#07#3_vf7s@k!**_1 zuq_G;wtfDvtu}}4!mwa#4GXrSKWux=VY@Oc*cLYc+oEb&!YMbRxY6wo;($4brLaI; z(g27HszEF!qM3mJsqz+c@ZJ;_cmDE2@Ap%4M5ml4I!mvFVg8Wr%Fp+9Z&fK`crd2e-aj;D;of`xf;++tkCBV-2a*b z_gq-OogWTx!6Nj;D~v6d6R2t^mdgbV0OxUHP50R%xX|WLy{I{W&0zufk_G_u&=IT# z1BB?s=HRUf3%pegfakIKa|cmG=`9q0TE@(QefjW!6|Xms7W8v-QSa@rQSUAuC z7NXTyp!Xn>S4S!NqhGAeo#r6k9wLaF!UQqkB>N$A5FZ?45O-8l5epiNxYl~EgPnh2 zj)5S}L>M=O3S+?0 z^{dTcd}W9*ZVna3W&TFPyUk&IM~EmK4Cqe`=+X#@$YH1U4<66qZpKXucV{9G#zYwAQTqDrdCTW00 zf0{Xvv#DxGCeY?rg$rbWDcfcad`*ZzzAoG~8DQMqY!2jm4qYGvth+Cm1NqqyfqX-_lngNMzH1KTw+>w(1MIt} z&4GL>L?CYtm6D4C?7N9CGq!lfQPr@Ff!iAa@};%xJLxSb_UGx1XA^h9ndVTR9wOAg zYXs_=igR&*owvdq$o3F{yenKF1MIvV=0I)>5y*SO1v0?S>oW&36C#lJhYMtYo%aTF zAYT_EkdK55WPqLb0dpYVA0m)XhYMtYop+BpkavX$YC`g$U&H;Q|?8 z=l#wc$Y(+X^5}65xYcXx$pAZV%3fm==oqRRmI>4rDv(P8?7X?=Kt>K-AOkF(mzV>& zGDIMkhfB!-i|2B4Aa{lcHU;<>>b$iWbSyd+#o23S0|nFIO3 z5P@7DE|38h&%c@j`K1tn+!QX50T$1Hm;?Ev5P{qpE|38h&!5bJ{C$W(UK%ct0T$13 zFE_S$rc%|gES~M50=YE6;yKS8$g@KPG9E6F0Txe(IgqPD1hOYwAOkF(J?22}4iU(7 zxIhM2JY{nr3n2no3Kz%#i{~bDAS)pP`RZ_i46t}UY7XRwLIm>KaDfc4cpfkZ^1eeC z$N-DyQF9>wGejU?A1);WES~={2lCG$0y!8ikO3CYj80>VXF634%i?)ss6e&_SUmI1 zfouv9$Q!~1GQi?lYYyZ^hc1u-7Eh-+kS_}n$Q#3@WPrtUz#Pc^Ap-fPaDfc4c;03X z^4&+x4T_6K2p2y9Bd@MvDhr*>~fW`BIIgrnX z2;{Bd0vTZOoYZA(@yw*EVOc!4g$iVQfW@=W9LNPB0{QK5fef&C)|&&l?$8A?z~YIU z1KAZKklzcJk^vUaHReFR;?M;$z~XtQIgmpk0{O#mDH&k#e99ciI}TkS11z40&4K)S zh(P`_TuKI5Jijyt^5-D}`J@BLWaU`<`IKZ~XiMeTbS|DPCz74neDBcSp~~sLkD4@X dq5n!l*AK-iQxnN}zQ7rQhPL2|@^W{}{|AQ0ZsGs{ diff --git a/en/.doctrees/pid-issuance.doctree b/en/.doctrees/pid-issuance.doctree deleted file mode 100644 index 939d7a6a7253fbf1cf8e2c57c25d5fd63126168a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 286685 zcmeFa33z1LRUba%-Zg6vJw0Q4X8fkd-P0|1m88gH zNu{2J=3_jgdUrYJ+;h%7_ndRjeaE2>9=z-ByXgPQ4;1r>WOgeYjmNXOxLw>SAC2c? z>lr&++WElFxp(foedlcXSRuMu%&iw<_D=aOw1_2=>3G4;?mUl=_fz{)GF=Rd0gl9S z8KZyVQ28pBIAd?otTkGH-3~!j zKAevNgwjsp-r{n!+!QU93d!a55>OzJ4l1%NE0hVri#*FrCcWJ0pkImx1&n#r5T4DOmyub6H1QMSW23 z@o?CB+j8M;7S`e7MJrLtq??*7%X((H(DH1PB;Nsib@n>MKJ%}~%i=FiJfIK()e?_@ zREbxE_^-u3kK>=$;h!f#s>3U}LMBSE(qub{rxLGUPn=G)CZ0~5O`ID!i~-KCdkj#1 z)pB7cDulGb9MRd=AFb_ibT~hEWnVUY?IeQ zByM=F0%Kn9Rannz$ZM`c!HzGc?NZ4ugtj~uL9D{KTIWkOXzxE>Aj044M8K2uPgfzm zd-9#c;@fu;(ZpL7sS|?K_j!_f)05Qqk)Eg^^;?PIH=~7YGP@drHY$SML&*|E+s>z< zb-?;F>!niCT1_V{XrD|zX+bbbb`}c4N@lH_>vpjewWRim-h$e&tzs^lv*J-SK+CvY zC{nMCZDn&={6nIg+(=4QaDD$~Q0nDtz0^zjp-RlXwZ(By;uXAzXG3df;`OG}Rw-dy z_Et2LPuoRCyeRZ-oQPLSB#WAKq;V~5B38zZW=mEnXDu^|g(Su7Cc((Z%j1n5ct;WH z{lN%@&DN949&!-sSov@%T3EI9&J7Ja1ez^Q4E6Vg1_%0S?M7l7QMD3`)Hr%|?MQmPrYgM>M6b~+q269in$6A4aC8+?vzpro zCm}dV?8_}M@1pDJQp-vb>ZS#nD2Ly3h3!TDLpr^>x~PoP#prq|kt@I&w2Kg{e0;@4 zutVw9P&DeGjru{8;d#k6`vZ_9&TFd@#}qXoA&YI{h^Eyp^o!zX4CJDU5~Wa4h+|tQ z;vkax{*?Gmz%*XeXi!O=$Lgd`d$_GJ)WJYCsnZ^6^Q8`rp|+Do2^I}1sq=V!)FJKK z80z?`X~{bs{?uWrzTwm%z$A5^sGB+slB|vZlGWiaS)k57NEQt$sq?zJsngjg-s!9< zSskHHKgj}h=)2a{4cg*66?Lq-sngXc>bN&|rFE57?g(|&pbmX+ICb=f{$!oh>1>qV z!9X>6r?ZCMp)ndx9U4?h)~Tx0u?_Q3?C7D+aKm;jHk6A(CzWw1HFIak+__W>xvz7O z3@QytYiKVf2M15m>8V}NsX-c=0C8JCiV8~3h)z!XN3}5MWa{aL(MfCS*H@*}^Pc?F zAWh`fLl0H(ky8t)uZlLN4jO0#|7Z<#x++aPt>#d7qcji(a>-Yve(tWJfoP0|Yakj_ zO4gaG)bZ9p=-WX0R8UCCjgl--$e@vGp}2>EWKgLglEsIWbb7ifovLwBgY-{#h4%5{ zBB$W`T)E#aQAY<*|4(So|q7Hp;unk0jN$Q-dn>rnh zqE1Hu>U7kg4t;MpbvhJvnyXT$ng(jv*|a-cc{)}4#i4=B^Qmg#kS`j?Nu>s9AmO#?OP6xNLs6blF|PqUIC2aWtsVKj!5J`K`9`V@A)Ds@)K@);QF@152{Wv>@P zX?rV-f9LX1{HrBxuSV14Y)81J)G{#MGP5w#@+P>+FX11GIiGItofr;}E`}qmZ8#iv zc86Qr!mX{{?ey<~@hdJ89kLN6EIK4h{h&qZIcezZ2RKssgsKu|iU>12@9?LRbG}qS z@ZBzilXht(oGYxhAh6X!(T0|IA-Ylu(eI&Du4so+h;fBB?d4E3y-FU`M5gE>!hzJL z({n2R)C5pcviFH4y5Xwmj&pQpG#3P(HAhZjjc+NphUkwe62PtGSZ(pAMpYTLdz)0E z*-{lvv8n^RK+{}RI~yx(=PA@uiK=a)N`Gop_qwW%i6y$NRnZ;ct2(l0bl2?dN<7z0 zJn2u3=Vd9rftS=IFwH0tY^#bOC1gNK9m;E$(-o7*mnp3mkTGL~4Z*5TJth9sXkOhT zntEP|Y@{l(OhzYqN!t1+bCbJRR4%IVd@dhqYjt7Tq(3^=)%;cC{cPQM>)~l`iEVpT zY}vlecBWA8)SyOo6}ohNIgEUP7JEGuPvURvP02V9z=bxWX=Hk|L<`9JDk1uUB@H1f zC4{i9jRdTi9a29cSi0u zLde&N`6mz=AL{Rz>l@M}s^(hi2yNJf8R+j2!H0#cI58O!7kBfxq#iCPAMh!Ct19NOxC7n(cDaLlcu5b$Au9 z<|~Zx?RaP-QVrX~#bhqO;q)KqUo@U?s)eUaQ>iwo#PLE^9Q#SuIfIAh`n0GU%%yl6 ziEhj5Ao8<+yY(&DXVfW7VptA$DccAO_O=Ep&Z(vC5FIL6=jm&=O zof^{^SIP>rufe0KXdx3qa&9#3rIilSX9s5TZ;efx#3uL@5`#BZ#bAIi=%1W$D4W10 zm^KMqTk%0MQJlDlzcnr@J8L(SNvxi!id6?;H8t30b$7P)=(Qo{FRa8ucARo%*Z~lK zw%{LX=R)ErwPe3*{~GYK$-8zElLp9UTnw>1c+VgC7bqRaOe`-R`|h#w5fKV>ByJ}T z(+T1%J|05eSlV`cD&IRf)Nc(5Ym4J}-1Vc(v`l>pR*qM)r6d9{O??7w5+_qH(7%wY zo_IR-G5Swryff&I;m$#HwGhoGoIqTeLBeSPCeH??kutLx>0K6#WR{OxSV3NI5&yZ7 zOK-?LRNIovW38lfo0Nts*64V-VdE*(|9t?|{~aN!@IC6F0z>_t<#aB#ws>#mU1JkL%E)?^{KfgPsMe9;;zQCcqFhlm&!ygSis@)p~2th4#`<#aNJAFX^L zxq%G#bI8t(mOvJCE9PM^C1F%sxQD>0*vi8Vi85;G%3alr5IXK(~64!;b%?ZIBXxlckC#MQeGRWe69=F0KD**972J|cnB~_Q~~iO zj%!xbnklRoOV*$~dQo<>qY+S{;UG-#CyMzPonzY|@6GjO!KN!Z#c-2eJ4v{TwWE;; zP-IHy3%U4u40Hu=lbaH_Te(fjt_G2!5`4)8=YbX-65~W#Fo-paK8%cPsf%i*dSy=u zgOwrdkd7@07`LKW2pd`RY_T0{&nE86W$DHWq1sE=eTsygbvYN`w$AqTUOwlQ^f?QPUbL1Wgp3@74z6$UR!mIi z)KS>#Q%7N?oN>>~qD*s0g8;)?dXDna>7*UD`pMgCwY5KQJtOySVN@+AOUvu<5tqWr z9IjNc^mLi69{BwI?9w9fpwuEnNPS!fadC$TD33GxMAJk)%ege*B7rCvjq>A3Z%y}( zjYiJ76&=xqk(21f_+E-RbQ}}P0XR<>i!e#1_HdLz|6tyJ?tBpo24uDP8cSGX zc4irDH4Qy!TW5*Ihu|XGwx%Vw_6-eSR!eC#&SynjD9V6avN@&$!Na{b4 zxg+e#qqt_3h!&GY$AXuSSFEc0fAv;LGOKAHN@_!kVT;|u=^jOCW* zJJu2y?Ima}>6NDCD=ypWI+XiFMTZH~qQ=$B)E}`$uYT{Adi^2ikKboaQ(wTpB+r)r zM6#qblRS-pm%FLvA*@Fa2w_eAnUfw$L=`>UA}T-Vg}VL1-<>ZN^@ zV)A#^FbB&kw}%_V)W$A$zd5zk4$QSF*;9+lLU7eEBUQtK*Z$QA=GI`*T=hvY>La8k z8HB0da%}1g-w4tCM@zu2bx^c?7|cOsI8q-Z=&729Nc+(U9WOuT=OlG=Ts?>12QbSfBU>Pot;Cv| z`sLe|`|~B}o%PTMp9T)34`7>nH17*6MsyKFocyJLS7W zOyE9?O-IKhiHY(7X8X;GUfj;8KC!>wW#L(vB#Qg)INx~%q57Tg#(ueQ=?+mvBy5)v z4W@I>LcRRTD~UJtF7rjEj!b9DAr?21HpT%2k#ze%51_t;(}ad*p1r#*-Jj0~JL+(; zRLEslokrAA8L5&}AEdyQ?)wh`=Keou0}ZC;KFp(DdJuu|*P@+r`98OgK{1KTnP71@ z0Vo-74;}<6hsr@a1~KP?js*h`_k-$EK~CFEP+!|_5pBB#)o7e<$}BshqmIn@Q#I6# zaJTc)1MAU(IHkqSMFfm_RJo#uw0V{F_9Q6pvfdO!z3N=p%}oAVp1GN$=3eRxOfUl3 zXgokseS*|~#8|1{paEezn>#thLVg>&v>#(oFLNiSUNSSwu)k4L(?Yqe)kPA@(5Ss( zr$d9tstQqF(0mAfzR(adBM=*}kq4LhD1a)T#!#UI4TY303`GfAA$vWZ+ziR2H4LRP z<7OOS31bD&L5*M-y8j}}=q3)y7_+X6`MrRgH*?oKt%-^(yJ=m-0HXeBTWjlSmdkJv zf$`PsMWoMAY6?&3Aa^H`f#p4gtSdH>_mFeoyx74~PY831Va`(1MBrSqyF1V&%94;B4GP7&B1C2*bT zgb5QHFbd(f?uZ+nEgwwA+q-sBv-n_3;xZOotj&Td=T%jjJxDBo>Zfe|QOB1v0MmeT z1PrU7sH8|xy8LQ;3n><*Mdd(3G*Yi&VYvWkh^Ch`U;3|yU0!Q~00$5A{kgDRh-PkGf!pL|P} z>jn0q{4NU#oyfpjPe%(}HIO}ZkigZN^gV?6a^kM?y-@FQNdDp$@NkHAxus6rI1?h- zHH|D2$e?4a)DC77$41gawJD_m{Zf0m1ZtlMXyWZYR zr}#&aW!oA?zLZEkks(8C+Agi+Km zlNsE7C~PD73WHdb0%Kcav(qyy@iJN{Bq`Nzy~MHvVWJ>G2C^nHRb?t2lO}x&j?%~Q z6ALb|q)-CHnGriJvPRL4k|$LgS56HOKr%3uZZ8P==IJ0%21TSv(x@uiOeVO}kB%Hz zktkbYiL&aBqJ-Z?9G<~jfyZ((8z&_svXya%7Bduhf-oeaS_4xe!b&a;3sA07FY-B2e?a81_W>7+ zY)#rsZm*}E(c8@z0&L=0!op)!!d9=f0uD|vM$Jc|Gbri47RPd#bI1YutWz#97~EKN zN)M&QAu%BFA-V~jfp+1h4x%vSz@m3S3o%O>l`LlrsN|f=;IpC43|cq=EHXH;@yuslg1*;m_W$U%>crIrRh56r=(b>R^*&k zBASO)AT$zdzKUzF49sMK&UJJRkJHXTiq+cZ*tnMv1f_!HO4Ew(P9;h#PVjMg>PwL6 z1BDC%u~d8dBzj3b61E2Eo?Cj`0~VpmCC@C=#Xw0kT1Chnlnpdo!cHrNCK!$AEv8C} zWO|)y`vC4cWXK?+*8)7#Z4DRy!Y@%)#+@zh6|%)KE7v#(q<)2rHA=coedU0|$@S{0 zi!P6A54(kg**)6y{S6FU>o6w#Z@(tY!-XFOx81RugeG~p*iCxLX&vj!I6=wo)Gx8s zH_u4!bCAdz`wy(Cp`pr~FOtpXAxr-a;CaZ>nP3n~!8%pj1l1(}dq#49;t47HTShz_ zrmt}kbIb1@>{ksBO;R5Vpe}jpuNY|lSX5_$g-6*YrO9^3eAec(2b-QeRGUq!lhA`r zt2Nea@mfq7a5H!mO_{IYZ@k&`m3-FG1S2ZcCr7AYpE|*4w`)0i3zH)8@R-H1lzzH>NrO0nW%elIb}pd zU!wVJQ$*R9XFi))BpnmIP5Eqiqmjy(I^G^cQlEDg8+(%wu49(L79*xIGuRZL{TMqJ zyRD6vyjR4{^7Z(Q@m@x%hsl}0NLIIL%HQzP@yK{6t*<4~sysEm)(2>*z#ggMXwvk4 z4+altEPNd!GL%`48w-X*$KfSvxR**pOCZ#@Q(NGUcQU|t%N+|-YNx*ABx|sf%y5q^ zT)RVPa?`U)FAXC!Qw1)E(}UdJ(d;bs1-o=3f7W96@!(40qe4k6^kOmZxRUqiO4dt2 zbgfVG;Vq!l_t&fWs&BmIqvXvN;cNtzmXnBpA4V8;CAqbeIE<{p^%eTh^4($NU$8*y z&IrqW`Z+ip0L#w=@H?0ZPvo$2M1-C73(DU=qn-Tn;J~B7B9M#t3~JNF@F+Hd0*DWY zM|~{z{x(9o^cpJFSCX+U`JH}6*^qn@QKDSNYNJR%CwnFp))zh&@V06m0SGoKzGZT# z3xvY3i7e7t)0h(>O)8ng#t2KndbxnB;`d(&Ao6DX9zAaW_@N|}>sJNOUj=|iR4@BWG&QT2opEL4EPM{ii5Q4Xm?4=H#uEU*H>zF?@j`QR zm566^GmnKqm#!li9JkDNQ#^oLM6o+Et&tO3g! z7(uX!!iOxVN@Xjl4&`}^_v`Lz?^-%X!M%bFZ#4=$aTfH9x`q|Iw}(6Ssiu&6j{#Gl z#0)TaY3vDUI*VO(ZLXJBWWE30DO&CQZ)AF0wp zk9-IjECKCo0)jc^4s!<6gLr}WWKI5)KtArvr+Su0b^+>9$>e$%4lMG<4j~F|Z#j~@ zxH_m>JEVLBF=NW^*g>QW`wC*LsCrnw59Kr8Xi*JK5}}>)5jJcH#aR!Jmv*9*P;?HE zLkkH4ssp`izSIRYGtS)!oUhr5T6H#kE=Sd@#9AhMnBTy4`Uj=Ft^}uOADX(e&&mg& zIp8UH9Ji@tM)XmZ!GVxAvdCn1bU7k3!~KhxVl*NlFZxP!dl#aS3U#1xnCmC^TDlOI z>Pzz1LDFWrPb@gnisN4gHu6)2dUPQQ&6vd8WrDF)stX+*EJfN?u@oK>tCywTiQ(#J zDK={rmQvp&OR*mmOT8~Rb<1e#W~tNy1Gs@4Mc`HEs1sg0SH)@?j?RDTl}_{`Y;2Of zpY*uVYl0*2p&KGU1oFZi8laDRWeh17cYOm4gL@%MQu-Tt3D>#HJ1>&Bb!<7NFOuxn z{Lk{Gkg53P$ECAWT?ke$B(;Y+v}+a1AY1Co!C|Tn%F6taiR5)t_@_v2Oh2nqR0ql2 zso-CuuEir&tRcxyI;X>FEa@?S4b#`M7{q-p1=jQXYHDfNg!VP?eb8-*Nks2AEi^sK zAMXM~miuF!EVs3Ie=0( zXj1byFPmH2S;Hz3R*kw$vp@+ORqxZ(LaUzZG*m70BF|MfOPS}>s7Ab=NwddPW>xrhX+Ed z1IxE=&CN|;%XF-i+OA#>^)75r=cWh72L`gGxv`0YX?w~Z?Ye$pYH+o; zt*du_dOVSx>TesFzdUYVADy$eyXOkmGXvWjtG%nGOzZWHxoe#R8=+f?8_B_`+0Bmr zxy$x!w!aV`-|ULSVizu~Ci`w~L^`i5Pq)owCug^&H`|M&9anCR_2lFE;%r}L{>t!T z_gLF@WO2RgR^Lj`NW6WdG~X7F%-_1vzK~s8zpyYC=^eOv1|pj$c@v zm><2c+85ot*_E2;ifzvWxY)k*KixHTZD2GzlbPw-&dsm3#=u4KzGAv}d$sSvg=_Xeyp)gS zSKEi;v56Za%QsgNH?Is|>mBRKE%wihj`ofWPtIPLUf!B*AGdGLk4_Hc3M1|PqrHW} zk?7Qw>086w-O0J3tI>G8eY|HmvXZ~D(A9QfbNlLSVR>k1;AYSDg==l=eWkSpduuZ} z({^R`*7`&)GdSBdHn=)nh%C%bU*F1Z&rihS%Oizbk-p;Qa-nysV|o5+^77@>N>6C5 z(Au{!H#KuJe&cd!qc^*DVYN5Xjg`oB4|HFjTg(jiEp~)TH?K}E^sJ3tU7No#-yZL7 z>*;KrFZEs+n7@#o8fh=i#d=CJ+w-}V_3Lx3@B$4^tf#xilhc#-OuQ?VA8#Ly_itWr zU7eb}HgI7wni`#$UcEYgIkP$2+B>>BWoJhciS+fgwLDUO*GkD-(+i=_-l5F33;Bh$ z3wCs5ZFS*#rZ?3-na+*PWEbq~ljD)8uKdR6Slish;=<2}j9i}> zj`z$JHuBTU*OKjvH^!!Nh52jgL~LOET1RMTaqDLLwaLZVh2&7@LVjy=;p$jV`(WpC zciWAT(a^+lBD#Eax#z~#*5>f#iPVIho=eQkmP(7;H|){Kt=yHF@yzOGK9QV@_T;B7 zx5w-e`^rk>!nM||nf%r1xf`qL?8+1=56cQoG}&38xhd22rB0qOwM z4&2g7hm}`;%?1-Q}0GwT&-=x=_|Y61WGPtlZI5Eik=Cua3a0z0-B1ep0^)O#c2dZeW6J_NvW0^@E=1> zGuN{!w^%B`AYK&Y_nED}gdJOx>*-!4c6p701ngRomE@0!I9G+v#dO!1u3|Yx6`=@} z`Y%~AT$-XN1+MI{cTnVwJUZ!T@%C<(-NHkx0s+7%US8pku^<{FViYV~NNj<~Og;zq zEJ8=&O*@?qt!42>hOKukgZQ>Co;u1ZO7r2jB zV^9g@2`}c-W4?12z#UV}ugCF%?OvyBNO+D)anXH0unQQvcPVRnRspf$+CCRp6eT)m zyvSQAyJA}Ma(y4Lr5Z&6I|gw>2OW!-kvU^CjYj2wv_^Bk5^EQnHWAUPd=wg$y%ffu zr#(&yC2FtX)YSHgGkaD<@mwB1yltAA!?=D3lAmyf=%u$Mbs`*h85j$HgCqvIop*-1 zs_jX5Uk5R1md1s!7j(p_V=QDKLsvp>VqlN=IM+RLec155^H%gNt43f=&q zn#wv|-nGr-jtpJJN6ro&!Ni^kFhr6@cW0yxNgA5$Zi~Zt8yU}qqiYe>92o4)%^ZY9 zUcCW#rmUW1Say&QQ^MZmM@mu4H=;Wr?V6gtNU>0;+%$tBM;FAe9>`eBdRt zc+mw))>7A~9q&C^n|OFlauT~SZm@*B!A|Cd%mwtfYPlFlT_vnq`cVt+uRy$N9Y=&! z`wL835%#?7x!u<#SQ-Et6`QaTvUtK@?j%Bwd9tIB2tC6W0-z`YHVVb30?4+WLEzA+ zptq4n5vdG%3n*2P#GOa+e}Hh+pf~SqL@XSs5mkcT3?lj_gWl{1rTy1Y`s@eA`n|zf z|I%$?eFCo{-$Sx~xqFwJXT^dWho%!=d#lva54yKqJ=RwTC!WIK4SMsfxo7K{s5^F< zhG}S+0g6pK>SxniyJFKGnzag>s&A4_*$;|M-y59LUw2#Bl)$UbrsbEEiKVE>xu~8~ zPLJd0;ySRD&t103Sd3QpVlih@?-V!ku&{OXP%wWqz{;Ds7H#jYx0W3V zqYLy3_2dL9v$aHvEij6$t1~l`Ep6eprmH!;?rl*aJ{$J8zMU=S%cs(;1;ylJQHgFD2G9 zIQU@1+)4;!3#B&KLdh)q&scUvKK~un&nmwj{V~cSvbpi@CK9?Y4fKrJ=|nCXnb_PI zEDVgz46m;DU5)1Kk+#x>*{S*E^(({E#nNUdHsqcMn z%G7kUeXw6QpYd8l`uMK9EBt@82L6?)g(D_5KZyZk z`d)eLttd-<3iTRKU9?UOkoG=xo_<+N#_5;A&%X(b3;Rg82Y_kTD%P&RpI{m8o1Nir+xvA-kbVG{BQZ-@btv^PU@HO z-(Jg1Nj5UD>$XkaD3>`O-A?DC^a8u#<_xmddm2L_{TDTmu3Ye06EEk2FFXc=<*iMp z3~S=l#ZzPnUF(o(B>FMaPlcnf99!+&ovR>gU@MKMRT4QzNlT17@K`3Gb~yn zQP_yRp%{l%Rg#}{WB5tor$w@KE{m3YWXI^%bEoX}FsoA^hCLWgmQFp-Mt^(L+nb&T z!EpDC-7Q;06%7ExT3&2vVOLedo2&+n({^NdGjF!`bGYc=d|)S^1ztYEu&&aih}ms zXYEb3ozG4U>5ZI+xv;fU3qz}@_6Twyj8j0(?g9mEM2O233JF8zc^2teN-seHR|C%X zzGUEJiojK#;T{Kca<4x^sY0NuW{B4u3+xO(iKZ-1=xbO+eFvM~zgL8SmXP{;aPFt3 zs&qf$cTa!`j`0bkL8S(uIQ1;NkILr!70=WhGiiubyXQ$$EF?{iAR$Szax&T3I5M-$ zDf+DQmsolRg|FjrwkcB*6&sL+xjpN?8>R3!@JI)GqD(fb%2Rq52|q=aDe4@Bc%#BO z%Cpj4RqLmkvPiqnNO}tf3>cz(jx7{CWk3FMrKb`FLZy}@nxb$MoI1}4;4cb6 zGb+lz;m~)xR#0$nR^2j)jrfLvd<(n~!LuUVTLzLCs^<9-=X-BQ)sLaO((3OB&V+B1 zO!)J!5TYrbB+TmL$s%}CszfM4=UJ@$@1(QXinO*-&J1x#{{#ODjYL&mW2CG+Cw9KuIjnCZ&IF-UBy~tNQ8v(5=8NIdoTI? z@h|T6$A2)tKmP3yN&Mv_ltE)na!Fr77^yY?_cb`OPEmcg$qU#iVq#M#`t`V^>Jv7&!Qd6S>8#u@+FCCbJ)7r75giz|Dtr z8vR+WIh_hf=<^5!i}-_CdCX-jc%4TdY2qS}Q{l@KCAGe<1}3!*!se0i{aD|J(aW82 z>AXBmI>_%xXqW{*q-^%~)`&GoPck));+Z*e{$I3ex$fUYQg~@PpWaGOT()mqyLNr~ z`gGU)*7WjF?->?1xl}7^at7M{61(9I>)>=`5dU8-$wW%*%L-<-*yn33cAZ=Mjw$Je z75;H?&Tmr}GhJdOZEz^iHJza@)v2-H^A^(Nc4X>HQRN5PtBew@3?Ek9I*@qx$sBjPg+gCxdv4o8}c(uZlE<*{7m@9 zkwgPYGrLpb4|9r1)D9B;bdRY3Xo(beh1RRiJMNZwP5A(uQZJ62`#zdm{j7nA?*|a~ zIvGMj(4?6}PrtE?=?}5pMUUY{hT|0+D8YEZ#hQAY_v``|=XEL$hrgTJ)b#(tly9ff zUij7nGE0w3r_|w%PST@Q!6vXh+-fiMQr6pA>`Kq(NF?7L@1xAO!Qzc=WWKG<&5WgH zBS~fO|fyZW69CJ;Z7u{B`4-?431yPXBJv} z3JZ}7k@2hfda*P+t2Y`lN0b#CVRts9B!k+JRNL1gz4j#sBjLn$^+ zE;&2UGc(7Cfm}I4*pV|Ai_C4uGjrP_XKr)(%IrE4^-81dQybC9+&UYKjWa*k3Y@ma zXRdFLrLJ#}rv@S`*TRv|m95^cnG5O3j*XSV>V=KaV0?bEwYT+FypXz(TuqLRZrq$2 zo88#VUR!13bWD~8N0;NH3(1M;;zH|I_xRlP(BSy?@JM%Sc4c|4y?blw#!UO@YE#qR z&i_qkRtqRW#WVhlonVoa2~Vf2Vi-_9rA`pIRLjN?shM(1xfDmeq0+E@qoZ$bGL*U8 z6B&tguP2sghiBXJZH2|n`L@-;`N4^S)WTY2F5&J{6qoI20k7N3{8W|1=u8M55(%L~ zm)w!jJ2HAlMqjEjs*LjQuCcGzX_SAvxoI0l`L{@mw$szi!Gg5xA~PMWr8At)%BZq| zQ!~!f#r0SWuad8<<56q&OA#+e!{D)+5#7KCZn~ljy796uGp%52qcALa+r*p9&9Ozq z;P4Ewzx7S9O6y2i-<=Kz`lo7;&tZN42%0i?*m$LrWG}dD8;xdgTiN%Uq>-rH>m-;S z;pYROBdl(P&gnqp)^m74c}%T_1n`Jh9^LP=yMWDUf%19lu|PjzGPBbHE&o?(aw62% zYE6vPis4lT0eR>TvAt7#Ef$$6OPPryx4z~=W?`glAez2@E4z6$G};$xTe;ku3wMmB z@?UeSI61I5Zcl_)w`M7Iko6P!g4QYGcKX$b>_xh|yYZW#Da}#3fz$`~LPaqnGV#Nu_(Z#MCW|=P4W8roaQls(z`CPFGrK+A{ zC$&t&(L|(4>2D>s$d$))B%-!~QuLy%5OlR3U!QbUj6*7WN95B1vy6VIaz~yTTf4Uf z$)qNc?rrw7RwoDVsqK0cq0hU}lxgm7_4J!))FgFo`!Z;>2v+wV5JbD43_uQ{`4u_t zGZwu92IE4l%rtE4)cYyVG;HhCJ}?! zh@ZmsFkc*hFoJs<6Z-|i@n$zy$why_^+BU@YrlXw0^cY0H^p~{*q?gh@-8N>LooD2 zUOaQOS;&nf&|&_!?)9C!0MBUz^I7XrW%s3M+Pus1}2 z4yMZrY!XZ#_X?E$1gPba8xg4=Y`Gxe`ta2Y_tOCuPV8)-K~tv8Zd4u=8%8X(z0qv- zh1h=)9Pwie#@**YIL}fGS>?@l=mUAaYP3tAvRrb7yy*v8!WUquV{(Hx|Y> zaJ@ctW7>JaAHQ$+Y{oJ@tvBY!TW|1?z?7pgMJv(?1YNquW@aN}sUiGxeQTm`GkJYs zDo2ytNY4$~vlq5wsp05Y>r`}nW_*y16Kn0DKYf zvH8-i<+;JZEv3FW1#V{BpXp|8#eM(;2=QTv8Voo6fM!ON_$)o4EnlSdj=y z6ojHNyEW7kLj|2yyR9qM9--m7`-M8YBYBw@GZ=SA^8OJ@p4xanU&A7()1&murk&>W zD3vez+&5urLsy_8H~T8`-?DHLIm;aEWeA1xU(`UEyya#Rz#p4fIn9Q0KU}9;>5)^D zU*=~2!e0nw7ozjmSlAx_?z*v%NGva0F5Z~Qr>|$MFTUgZPwD#(jTuZ~`sEs!RxGZ6 zVS_K4WH1+Z9!~}Hf}nA{*GgqO>Eus2#Nuc^JU>IrTD^wF#XSt6P(F5VZHJnZP?$y!m*joF{U~;H;rF*<QiFDNvddrk5ca*08XT^Oh^@;V?H!%% zts%Ru6K@#AI$$bXSndvWcf`6oqn-9jcULO~2BPb%c8Gk1rdoC)HO1?=7`d&pwWF)2 zr>(sUKd~qqO~*nGFiLp9L5to?2qLv0Pd9c!{=2y#PWfH98wEVLQ?Q6wQV4b+yyi3T ztsAFgc5PL-^0Wt?ClsQ{E{@0SjO>ntLhM;=k)6nk>&a4d8P5rb1GNmY@^d!x8Aj8{ zU3SdHcLy^VAbV3B0JSvi0v-Ix>*pJ5Kv)7Ztgr*Vn1F?I?KpR1nb@k5)~+#)z^(xR zMI^YN53b;9_b!R7?kEa7Qj7Zt3=M*W-n?Bc(3N2pGnN-T=m!Bj{q7N%W{*37YB4w^ zc*%P_ia-~PDcpy$MN%izB>GI?AJLFpA)OE+qQQUGE`~SO;8{m3x*JWIi{Wu!PSayk z2e*eaxNC7N0A#|usUSPfDDPx#e`xCSw=UKX(ZUZRE=T+59f6XUCs_ROB`Q!#m2=ju z$L0BdO>J%1C5;MzPeK`FqWU&4UGhD}5BRiKsx$s6MD3O9;FN_=qqF(s)?DBG@LH=q zQR?VhxMsJFFO0BQ{``&2Od^x*nYfnky1up08jXxPBKtJ(%9X*vZq{~oEioE(e7!Ak z|CbBeihDL|D2fWp%;)Ox2k*KIDg^(RI5&3p-3F6s_AKAWi}c&^5Is`hcw1O~V6PYG zcZ5l=|1gXQ4EO^5>rCQ+s?{-a26xmyj$dW54qmzBZ0eJa-^!;a`J)hqZ`7K?)kV8l zvIfK}Lvs5G*jkbB{WVBP@PC5C|4nFWz(4lj-9Zp&_C?_AWbf2DiH^jgo-PWN?+uR1 zcUPeDRfLMu^ecak>=6;#rQ|hbeoTrAv#uNBGQ7)+pP)7oImx+|A>O^9(zWOHQ#&g; zdcA?Fon&CIL}7wZjz}Sj*0|xuU&9ci$Ov-=DIa8~Ea&3e=aF*3Pn0OWvb0pQsO{1c znU=5#g*}6-CLen_p{Om4A7u-j`WCzaCncwRIuHdUe?3`~T6(sh48T?&0w|Dh0*qO1 zM-{0RcXFV$DyjKo&Dg`Fg(Rn9SoHuy`Eh!snw=IFNuw$MPTi-wmX$q`ZEnBYbcF9N}zv%uf?(Q;nHd$x1O&A7`PmX<k|$m7WK=A~|3%x8XBsd@B^+#-sAOs-V#mq{3fQ?muw#Nr z_0bN&EmhdA_++ZZW6jNd#AYHp#CXmu_0)YJ27kBX5NoBy=rlgnx=ku#tWTn8tt+I4 zvuf-yTJa|WbbE{dJehhmYnpl-|1!y7;`%^ybH81T6_ReS(eUKW%-4 zyNAE}*45q7v&3*c+pvd6XiW9+NN454BVXWzQI?5o%S-)Ne6RXG4)5&oG!&baINVS= z{Mjh=4d(07slh&r{h*A6uVBJ}jQ?eig=qZKPy}AZ!y_E?dRXU4Vx7->KQ4!Bz9(X>7_b&5!KEct}hHmMd508-s!hV}4QPeLow;7lvtZ=$IOt1>;Kf|?$G=^iV)m_D)#f+~f< zLG%|CQ;R=Ed^N;y_a{?*e096DIG%JmJYL#~(z)Xt-ckoL|CBFeRW1H4_+C|u^UjUc z;@=;D3&dIBBOVKJo3uE`ydKthJ+aQaJs_^4#korIpJDG>{2^#@DzTxSCh}C}zXz~| z)p@_!Tublgg0I`}1fYT`cc+PXzZsyLkh@=JO>64&g=#rrgP0=9tknmBHu<}%FR z$4R4J>_zaG6-Y*)3E@m!d*x578zly$!-Jb*FjF4)ok3IY?-=z=n+FF1BDMnnsW(|! z6!p6v+5|7-6 zI>HfoaM+_U{Aw7PZ?wqLbWflR$|LYV4v(o=0M@m#DWQOcxS3M(<9 zI5VD|>&jjbdKa?N!Aye8=HuY>V_iw}V^0%fzSaY!Dtei#7Jt^?yIy{^TQ7?TS3K2o z0niKe{IIE>MK7%(N{l|{+PM)G8X_NnCZ>#^B~oSrbQ3b3Vohsm>B(OCcsSF)o6#a_ zeL+zpEW>rSB^0I7<;~43XU1hPFD=nqHBP6(lQl=ylzSheoT;J3?x{Bsu{;nrwomF0 zdYo@%;{;j(nv&`06JF@(Aq8kgOavYfj;-7?4$_~x&qo7*A#8mGhSLMW=kyl?lRM54 zcYGs5$sharxWjt~Xy5N0pk3_%7bamKqX9s9^?f`+gLBz`bk{ zob%NAuX|AG{3D{BUdku&G2mwYIGWbyTX_SK>oozo335Hcn%30vpT@;#sj#E${ST;k zBuMjACQ<&5l{kpy3f%P_XHNz3;Cz048SlDUx$K@jE(!{^$xu!uJx0P`B~nQN;srwO zotbPj_vRQggvJX!_gso}(CzaOdvYwH~Do<(;XYEo8MU0Cr{D%=&V1=CLP44vY$ON;y{XsGj40=Ni+?FoMv1Q(nI0aDcIP`OqIKVdE(%p${N zr{)-m7s|bR#@(r@SJ>h?vKaasL0oRy$Y_1}aj#X8hr%vLzSa}GA>GDc>rTrT#-U!U zyH4OLA1>G{ct>C-b&C+7?1 zj}Q~`_~XN#y|mi;muMPr6Z-A|G%-~|m`M2@0lEp5@Gn@?nw!v^LyN0Wr1yI+9Qy#z zMmrB24^@t@3HEOp!Aw2hx3sk9>E#LFO?wf_3uA&(F0Dwo)#_uyVbR}k`#B$@FtakR zP}$L<)@yiMJ`6ub2o*(<-pBkK_>;LdaO=0q&hQsNQOMV1qd{}*CI3H7bEw?-DT3@i zjh_|!)fu^8`IFtbDSe5vraGmS&jnsQ*UmGk>aK=XBo~EXIfmFvGoeVR6$y4pa8HQ5 z#hQyk$o*tLsk#RtR=l?8*sS!}@Ju^7l#R_el#k6)QuWyCevBI1Qe(gF`JKd*&+q8% z?JGnIb9>{|sYgazNk;#a5w#8(^`Bwy+uMoC?agy%JAGV9-h-T=`psXh`JP6rfScM= zXzC{p6ofOCTpJP43eZg`xyM=4nwwgeW7DCCwNJF!dG3h!AgX zI3Zqg+WxD7;%(6OZ=q@av1|JqjGY`ukX>v01Ic(qE9eB2X?Z`Cw4tE01ih)CIYR#G z(-fIN>lgnS36An_UdCG6`6r$MG{ycK1k?*QY$1=MVTiGUGn+^myXjcU%)4)Ni0gG4=KQ7n+v;;=VcZ<{4;My4NpU0M^8EihK(RL@h}9>Wd%46Vn40 zx!Sw)}H}?f@m+Y z=zp9sX8mJ0v*>p_h6fy91#Weryqm0Eq>(!o+SBs*V<0YefqNWnwbAj#0P80_^Iu>@ z^p|dPsozLT{rLdhgwgR?*0iS45g>j3u7@<lC> zDC^*OAU(Z`BVH+yv68IV<4O`63Mx1x@P4I*@(I>Z?|83uit5-{^Y*eeZ9J_$kc}0# z*%cS7R}NG>g*+x!9CF(TJX3H*RIVwm=kvJ&9#KZw2r)gowJ4qEOMNtI4kyk$DqcH= zww}=)n7bT~5O!2$v7hmY8LEMe$|RTxZ~SGQI8i7jY8AILxFlJ?plTrN>{xH#IUS4n z!Iur0G)LwcM;c**a;PpU%JbTz)krTUqgcWgX2Xe~dQ(5WBBKb^d&3{|fLfhmMG8FO z3ZI~MygXFN6)q3Uql`->KZW$*+7K_BZ8Uq3H>JYk@m_+#G^hnw$IDk5#gNJZ39MkxQ?ye=hDevQbN>uhu8%e95u8k8^bTAeXhF@?&Q=&8(@_^68|+?Po{ zgYQ){CU|F4c22UKxk?zw&@z*F{8}PwqS|M*w!a9_0$M3Q=dqqa^CsRb9h|i@=YX|4 za}F!)bbShPo0${zV||$uZzd-F0S~0AWKImTrv73e?1?L^>8@_3z#v#l#yt&!f5521 z)INYVTK(SjRe=}r{{+C-l;vI`)0YEu6SDmG9QRr`RIkitlPCn?+#*$7xe?m@>AmZ& zj`c!1B&!7s&yS$4kh-wKZm95m6P(_#@swyh7J#ZIsV)<#UX5;k8xWbD^^xkNN)x^y z(@7T_l_K_tR(W0Rj^TI8N0ZsOy%lO}t<-nz3`M;Ky7gTjzE{%( zUA0zNeXmbyA*TW?q&SI!?w}yj;ml9@$vQlDHfOAISU+l5&|*XI!&S?SQ((r)R-} z_nWh5?ffCOa^|)TEzf|EX72&~rF(n_>)~%X35KP?S%msrV0`pERUl*ND#-Ac?(xDd zAalmf`Ha=Mf!5U2se{DD?`K&06GS}CE&YC~R?)cI$=NBLocZW>Iu}K~Jyn}_+vVj{ zOrt%UyX>u$(XR%ephSgd|Z**Tx8 zpK@Egs9$31yf-iEZpUzXQNI5G_7THm|QhUt9)O8 zZo*b+VohuLdCCDirxA=K%vkTjBOPcE5bxFi2$*L#d(TVbJIJS^$b(}9zn%t zr5gp-%&V);ppAi#Fv_LA*;&o(*}Vb4tqzpFN@mk|_RmqACiOAQCYJIsKm0U&Kf>TM zt%kFyj{w~Afnq5Rj}HD9+uzEL?KX)&PLrKXeH8!lQ>!co3HSbXQZLY`$1qkrm%;03 zJE_m0YZ;dtR$$p7Y54$6Q@#iPi+3=Yb-D8%_IWc}$nLx+^=ax~J={xn(fiOuSv6xb z#96cg75RyLS^TBf-Q{-}@V{(`}^7oPhwjIc|d`#W^qPoA44o+HXv@El)`dU%eF^#?U@t>8KT8N{Bn z%|_jo_pN4Kn9~m{j_|4r^E5sO+)SQAQ@?d4+)Xi^Bl24Tx(P9ToHc!!Y$kn-a{DdN zW0<8rfu3M+?M0wR*fN+SIQJW$P2@Vd?x#S{6Gsu{D+HP^hrhU)+{wmza}8V_0v(V$ z_j42Z8bG`Mo5*`GOMN`|4Gb=mW9lvGS}$`3j!n%TW){v9aD- z1J??k^Pgewn+VSPMbwAzEvCSlZGQ41yaJ7e5L~yhh=NVZh z5*}JU9Ew%TG!FARf|2YIwQ!#Wra0cmKykBGUb-41r0pn5kGDqR7BA7v_x9l%0(xLtczcX8bvCspQ;Bxm#=!iq*sxAG@Mv>o=I!0sc`X;P{ zjLyhAkqv5F=f3RvCahzEXE|lmP1r}&O<3GZj)Em*g#Z;&EQ=;#y8HT+*`y*@<~Rs} zEx>vCRiI%8*f>l0?+vD0JV$cz_w~w!{|tNIeS#H5yF~24ufkR>iuNY73Ai7%I)`I#>Oo58J4RIE_0dcGc03l8O#x! z3+-cA-bB~^G%TMdjv~re7?ylF`~}YxZ8p|I4O|_DWkBxS&%?}z0PX%CX1*J<)W>rl zVQ`roQywfawTZrd~@)bPCm!lq@V`F`w2Cfx6=Rd>Vx0AYRx%~m4 z7u->+mfIK5G~nj)`vGWTiti#V%kKr~CN`JfW=&rvo6G-Vl-uvk<=`V~DFcRE4x@*A zMe7svS78J{E5b+6A4J#v6!azHD589Yp!4PM7ekXf*;xOh;oP~On@cBK+x_ObH({3g zHkV!o*IqW4OBi97JU4=_`^j@r;yI#x1<sE6m+SdkjIIyM)s5&dUq$mT+)H&x_e zkv~#b^h|$#E1;K~i)SzGNqak*x>b?WN+m=^0^N21nwa9dOv|znpqtoSima)}=5p3Z zCM-wTB`1F4Ry(tj*;slVb(G09rmx?!7q4_u+HSfkhtP)u5X+=Mj41FSj@EBEU;O*s z5YMiJ>+_<81WH*FPgNu0NBc$n_TT?XE;6koJ1mUXLd?!+4T9oGdNzw@Ff;b70Cdp3kPf;P|Z^ zk;4baow+^?Hc0&l=t^vU*31|^DhHQ-q=PK6K&|4Z1FWK8`A@KwLz2e{FF>^vQ9GO{ zjLNJJFD-ejp@ivp#Wy|Le+U4eD7&Npy!*WF&!O?xNG6-w#HJr-$eKHZTNV5vRuN5q zh&46W^n5+6>9LxBhA}->vq=vtX?K{5fJXQ)0}xEC=$9DewO5qdxmWbQr6q@WNobC# z-!wq~5C9;tf(jt#3i8?OS-}-r!9QWh?Ro`~>iuG93+IcRsV5%w1vrL6`l_WR zZ+#7Ec);~Vk8~vfkb;#t-Rj}mRpQ#m7`f}<+Uhf;{v+t0`VIUK*)5+XWu;z>WIFB# z0!YYjR(9h%c=dT5=3rGD#@M^c@1>B=b5nRglV4ftY47P;dY)ZKU3zX}sK2jcu5T!8 z^%tTmC9AFdd0n!MZye#}WNCRFW%WzpWUfV2xRmuuJ3k5;*RzUd(YLgX`c5#O`<}P$B-=}U)5tjPCR9oeJ zDVh(Wr@|(#$x`2d?<%W1KC*7q|-yj9Lu`(7u%n0Dm zoMLPFAe-K78uUg~B=D_Ig16$PwIJK^@?p+G6$|*aPQ8@9y&NVr^a(G%7LZab?^B>3 zVtL-pd=H+Y+^u&{g!X16bsH%=&S;;TZOilfB(I#7DgcNQRqgs_JS$Ok;<;Qh9_!eM zCBs%+Y7ewA%1r$nv8oyAQ!M1XghW5qca<(d8olTt32sZ$IP&>x*1eyeAEYAd@niuN znif&#*YnW)--!KqobO&|V=YU6%cx-rxEn2@3;rqq1xyn>Nrd~$0Nn)PzQme(oR!Ue z=08peys6an?9>pwroj($bWD~xBgp#TDJJydkv>tQLkRjRo7F*5qt}(Rdqd$rU8$$i2yV)Ntq^6+5x%=QZBQm zHTR;IM#jl|80GdmK=XdgB9<~>P;iIAWwLI4LBaR2WiUr@+9y6i!S6)Z{S44#h@*(| z6#*K)9R6Zxawi+>>uTWY*z5vw=Y9qSe-_a0f5yqLVwU=N?$;SyCdbsrbH7|;9ejB1 zbLhICJeMV&Bg$9s9AA!lc#e(rZ)@OM!E^pI?0s_yTJ!waYZPPn)I7fjtpaW-N6@sE zsc8yrjuzu!fNo+-xtle8nQSRfGs^AvmePh<>J#sF2G?H1yM---IYPiKZ&o6`V;)X zyz;vARGF8}S#(s}!HH2^IUuY&>ru%{>^};!q&`pee`F$wBgi;QwW{-**l$&`U_Ku3mr;#suTW8VfoczlK`GTXm{ z`Z&ItF_N>XPda`pzhRQW%3c`K^U7O1XD557&Y_xoF`vs8ZRs)k6E*wWi;-MAhjpK2p7~FesC&HtL`ol51SX^08pJ(4E@yy<2A-91m zYz3Y!lIMT1ugbT#nZ%<@QL8!9+Geq$8+5;Ky@;3E;&wBC2~ub9I0|w^3-s(GOY=cR zVmJ(Q`B2*4u+w-sII|2Vr7Z5j236CcTv;)?YFo>>`1W}`Dl8v)Tv~!V6D1}XIxVSU zF1xgZk>bgyMJXdR1Iw9#j}w>dp5u|a3z5#ArRVj1so8xYjrKbKI$O-tpE+6Sq&MXx z*PQU8s~++90|6qV_2G0IEOPmB^ z0Y()?=Y&u-s^}azO_a%G~*qxsjMJ4;)rLhmd((lz*VUGBG@gr$Dl+$mhay zX<%K#Y!lAK(-ZLQAaj`WmL9|lE#&Tdu$~0^c*Qq8+M~Mw={h^g?h8*V zJC|eWzh{{G@m-`J|97MHWBGn@jP7ZRAmLR>UHR_kG!c6k5mSviQPEWTMAcq-qN4en zmb^RbbPV5>|H$FQVp*rWv&V^wOjAMB5|TxV6dD1*2bTx2)v3D zl_1;kvT>r~i&qb)eJycXmj@nh6WQ2_{bvyN&+qU}dp9ro-QV1d0;I?pEG{Oqo*9GR z43LHW(xjVeHvT~HRs5y^*qh?{ZX#MaKsQ0O_p+w7%$M?FFTe7Df=}?LVW(x=X&zKS zW+2~A)5#UPl!Wyls^$u1%`6=GypeB}*>^ zSOt@`Uq__6dO5KYB@F=9dI0>pwubVadr`3-@B zL8_Z0fK@dbL;(~{%<^epuu!BgpM!D)LGZdUExYXCeUP&p9V&r&fxPxcXzIa0p{bL- z&b#G$4zasc`>b^Ao3KW;4(cM{^bDGsAbx{8;8gwxIzXG}Scx_Top1t<)4`Ya6skt3 z6VUsRj*fjQi7fOX+;zeRM!Ds=Wp?64D!Vx*Uads7dsF3PMZ17N7e4~6Bnvpjv$z+3 z^Mu!JEN$!Uub5je;3%Hk#5vkJONY~0jKKF!{D>6yrxDsxpcT(GnSmwh!DCBZ-5ouS z((->(3EC^24%&JeV?5Qct&m8o4*{K(TOrNow-rY5T?wiC5WqWoY=vyvDu)2|O&$W+ z4@#)=i~#2T=H3^?R+wh6n@tik>imI@ubfj(w5>0>D zR9RCtbGOMOdX=w=wmSi6D-_l@qp7K|zS*s?7G4l8BNHZR7(->z%}Xe)Wv)V8cUr8= zh1@1I#(5qKZ*HEPn8q_&bls-8`N{zOC!WGhsdw;eP{Z5SG_Nk}o&+;n z8I-0(oEM~UTu5*qs+1W$+8+l1UL;tkrF^JT z;`D%C6!c%%zXo0}R;zsH(=L|@YJHPzc_^bbB!+q`ts^O3OSsa*7^f~dyT=(thY z*wh*g(>)6JiM*X1>gV;1&A9}WbS?TMkjGWC*Z4GcXH+&$ER=nJCMXQR6$7etk#NM41kCi|= z??H1`smGrA0G;fm>EKGJD@SR|$>3-bE#`(s zJMg?Tv~twDVhJS5&2}4RQa07I0i@J)e|*qIq(4MvrI|vR`s<3H&eorQ;>;bHpe0|f ze~f1+N8`U!>gUPSZpZL|<96h*Y?0{mYlZF{mRkYVOl%VyjBw@|!>MR0b6CEOmbVz7 zoA7SsS<{*>>Hs+`--?k0#@;zB{{jtaIV=R;9}0kg$=2Uacz+;3xBBp|nZxoE8f&i{ zmd^yo`NskPZ{qwNg!3l@bTe@F*QmminF%ne$YBwJ*{B?rnr~eFIY1M9=Jm$aU*dB> zF8eP5kTfa&oka0J3D8YY{EMt7;BvxwyjcuDsJgUeKc_1$iH z5F_~7Ylo4&;{8zK6X?31w_Co8IEpCG&X!L5hcAb}w3^(>#yV63SK2b_GT-ZU#v7dv_FmpQV0vYK zfUS(VQH@r6$#pkyvtzLN*6NR9PQfncD&P05GKmKHlMLj&=#v*12bd!`j{-jWB4)*Av_C0uU6s)< znhz9HZX9D4$a+?1P#@6NER3w7%<5TsfUWp*19w!ie4cNgc z^2V=pit#KDBUR#Ia(St%u^v}<%?2`Q-b^MDc^NX6sBh`AuwBhtx~^P@Dc6PEYM&L~ zP6psx5m_8VQ!}#o1MbLTd7E5?6`nx8wNbc3y$LBoi^c_9gPba>qvrdN)=E0Jsa%LJ zA_R)4ZwWwDQ+59!36vzT%m2DCtuHjYNDGSUE6psnY7i7T9IS{WPlRMy9-w? zeprN~P1i209kT7vpCzx5*VZgb$*)n!DOftC4A|~R6-J;+^?@mo2HBmW7NdM}l+tG6 zcG_OWy%3J9J7&Ft$Rpu^``vT{9CuT6F88~|mFO3hxOyu|Gwv~OP~UITUT#EHDu0#& z@Sg}k(PYf@_?eggdMf$j6s*26kPT$Y-w(Ou?{>KMzlo84Z?65_j^T9ei!pA8YyT&J zvaq4tuKmvh;923~{xL?l>h^r)^8P3-?QhAL(*e2(I-g=qYs%EHcz3+H*J)f^eN<`%J2>ul&^9jL9$#P1BfN_+-V=G1V@iH$wu>6NMgUGiP?VJQZF)UcjK`8 zGps2RpQfc6U^DvzS>IB9Slo@HM9ZgekA@Ums3Y7Kjx0TY-dgG{BBOy--We>wi?*37 ztRe7UuqKF?Hl)k3RXdA3Rp&Lmn|#gp=A(G6dK{t>Yn`v#UFor)+5J2gUx)8iJr=yP>9IIT zUI`B%Xty!_7k({4qiUZO!|gD_`E!ogn%~E;G@AzXZM<3L`q2I65;Eo2Z~-f6msZ#U zBgWK{C}q;L$||$h1u0pL zpTcj$5Q$v-Fe}o+&PZ1A*90C6p*)7=b2{{#@-OV`m)%8O*NTOO1nX4E17w)5EN-2|MDH8)c^H9X$uVcYx{VqK97#9C=l{&Rc^Xx#j10G!Po^T&x)|2aT6L8?Dy zO=}uAADhv(3v-sl5_W8jTQsWZ1}l`oDoT*0!>|?+D3NX_Q|ofeDQvo|RtCHyvh*7q zH=>GYrTOfj~bU`)|&yTpCHaB$}=m~ znN`7;!(SbkQpCnOPyjeyZ4o?L${Vr6Rel)wE={Jk-RZTzM z`NcB*;*4-6kGppZVfrmGEX}4bis>iF?Fw>n7O01Nf088OSr4q-1TeVQe}=tpm$*lP z+gYBQ<%a>Q&}0YDMr*2X3%-iq5&&OQ$XS8EodDegnZB7dt+`dcL!8<9{Z%B77vv3A z7UGx^MO!x$Il8OL>Os+VNe4%VeI?^z+_~)z3a~90$sI|YIOrW=?4oK@Q~{+I9}smA z`|$wlXfDpbCLaD&!x!g^OZpH`6xZhKG{1{1t}_p@>&kgx&ar3jhv?=Ws&q?riHh zkL(=goUq6_(dKxZk_`W3G#h0n%+(zCAhh-93wNg8{m4rnZRxKXZrlP1JwhkR-vlS& zB-zNpeeECdQeq?L!|8F#d3tON!#PiyzsAH(=cbfr_l3pzN~;S;!(1F9p;jgiN+Lrz zn4%m2drX!7r6e+x%(_}4uF9)1wy zrvFT&GLN-_df2_4ejEA~2AtuyxwIz%mxA(WH7(&_`@iFCU%hD%Ca&HaEcrTvB`YB^ z29mjb{S<9qzs%&xG%Tx_VBEIwpTRJ}{F{nABOc4C-qb74sO%9c^35}n$sZnhMkft{ zQiYZs%VoBp1PLj~VzKCuRW;Ly(s(p>Wpl8QEa6doI!BAj>0WphwhW`j3oD>fGqLG@ z9?Vf=3&Ym^v$BmQ!GyKkK{AmEO-+z~rXrE)8_DNUV(}yig1oL>r7S`df>4gqE$pEI zF#?iqL`gC#tJ7HAyE9w5Vr^m3O}AVChrETNuR~mh(wYeH}sRsXRv0 ze16C10=}!AOKK^$yFiKX&gKTf(m2_)#9U^~#Qf%6@#LM10RD_I zj_HXG)R*Azb>R32-z@^w?EMY%;fJjd&Ke11=`fOhoR2!sMhki|IkVfVKHU@ z*@Xh8lr}ZYv>1vt${CZxkFGD2pOr`W z-3fuyWFx9LE!__uxC{0S{;%AtkNUft#_b8Xm&u@zWXBQj{^y(@p7%QTKLEU4&Km*v z@$xUeVg$N^SNE1bcAt?yrp`N&*2?pan+x1`+(Mv#)$U1#8uZ$7uSai5& zYM<18#bu1#j=Ky6w%&WY%dp!qPLOj;lsXb)+>W~p-v*S0Q_6jp;X4BGg%FevGs2mI z;&yJDKGENz<^52AZX(|L0oJr;yfwgGhJTHb1jgQFihddm0xF1~41j=%_iq#4KNg@{ zeR$Wr%kX)PwbxySKMaoZ=K=t4;`}>=^X~@eX5j39auNRT_XQYL++`3#)u_7+HOmy; zcUtk8SDB&*@Hrrt-Gip?ZOC7`ewQeIG(a~&@k6X>P3d}Rlqq@xqg?HTI(EWT#}Fjm zGvALajL*Dc{E^6Km)JgO)_ds0EJ95LEK}6Y;4+n9eVKIaY#GcEoD1z!;-ME^>&>Kl zv>HK}6>lcg{T^`?QJy)0obfQe9RAX3>H{{`*&4Xgc32;G?q`{z6+jy#iF0o}m&Yvi z@mztyWpYe?JeRGp4n92hHgw%jp8G8E98tc4=lF8e!*gt`SPfh&c+P(Yu?M}1jk>F> zaXfd#GUXTPxL|!AR15xEiJ>GA!@l2s|s$pUiaUi0p zE4Y)xTMxG51#_d*6ioZe@3X7GnEx-OBF5mw+2j zgb3<#qq+5|sSp2v2-Omxo6v{nS<{*u&l`K4n+#%YaSHpE@Ej@vG9oxdO}tXC<<7CE zF_b@SDggCNlKdf&WTN3DxwA!7Ub)`qi>&{zy)S{2tE%!2BoMNag(d7ovn5TclTJD- zG05GXSwH`d+xdC_7D;O*Qm$n&P zy|nyLRj#SdG#yawSDs+J20O&OuY!8c$HO7^uQZCJZ*4bBzsJ+l$zGd};@eCsy$7cO z;p3xtmYUY;qcFN*`ZMqwFki9#6Xft;k~;5lUtbFV(&3yidhq~hHaqt`{wS#>A>q^hkHHrg2*dUVRP%1*6a1i zBQXzu9@0_$bD%oLefbYt8>+k7HX~{~vOc+w^JlHV=6ls%0-3Oj%P8Wi=jKv-cRC?+ zYB`c+`NxUjn%Bbl9D>OhovC{rJBMd%iF%!<73t>$1wk?%+}mr452yyD8>M*)|vDkP}7s=$}Esfrh{2>Tgr zH7r8^Wj=USaS{nIPIecwGeuQDxq6yrFIC3zo~@LS`xfKJA5f_}zF~k9U7q~{sC?X@ znUrT=<*I?IV}om-M%PB#+Q^f*6p`UeIqaaYlo@HMfIe#DEQ-^nru;odRL#O!r7C;`&dAik_k4ZetFK82A}!!q|5B!gFj$5pC9 z&rQ=dnz+<}Q`{O*3D3(IEB@d~<+sHE6S|!I4=BK=^$99(Mu4ZShn{Hs@=B5hJTWaZ}q3PT{d&?UjT*ux_V01l8BuErDRr#)z$$3q$g?P=W~sfg zvD!>2Yl{~O@1?H1QOLbnOg5VSQj72*hR}bi5{38kR0)Nr`cBM79_rVIyk7%(pXOow zXXJytxs8qSQU{Q?eaofREl7`xe8Zd|(~vMo)w=8N&3UL^#J^p%Bg2ub7? zif0qa*&J>_ci0P&jinxPJ0(^kT^pY#b-)89LJ*J+8`-|RIQze7?%wp^Iob4}zZ5;* zU_AK)Ea~w&`Vo?TPSayTE_#MQ z#*=1MBO}kqCL{f&$ap$6G7Pslg{txvtF1a2LjukwBF3zZh`$99PvoiAO~h1VW2Q(; zlHkmyDWE^%$kc}%{d^A_k)Do#9(im#JJOZRCiA@P$m4@c%tA3YMOHO+HO-EcO6iUk zE7t+jL>G?BY3kmKk*8!+k^WLtT)}AahgUAfix@Su7~?|^olQmzS{oT(1sRv|T>Zh) z)?#%FJ@f6+qef-ELj?{(ehBN}yv+UhXVwNbDufwUy#vSjNmXN3qhxtx(?9H+{vt8V z|N0Q9Ua`WJSG?{Js4?k|=DEYY>wgEPukZRLMEb5DU)Cm5{u45#hq2=?Q?yO1zevz_ z{r**DzC3YXuzFRme0e#K>xjPj@~mttR=zx4GG$sLjm~^CjY!^>&L+A`GCPwy$x{hW z08m4~PNW+YKrw`uDtYbJE2N_nvaO=!c>*r>Z4D4z^voS}yjVB%DF zyC6Ty@t$2PguUXy4HKOsTZle}8H6UI+P-dpY{>~2hB;ww&5+ng7gMbT>A!a&eK_(B zOl<_DgUdHiZy(Nl1G0~h@(s`(d2y9FpF7XZ zkMpXkp#KI#ub-SxboOMcE~|6Z_FuWJzkso>gECws)tndP#n}EVrK9t&Km(Fis!E!(y4}rmg-Pkx_kNTNWqKfQIX68dY@%WQCtD7qIYi z5zdG!iMFX_N*~2^R_q)y1;ILsg7a#p;G62AAP-xGg7$9~1^Ek`f|r_8@RDJnAf{KH zf>SEir45N7Wi66r)R81vUaeKK_>Umf;m5ewy3!z!K8tsgN1lbSwj?t*5CtrKMs*Y$ z-)K(7>pZCFygpL713Lm}daFS*DS-EJ)gXPgBSQHPTO%Fmu5^)f8II56borDHfx5fs zO^RZw$N2l|gC=uJ^ruIfLs z%x)i}_J!q?3zX)<<80itjWR4pvOHKG$wwV8Yrrobj}-RxP%dgZ1XF`YW^QO*F-vKk zdkz~+DW?1g@qs%{%-mWLDOQ2@y5Bw2uUrK)s!>GE;y#{*ZaLI;;p$V=gIjYsSB%ev zt4FA5trxB)>%8QVe&|RnNMM&818c(KHCvJj!uiWN-A3aXeJB7=j>8Bu5kaY2#fu5T zMpLW7X@mV6jXLOe096W4-3FUqslhRxpAGg3{a!VNr)V6m4fbb7fX?7f_5|9cGwBVU zyIyseY%qy7*9(4vc(riaXz>0IJm7GHtSKY^5kk?~nZDhgI(y!1TUw2#I!Z9L&<}>T z^IWRxCxI$;_86ckYS2ugsgbJ&>Fn~|`K0636F5=jy#U-ENThO<*xY(bMI0c{MkWbc zRpYwL%ypNqpB0fWG%eaC50&v!it}{>OYh=!H_lrw8!XtRG&nS?jHDwa>WHrsf`aVb z!)3a*erNO+877z0;Lvse++VoiPAFhkFX(?lNdr8{C0MhGhk{ z*OB47%wfL8VDdW5QvvhM2F)~>{e^|p5UmEi$|FO$s6sq4RB@@gi}lMiDam1@wP@9^ z&<}>3^+f}~bSzH;mOpRMOk(+STs3e-?XP@rT|@$FuTfEGigPLl4Lmgaf$+8jq_>%yCcQlLL!dStZ6(#F}d zWb2Pq@K`x*)$Rpu=P&N$<7gOy73XQbK&!sxoWeQ}1RmA?XJMuFEGK9OO}ftmk8JYU z|A@vO`yU>*iuG*&X6=9Y3)@tfN&^}$l1Wt6?b8T<|AXmO?0;;!YSyzLp1)C$~NO&%?R+Pf;5M(jxjB=+Mozp*20I!fe#mZfaTs0Xng2Dg4EHUW$v!`95Yq)HeBCJbG4K#)lmZU zedc6*w*kERay=esdY3^niKbh*YM_!`i(Q`f<{!U%AYYf28I-L2h!nEZM`wpA4nP$* z;^>jXVmy&b$}6zM-y!yBbJfEJnAOpB0?_qf=;%5{O1CA=&2t^nZAnwLAe$$6=Ap?p zjH{ID;!4?u@%&`lPw4lmvQ0GhkZn9{71?J0X2~}G!Y19zi~wC=xmUK7Z7=fN^{U~^ zHcYQVwn?;2Eg!37n;@zUh@hmu+|haPMDXC(Jb-e;uPs^s5kit|CC@E+WR6p^m6T*_ zpdSn^qtmIX+cI*)tD|WK&~%DHGl`}dTs2U#B_P>Ym=)vsu4IvJPp_qyvMDwrS1Ly6 ziXq(yMVv!tKHk-XCv7QxL9sB~y6{_*%o~=mY))KmKn)$mCjrG5gpT4W(r{5#X}Fzd zK19-xEG)OBhw=QRVVZugDh);BaHZj1Mu0Bj+^a)M!y?aJuR2W9P@+wfhJvUz4+={9 z%PO4*PX-Te@c_yVzqZW%M+ik4svGyZGvxuAt7YeD_wXMwC*pku@akwf1!(%TK{JV_ zPjb~jX&4L20wBz}ni3q?;Vrb$C(}U*)?fe(Cz7|f! zT6n?(3^&BJtpy(!#lk8siWzfZ01Xk}dBnc<|>Q%iCnj;?m zy_yc1)o|rW#oX>>HYyEcbw^$PKvBy45U0wn3YXghA}Q2{vq+bon;NY$Ks<2-U6*{2 zezgvetqfeBb$nNzybWVUwj>L^xojb6ImX>z+qAvOfKC5iOzB3ds!!?6Bi%Q2SBl}2 zGP4qaDCVIbMHgwKp|0ch(550@%+c;boJHI5T;X(PgF0XUsxD5?0vlUk6R5*+u>DD1 zHG@0YuD1{8!M5yUI1aYI1;!FLV%-PZ-!`C`l%h{F;&dtM7B@P1XMwy=8Z?tq>g!xJ z&~h|5*nWk2k`Q|zY`;ns4E+bcHUL0}yAg2z%Ai?oa0ec2Pj0rM_Bz;}LO&bAJdvu_ z<}*1TFpo26ropU)dFm9pv3(l-UnatasFoV(F#}A>gKfE}!aCTdr-|Z;M6ytbv8M5K zQC*~vKG9iOsrQS`@xI&ufjY0v2Hr0)XeRN#n5zb^u_Am`ocAHxo-2`4s+I8&VfE9< zVaW108{0H-cuhgaNW59VAvWR6$`-PMUUx!{tavxwCZZd#Y4U90*gV%>jHk0!ElMA# zwrpcCxZ*K<4k%^5sJXyRAkAwEinY z=Yc4AU?K}sZ=h5A*kHcL&CZ(z!mFOe-$B1u-EWA-9{UX* zw#u=A{hM`cz+c#8xtj(wl%5~=AVv854NR}%*g&F9-{<1X+Oi}yfusJ$0}Qu_);P+a zXQeb>z`fRW1WEy&EQhPV3-Dv=TO zTs2S>FW*KP{c#A;sL5daaZz=HgYHE-G8sVpIkOlXWA&rZ@dl$q7p#-@VJvAn(K)#4 z;fQ&`t3rxU48|h#jDV@D-sSvi%Dgn)U`8^df;}T=Mg=jZKP&5Wp9{Lb9y;BJPyBjZ z%WEMl`nh{n((hHpuV@^u_}ywiR=ILF@!a)AK1||QqD>dS__8+f+YF9s_5h=b_!W}G zpJzi6znt1NS%{^xp0;p5P1zE^s;XMgw=gDj%D6$2M7+rWdVLwr1JZ6ZXePz)^;|Vj z{6<$*=IYf&B<|!Dl5};hL*@*}sl#-SW(pB^Ga?2fcpu~*{81?dF9u`5J5igdvTV33 zf9}yyJs+sPi@WuoL2alWK8fdX`Ry5jrK$$!bM$*vi6c^`MW5 ze3G-wM;iH77fjUNT%mxie=ggIKXHwjqS`4TJ#GH`C{woOlE|tzEgI<+2rPn<6Xo@y=qTdHyc-vRxXpS5F-+__Gk0YKgW5W-eEASjRN&HnQV}_%o7MRoe7uCeT)HFC zvL}&ligZ{EMs?1l-;SpD&P)09K;}A3SkD73VbB#0zN}5*EW*0!VtmxFZv0o~;1$jZ zw!(=i``J_X+(%QFruH=BJMH3hAw;-1BrJVG?T*TF0LA=hSsnS zAU|=kE14&MYmwB3%#%^zNbl}+XOiE}P?k3&E{;8I1UetpyDpWqnsMJh=a)pIJ zrhla^@EvYxL<9`NI>hOd5F`6DpH7)2pv>2~FaKd{qs)j}&=sOXExb<1K1|iZYl7zv zidvXgk6IYpQlSC8!~sFO zD;ZX^nyTtyHE(i<)$DkMlP6X=FvPiI2AI?i zXhk$oD!zx(KYFL=cgF!4AWmty_bt5g?Jv?{4YWV&!&%k4ewyEWx z|1Vgl72J8_XcbOb-V**Yw)X6kbphcp%ic$%C$r35!C;@B`7oM3R9qFlZ+Cn9p<7 zz}>$=c;~nUHpJfHofD`+ka;NK9!pjIqyYjEb+}gp?lA_wm~xuX0@g83GaN?fP-Xsr(9HFg?CbFcydO2y4Q9pT1UvsM}Q@>RF3{B$#0^Cf=Xw0oaQq%NFnPE%KGF+>hpu}5Iv zKHfH^{Qy6ODpEGkX%FRIsO$izKa`A~b{Hwz9?AU=Z33{pP-g@7&4j~f#`czUp8;p+ z~MABVx_Dt?%c+9lG^xQ_X383!3>WR9(8PgLHYP2lKfNKuwwWk04!{o4MDzVt7gC z7E0}&I(NcC+o~H)brio&q8|*cxp7q0kAEtyx%EKP(FV;VnnrWgK%Kjibgum}iO`1x zQ-*lKI;rA3fey`#11v=PHulET`Mz`^*{Gr-mek#w!s0B(q8=DAUJYg~;bW}fRm)~> zsY@_76Uh(=3{r7?B}Vq=ES+~R1yRoBzWj%+jVS#t%_#qbsAHGN}k%J9p2#Tg>-6_E8SZJfx=36s4G>E ztaBL8PpNj&?^TtmXdJFmEinT82`-iDTX^nz)nQVq5^Yn`$9_zT-6y3d?^pBfhOVR{udkxjnJ*Xtw&HM^)|I0S+vdrz(| zd?cSC0O{+5JTjpCD*LHGX+mYbg>D`yue6M%!3Z^{Mdjwp@|utYr_0rOvY4GdwgEbAlLzCwRjH=a{6`qP zJw{$9v8|7#J3OtjBNy3L**LqVl6qt4XG7a;6jk+O%u3sABT)8dbCmrLR}HkymRVMp z3~{9+TBKz&@QG~MY`Z81*NH7OBL?`>ZKF*<%4r6;lze1}6zg#?m<`Ts)6Q-GBA)CJ zZTmg4rC~fj3uQh1Ue!Vojl;E2u4Dx0W`}$EN(<#Op1WRkm@E{DHrL}|f_VP&MCY{4 z;ItMGINTs>oaR5m;3XCw^elPHs@rI;@+4$5)lpLF-R5+Arvbb=n%)dF-D1#8qUmO? z8Yrc%wxksMRM}H1e5?+EE&Q@uHXHe5)5QX1fJq~>r1P@8Nz)G4_Il)RT`;XmQpC}|>Ezb{ZcB%8k$ zk34c1&rh_zM88)Rt)g+bqV)|%fIr%$X#G9UU9UP!qE({JC0YgXYT>l4;I!|0z~NpR z8mIY>5Q=E6mV2^ku@bFX?#a3IgP{R9o2u4k0B!@CW*Ib-XgZgx28!1IPjXLQ%BT;` z9OK=*m3y+qBL^VH^OG5E^m|pAAsTzg4BM;VaSCJq=IwFFF#>c!;9fvdX6)v<>s7;- z8J->oi8ehnSwCJJ!Nl4=~&i*R~dB`}jmv>Tw)iR7*wqex^cbY^eDyTRc+3 zU_3uIe1Lwh%7&t`2OILRRUBXTZx$Q!7q+4CMMi+mTW+FAHvC7PyIwVXHpKKQ9A6S` z6@JT*$)`&ZkJJ)D;Z-w;@Z}Ol?WRO453Tf0j)X?clspX!)OnU?^v_jMzF^{ z2#n{)cX!k8RryXd_TW1nwm$3Q5k`Q{Ol~SjzI&MGu2&78?>wy!iM9&sBV_XFV#6bn zEQowRsf&Dr5F0O>lkdf0A)lw%u*s(#f(hc)A~&vp+_=pH4mZbYa>IXwP|S^L512-l zDsw}7z_fvWFf=z#r>eD?8&?8Nrx-MoXqv%Q1I>-wEmtpYDW=uDO6g@Q1cGuBk&QcL_2LjW^pPlnLYcDdlVF_o_-+ zG!9oO-@*v+r-D?7s|CE6;Ka>(SksDV*ZghCS;g*t`-0&Y^@Je}HV`KHyYrm)2%9GxsxRw(4|7}jY-x1LGMLd*KZ=9Z^i|WzM%LG}p;L59qb|#iVc%n0`(lJ@dGl;2NNwcGv%BnT}%y%oG z@>2BiP`S0ffJ*1Q5DE8ox;jr21KOOHO?hP)RC0wyTV9KrIU(h6S*M5m3Vd@E>9DdWqtXGP{eOzUk}10pce1XsV-R z(%b0=!_DH`4B*w}L>tg_twA#>C-!pHK%Mlfb(gP?Y`vs4I&Z;3%IQ+-Y46SB?T!_> zY-c)8K}opOv>{2a*LFCS59^&|gusvVBzxMEd0Y2D*C6%F!j@9LTco+c{%|IFvpbTV z>8x;G%Nt}1cFj^3WjyC02NIcQO6}e0L=p;ReK2%(%kOM+CiziPuFk|5lvLEd?z#|{UGcQC`3|I`pDV#e2_g?76chy-c7~bxerH zIxC8-Nf@@uX#r13Dj`+bUhn@y0~%_g*O~IV<_+I5f%#U%D%j-IcD90e{`y^)Rqc>f zfA0Z@+pO1AqyGq+1>s*+rt=eNE2>xZO6T__kE|HJ>HMrbJ09u$;^w%ps~D z-CiIYsYI`d!iioWC%Uk#uEui$j3&;-bLRN48Xi2~h?W)Ec=i8CF$Fia-% z4`WA-T2K5*ICS337ZX)$!YkE{E|t=dN)~(37309nnA03ACim(V@LoUJ+q|d|( z>mhqT-bEXa9344X*)8P?QeLe5@I$6J{as8Y{Y-0GCEymtr?^p~db-_!-twdigEA{$ z8Y)6<))PS0vMRDz6&4%Ps(8%t?DCFxQi4{O+_L$IsR~urTVx}jg(l*nK!344%;!j) zLbh6L!Cy1yrRXq{1hAHqv`|d;YNB+jox@}P5alC{tQGmo9rGp8p3X8bvl$eJ5U^p- zCyS+gmUKWilFaAnRZS~1Z={!ivZlSDX&$C6cRzSIkkTFS@@tbL#9(vBIDu;$)Cf=~ z{K9gZEqb@tms&cv96DrC3*kYrq%>#aK}kRPIhqJ*p?cC!ei=Mmz zBnG6P{5mG3Z|3AYrWm|0jjs`T`9{!fONjEOS-yUMV7289bK`4g{YC4XHz6hl?_sRRqAbSXl+I zN+ZuzU%Kvn!Az>-FvwEpW$wprebz=Y&3-yjrF9k}EAwi_S2HueulO!yJqhIABxU|e zb=Nx+=w8Niti6wA*tY!_^+uDgw-1kb3`Zj0>wt3aM7}rBPlj@NKO@ecxcYwd8t}w5 z2F;|GtdFY(9v~Sc^8E<)Bq8=r z&0+qM!Q^$A-wK$&V9-p1*@(A@}{(0C=4e`$36c8#I%Y_!Uhu`M8>Q?5o%h8<&me-sy>yr zk&umDnCC;A22T1aEy-CjrHHyJdOLgq%U8VK!0t8<9NvLdA%T9OW7NH6j+B!_2_TDDF<+V&*Q zFLXpReNHvmQcq6`dG|2#GMf0G;26jf{NwDgRojQTtv}+W$j30O0G%RVjP1`@IyG(p zHSXrV{D-ZL8Y3dVs>uI7A^R{D`Tr_-?x2YLCH08>7cpU7C#6OB_DYWoe@4(+Q{|h=uTy!fZ$xYtwU5SDG5p!5vK%VDhn?9%>O&G3?UeqQY$r~%OnZI(5g;ixu1Xw7pp{h{jbG?<{Y6YL2(?F2EN zzckW`dlQIzF$3!_?|ur`_z9T{xoSqEd6cdT^wD*JrM&bgi3?6jIE9PHlJz8hc4h02z4UfX zM|y8$RnxpC5vR6k?aCFd1*>k>$Qyp`>0)~+u{&98O6TT~yFN?7Zq|!7Em3~xFCB01 zPDT}kQJ9bj|FmDZp^Kk231SlWj^F&YNY*XcxoGuJ=2X(vP`>h-D`w&hu%1zkrTr(LZS(Re z4;jZ>=<)Vs3p)vzS|%{%UCjV#2hrgzdG(+u#^!ny;|9XDOEKE(ZJLLOvaMOM7^-U= zaI3yOC__`e!ScjkQ*I-*LRFQzam3O%!<@@kBiadj1hxMYZd-YZ%6ka4@3zBn3wF%W zx=mYGMPy7fZaiYYj}8(4Zg0zndKeq0yNMVW$iS`g;H;CE{{yd_V9e!%ew2blp?;Dwyi+dxvqS?H${0NRR57>cKaB$ zFD$3qF3u=s#1gepLaAh1TZH13=~|5=_aU7a(|xtVz8<<_M!A>O1R^sxw62(?Vvg=P zY_O#ma{=)Jd1K!_M(u#hb8AH=8^oE1j#GVPE~I{?tesJfDry$3JPTcm%*=e8CRH9? zD0U2#$5I(35)UNZ0m~24sKownq8|KK4ZrnA`|yFxL+EuJ^+n0H=uBfEv!0rk$I=%Z zpj94?VagMzq-@-D2{Bz9=;xmiTR+gBc?9hz>-@wIA^t7>p!|^U$D#ywdDl6$g5MPI zk_2~9bIS=)KE`54Yp*c|+^O2cJrL%`%O*%12f61)Nen!B&0J1=s z)g+b5?;PH}o--Ns0zEhNBKy5O{W8uWx*NTTNO73DY2PlE(Lvdb&Z}oPdIu(~yJ;m1 zQ_G`?rPM;k*Cc<#x_U+lBNy12NfvlK=Ho`C`|8;vG@q(h&qQOL+eNYw3=46u`|$MN z$b+Z8um#Ik83DTJcS|y9bAJU`ZP%-YfAtI~thjn+Q_uDKbNJ+2q{!#-2u=|BUapsX zlwG$f`NVGy@-0&Q`#O-TKZ4xPOypiO z^#niChJ;KP&kf0(i%IBsMiKg?oYS4zH ze1;v$D2^~%_9W6#cA1@z@Bw9rA7fQi@NQsu^{9gr+C2NQOs?a+epNkg=N@%w z`Sn;-w_?J&MI~WyTU7XZ$Sf+4ht1rmbX!#S(0r;|RHAXX7S%s80{kU}w5a|MuzGMT zDw}#PizuV2c?3@_guZ?tJk7>#hiRE4Hx+;Eh?LQnnfjuSBp;jFmzhM0}i(; z)pVNw2%%V1yVKr}ji0qbSyWU<*#qa$4~7=inN-!i?A-9`s{c-)>2!l;5>2OY)j*4C zgO$eJdC=%^eO3!4Mr=xD@UW#fL+;hyDz+M6SV!AOfVSnKqiw`us?%b+ib!#oT1-2b zi&6*0Vrr?!V(P(!b&E;D;I^3X^^jRi9&hQnQR%jrZl(EDwU|WXa4n_}FanG$rrUwl zgJUt-)N@%(;gio{F?qbD7eu~C>m^^k7Sp%Q$@lbdk+0HXvdO1eOoDj+_KdF6J_?<- z-2)D{1)-S&{v&7>lYdnis4LFYt5@|3)ZOQCWM5mL?r>xvn!XY%d~g|v>g~fB79{%! zDJ+O?%dO~+r+YlTgv$tI=_NdhYbmRCIsIg4)h=bk`AboqmG1^CFEVH*S-FL)23oZS zp+HwrPZDD93`AE`1w**6Gyp({`%{4Xa)V~I!5tV1^i~D6S18ci%wfL9VDdW5p9ai* z2F)~>s|y&M980m)Y|yI=1(J&@#84m#iT7Mn57MM8&pXvoE9x`!gCS?#ZvdE%<$HkT zdkmUMEZ@yl16R~q1gJU^!_wsi{edyWn^HEW?lfiXiDBn#-9mLG9#lU1vrW2GSbLhW zrXMd7zdJ^>cAw+y?^NsWach6kBwb<{h<)`ls)Ar|NX4Z5c~qy*y`ayNJcR#jYNOAC z!yOdSCg1B>GTY8J+|tyH_g0o!?_l-y^);pA*?3bf-!-QzHz(hjz;lLlV?;86Zo?m< zQ4?+c08ACw)d`&lugq&4GLRqR+L4D_bh?1);<_?9-TH;#5hOucDPENKak z8P)h&4vu4=Q)!yS64k4^_lHiyT;7NAX-)Zz&InjT9BwAB&{R;lA$SQ2Xsx82WqJp0 zp5rARPTxFZr(CbIDSG_AX#LsRx6c5pI;tK3s*0hbY9s+r)w|*EA!Hw>>hoR9 zCkMyj>rSR`q(1M$gms6ngh9U>jxTGw8~z~H&8>_NBdb-2m|>8_>9~~&L)#f-o}sx~ zl9=i!N&Fp#-5&_K5%{J7yt;UK2x$6-K{F|dALpupk~p?~q|`Rz9*I(WZ+GK|B8it*?d8U@g29`dT=M zC$F?pw7u@aU5C>?b~$m>VXBCi@?ua6c^H$g&Z{f=>LyHBSHuzq_sJ{14)^5MArtAX zP`6BUqtY!CduTpYPhLgiaAo3K839K6crUQ(+8GU#Oth&twNeDw+Yv#_T4dzIkdcc# zz;bW+G<(5+gu!oc>7 zs_x;cfu_}sYLm+edN|&x!nqxfh!j1uDc3!{D#XbZgfpCz_>dPmCNYKt4tr=*Y`^sB z+zP|)g4rfs!m(a#Qy%e^VN6ER;~A!hW*3(yIOb}(yvEAetCm0DmPU&bgRr-}r7qCz z#Um!`&)Paid=?z>G!O4T)7m&M z-7v?Owe98q57y1^Yh5?~D^pWC{#9l8h&YF>UezmnWQvC?xTf$CHC%a`BdM88+oodd zoWEL+lhCj7L3(U4gZX&)2+C$2x zeJ`b|`qRFjuXx(`_7%VZChkRWpw{{+ReowVjK$^NX_nWkB^zd#+IxgRlfj+a; zoL@d8?>xeI25$M_=BHHJF2hhnk>@AiUrUXmZGyH>#q^h?MXC#&EV>lwI?jevZ``8spb)Ny_NY~@17;*k) zjZWT2LEcXoG?UiQ$GB>seQXd(^(6HqA@+`>dWtFpi7W~C;|2ieaQ_S7{;EN<+Tae1 zr23VD+AEUkWpkKcG?=^&^J9Sd1%qZ9%>KecYVbP^dXa#4j9N##!WsqI@br(9w) zSw#}i)95!t{yK@Ox?KqFy|#|)uL9R67&Mc(p3YSR*VQ5OfXfm_o~{>7A8={qw*FE| zYC;Udn$Q^$AjbCROPv~D12qNz>wE2GHxm=5ZkHPJ?Dr*nE(y28#Z|3h|bTcn1^5w&X1&H=&mJjuOyqT^Yr> zE@#o(B%WfKS)gp+dcr&S7wLdE9@#*rzTJ^!^bTgMgZ_^7;P0kgbKFzZqa^xdy$dz!H+fW@@U`WOdy=W8_uw=IeDcNpfST5t zFK${TVLWoiJpq;jMp;)LNrba^d;-t@OH$`w?(E9}U}B?K8~^TC>E_|k9^SxXuvM12 ze}us+*NT%KeM8j>))S$smFGVz=tsjH)rCN->rmDyMk^gr-vGLn88nk(X$e;iRI49! zzNsa%8NfvukMPkPoSKy6mET~Zk7P`6R8&MfA%`F;^?(}RUC~}oqhr6U

s?c9!yV zl$S?G^nh0pPpnaLO=ODAC$q^u`cwU)gx13PCaHv5j46|O@kmGD`|+MISf0%39?wmw z{<^ro>RJ%w`y~xVB*W0GmNo-hp`yoDasoX6rJ*air@&2D@zngGsEwOOc7#=Tgk?hZ zVY(yi7c6{GlvZ77L_drP>pMaTgRZpjWoGb#(=?>Wnj*1P zP1QAi z<}|9c{)ke$g1J0hd3oq{8X3rEU!ZXQYzM*_1`=|tUSJ^Mxn}TN&LGq3whjKgfv}R{ zhR^>9!`ML6zkEEn`IwnmD=ooGk3ms5WcW^M4!QTWTmwLMllG zvrRZLMa8LZmakl$KgQ~`h)4l~pFc+V7r5nrmW97MHfHj=yEYs#OKijP7fo znb%ki`1xDS18+1ko|b0uZ=z2~aBCvbaXcx;c{J$S1w#y5=$G5f(W!o*H%{eWW@G|y|89cfr4Run$qn_VCv z1+0LmzZ!11%~As7LEUDP1HVV!f#29y`*7-tIV7r@dP7J^pLR z#(Q|(AxvSjloOG)^jae2y~@$ciIHR>+0&cOX%KSD?pz|?&27`g=-O>w6}oaR-0_%^ z2HH~seO?R7(xjYntGConuh-4#&UNLQ3VW0c5#8`C;@!nqF}at?fqIzoTS}B>Acu$) z8>9xwN>)o24%Q#sQF}bGyDOh7WjkVtTz4*y37*wFuX*mGL?vh#(NS$R|EG`P8o|jy zJf4O4Rnl^hIM-)wtpIDL4GQVWY;^n9%9#NNH6z`r80OT7bli| J2+4>H;vgti3; zBU~-~SVyumolV2gu0T}-E>Y6AI~xd&6-s_+eQ6qED_I(pUaF!es?Yl%^_4inzcQa^T>D zLA0hK_dEVlpRG^gUs9r6tD%#^zJ#}twtVn*IH=M<9)ft*+Q3>0esh|_ysbULCP$5k zG-7Q$H>5~Q^~SrBu~I%w{d$`EPODS3?9GwMzt6PYoZftTPn_zDW~!TFu3+3pI@_76 z=m0jYaSy1>I}}E(jbiC)$S1q^VFyT?WDU#9wxuZh2K|rX@NBOi1Ty}1n$eLsr7uM! zV1XQuTSRY>&FIZa$U*PglQl~*d)8a`GCEMDN~zYcOgrn?JG%LOb{?jOHjIsiw!Xd_-UAw5RCXbmG?Gz1On zzA3dm81bTwc+p0@XtrTcX#~k%(n1+Iq*)gxXs+qt6Se5epU;zb+rqJh&I z{y*}f*}-kcuJ^y6oH{FYcIF9+UptU_lFITJ#7Ycgo}$nDIqSkd(kB(C_)|UdO$E)( zYp6}nDj_VdYHrCN9VtUlGk-G% zkYvs#JY=3m$YACs@eN{F#Wz*MRIL~wN4iT#6l=usb7j8Ehj0~Gi}CED7*7Yn$`j!h zwcer_$lON_Y{bpvU+tGF2Fg>YG6!zPDcv-3l@O9E2BnBn=ZNc%wxC}O=s!vW*wAA% z@r`p*7Tv6_%SRV-rFG1<9@j;;!ReeJm!~eq;S`vk z@Sr~?h>>E{{ciemy!?}bd+4u8#atqWm>T?A7~l*YVkr;8-ZolxaBG!2V)lKG~bg z7h~PYJ<0BY^+%S+r?B6ae;!qyn%tW%#t`3GDyVOd>PWVix~RX&eepbpuTj6rcn^Iu zu9&CeQb07&U!I)K_LhotZbJ8B2%`h#qe{ij=;DF$srnDGWImtE$5QcZM>j1eq8q`L zC=Qg5&6SGYJ)GwH#nnY7Mm$rVEc*2rU;n|?xI6{(FA$PagdQCK4wNT#$Fp4}9M#~C z&p`ReWOkrDJx{kV^OT1t*-NX5hDkG)j~4O**dVs=%~Kf7Udqs4o=lO1IUMiFugXWJ ziJ>NSlzJ!*&|*45Du02SoOwE`0NIY^ZwRy50!XjE>Mc+NUM{w`2fQ?eB4Bd`I<0lI zWDZFbV|&ttwBXHSV-zbBZ|?>mkZRO$thE?;os=gMJOx?-d{#m~Pm(obo#}3ZZ`VNi z1bm`#3duaqQ;5Lmu!AT*As_Fv|0E8bibX|?lkFlt>`wQjivt^`oL8RQo9vAdUMR;p z2?W415#Qh{6&)sZ50q!vL2t?4LR0TPiV4hetlL2Oc+}(xP)!PIqkwW+ZS+74eIGq% zZVRDwGQD}@>K@;y?$5Qlr-d2^$L^*Bi*&Ns$z#x}pOY%~bk7+ec8<5xBI+on2G$=_ zK8@J2CuXls8-Q4$7ff=XJf*NNizD1rx+~R9|0fn6)13q7Pb~D%K~(H5C0f=6LezBr zTl^UlC)$kK(-NsT&4*|&mK$N2QAn+KmwIW4$uv7Uh9vw8F>rtwD3{=~Ia@AFgQTFK zWmmm)5BRq`7Z;0h3`-#pf$dasGCYAi!{jb397X_mh7P;u2{UIgKj)Pfb^HA zqGyo2knHXhBJDtVbTYeVU}LGhe2kDLw1kNp5zk5MgPeEqd{>gB6EV(IniR2Ck%TJs zLGfh;h|tvP)a=xiskN!TR4R2_>c-TasrQu1)3mxcT;snvAlDwRy^j;4u= z2U1s-Czi6#FZ#;Uq-cs#y8^)-CDu#bR{1rp_;o%a7@wc&7Cf{$mmS6K4~Keu0@ll_lfnpAd*(jEwSb}0L ziq$ACL$MV_0!15&UKBkj_M^B4#VsgqMsWv<0TiD=@i7z+qj(U-mr?u^iloFiWU^jC|Xf0N3jvbdK5cR>_Cx1 zkwj5Kkw@`%6xX4+4MiEnhfus91zRUM^LnzKCa%N_t*pC84&XkFe znFA=kPV~(@hN2nv9H^dIavBv2QT)@%RQw}~k4>clY>@ezDOB8mVl2KJgW|o@sQ6nH z52G?TBy-9MRLnrpjINqcoQDD|lUa8b6>Ctei{KNAxu;VRMR75HxDdr}8mM>)#T5KG z3B?-X?aWFP*UzP5KZ=virs4z?_nt?^r%H)e{miKS%%uIyp#998{mhvC%#{7ikp0Yz{mh8{ z%!K{Sfc?yT{mgj%%yj+CaQ)0|{mf|n%w+w{VExQo{mfYX%vAl%Q2oqI{TVRQ0cN6p zW+0j&@l8K7&H-kcerA|{W|jlYC zIe$;;E)qfylMwnc38AM*2>p?Ae6);ZH1nZXZqGvG{3#lr!V0X3#ZXz>C>N3`~}54+FoZ`P+WuJtteP@-3D33 zqU)ph#G>n2e0pUP6|bVWV=@)*N6~aF6?0Mi7{yOfu!y@Ba*jpZU+}2}VV6U}!tNGG zyf2{mB8n9dd#g~e0Q@CBu>hO~DR|2aD#|FHM)7qNt4^ZgLKG|>zYO6y7UFRn3KoSl+>GLJ z6py0V-ay6WC|KOSfKM!L$3o_^xZQwHc@#wyEO9{e%t3MNxm1ip@eUN% zp*Z6_Do#Sd0{Ub4G-oCivrv?0QE?NBvFB4U4#k^LT!`Wo6tAMVb~Y9JQ9O*|vnY;i zqGAk+O(@=s;wLDcMUkFE#cmYOp?Ds}Y^aSU6s#g{#HTx&sdzt%mGh`rjp8{J&!f0$ zJ{8xam<*+I3<_2%tMO?!iXIgAqqrNzCl=rnieIAm8H!FQpA?D@p|}%;P)PW+ei0QL zP`rfV*C^T+Q_+s%0Td6R_&JJSptxcQ6+2PfjpEZNeuCmz6xS}LVn2$9QG6D~PAI+Y zC|Lb{3!h#_@f#GZ2=Us8P=x#O>6<7XNAUuRU!v$-PDLAvS5W*1iYG6m;xQE4E}~*1 ziaT4W_&XGjp!f$AFQfPkiuYVhMH$6CDDFe?9E#^r6jxA@MR6;NccOR{#bYR@(vy#w z2`E}nG@-Z`#V1hU&CSec6qljci~?`YWpXHvTSLWU6s+WN|2p%wOQ_h3;#5lPlQ{v! zCs5ppVm6F{b5T5k;vp351H(nu%$e({;7`{;xUqz58cUy8UVRuM1Jb8dp5)xT!Hy_T zLJT`^M`#BizQH!#swcKB&Tp`>-aua-(Tl|Kx4S z7vbJH-rbk{WmI`QIS~?c35&Lg1LX;H5vyBl%gARnc7^=@y#!sRhY+*=+`>Bsw$QGa z0xM~ME%!qhcxGxG`H=P%XcKLHZTq!SM~No`wTvOZM>^ z+}I!w4Sh-%BVtb+fkjJ*+KJFo>>ZmT9r<`?G15GLSA)3MPRT{;Zf|4jcjnl7H2_;| zIK(S(miY~}3&z-zql_??+@2*&5la)7AzNpfyi4>3GC4gWxjo4|D1juL>=5JoX-(s| zAZVjDH6B@0K5ObJb4ooCL@79;>Za5vYCJ+IA4>hwoKimzq7>YNbyI2z zH6Edq52cRSV7wFjOAw{tzO9>5J=EBMQgwSGr2STRdt0-gYL2m!sH)%InH|b?W2}oD z(T4@b7MWwLB?x11yw{Df-?mtq=eb|=m?dF(!ZxH4XkTukpJNS0l!{!)!FbHD^T&o*nw^HN7 zVs$=kjL63D~?DvNY#*W-%Y{~vL2xABdts7%8 zYJ6Dm*lFe%JDIBb+WrWgts7(FY4bo|vh=85n)a(yzt2waC!vglSp#e5Zu>k(S?lcE>M_9m~K4icKuyM&8 z*nC*Po-t&=F7T)9ZRWt1!vZ!kWWX-;2lgIwVDAnK*fWO+*abmr_Azr{zY-R(4Rrv! ztWvRBmf=}a^+Xpm1(9No}BQkvf&X+%$!}f=; zU~38swxU1Xj^AQz6iuV5p%_JT!h$X758E7b*k*?X+uX2V+wBkAT65S|hXq@6Sg;lR zVN009))p3Q^Xh82XI|j0KTaX06l~# zEBXK-+GP%2M_Ax3uLC?U5#xB4B}y-?_|x$Qb3orVI6%eQ5;8O0$~s_OUnyni`HCo> zT8MH6$7pAFt}jXtVx;?`R-g=J1oTJ12h9=icOfERTOA09Rw97jSV-=TQl3q}_?bt{ zLHzp=L9EB`SQW&8)9Gi-L45ikgSf7eieO`~Zv9;RD|7gN86y0K~b3uGD>f2 zr2{P8H=Dz}F+7+z>^LIK)fwO--)#C(JQ|Nb?!}#_PVLUrj7#I253Li0t z@k1fPcwVS5F7}7<^X4#qE<_j`LxnM5fA(E-7{47Nj2G1dqsJyx*tN|8hV5_6fqW@M zAXn4_j;Q|?8)lRs~*aSL;s)l6(Jr*jE^8&2ebIgHk2ocDq!v!+H&b!bY z$Ymh{Im*8HJGhIhVt+C(z|OnE9LUQKT_6K2o`N}$y&(cQI$TNySUm4E2lAE>fjl}~ zAOkF(PniSxi9;920E_2Qb0EJQB9PO=rDTA`^J8-$e;6W=$At@IfW`BBb0A*}5y%t6 z1v0?mIreg6i)SKL4a?#=IaDC$2Ut9_%z->NL?BNM7svpMXN5VC7ljDqY2gAHVDaoS z2lC1gfouvF$N-C{&m72Nh(I=n3uJ)B^KNq>-xVT|E#U$gVDa2%4&Ozk~?nx^RIEuy~#`2l6K&0=XevAOkF(H_U;2{m=z6z~Y&{!`R}PLRG`Ecs7Sh z$(8_%Cu$C4V~9X*4Hw7&i)W2FkSjw3a(lQy23S0Cb0Dt{5y;EJ1v0?mxz-%Wy@xK4 z0T$2u%z=DQh(PWLmy!V%&qL-w-X9{6SA+{>fW`BqIgnpJbb$=8cz$jUHU;Scq+(jR#xZuNu_db2<`^0^JeBVFLde6<9H*Z#D z^(?eMhnc#0mWVhJapFY8iSy=z-+Je5x8FwpSH8E9izhN$E#X)!la1Mho$`@bHd;#C znc~j3?3{Va&Kq}5myhPdn}uvCAGLSNx1mKeo=C;=c4p@}{CE$wFD6oj7BRr#Xf|#1 zj~^^QB)%n@R-SEXX?bpCx#4Zx`(RhP_iNA1;R1sK-vcDSje;pnP;$kqLhtlGHhguZ31Z zHk%RuT8`PPiA1e_ zy&;l+gN1cCf8L50)2XH=%d(!1Sqv0I+_F^A#|=LYPJ4c62?Ih-NcyuoCI;nhhLVT3Ye{?5{%WP<@uGs~<)I-Fl`DQv6}A{;~?wnq{r*_IyNU|Rhk_Lr$DeK zjSV=C!L?IL*9-pr|e?U&WE-<7D24Sq*~_-HE8cYULeBXmmuj(}#%QzL@|q2ZxH+B=H5!ui(LY|hRkVl5fF*jmWh z*t7VD5O^(PM~k6V8(ajg$!0?B%WW-u7ocrgs=xA)Y$6t=b^uIlAI3Mem0)XSn(sAx znVXc}_haXIK;lahiLK;4O2veoh(0zmy_~j-VW`gVo{)ZQ7StdrbhWgbYN&i%5+Ib% zL6rGq4q~X^AIs+yFnSf^A1Ghi14RtLBz0a{l{#w%b%xdIE)Qj3d~7$0Mm;VXy-Lx@ z!BDW;Fr|Z1s?}q<)v{_O7^!je>e-R>dR0|=#fe_ymqPvhnlzi6n=RorNX=Syqa^{s zNnl@Yg?Se)rHZYq38XY!S{7*TzuC zPfbhS>GG!zQ}qp}4gn^q^GMy)X^>=f1(2*Rf5`%M_Cc~}P)VIv*G--7M)6K}P08vC zb^A#cs6)SNUEQE9zFSeps+&4JjiQcwb5~kdY2~g^PYvqO?+vGp-q0VdlRDjv(mNQa zChv6D&^t6n!>L1qO36A|l{&Uz9*P}3)ZNmsU5gFnqRmobb8K{pBkiz z+8;%Bj!aN`n|z65CJBsbEa+@mRf9V8d&8;IrKr9-V8pu4Ksum9UqH&y5YLEtUo>8Bw zN~dZXs6nT&UYwvikOtDHu(MUEvr3lF(8yr_tQIP}ln{rMcGE!cBew|4_{NiO&A1(U$S$mX5Y|9FDtt zTiV)N+S+EA<>ms}(|Xd_Bka7dQ=phf9fY3S?+I8yn9suE^~2s66q@TZbI-(q$h(H~PJfLqbA+Tu@*sxoT#HmO9j zwJMroRfl$grn#ziCYs;QQK+R7Rog_B{?w@MbyXb`OLW_+qC3V{b!^Y*uG`y{c&?jx z(w`d7i&A_8FR4jjno%OyUKK$~$bghOl-Dk&D-k zvVEKFOridnVU6q>bZIHlf_#BiyA+Bg@Hh6RM2rXELYv_fGCf+ud1QSR5q-guhLDvK zLRi;E0#?)xt>%#!wVBPYy9jWUZAzhVe$|1$@lm5cBhhalG?FA;PLhOE~DMZFc2D=spMl^}4xt6*@8+Jaing~Zyb|{KG5~3LquTUt3i8NJW=S_UTu8nBI zK^pU`rj62Ydj~_3q}xdng9glVGdma>U36?+6lhdCG~jEF~L#E1UU!(#z#$p0ZD?rOfQk{t%@|;-eyOprZ?(vCt%H28OPhP&_+i! zY!4L@+1!THaiG6wJYQQ2Pnn-mZBmKjxvDr0l8|!-4=oI688?_q@isEtBBc;#)6hn= z3LhU;4V+8q{HRgvmMGRYp+u~&Dq^#Q*fgcA3eFqaiXtacPA3(5%WAfi!KMz@Y<2Q! z$VT&UX3b^^L9H7dEp09CE$!vb4%FU(uGeoG>kE4WLt=lvD)z5ohD-m~+&qi<|XAg7TzB^Rc~_!905RpCBPaOV=SW!lS;tVyZc=S{ezlTXfHJ_yqy5!)%> zi+)TaQj#a7e9P(j^>pRg);KaWTk|C(+~r%zd}`(PQlcnqt`JKm_x#9zfdK1?SZ+DC z@}uR$BAn((evTg^EBrKmJc!(@lBwpgEI<%W%?Q2%HE)IUs!DtwPPsK8La zGm^?i*O#xCvPCETmww>TZMTK2=0#>_ThsaM22^#v`Mfn!q{LRP(1{op{3GE^;s(>* z*6Ca+l1fDJ(aPl$8^{qqgZ$QT5oAHPLJpQk0%oa&On#OTOXLj~Y%9A;L)qk^f&&Uk zvI(O3(EQ+tB|weS{EyzYAnL?3FT&o{h;P_A4Pbh^pQLJcE zup-+m$F?9QcXpYDvnvs`TP$J$0f6)OsGTpu!sfGEYsiD9%M{y;H%Ofmvqb3w@WNkm z2n8PFA;2V21;m>;@K|AME?+7Xtzmh1q5NP+BcMXVL6qQ;6Z0`TN4G)V>!n2Arb{k` zmL|P+l5iDkMkMWlsr%l_u4E->XPkIS;sVcvWCLO=Hw zg<1A3Uoyw?YWmFBscph(It)Is3ui6TW<=c6SI!Le_bYkg3q?Q5zMiW@It6nB8zv#v zG{_CmN7%`3H4)`}J_ygHbsB@6VKM@VBhG=B5_qnjXLoa~kTs=FlGXtIoB>78TM-B$ zBL|^_3sAfj6VnBCn6w7eVUnq4k~G|uvM5&@(jdUFR-UEIZaS;BScBv*wc0zMv!0fl zps-FNiDIM#FKe+Sk;SDXmf$V(y#t?MpIKQZ9+X;y2&oUeATDm<0Od(WpKyw(XE~P! zTqF<$qfv%A>8;uRiSdpzZbe6QVdNxwF}{~#4jspYatQ7R#v)9TsXbgx&_9@Wkh?F$ zf`OUkYP0oM;Elv!WtsXFiq_sr;3^iFN!rR*VY^VY(~ujvXbfb6-NfcBgfnl4AuP}$ z;A#?aQi%A=4oBnGgq@Cnt!AMoZR<3#_z0XV+t#e))`5{B%xWo(#`&y(D>-R!OD4;7 zU`#M2L%VrA+uv+8H(ySy#haVYLYdgs3XRuFW0~MtvrfJ#XbvG)Pa@nRoGxIG0$CK% zgdJiz71GSW;zI#&9>GPWc({-#I2OEotYWpLd3mqP*iqMEl7AS$&iVtI_(bw| z@h=!w$CiEwjOCW*Th6NDCD@1H{p~!ujqQit~QRDJr^0(NcSHHPRy*|zP z<2P8-q)q!pPiA#GBs}Zmf^q|*zrQ%mh|my9Sn}Gx8o}HeESjr6 zDMp2Xt>Vc>$sP5PXLV!_~a&$>tNZtnP;IA5hp9( z!73S5>51#WbNk^yq##(bL@=L762W0|>EaEG+9j3cl_?tIwB)o@nZ(D)t3_EiA)Z~@ zZlvlzD}QaV*w5rl)zQWBAutCOvPiyzpr?8i$%i4*W4CLBj+GzsbCS9_uAam1y_hA* z$QH z?$76g9d)Qs%x5!eP9y4wj8w^~@1Vey?)$d^=KdnuK!d5d5Amp%9z-C#fp*H}`|Lgj z#Uw7Lg2mkgpk%xqxC5vhEC=lv#GDH{77RSxu&GN0Ic+yVeQmpSXxlBQM&oo-X4xqn zb!5h$szPRjyPektSdUi3DJ^a;B4Es;$`w7N&8w`pyn>gf)U6@;{l556C^*0v68<)1HyDRcXEn_{4#cFKgOV5=1xw%WM-COf1@g;g@RRU z%OsScaeKo~g@%z<6{5VL#Sk1Rp%I=TRwD;4`ECGJegZ><;xrUex-b-FXoc)jEU_7K zWUQ&QxGN5@gs}qXphhqZ-5`;LXyXTEj9FKfd=DV!&D>Q(Yoa0xS6b&WfT$qa-q!X6 z%Vju^!1!9`Jkn<<-mC}f@Pi%;ub@krKX9vx#V_toJ-UN z?J$Z{27+DGsZ3r4N6S)`$uUwaDhcfYM#sa^Fuz%)30dyh9Wqkm?Y6rzm7gP^Ju1jL za|xd{aRHYQb|pv9@O1f(M69cKCwUn^*pjr2|CVd>pUNCng<9{R^+)kgw)iN6%U7SN zzYzk46(Ce1BkU-+so{b{l=YS4jq%v;C~9``#l>XWfaW_1Kz9@ zG3>nZd*=`=JD(|~G5+}#@M>)-U9k#rmJ~@b;Oblo7LOx0j)HM%6v-rI%8Nc$Pqt)v zUf>7^6i*S92rRm)h3h%^cxtUrs4*BF=)#N3Pt4gHsOCmd>wXdXT4<7wC|*; zPbA-lfB7k8=0-qX%})7Frz&Kwr&yL&VJG=*7^8d`WGZgwP>1@En6i8)G1wL|Hj(hS z^G?=+3aakBgY_1*KZ7zq!TeT&St$!tLrl_gF}v>i&F3Jc8#vEY-xvvWbLS<{^~Pqp z!~Zk#Yuj3oDJ7ClWU$bhwTq=(GvZdn|EmckYFotwissUv?zTwrLy~L0h-9oV61?nG zB8}?<`E8_KVGxUwUuEiYz}6#tBkmAZQ{-RVL9fS<*MiC~*v* zSXhCjgAyRlT-aHWFN$`QHmTaUvT1+-(txS#d0q%NPXvJ`C?G+SMpb!cGPRXHIHYswhNRDEQ)M$dda^&g* zBm9@hc#g3&RhF#Fwu(psI(Xa4*mey0m7PQzLV{WYQzF7@HU-;Hu2MfTIdOMiWUvna z7mKV++DdM&kDbxmy*L7F;#tDNV^vzLerpvR9A}K03qxm6x_vE<Sifw7?mg`L#i!zi6ge=_&ARJhNu48^mhh=I- z&S}NNIoJe3BeCXdxH-zeOyucAM>p9x?F^(?oqCRqdkH~MD(0;;t@z!kM2W=-J}yrK zak6`$kU=1pWKTbdUQ&;=Si^KxEVbKPRlir4NGJZrM#jle}2$CcWgej`ii5pxkxx zr`hV8CnWbNNaWuB6l-c|sPg9XWV3n5(*FQ>9

Q7=%)=PS!R-HOc>ik=&nnLdyP( z5f4Y{D_q3f^1BE7Rl`G*)W-s->7D!n1I-_c>MXGI0NbQA*>0K7+I;q4)1wD#vuSk_ zda!A=#+ohe!IS|vgFDfbxeETyn@wNJXB|y2qC$OggzE3f!;E&jmZPs?azsY)t)mvd zHZ7exjXG+1NMj4u%wyBI*LCKVV#lu4i{;Vm(#hDxf8oV8(8hQK+rU$G9HaG2)V&Z% z8nMt9XeQebQTD}|$tD&_M?-H?CL7*2q!OTxcl(ge=bgXC-t&X!nB}f55L21CYl_c4 z!p_BRYvTp)6>+nCJ$_@nHIY2aXz&`cGaP8trUmvehZv$NC}?7EHoti|s8gDZ)53nj7CkHx&@O5UR@ zSuX+6wLZ;F7gRr=5J?JY>Y zV1d@1F_!i8lW;fymY)dVcQ8|($YJG(2sXs?tR9pfrL4 zh!2PdaV++BHA1@dk|Ig5Q?hCGe~4jVNQfJsaOshqeTkViv?U2zyC}CkvHS_cyY(MTHlW(GU?%#SEb(P z_*TAqP?Cz`hmugPuL_E&F3MHS3n0a;4)e{XUcvF%X$BBRnZivyCbgL#)u; zTqWSy+{{B^P^Bfrf@7B1ZidHC3utzFx_{=3_3U|6yF0(q*WS^y@*E4&qUYGa5Np7a z2F4I;qUa%usZ!xbs^oaq;{AGiI(t^mP;4)6!&!~WPMiZhgRU)#+dEsj_NkbVdddJ( zptcN!RdwhJk7Kf69Ib3Kg;!bn1WKZTPBM7MqJ==lmH|Vy8Zi{uiWX5;hlTW52{eco zk6=0qDhcvhr<+GWix|zu!qCmg{$#c?%+yoCR#@xUzhOLPZk4dI&4pDF@8)L7v-ekN zp-29g0Ng8F1_T6i$sOYSr3di>@6npNR+>RYoy1=f22rFtGmhVRW$=6s^gpwp^r+k^!YHn;w@VYF6SblReDez;yb9QeEeRQ?v(7 z-I-_Q15h0B6FiJtR5BC#2+Q9gO=#+7spJ>~xPcr+;8o|S<6awA#cCRE&bNCd z6Fm?6nq==sJ#O-v;0S!^X2|z|yl{pF=;K})L(0V+-vGnlKFErc{zhKDb#C&`3nXqG zTaM}rB>Of0Gkhsz4u1Jz=_*whfz{hWouMx6Sj95Pmikg~3snVW<^9M)^131X0g@Zj z%c>OB9c1lP@UKzN;{GbekmM(w(c!d}^q4<~>1%Dn;vSa*>$!ckv@~o&`x^MZ+--Pat{Zi`iYhHHuH!=vMEmou(6bhP(CB?&Wz)d%bu^!JdU*W5G>zd zH)rAwpw!Ko0Et$MD}P?ga0JW<`O1)fWx3UMi& zV$YDsKUxbLYps#-%X6clM5(K{Sd3>D+pkB?t>$M+*DhY^YwO-z?OxkloyqhJhx?L) z(fr`(P-tx^a^uFr!t9lF*J`o-^2Jd9()Mh2c4%^FC{tXR7?~g5jxWuO3~d&-XYBEw ztLJ8h*ZSLg`WI&>>6CSXwPQ`^Rdazo{nhr+_|;H!1axe?n{x`_Jz#!{MPJdXJNeS(v69}Tr5|Z zA4o4=8eQ(4Xy5KwF7@0PSnV5&b&eGm+hZMzH?DOqW!6jQmL@v-hpu0`(Y`g<+tHTY zT8I@U&#g@@j-Oi_2yb5RNlx`dx91|OZH10lZf0t|bUn2`7Frsgjt^W*rn{#ucK0kM zdnaPO`9#-hX)Ccccw=&AYA8E2F`JsXp6bn98SP(KzPdEjXZK%C7rNs;k+qFvxaVBQ z#HFRp+5YXqjcW^8dm_6vk{>T@Zw%!UT?4U^P$ZmPDs=P=bYAZqi}$97x3@=oqhnom z_v-cO_@zvHdNH>e8SajEwk_uh*^7g-Ju_E^#xry2xt{Ip;#yl2TofB9r24nl2F{(k zVh_cNxoB>!b0ij>x;7TMz8b%NY4l3}L|=A!aBh6Oe{6Jm{@iS2Yrb>RzP>mjBfWP7Dg_IW3kT3zDUPv?$T0E`?<~S%k%lj$jH$3zN<@D+Dik) z^(A|2GcnhGY3)X7Dw`gj@0l20o6UDD&Cg!l%4{!AMPre%{Ed!*!e%7jKhqUiyqvgr zF}d0oTFYuP!X7M+cU>LdENsr}u)iLK}QQ!&9YH&tzhD+MbK`By*FU zqp`uwt8HsD^H+w>O^1`?Q?qNACoiTq=iB(d=qr$%Fa3;B)QY~)I!bNSlDOg6uGB^8ejO0ZihZ7yA& z=<6Krj`X%)8ygQzMdIPen=clZx3Agb9XGO<<|fl?o4I&m zA>5anx!4)C$Lve19p|pJZO!E_&n{eBOJ!DP` zZ}O_$;ltQjX=k5+;{8{$)YR>n3Pag2$K*k4se>Gv;`S{)QXqBREyZ_B@!e8po8jJ)!LPG@w;GIXLerhVHe@4zwAaCP0w#cPR44wE*g`Mun8JIQ|p zu=-vu8Mn(&)BeV-x|W+P0LL=FlbbBje|ucWrRk+zF0^rS6K!#&_Hp2n{3|*tB)9n& z0*8NbdG*V0Zf>4sk(>5V*LnEW$^Xl|%(&Ty^Bz5GM*e5xz7D@HMV@|l(hR?!#qX%d zJ7LT}PmR@R&LjxodNv(p_n1J*m2A?G>LXEWfQ1uo;-}D*xry`71DcA{2#Wfml6c8c zEj8djib7_tw^ZKCvH*th5FfwCYz@Ti=(=1__bRb_YZM@0H;SwTe?i2#Ds(8OOU`r) z%Q315L!iEY(Td`}6h$a-TZcV;{e|(|3V(qGkr)x5V39&% z3q)mdS@>oVHfq_lQ>oB;1`mVChZpPI@3Oa383~$`Z=sUfiX}Ebaohqe@KlI9{;b<&+``&k-qDy6@NR0)}(Dl}bIW z0NHSX&oo|WCE};N7NSxe2>8ft_AbzciX8>)7{sp~bSyZxALG*+8d67tDS~h3o%R)x z({%6!)@+&W(K72DS{;oiUAETJ0R#=DWz!w% zskS}ieIbPADVdGmxuzf?sDex5yw(7=9R3Oxc1|i-f`-jGo=*`rE}DxJW;~KpqL47# z+{8D>9rx4pf{r86Lgzu?VKuKC`o~Q{_ab=SX=2K=u!w88Z@J(p04Y=}dTH6LLXRRX>|#@LRONhbt{ArXNXFWg-ZF9ouR{9 ztf@)*K9|XwzCa(FP6?%wh+TNR7%!!97Q%?x)ey)QN^Y))5*hZN(afrR9i5+>*hG(` zKSo(b+B;q*Mdtg3p}q+_70-q{rZzW*^FtGJqidys%i*j&)?Pd}KeHGqT^gM&6gNZB z33uORex$lE+tJivTGyh;da(>U^E-MJhK_S zk=+>YoJ>VC*HY0$cgnsrT#R1YN{y!{HzKpFkF_?E8BIkyFK$FKlc}Z7neOPNc{ah- zj=uG4vlnyMhWpwg9mP}xknu?-3*p6uQf#=7Lpd;dV{&~odu@0$A6>d~!x~9!P7V-+ z>4o+1(rD^x=gewsX*4&IBnabevC9{4OeM~3T=RO&WZ=D<>?S1kreOXV$=*w_o z_3BnzXC#v?44zB(tX;h_vO0Nra=I@%u{;}2_svDSGvlf3$Vfhles7f4Zi7cvxPPt& z?zHyFUq+*MCVvJ0TfSp-c4~4b`D^%ZuVtouBpC&F+a|A(%bW{ur?O#squy|V23hMp zjiHeK%Nj^mF8I8Omvh0F9)iL0`lgeHHF5I%NwNg6f+v+lfp5F9DQFD%V2d{TuWnyU zOpW)AuXYUBW2MQtj?o)iiSe1iL}tCMG#!nx`3wsLo$9bbD*FpB*tdHlNlB+k|=CMpDM&)RTbq=x-rIu(-vvv*$i6pksYI3 z&z`hPEv%A%3+%y`MDgTvZ1guay|L*z5Db^}*d@GWR2u;>tmXOER?snDY}sVBdYrZ+ z!<+fFwOf~&66m`}W8&mlX&~IW$UINDJx#edD0FMU`OX&%oJEs6%7AgYyM^%ZENjm0z=_Fj(1(Q=b!L6A($6{<#ri?Q-APa$S%Yo$i z*my2r1Fx8%7fOkv@;>Fkk>FFrnWE8Qh&HOg%M!M!a3W1HbQW$+6ulC(mWU{orKEPB zp!FOE3>d$>#ug1;vroPhXsbko(5fY&rikRg!3&HS{vvV-T#BZi9BkA=`HVvk?pkrd z?OAmzAr|8s2_-;O+e-YBB}pQ@x2fvK(_Lx%Hw9oh!DvvB z&NEv1=cNS$}HBrz)O(KHZ-J_?cFIG;_OhtE6|r7vgczY0YZ#qseeCkxq3lRWbX zcZE1@c%K*?ZO%tFqg|t8p`qDRVxzsU-40!CADpkJ@Vaks5>{7llZw`9Y}zmOYbd8iZKuy_6U;OuT>tCUBzHzsDy;^0z~nN&VGso;9oo%fd63e0Q}n_lK9ID4r>MTwWC+8Y{YY~&yYtcymZ02K9>!xyE)NHoIYg4nB!=#*rlXSrE;` zSbaPQf|8l|{U0A%Xsz+N8f)ax8o!68?40|H7TW)!lLDUljur6}y1$K{Yz3jGV&6z)gibU?zNL!em1C(IIVE~CNg zjC!Jpi#<+?FHV%y`aS?mY8{Tvqv1DWeUGD;J2}&N51sUo-_g)84}L`1?wxHN)-XM7 z)ijRh`Y1SX-m2x=e=SMjh1pzcD>Ze|zINrx)yUP^p2e-%$VmSw7FW4YE2?q|snQqN zWqDW$Pjn39|EndTNQr$>!K@bhsTzx2=NA7hrlcFz_)m!Qe!IHm>Jlqyi$j5~>y&n> zPM!PylMqwZMjGFa#C~a1GG?)wi5GDFg8h40-rnH16q^U9v(xE($l>mr|taydk%g#Ek;dxDYuWO0q+;`L5YUMN#(Om#>kgc*F!wZhPoNOV1Xws~r zdzW?r!6D9QdJr!Vj#coXgyUWpgX(eKz6)TSm$Nt={w{4(>wkwS>rMr}^sWOkqmRp} z)aQ*(=%Z!9hOj-_W-s+qhTMAeQs3rSN3JtAKv{Cbg=^c$l3QPxn@G-gAnhyxG0%@A zbG^u*YqMwRHx@-+7^ELB*q6uyOGG2m|D0tJb5XXUTW*hFLj*jn7o`z zEDX;Su68a=&8CO1&t7V8o6KD8UKpBLjHc!{uXN0G%(RaVv2m^-_iiLTxgARY#8iKg zfuCvbYXPp;W0%%}>qzlRCN?j*0EaFfsuN$ICOtkt7=@o0uQ!n_FPS zKwcdo?8vW+b}Vei(hJ)nziu;fX}*M{zT$Z2%tp9lp~MDb<17xh0jI6WxvSd~$*bFw z$)S$bD=i(NOI!UtbLUdiT^p6$JMk4IwTONpu3!cyB-@8rVO(D3B;=vZ%CW;L?V*}FA!ZLV{Ct*L2mK7poFYk3s* z;@N@5p0G>`g{NLtF%l^EQYRB!sAX@6G)}p>T!^8HQ*qS3)-|v&9ZFy9>lo|kEyW}A zqx0>#_WbhZV*A?g;_%c^a%sIX?{IhNj1fDWxAT>wIg>|6MDnQ6CAVbsmWM$J()(%& z4~4TYxGs*ouYVwst;l*Kr9>kDoxU2;zK)*WUVIZYr8$b%kSf7m{U~IHBRQ6?$OU5A=y|TEtIZKA z{BlEE>B%qF;J!Nbf=+_93UrT%RW%@|7rU02VY*b0g_}@FqsIT|vV{Vas(Rj@)G`f66OksRzm?n~ zuO3glh@uEe(TjRb(A9c;ebiMk52@@O(NG7>vaEo<70i@`D-lAwx&_IkCXudg_F1cw z19#STLyBfQr_XxCQ+AcxTWiX3+vi(UbPaq(7W zCAN3#{gh`Vws-5EPX>U(y(sgH85_=GO7b~H>)AJczPfOi|60mMt&9Pd4yIV&Lqb%F zokLWlzY;GwLFABy0+Hk)2h$ATkI6bcQR0hZEJ`be-;zl=(+RMvymW)ObD<0@)`6$w z*RZXK1X4tl7;~a?$T~{h(3V-Y;Md!}p2(P4V49_NSis8+I{q9fF}J^5U5z%|dP@ zfe!J%b+32t0z9V?%xA4fnf-#P%#5sxGM>9Z-Jb!tvnVG5(bHKZyQRZSBhTW7QHgHZ zQ4E!rZJ%}qCe4TZe6&P~C&XmI=`d{&Tt#d(Z*PcT9ZZ*1*d&-f z<`p#kD5&L;E74Iu*m6Ny>cdwr+{XhfoY>huhNeuJU8_7OvJB})5KC=uG+TY)_Fn-< ze3-$w`+NxJS!yYxy!j4&AkSBgcIi{rOE#alA%eZk8m;5N#UeE?sgMBkn>g8V?D~I2u#5A{9r_rDtMpzGEUef`6`VO$}@&t}e}FX_9NH zg%NxH+;%iM8lGsI2~W;V4zqEhZQa`oZKH{a%kibfOMUUV%zFFOd@48FHhD3+SiBKg z7#@ynkM^~6WEcBpraQa0XRhCf=Zllm=X%CNL)*RWJY+JJD{jps($mv(+5UD^yG{46 z;XQ(_%fsikdqUgSw-++$=w{FGc6;nPt{|>%&0ft;Y{mOWbK}W=L>rWjbX-Kd@I>#$ zCptRF(!#&aKhaHpxvnAN%M;y$PxKBpo#LCp1$D`>=@i?%#3<~)nHzwO)zN`+2BC1& zZVUBAQE8{mZtsb9cF=IWgF>C%lDzcu8H~Fnd0&Q-r#9Zt)vyTa^eFwBX{R|oO6BuD z1-qHr(3Psl&Ax_QI4XVVEQzp}Ar#7gSp#MAmYYcce{5pqG#ko;aGh$UM@~(C@tge% ze<75e4=-L}VSD_$=h{*{9$C6rxHgwdT}@kGc=P*C>N^mP8BAgNFEuc&SX}=i2!Cpl z!C2f!7V-QtuOvFUIEVbiEK-b9iFNvvD5#niwVEl=kK9$;F=j5(UzpGtiQnOWzASDLyV%paHr^Xu@0=S>jP$SePWCMK&R*WQzTP%5cy(gv zN;G@vQfhs^zkk!Qnm2h?MY|Ih5d{+3nqU?k*1#vKz!BT!+X1>303i-&6xww`$o%*sj z`SVdf!_LzIo;*svF$07bFvBW4sEY|$Sk{hlca({(Ds=4{(+JQS08nIs`|IG+t#Uoz z)5*t<#^Rmhqg^Rs9ex{V>(oy(Lg~(UKP;SRAn8#{COJpp+`-tXq%k@=K<+ zHtdo{1+u514ANnJ)0Zyrp5zC0+AGyr{UoCA$^~%J!cXJ#xy07Oz~bn7n>|(R8d$nw zw@)sOv6%egwas)qo#~splIyv;wbT~w7pgL7*-WIi2}#FJ7OZvax6NOFyewdPae&jig~WgkcI$&P6_q*0?=J z??I6L#72=3+cZ)r$Xiz8#Ltkf(hyRt$i9&9sVSKtE2`(I2b>Ye__ z*g_}29*@;Y4lX|thys#%9<50&J=;$PV5@fm6i6BY#w@5KiqwibInY|9Yd$D5ah$Y) zZJ`aDNhj{!F*X`b87>6X>7k zYjL!EsJNETmU5K<1DC_mY>M72srWHojeO-J=(3rJ72`W&$4RaIJ?6o5f5WCr{saCc zdD8VL(Zqwa;tvPt_8{pk0XO6FIuf>51`08jxdrr=zXLdk_r*;{7@Xm46)6#QPz_`$B+j z_2GSYbMuV73P&KNH1q5RbDbj^>!Yfr#yJ)o=am4!n>asAI6oJln}M^x;ypq5oJf8} zfKiX}rd-~coY7`nAvC9x_oJc7T&HU?+_C0nqfVchjMjAEyax08~847df? zJrQU=u{!j!;h$39gXMtz{J0Ts*#e!NphMwZ!&AYqW;MY}$Q=Q=pXbZ1?X5F`X~%g@ z8V}_sV8Mr2IiFBRs4Zk%?F+5Sm2n*BsDs5iu%$FQ;I4^SN`1`J4;%h10c}2P$nmI$ zLoMRa&oT7t;86b=gl_!?HtMdlBDN!SztU49zVaT$n@3ektsNf3&jGdJ{b=gPe`Kwh zLj5R_?0A4~La2|irZu%;!KLenFX+XO2rgBlz>mn2U0K1SA2`^-onI2K7}}&bGpqQh z&XTfVC5_=u`*%DQp%v{DfhN}k?qviv)$d^eo7BDs0IBZrTGqp#$At2w!I|>C$3#;P zR%Lod1vNeX(mk&1V)~9<5L6vvIEem&V)E5V;;Sx(yFZ!gigo^ zEb?rL9EbB=Zx#mw#vdnEaUJ(#C8B6l`kucqQ2`V~7EhTOrid(jgBydwi+yl{3Qwud(nymU{yAYF~Hdt9}2-Nvq6V zm)|OR@Lr$CC3$D#s8Bxc2>}VD$uQO1ffK!dR4aNMKm`=vm!qlMrVIKM>ofB70RMa# z7Z0NAcD{w`b+S`aEE{c&7t<*^IuXU$%YM#vb)G5&nayX$>0@09^Ao3tG5@Y!#`I_X zz3b&yy7jVnn8i~)k6=NBdVYneo<%RMA;y9)^CgdEb{BOsW&BAZ3vJV}CBqBo07q03K z@Zhr?9bL|}f&l(5X0eHJAJ3y!Ah@T6<5rQ#)+G7=O&JNJ&+yMlc%^iR~*0%$k zA;$b(50u>6&R|S`*5CUMfIHd3nDo^7{{(o2&Oa=TPPLi;3!{O*l!>MMhX8n+a@n*k5hddXRl1<>(yhF0}FwAzb38j`(-p4z(}0aeEa^JHvBp3RQgnuLUkbcpveHL2v;% z{rjoY!E&t*Zp+-M#H6>s));W}_e(>4*SI@1^##slYC|j!HiEd^v{AuWidcEp%SjMrZqRA1&0<_VN>t- zT{!juo|kqWIPR+)UlZ)x8Np0FKd`d0=jr7M;I(@kNkjU*3{rm{7W)e!#r7BH;eli7 z&)DXAx6pd;u(AB7t#7^Gu+on*N_lb{IRd-1=j-tA022-t1*SR*j>jp?!0;t1Ia<(q zt$I|r7dL*Z>9Z~l zHJ#IH?27H}cZd|`_Qt7GkBqjGjQ%tuY8^7_Kf~U)x8s%Do9E8YSYXl zL^~1UesuFwC**Ibj}R|7ZQltLZ-Tb(rfI(1wS7Bdr+VYcUfLdUb&y!KFggTM&|JUx&tNEM|EBLm#u5PFnV!{~mXTMOD(s9MAOZht zo(;~E&vl>E+_IGn2_pTtj%{PI3z*OMV(H3dwE$g{I|S+_zj_H;1Gky6P`n0M=9_Nxp?Rq86ll z^(B?jso5cma>{Y3Sfv)}k^p-jNGaeq0{&W?mdPny#3_;(K=Ho;Uo-bM`NfJ)r|Zww zKTfn48UNqJ7_s9|huK7r4{WRvR533$T8| zo%>-%M1Scvm-;*{^^XVWCidD7u%chKcs{cQ0ti4kG|1~(y{}=#x6X&N1=f4Zk&A?f!UH6q6l3uX^yg$IGBGq3A z>DN~X*zR)t4>vc5Q)`}*b>=?BVF%DgOVm^NAs}ZxiKey8P?O3Rh{}%#=q9NAC~I0v zqLv=UJ=uOMhKE&(Cg(j0k-aikgb4b??Od0u;<8tKJk6ib-GY&a2AZ|cYKGKx^W zH~ca8s?{m5Wp+AV2v_(7wd3W!O0IBuSRPcFl$Fo8a_@ji*H8?*mZPBvn6= z>TeoOsuLjLhSL*IurMheS3Udc^tGid>_p0iScQ)1CeIiBJ zIe(?9tJVsO@AZ>f$1?yYpo)8fVP*xRMu8;ptPalmW{+PL0(h6(Z~AK+eKo= z!yX7#QEyys>rik0O@+UVAD5~(_41c}gU4wsxq*+&DJHEU(#)QYFL->6Qu4#()KWew zq}!rEWHX+hKxwvYI)Nv(QC3lIx%@ z@#$%>;63InS~;iL%9*=1lsp4MTD=GGm+nzyJxnfiFPc#2G&l=Tp9zeQo~H_A3|$2o z{?a|ZZWoX_L+5

fAtUYO2&B;^G9u(w`vWg>LEgQ{{~&-9FB4>Eq0Ww^P|L3g)P? zwA(Hxr(zoI*xY4rrHtMifPy9kE)xYLTE@ZSgf9Go+NQGZOQ4D`$9TmTbdv>N$iQNy zUf$uHPnCMPDNfW+uyx*>6Lq&^IGw0sj0QPTeQTur1yB|?ox4WLUj<+lp$7h(5zb#g zOs<-uRsJ6Vx(Tc9Pg&ENR$Tzc>Cxi~WA7R%ccMYS{rWJP`W^Nw^~p5heMf+9_2FI9 zae78$?d3RqDmczh1_0h%>nnuw;{m!EIQwg9anSjr030M7r$VS2^)qyHqiA)MF{yFOCB;ShJgra=N z4?hjx+ZlYOQaqjfR)AYRP$V?(Yz_q`fvHEE?B~sJKC|d{`( zV{b(hWz|f~5@*p0RHP^JW$~9@lS|oH8#Qnx5bER7fmz$O_Qns|D}DzJrq}i(fEKq3 z8qRykufxDHaGLxC{-}@VexAX#7oPhWjIc|d`xLtFC(p4WfJFHUp5x0=56`i&K2!tO z3ZCY}8#j-)h#D`45aOIKr#8%$M+UK-1;l0^n|n={$-2KL_Y0#PlCn(-+BR z@~T(d41so?vW~9%$#aXub42+Hp5x0=56`i&W@_MC z!E^pI?0pl#dB1@25Z<*izYEX`ZaBzVX`ANV_$lD#@f`thHpO#^$o_2sx{1x>TUgVY zo5z0@Q5^Z2w5fZ#CS z`EaPKEwec2dVsz$VB~s)EnH`TDUK&KP#|rMSJ}o0DLY&!TAdvTujk_73|zjHih;@t zsO3RrwpBFgC5M-CKz=L$mzk_{m00H^4QHJwS@hx(YYSaoeT;4-$;49?O{wn&r(+1D z=2SgCe3}u#3_^X?{=y<1>i18vYr7Q~3q3&jEx!-wkl#|ZrLQ%?OJXMfgvQwQMOX(J zoq=~E8`QQ=ecAOzSjPmg!`>lZsTC|4A^L zsWJi$Gr-1K!hdft<>DI2#cwc@n0vL`n_#F^{~7ka`vj|rcKn3ehN{*?JApO<_oMsJ z)Q>A^4>pPSED`VC0Nn)f?qW@A?nf^S&sYbe+f^a> z2A9b(_3>P(#ya@$+*{FgKY8vs;yI#x1<sE6m+Sjif=R`8tv413>B>MG^-AwVy< zqgE-m52IB9Z^q_w0<+Y| za}O}MOpd8)VW z4{vY+vaCx02d5<7tg<$7xhq}?q+M#UOR>ae3tq8qNfcLBn1dquDF>!JXtm(0uKZ7wnRlK}`OR`e4L^4cp(?c6JR_sWVxyd*S7 z)i({$X9EBvR!{-tTtPm2Ju7I_3Vxg+x9b%|s`vAuEex6dN1))r1$4Gj5BD01OfJJK zJb%|q@^1l_MDWNzGctll@IbJ?mej*jAMnfH;2|WL6H~6Gi0*nI@ZPIHddN>9SAb(w zivEg~6>ohFOz(C5qDOip0FZ)}Igs^m?J9BY-!pR8!L`+ANPZIZPyPb_hm_T?ld@8e zTQVK@)dA-E#ma7c2d_S_!yK$?!SDu|38642J_+7qSfB{oGv%VH;$G_q8KTms(!I0k!=+PE@ipWuFwXeb*l-=Z47C-2qkcJ zBaEjBRS8og@N-mwq*s4}t^OWgSGZeUoFXjMb*a9}>rylwOn4PFabK4T<98L?aNKS| zHa-kZ*4d0y9ii(|Y*tb#F7Y&egAnM(%2voR{QY@TXpIz`-fSB5LR3fKJD-G0#XW05 zwqxZ(oP#RXZ^NmUGB=mOq=G)~#nu8+3gvwR=!a0AcQfB}r+C`VyC))hbCSA^6dh-< z&&{^w#eEW2PD>U4LxHL;eJ`FBs5<^^HW7<7hNN-g^H;2UKRmyjO035cdDLfGF69%RXXala_JfXq9=OZdSj*C{ zF>06s?nX=Kf?oDH1Bnk;_>~H(wWZL-5jVOux&X%0{UbN|C@tfmD*h zcA;pe&sqhl+>UIPR2Vl1^L#Q)olW7aiK8#lPjKh3z;6^PkN_xw=z4ZfWu3hA5L0{3 zp9SDElX()vJpaAn%=3Jvo&0Y`1amWg;iR1$d?nkf_LO#VH;vKgv=btm(}3E2{q=sG zVdPFb!M4-w+ID=>OpKl96+qgx^9Yd56cfJu{`-O{14)vBf2&sp{Abwv&Qn*-^?u?A zz6I5)xjulV0o}H*C6Y({w=I*D>qN?@19TI6Q6Fnsb1!;fB%CZW%I$YdFo9XbQU<(& zwa(x&m#Mz^%o?kCTsiRXy&6+Fk6qaL1PV|{xK zTq}6ae}=tpE!F(-+B>@+C&O z{oYcJyh^QNz%8W-J=`l=pLid_2!6JMk9Z$P*ZmalEO8W3zCyhDa`+3M$(?Mhe{VQ< z?&p@$$JTbgd2Rr+)VHM!F}U`!rSxNjUGm%%y6z{><%s8q@)bPCm!lq@V`KHyz}2y( zaE<6cgR!OfHx)Ifc%_NzO}%PP{j{r)Me^hLz`XLh@>H2u%~^I7+rf!Z+&CbtJj+qZ zI_&QNS&~1FQB@swnu32RMKrXu)+mfuz@wbbip9>)IDOJ|-^b(D--KG`@l){wIx2ME z?a7Dn+t}@>ef0hK4;j3ZX$$Xjd_#c1F66SAf-Qa8`h)V`ybG|qm9EnYCun|vL-Va@ zYC=;aFr4wwrTb9~cx08i!gx$aJWE86lb51VyHHpyrOvY7r}4twbUwR*>tlJIs*&S= zv0s&AZ8K3s#bB$sqpjUy1uy7sU8#Ua(qcBA)15Q2XB@>a!g+dek)_z67%;qb*<2`P zZ`dh3+MABRLnsStpg33|yk=XGY;0RzKw}dr5K0C4%HqljJc=mtz;c>elZ9+%Wd-BK z5@CyyHfSD}wE{O|WZQa{$I8xiboZ@1r*ACH?+bynaji%0Cf>hR;WMd!xDOA0p-JZ zn%9)#xD1#$l?0239EQI;pRfx%ltgp}9m_gaNnEy5K9b19?5$9HTV=3PfLAqG`A5Li z&`UHW#GeH#d1uqV$>NV}TH13xf|cqw8LVU&tYGJhr&YUqsYq>_M%xB$#!`hsLex5xAJN6$DDsDDZ(M6Hvs|`7Mc-b@i@s5J zl)d5IL#(@4!7~#dan65pi@!beAnAm?6@T097{_TP#7iDxjGIyXZ3rj}OVnNb?Gk>f zwc`r5A7F$t+1|Z5n_TurTIJUT=q3)X7g*Dp2iE|_-)xK|F!nC~wuS})@s0*Sz{LBj z3GbBv-Ri@;X7RVTX{^19zr8&;&TkC>yovLh20En7Ye=|}2#{+Z|RQ~{LT1&!~J`BT|Y*~R2 z3x4AgG*{-%2gQv9dDT3ZMeI5z$}mviTqbCT@ghfN4S7{~H5{#15dud>6~)zMM4g@& zMr7M_Tpe6T%2pBO&k!6>vy!_-Yt7D3kU;tJ|&ugf}?`~1@in-Cl08JObiu&}b?^%ETdh`zjf1P%&CY3#E+ zgE(ea1M1kmA8{-y2d&KdrKVde=vYB5jh|)GXg(j@yUPWZ279OXlfl01p&|M_gUEkd z6*fHq&yF*PIB)4eywE}py$9<_ppRAjrbqkYEBrw< zWb>zRUHY+nk2p;CwRa%#R7qX=_GdK_U;Ys3{l;Z~Vk&*2YOg#|(R@xz-ktvWIDW5s zqT-!BPE>>;V;PSVmHJJdsMrU!TAhpl{$v-XWh;Z-Y})t}6@gcAq7q~~RyIyleDUhx zw67sfyW0Z~w~1_Un*R*K{&_#+-(3|Nyr;Ptg+P(KS6EJDJX81L09n{CO}eRO<7Dtv zTn&J|DV}d7qD2FA6GU5KO>3Di<>h{U^#FyJ;9J8^%eK=Tr~sD*-%eABRlAsg^&qO( zIxQVCENqw$F|umy7l7r!XqE>pDE>^zruF#W#Iqh#sp0<3~b+OH+jzO~_`4Wjwp z&4Aq}&DT+>`Di{r&G$k4URCq)&W+W4pI`(q)tOrj2+j9#2D{nxCTTuFHkan(i|4PG zOip_naoTr!;NeEu5Muus49(}?R0L!A$*+1-uVBn8U4}vO0eoPb;t0lYZ1)ZYq-CxZj=cm)vUijdTgigTGs8oB#WCO3N>CZ8>>#n}<@Vm`ZBz$Pa4 zDOXB2%m0pK5tM3fW?`b~so6PPJf^hp=H^R7^xt?0GM_pbMQq z#gEO+q9c8C#I5APoizX^IQgd#z;jpiGkO#%?vP~cVrwC1M+@?vm$>#7qT+7qPS<1RD8?19`8i~>Ur)4eYQ;8U^Z&_wJQd64mm9>WU)JR!tZQO064hGcz=uKsbKV| zf|kZzz?f0V)6^Ud(?1ILDMvj|b1nfT-2?n#Adh>1ukvZ^n;s;pdVY|G`9OKlb@y*q zI+Uf5lyHX<;0eCf(Z)*+q7$c*3{{t3#V;#z-Cl5RQ}oR3gSe>n@N+w|6)*2u(W;`t z=f^-47J(K?FB%{7`UPhdZF$N0oEbc(1^rEAK}+kwmBdmG)3%ewh8`|vu|GQWlc-(H zHUn~)V~-ZeAj%U@c_*~%;XX55NtB7W>RL=X97s6Nu>YNMWp|RbR;uX zA^F9MPp9jT^EzX+U!W!5W2|_$V|c)EGh)SeJ_1SQ_h{U);=A!vz)03nH1$(7l^F@& zM$3CBKsRxUJiwaPbOi;76+eZM1jgR6;t(1H#QRJD1WdO6cEbBqfNu5ST{BiZrm^;l z6;A}mc_aYvCeH67oQDH+GjR6TsKR4#TYynTtXK$UqhiH1-*kB+KoflC^`^_4@N+;e zdwl>TO^Sa9QG6>vH$m|dYg$vfUKqF1zKc91pgOX z26F_bSIy@N!3WWGKhwFtlQ@bf&rXug!Uudg{H4|8PBzxNYT!y+Mt$75pH~Qe7trqi zt+YSEEcNl+7Z_Y7$JEDje^g@~e0c7Eq3eF~+;Zz!O>h1wdy@=jq9OpVH~qcRo;g zaqocXl{wE=#@wjJtG!&f8@Smq*nC@X5OWF@a;EY<%PNy-kcSz_d(kHs83&jn1l+@> z(Y0QE;uEeRX*OTCd^d43txAPL;Y;N&?&c=O#_FwstV5v$l#Cz&*Aiykw^WnP%781) z2Z|{-jyu)lo%mh3SsZQ;mb}k9H#Xq+61zZK$Tme_Uc=d4F z_Yl|SJ@9afRRyQ{&tPm_{!K-|l^>s~H}wj*{xS2XxQM@TjJO33IR~f6D{j&$#-pi5 zq!fizdbBf-`X;}HT^cdNqm_}tvJQ_n=GNL50&t&*Q~oiUnsLhaxI={HZF2Zk`1AM% zW#Q_YddUozy5RJ)jH_$ZuQKFX^HnozHI>~|j=<*;0_7n5n*c;L74UmWEF^(lUeu*o zeHG9}TH`WcB|&95GoCgy4>vJgrVGb-7BtAOy{WLpOb0D&7P8Qgeif5B&Sot&o^&jy zU}@Ge;<_Kj!+#5|AQ?R;v zr~Sp0zxTQ1?`AmYAH^!|)j_}8F`N#1F~-es(2oLTVbHrB^yBy`;K}bYn$~yndp|Aj zP=IdYu1mvxsV(^;Qt=q0O>HGnr^G5@86LkIw*0iQfjf&TDoBIuGaDa*wUG>~XIt&9AlMPx_~~yQ3Y6Z*0}bv~yl+Iq)b+!yZ$+A5NWLTO_ zgL)`lCo^{FHeeC2O|Rp+Lc%VtvIUN1qpk5`Iz_8YShLG8Cf7N$bp*MOl@EXwwWJCj zFjAr3@Vs*>7Gb*4(jsuC#HxNQ3KFXtKZTzWRu;wC8$T*A#)m72g{vq&lAIyA zG7GnJ4zFh$_#kZqw|PjYd!skD0sk3RcK!qq>D zuJwkOJW8{XC&UaZeTX=pD9@}^XKn;v4u5rEN)a3DTWcWcaP|k3qKAC!PHpr%O~2m; z3^&R2>#j8YXm&r-@6YjjRnw1me!fh?mr8)NrJLt7~K|W;7$p9d5?6sFq^0>M68c(!tSTU+FXp z+QZyI0k#DrMI(U|2fcoYT~wv0tANt;4~RO5jRaUnb8%R$vf+j=&KFknA)Y9%&DU8w zk8+jP2p$}xf9b`8O=7l`OJkbh>bw`uN8`A+-kONDvgeFKX?xqw-@p~XR6LCT&4ie3 zO;4MJ$bx3o+Cps|>|6*J02~m{;)LAW-QIT=IX28WVUcs9-SMOv9Ul_mOqiW8*RtG$ z(B7x7&Y61mJuiH;`B~*yd9-m0B=iWKBxB$toFp4LxSz6-XUIm*htuPX^YqvlhI5`Y zSD3iz43qNwzOcCKR65GVp(E7B#6d}92nSP0Bzppo{-q=`l*qVRBCg7d+$v+F%tvL; zIubH9Dz30HIfwL-oa<5P>|wTaj9PImsYIkQkF|n&*u9;88~O?Z&hXn@*pq-uL3yB> zmT<8B+d11;ZyJP&tM>*=zS>~PN{!^pUngDsRoUJBkk2catF*lj%pttCq4rR_c50L# zcviH)BVLB?M4O6Le3#EEIu8(h5&aD$bNl)z*%r^y@HO7CF>DL}84MH5zp2O;dXzag zsyFq@7J9_P+pY^UNE(tgB?@B8Y zhJ1RJRWMuV;sr5-q|bgg50t?H;i0(m=I25cPh!oKq!e;ZA z8Bv~(0An7Xfd(wLhCtwJR2eu{!3z?%dtFST$9Yu%OhklLVRFKo#q^+Fz}@BKKnYiq z=1SfB>@Gm+-#bq$g~*}TdcF2l?VqFFRO%&nl3~xwxGr)DF*_oM@!mj=zt`zFE!&nR z3#!}phS^)kkI*t=|lmC zQUWJsht~=CJOIx^hgw8EdgPRn6OhCx5*Uy;Nq!2vn<}?JIP&>>4-T?oo&gU_uG`7#utl7LQcPlB@-O@oII{c@2dYtVXD=T82WkPqEX<#UR1QTcp z06|HWo8vRN93`Y?f0NX#3&IyM|7cMkWTI}KK4u!vUQ*rMV=}IQgU;XM00if6cLP7` zSe&7gbJX<%Y+*0T_dyqAv~4=PINE6`x?y+&|kR`9LF7Y zjfQtN<%zw4!KSTDU@?D#rqLhNcKA+A7|_T4HpaN7Srjx<(Gg63oJlGkGIOkaSm@n~ z6*Nr46W(fBDvJ9mb+#Vwy#WX!j6WqAPXtr=is;m_zIWn3>9Rp?Mxyo4vh}XNn#$9} z@8ZRa-Hvg*a*UgiX#GEdvdo(pNQDz=%@=wfawe2|P-bVf%zX!Bh{y6~l<~H(aT7Z8D&`k*H z-?FAPw~;fIbw}Xhc7~6aDgLmsqLcORtL&m_aQ_obINc{BuMySBsPacW-mBSorcgQ6 zFtLd^8PU`g+{xkb=N*&KpCLjYXJh$KTOXm{_tA@PLf-DMCHxUeZFt^Q&_|=`#s_#jFTN%kh{Kb zM|*@LH;sY``@cv0I)QKQ5dtG~kD!nB?Gc|PIsXu&j=yp>RNsE@5ih6LVq>WG6D?MK zF7}@RwAd@E6rTB4Mh$6EMYp$b*zCR~3hWI@@ zYi~Et^jYV0&Fm*hi?Cpu}Ar9lD!`QkMZh3%eV)^ zZqj*rBEK0>3+;b5x#v{t|G&L&fs?DK@(u|h??A#UyrdbBBtv?VNhT8#ATZ_9K&k$ogQNU?U;}u8JTa3a%@#@&O`>h_0gUe&G5*R8(9(pS!q- zqN4Eq&#Ah%Zr#3pZ{40d6S9V%R(iVYbslxjsZ*y;DK&H>}4{<+6SfwGWw2_#HKM(1sewI-EDelXE*l?)s?bt+t+p%@YJ)G!g1-K}- zYBxXzb}93uxRbW2+?h>x$>cwdtUmrRV{{*-brDBlGDhdn$S8QUV}qB`&;t8e74s;dh6GMuXT0WHGsFxo;aLjPqxd{uD_1Q=)KYPVC`)IPjAX11*|j`VD$gxqnc zYIu%yG^+YBIho12Jo_P`@(6=wQl8D=s)4Fwy=$X}nNZ zAGdK9rvtxb*l@)=lX%ChV0_lKgz=Qo&bpS>KdL3KTI-v(qTks(FMmdrXJ!OKm68&0 z`E##M)E^O1TevU(VZ#yiz?Ny$w@lq2;@|w1sY9#^r67mp4_!3cTc$EiU)O^YB3%#C zm*Mo_bF|KPFm^($bAL%Pd_8zXwI1}`HQkPh%U#o9ZWXAc=beldfAHkS={5sQ=z{Xc zguq)2nn^+VL9Xhd{pMsI#3eB6UCPSEA!@l^Sj{-@+ioHgojtqn6wUr&M|xpYIs}B)RC@3

;Fqoc=F=`cV@jg!& zdx{71=kBL~I#m5PuBs#QWF!DAcQ!WGnkjNjc%kqWbmfgg?#*JearjFu#J@0v{!^7G z{1Z#x0KFC|p*qA7H6Y?(Fe1UZv(&GZTo)lSU#^dMI z!X$TXV-kNUOrC^Bh6eqcP?ZhBx#qL9(MpZOq4hrrt;h11b)z+n#hoZIS~slO7TcP} z?fFuouU`qm627wVO@fj#p(Ju$$$9K!!d>=aY(u#ZzNfC0lw68WmAdJPV-bl!$$Kd` zkr!vTVea0X&2zHpfxi?zRx_Ub0hXM-f^h@R?gTwX8a$hjG-^0PzCeULn zZEQ^L?)M`keoo`*6Bj)rAY%_^?oCFXkxfSYrO3FGvE&b~Bx8y(12T5hCSydv*+ir< z!x8cS5fQt2s{T;<5HZ!*m?>dN0?u3-f&I?BVw6#w?_*QMrz5UM9^TH2^(J%40xvuH z=8#a#O|ex?y-o9C<#M{a#mafWG|`3QdoXoxD)N+UD&j9i#rH9q{Na^UypB-=DkerA zI-86%XgD(doXEJB=jsoZM#kD!dgh67W5#5@jDp-b-yrK?cIGzvXYP77DufwUy8~(# zWYB7qtQ^?+kNVF4aWKr^{LcULVueSv^KTjLo&UFJ`ufgaLZt8f>C133{J25VRK%I@{3$F)S?>|R#Z6)U@!E}1fIu|{X!nMQglFP-bk zmSvVEce1B4Jz&PW%#IGq7J^J2BGrn@U+T;>lMtC&)?Ttjop6qAb3BVMX)e)D-;3hz zib_NxeIHO$p1E*laC?6uN_|H|@n#?dkV>)2iE8fgi53nlU3@UjTeUgaU~WKe zMqghq5vku{&`j!=tGTL&V^o*c2FVCMfu1b5S0;;Hg>*kXgrwlU2NevxCwCbDpu_z; zg8L4GX5rutOh)ik1+`Z)f+x*k{))lmb(mi!n7?GuOoQ29a7bI?tp>fy90YQKMU{g9 z?qHlFd#qUvQ?M$m1=t;xAhk=*0oSntvccsWBap| zj?O<2I*;JK{D%#P&L)}P4gST&$nQp(HRU&_FIl*_qsdO7x2UPPd51CyoiApbBM=!? zJ}H`t$|tp?I-eAc2aMXABzHckt@vHLCP?oi@wNmg6pi(OFisK0!_qR*OKskF#OpR%BX^<#@0H zB_VaZ13-THM69@{4>_rE2&M*)%~{{JVy@CU_v|;AQcU?9W=cI>%!06p6stgci|h~R zSFVCtwJ4%y@kgG8u6M#+yLy@VS?|FqA$*d!i(-8fM79?Spt*i5* z;x${63c~rzIbB5XjD8t_C&yugnTS9N(`5*JUe+OOG_@L>HrQ;Sc-XI&O|u`Y)ork) z)f$|}^RvOu!0$C}Fwr<#8*D8jpf-CF+NBM)n&+-p9VHt~qRsW*m>^ylPWvW%iO$Xp?DW*xS7WZ0&PE+2nBHzqx2p``)feQegr+MDnn|5Kz*U2EcID%R zWIwWJ(+RS4t;@>+bcLWRmB%l1Zvbb^^18r0N_TFnYP$0>XYD2H=EmfEGD~*ILuI7m zu93aGxry_a%La>gC=E`URmRdmi8>9h$2-mLab-29U!@oL=!{v2!+Si}hlg%gaDuv?^kuTU89wTxd)uM>qrX$1|Rh=qY zt!F;dw)d4VhshV2^C=C*JB4{hM~D^_Hd~3Q)+P^GTRK~f84I>@oY{`X@nJthIlSY; zdi!u5AId%=IzGg^@0^+3)3p2`K$fQEc&??`>%->k@c~Ahu87>rUnlP&MBX8TW>RY0 zz*Pf{OM@fB&!Q&@v3LIR&!K|h!OlYl0O)W}Ah;heXci9cz$3%&E2zDW41Zt_^Y;uU zufsf%VE(p2GYw{cVIeiddkuP(M}~4yMR;VW;!-skoS720Ic%I3tvU@q7;@GmRCOB$ z{wrz{Vfhe)W)jQexN6{vx~lqlXb}mly-J196!G|!c)-Z=j^diGxYmRn9AauNx@gVH z*shjFJlIsA%^y0#Yj^q!O441^(!6kChvUd>ZFJL65^gTjBcnZNT)=Ke=C_SpaMur;h_ z`!~ya<}Ykh;c^4y%Kgt}j9i@#(Ob_ny{i3>O;^o&7R2+HT)J$WOsn=(4>;V5J>052 zL3urwI?kc#S?(o{RpoSo4l>@O+<2>pjTSDdW;`0tZ{vLney_=RqOk|#VJ{7bYt3z& z_|0NGu52^jKQRJyZgNvWGTtY6?t0be8IPt{#ds2J*cqr}OpB~GD1w$@_;3pG;WZv$ zxiO&eq5lX{M~~rN>q_g6bIeq!&(m=I33`=g+&I)x0`z(OV5nrDGk{lLu2Tt3KQL$} z(ew;g4OFsgXqTtG{m1Vg$X8~umn3hfl_e1&I|Dd7O!1fEMjReHEG4>9NqGep{2gJB zHdno7fLR?~(+FL!MvkuIq;y-_+`Pac-Ig}h3bHw}iFhJ1*+%0krP@+0+h{yL*)|uy z*OYCdv4?EqVQa`X`!`Fr@fSAfPG!Rf?=t_{}CdRY-LZ$)`z(&$yQd9EpJZ5od)pgXgZY8lrm^0 z(Ujz>fs(C@BpVB}QlikCEaCR_8oZc|*o=I+6vGum+z6#Ohn_;Bw-0ARbg!a>mtX6V zd80Cx&57?ZpoWg(!wAKLk)ybVG+a_s8s5P(A0cT7$GH0mOB&Bl8a{~MYf3}WI9h4= z6-IzA;@r|eO2fx_?t0Zxl7ucd~S_?;dfZ>KX+*u7VX*@r^+k@Y0@||cLE#D0?0(53_Q$h0GyLj$;)luR*iMA>i1(DTOU4oWj`0xng z!%h#d+!)aK(0>F?b@^A_I}M8HsEjy9s9n|Tpt;ZElp@qYvl47=VwoM+gwkI^{8K5hXR z3oc*SJ?=B?6Y!IvGw>Kx4R_)eBk~?)&`b)X!?|jpk!Wy+eFl1x5PP3tpM?sBa4$6g zKxgZd2<}#cX5rutJj33up!Pb$-eC^&r3RDNVQwIpFE(hV!K~zV>NxP{3HZNEd`$r_ zQu!Qa(5pPdmWwK?GisOvC0$!b%bm6ayH9yJVk?L7vd>Ucky z@IGkJOyd0-t{S+;O5~Q}6c6#vd>Q_yHpWAY)lVZw9Ltky+L4KKYQz_3v-yD{omT^A zR`l`;Jm*Bg%(#GL<^H1vv3zGKk5vU(SA5(L3mNGt?azc2_ zUiJGK?pHSf-8?9dsc8zZbZ1m987bIpH7cO>Ul}?NoI*TsH_y-?m~cF>xr4|co=RBQ zw1D3$#I3O_5|lw8wz`n$OAh1`|8*3JO5kj_$zprjd(Ut$rY!dilT}qEWA0~6_=6VHZ;XiHD1+~C5B{i> z%76xAWiVBnsco2x$@p`Rj_O82_1C#u{~3fs_1~Tp{xfj6A4%aq2u_Mf3ZEW{6rQrM zN(#$q>Qb1#3@3$8BQF14ST6TpN5hxGQ}Av|J2HZF;W27e|76ZVIHAtp+Pe#6y|f)K>53eZ-C2-1CHlU5|kFDD@lpWV2hWFNWX%Q zU4WXbTk)0Tu}Q>~S4X*RTI-vF z!uv&xcU{~c={ZAd3vjr{^i_X5xIcg5Na0UIv+!>U3B0Wy#N_?iTIYl~al&RE*nf`U zI3eG$edC&yD_SmIv8E}uvXJO0#hMrGP;Q!he=>*1U^>&K&T`kzWT`2gpAUw~;l=g& z;i(79?#GBhibYd;1PHuGPV6npyUXV+EAP3JofNbay?`nR_ z*z)Iiw}ks*h+vM~HRfzcPofaE`JSPP?+{J$27xn7Y(GGo|ivG*RN~ zamI{4h;ke7c>`?d!e>4q@ezY&QusW?RRh&f8|wfZO(%PiMhtQzZ>KTIrhAh7xQW^a zkgO#)qm4S})5nYJ>Pn&SM~psA?N_R-0&GF5_5Tap(g^W12s%n zo~poZU>8z9c3TOuJl>zPL#L1oD?#y7mvnC3Q>LuX6lEpD#>B;KCxA4R zou!NNSr%h-44&xf$``u%L_6;O!F41{FFHP)w8ULcUD&N3-wi&!&sGCKu~W&_)r* zywth4W|zy7wp=XIwA%TrXp^2WW=40XR zeAj$jO3cpZ`f>VRzN1dru;b0GYF_~beNP)d8{%=6?*-?+q`5Lab~5LWP$;fP(qkIW zsT163tFOlIn&ft-trm^-V|gnRb-lNR-^&Q_U;5H`y_V;$R~@BLT#2?Bm7o0$tkEj& z+%--`xK=htzl5!A`E*@4IIOUHKzeM*-4zVB;+gxY>AjWZ*2cR&LF3$FyVp>qO>MF3 z>wS6kW*QmVv~>vBS>{=iQ>bedQ1Mw>9J=jfGp%#aL0^Wmom$CuvefP_;=Uk7uqk;0&GI=McHC zjhx);t>hdFT2JrTF%LT@Bu1yJcJu5V73HgGcI=@jBs87KC3x@Do2Q6cYM^bBoT-XF z#;``V`B;jXs&pP6`Pykbzs<+P_+2x4oSP5P*kkj-!;$&`>Tuq ze{Crh>k~Y8y=wHE51MaPIuD7q8I^Hh17(~`>S@OLS;OKI%MPDai`5(!`SZXBEb`h_ z{j{-lOjf%!EcO#Ei@gS0J56#oXH^=MNnWG5m(9Jo&OLFlZPkrK z9mTIF;Ri!&?gUiz6%`8~YRK!a%y1Y*c{{OY81UVeu@+q8|G&Sq)|_;fdDps^uzfsY@_76UitC8U%t` z_qvOb{W(kL-4#TXW!#tlu;GX@=+cbxPf~SOe*BJ&2wuQdp%wW;^5iXoVry1X6nRkz z26+UZOP1yr`;%QoE2=>TImF?mP1+F*u3n&1Yh14H5d?}V@ua3y7kMP!r}6xh>J|9C zrcxD+qgASV83FzTmrC^-p1WRkl$5GO+l#ucW*2pjhCr}n@3FOokDMjN7(EN* z!GQ9s?56^y36*)Cy1BQq(lVBYBh;K0m76as=S3tqU9Qe!#e{{hmAWZoF0gWj{)!k=H^*#-(Gtzlx8b~@D@mtyQU3waoSIJa*P6q($KZ7m+xqr& zx2IKhRI6>3O|omMH8Tr88`@?^plT58x*4#FP&UJ$nMB!it{P~YooV?)WE3loW+_3Q zflp-fCfh|ZyiRPP*QKxWYeXhe9$fC%!M$k);J1%k2Cu8t>YBOG%WkYOF=xzZS{5F<{!Cv zq+xjTc*bzxvPG+ywLd%Rlw3oU`~uIyf5PD?X(C#GB~Uyvn?H}_?=+sDXnhU8*A%Uy zakQd!+7e?!ViKyl4T(__trBf6(JF`+hSSy(r~N!Er}>W%iD<2r1@v6t+!C!?7SNUE zbUVj`Zf;SaFUWO-rn3y1$pyKLs|JeJ|0P*KI~etmnPa@0x3YjP@<^&qn{i)v|(UCndXt41#~JUtE)ZMsiX(9VBB>uccxS_?Zo zz;G|2aBE?nk55!3fv3ZZT1i3wnW+#N8|r>bk8IX7o*x@Nj^Astp=j*EhCFNy$Cv$^ z#fJQaZD>5j2+(=UO%%z7-{iULRikG^nqHOTOQNmHZy7Q9bSdJIOE`#puhd08TT+CV zB8QxAY-9JxP^MdT^zifi)~P# zFx(J_TMt%Ba#COvx}+V@s^f5{Px9l8_Q?2-HM?yDd)$Md@%;Gi5&T}0??ht{zT;u* zvp$|=1nA7#~ctnx~k?*&4k#87c<8^cLy*eu7 z^AsC4`LshYLA)?>V-v}ZJ3ZiVbF3ye{6~ny+^F@GY|Bz*ZfH-*w&DlFgRh0C>b4r) z@ap3ALPFDggJu#<^SElDxpA}Q>ZRLwu`S{aSX{JgESJ;WcokNp*=>r+r(QW1FMP!+ zkf~q={3c`MbZ)zp^1V>Hm;OR>7d;+TNYWRbd+>o`ovh@$swdoo%px^R_a3@RNw*=b zC-W#**U>fRr>u<4jCI`;JwZ<2@fVQ9c<7{qUs>7 z8mO4>(-dC;@2TYbtmn!pb%1q&f6+py&;C>*CwBj_u2cdy-;qPDC{9ep0WpUWQ#dhQ z!sjPh>^uDl*(+Xv6oifJ*1Q z=$1kmSLZP?LYvdFsjQ5GO0G~!q<6ss@tT2DIa_!65@|CJ4>Fv=^^3(aT9wS>L{6XGk!4CN$)p+SCme1=#h@~NxUQ6 z?NmOjcakxHkF+j*oygI){-P~gDgO)U8cO@p+EOlL@xmB<*|a~L18=q?>5IHUws^-} zby3E19&#X&b*9{zO?Sm8rRW^&XKChQFFThur|PkGq@cl;Q)b_x3^nxhj2+VXHw3Y* zmj1`M(lQPcvsICODq;6D>i6vkp`{HtoM+CDQd+w}BuLBfK?>a9oi^e)DimXXAY>m?b zo|05Tso*j?uee&73I47NRE;Oe)R11x)&zhP1C}*C6 zq%xiRj9WSH9G#0_?1w}>yT60pCDoosebne()WcPBa5aGBdC%W$_D>kFzswhSIjZWD zyPWa`20q$4LGGq38E^k>PoiKxiG0;067HmhmH*ooy95v8B}=h2xne0nx!C&>J8@q% z5u+R)*5*zo@^hy3a3oo`@kq}5BIs$k?!BIQ?T6O^Is4#tpfr7C*U|fXr9DWX2gg1+ zEOLCKCbnrKOh37Cz)^wKXJeutc>ocw026Y4rbr3l`|ze)f-gWT-@^U-9bih){5{iH zKd6{l4Y$Q4hq*DLdKxs~7I}O@gR)m*s)kRS@x-Lm^7YEfqYKb35}+0ng8LtIJWsss zI%Lb-3gUaLMq%`meCaQ-FcE)EH?d+VoDgB>pe2bc zmXiJ2PQgkK+0wLVgc3x?)`;xUj`?EKkj^nM^O*6yU@s&~*U@?^lq<4wQ{a~@+3Yrh;9@BpJXB2jfe_RL`Xj6of!GJBG5HWR2e4X9zb``$@ibprYc1Bn8?N9=_9CX&={^Nl@b zNQ=h7oj8=qB?mY`F`YH!dm1@V!>xTRD~sG5+z)eVj>K$=_i%n0&o`c+6uolB&LiQ0|>nwTPb##c`ey=TBVS z;La0IWDS~0XMUQi20HT%lB(W-o+QNHNmXw|1w**6Hvm9~yPx2$7&Hq9cVJT0`xVq) zNmV~%4)eVRlh3&H#;gJv4c{t`xdr+N%}l}T0Q!i*}Z>M@8Ru;24)=YyRz?ejek z%zlPxN}fB?vy~G6FQBR+_x;oWc%2djqQr9s%_Jp$z*U1*-L`SqAoCkTd6D@|<{Pox zAl=DQBAvyZjqYTztB~&J6E(TDQ`itrk(d={QT?I=9tcO$8(0NMZzIAzit@;dV>);O zi9#U(-Jj24L^46xdf+$_j{XpPOKFA_Q}8C)UK_bLN8d$?5}*S>o4l59Ny}r`kt{bQ z%iZaLrhYsEmo9avZE5GoBSSIFL1z)e=yu0M3s;u4aWLUPwVA|i{N=T@F{pdCG2Z=_1nI%bHNP&E%0o1yXDHF1G8#I&1Ds$C9XwO-lr|=jne8r(I zaRh@n7<%Irw;seBNmg)7$F8o^irw+dfKy+#)YFqf-iH}^8BP38aSUV${z>-Os_mWJ z)*taw@PQ{K=c#6fgj`wt4$Mt*#pt#Hu_xs6gZO7`#1}ve|c@NP! z#&phn({W;L*(*;wzN@U3oZ2pS(aT~?O!>~e_P(&dJXO;-yh>?nY>{cj49KvVqj7&_ zx;~&qmdV^b&q6JSGYnvt_Rr}IFTC>$!-Jp(q+YOV)@+9H9R#5@&vE!e)n9KgL1`!0 z6Li`MVmyCoq!af_B5n%<>o4z~A|E+YrE=AbM)NpgxCao!y^PlkJ*|mrtDINEW664* zhV-FR57JU>IQ8p|tAYWpBr)?mX%O>N!ztRUg<6JFAa5mv?&JYOAhb5gGEd;@LgvdT zNCJO@s9+sftY_khm07z3Y8E7cwUu^YU*A&G$h#AS-A|3Y+r%Q+Cq~{<70O5f$Y#$_ zKR^@KjXVj1ZsgII;nwI?v_@}XeE6?XZQb}UG0n*HuPOss#Zf`+s$PMtt2~@|zJaV( zw3!vinmK=h@;Gc;4)>-EKT%Evb%n8`ub6M|!|T5tB0S6CMz@ZAt4t=;W>2`dDJd?C zD9^bx1ms&Tdo15Mg;8=Vdezu|leuHnnw4!^;%%E(ceKYS5*=?c_v1m4?)2{1s-}fa zWc_t`dDzr-2YKzPGhON|<4xmIQ#wB%e)}A(SmnF<1Gn>MSE=r3 z2zDV%R-~+&fM%0SR+P4s?L>?As^!G9gLf0sId{_xGd%>A zZPSV+QCsg2&+40mx0Am7HA@wL0dyXe3#uxm;|Q&B20K?SrP+_K7wY^EqJ+VxY16f|#d&PRF}8>g3p7(tE}9jEUioLYz)rO2Z^vCJ@^ zbFQ}!XXKIWBcjM7MB^|soX=tIo`)j;NODQUA5C%8RWkNN2K1BK^=3w*|2oh~eJzpt zMuTS3+CEw+cbkHq=(Uy1@}r77NOvN1Qmk#R>J+D0RTGO?;*H9W6&%d+<{R@ z&nT$9qL7|7hxxk(lhn3j;=Y%4te~#*y@f=73Rm`3|FJXe z_U&k2T#h?0&RAwR!aF*U>nGXK5yPDtT&}U-*DSD(O~i_O`fx1`X>rvAVsqBFt(dDq zknY)Uu%#Gt4tN1R*>@eR_Q90}VUfuOapoV6P<><;qF*U%XVs#LnnerGLf0a5GB;sT zm2t&V_fTa5$~Z_olyruN&{DVtqk{bxFi-0}IID6}5$wi?GIvm~lh7CPAR%CFD6H=E;s@o8d@n6Z!Y*%Y zW>oQ;0$!5fS~RyKsU}+NXzeu)Chk;iwt67U2`*t~FU`j>2V4mY&Dyp}Cno7HnRVIE z2zYY_(gG*^ORH z6V{!z5(d1N4wh02nZAbnjp_m#a``P*7tlQ3S#hJ%eF5!m%tzaPJCjC;#yYo)JPrbejJN zazFDr?`P_L_a3H;=Z2)A4MJaR^~a%(qT4C>!Ei$oLsj>(bHl5v{`V1@PB3UD(R3_V z4cd@YPP79W#X&~PuC8>PU1q0I5P>qpCt4L1yyq~ydhEeb9iIJICf5;Ozp5V3=N|n9 zm-PSB;A{puqZ7o8{CPu1>kWj~v$!w+VZ)*IfJNmx*RmPF>oiR=0QvX(K#Kj;qDl*n z+$R>*!g?&Kx6y=ki%P=awy5aq5woZ~-kfry(rr=Qg89_6s6^vvEvkQF1o%q`X;FQG zu)1$7Dw}#Piz<5ZIV>uVw|;`i_pN%#SFc6&Q*-kDXtc;zZBg0e(<~}Myf8ZL{iM@+ zJm7F!7@AJ=A0ZNpYG(5md73wH^U>1Hbw5X0iRrj)U!>g+I)vELn-TYFZxve%Fs!3(h|ty?Iob|bOm$jJ8$pWw z)M8r4T$I`;7Lz-Fw$ZJS4w|rTF-aKQ7889vViuFfGiPp8x-F)+VLml2Ceb)ri|IN> zfRV+tm$15TEGC=z~QzaG*iHT1kGaduPVcJ#hH5Ts$Su`S&t+8aN)Y6k&x(+6|};KmyoF5 zKAd4evX6+uf^cVUMK+P{^YjwV2guS(IG$@MtF{?G8Ctb*Mx4JC)miz&#LA5Z%_J+& z=Bj~KtwAWzM)V{h_D)E2Au1Tcz1{!-9qwBQ?zINZ!oeLF3Y1q+dxZkM#T@27gURbK ze}rJp7&Oyht}S5bTu6$oQw(~Qp+Is`MHmW%z< z`aH@*_|GOBeLg+fK@lDDDV3%3?3}|bP0jQa#+lX=MFRr^P3c4~(UdRr&hO37FZ6WL zOLMq4BAGz9;oqQ96Tbni_R}5fF9av=lO3z$%?pNBn1D<=D7gNibzQu-B zyT)?XuvpR(9vbN|sN=C+yvHOKIO?5*HisZSu3ShDWn#caEuuM( zI|a?c$jXnBtbBo)IE1Y9A3<6SH*>G`9=0dSP;iVxO&?`0AjXh~?Wm*pbpw7dRQYQO zoi6`^lYhwU(N)Urgr@Thnn{(ilB))){PRrov%^(<(dG**o$q`GLdbf=jzrdd_%%TGeyTp-&U~_O9KP<9`bG}ln`y$j`jjx}H^k}7a5u#7 zq;>N)#)pw479wU8Byl=nCB)Dr@s}`HOA@1wlEhzT*!_W!8-Xtxz^jXwj}e+aZ_rFi z;zzh@pd@a;Xv3Oqv90MoJfoWE>lX>|X~R{*S0r=kqMvm?dma+8c8hc)8^lAtD>>6U zU6$ykXL0Zw(ylIpc3;*(_P8T#YRd==q)`78Mtzi#uIj0U#UAgr(|Fj(+2*hNl;LIk zUh|YeG}bLlD|i(y@tUEM;x|XA+0kagsR&Nnn_gM!c_xJt9PnRE+^dac5WwP zB2mvgq`t@7LY!PdIKw%W54_Or5@VFWVHY;V-SpBSnP|?fFxg%7op=w&dbdq^#8*Z! z8AXpTF+DW9xH82tS0U|?lt<29wfs7_G+LB22z$$0>H^(fJYur`tgUmz-NX@(@$mjL z4aX4&_VP9N@-G6}`>6@>Yr&@WUSKp$h`Lhxj#*u0LP!{N!<@bhx0k<%*3B=%t{eZA zsVN=*sxo{;oWs_x>J>gR&chWPDttr@M=tM$ZkIQ%fa4L8A}l6(=h1qpxcar;#MsOU zW5I~Vj0@(|0ngU?1){q5jSS3TQ%vm-IQHF``w z((5|T6p4nA0D)gi74PVFxL=IzaK8D9}XZWyPzz=^vK)t;muE}s!fbH{aV+| z>gijU_jw9;n*jynbuJo|mEP)z&|v}Vw4gm6&e2FMM%}#hciM- z_Awd}QnvtP%kFhWNZo3{IC2Z~Ax50PxuRP+4-$DlV9-ojIYV4E(C#&eka`q7Nr=58 zq`rU(K_W}S{fGeoI@}Kt+z%Nv3kP>#gwzie)Ls!%&zZygtij}Um>(vXzh}@)gV|qL zNX>kML9a4GN-nCXBBb2OJhlBuX8L(HlU1eoJPf}X^4C;Ub-M=KduSckpCw#RGH51o zeF#?#TvuHj0N<<`j|3TTf(1enTAGCSvPxnwyQC ziRUicyYY8>AN}1_D3+FYI5N+j7t!E~1P?F?^t^D5A}^fD+=S~`%Lw-c^eBlwUGGAT z`b8d9Cw#a(aE~&z^d6k1fKMK{ucK+$Ja99s3FDCq?(@WQgi+R&V?j83$0zXYza(}3 z<<9O80F%yq!tw7_Dw#Yvsz*1VSUJI`>(fw(dJz!2V?N)YF~hH5s{5&OB`kwU_la_? zE7RJ<^Q)Argh5xXf_=iQvoFx1{Y}_)=0C#lm21@rj=rI40Xn3Rtv=Uj#gB$Ns)dAB z*I}zujFNoO#nNMhuK5Pdq*$8ARRh)Phn+8G$t(r*PDUceM{eZQgzu7HSi(mb6CCXn z6A#2uaFlu;jqjvrsSI$Om$M$D7M&ud8Ao&l>IlzsmC{Iji=>%&ITY1$$pQSSeo;cJ zwZ2Iz;kKD6lX(_CWjh7vk)AMEp3K8N9+Oi2UB>;@)`CR7?_)5KjD}{lw2814DSB)r zC&2Sx8ag+9k+^9iPt6~SaNKlYM_6-5cr}o{pDL{@1q<&JrBzoltM}1_^&O#vL04Mz zWw;&TF#e5G}i9d^);oXTm0KD4KEo;$-wF?FfGX3Dq(M-wIBzQCCA z2hnmq8(>2hK3^gvK4j2L3ZDnKYM?4Rm$gJXS4#GhhRGL12uL?S`;_O<5F1apK$%VV zBsszt);O-<`svO~dFkD{=AMXk zCW^_{mU1B*Pv*o;3#aX`J=o{)WWciC7Y-Heg`CWV-~`gGq(7=(;@iUPr7H>d;T;-Q z9n)RL?fm&mYGN9KRfOkDd~yPHyu_C^n1Vd8vZru}c!^IbNiX=lJlVj3r_cIr29t2( zVQqBmRRxH4Iru;yUr>hxzF*r|e#X6`huE}+vn`d7m zHM5br4{#XC_wbagR`20CJdUR|HO1Oj!S_Y0zg(Ln)!EsM!DpSnFYcm1SsGJX#;cTK0Cs9N z&KDdf_~|flf~T4RZFzu9tJ{Y6cMK$yj4}KcEzDC>S-z2hd(IQ z{^ZG5PM#c#HQ*_&hGnsa&07{OZf%%H-ykC{eY3i4!|E-IF3qi2TFRtXB+|Q5mt1i1 zMQaze?H)Mqyerz5o?hO(I`NkEt5y|7GhDu)W?o}8OrCtz4 zENodSTH}VV^>xdlB`x;X#Ug!e<V03Q-8UbN_MwfV~ADPA})d$3qX#wez*1 zV!Qo%7%;KjT0g`wi<=iV%!@Uw5-W;6&^J4XfQ(NEIl>{+R-I~csxN&)79Z1sD>o&} z-RXfQES{z`(M|n`pK&e%sZZ40)pc62I}XuccQ2>wc#p5Wldhlx5#YpBzFQx3djl4g z0@R~*v79c!aab?vxX12vu|J!j)oHI*`kwx4$R+xC-BE19CMhRkYw+|Tl33;O3}P%< zO!oDs^BRQQGMn#8WVvm+6koH|t3q$yg*zTI)_{#9q0ehUS(=pdXZ4pm@f6+sY`!<& zRNSRxi0FoAk;stWF@O53kT~D?x-`-wX?U7FXy`3yYkt5 zfhKrz^TOr@OS-B-qY)j|R`Y-Q7_JeV9K_>Uh+icw2Z?ii*47HJX4;^Tp3KEB+EP6; z!a-=HI~BwHkVvO%5sY~3_Dd;T4RmsnjuI)8Enr3l?G8fQ0)$6W3%|WP*^|zt$-1sW zRRi6K#JAfU0LKa?KeWCy4Y385269DJ^@K{jFb#9+1d(6K*DQpiK1XK`8p68UpUl;^Yl^lOct$ z@EWq}JJRCL|6EH7*y&01rL%iR9m728zCiJcd~a^_vD}$PcmNoc))k@7NBbXT%H-vfhzKp%NjZ=wPB6|OHROJ%)pkX_ED zVI?4E>nPy)A|5NYhC^$5(n)10JB1sh*$ByHYha{7O7F_Y0Q#;|^mbLGBHAYkN~duw7hFdjoTC>n2c72%3Ja!w_oh>L6?2M#_QL~APYD#u^yv-L^* z3nj|68hQ}xC0vZy@{za0L6ru02ogDK18XVxO=-k-TYH3!jv6s(#M*dnNI^^WCwi0Z z$d-wIJxzV5)u~$c=V9{iF>N=$zmVRQKz-3nbyLb0jr&OFdh%5rkWFjc16Af73ZvFW zv2-;QlG#191H>j-!}6J1$zI0)5PWBQ{YW6w-%c|+mOw623jZs@@wi#^7TZLC<_--3SUQa%@4eJ0;fS2`Kbr@Oo2cqP2Z zA%ER)Kc=(ArsV<_lvho@N;&`!c+n1c(S-Ck;6-aV;6Swg(5iXa~G#2fS#u zVNh)Z;v7l2E)RIo4tUXoBmRIF&E6F|_M*bu&8CO_Gk>V^3DUPp3ppz*Pw4?K8t^hw z*gfDyb26RyJW{wm;6;; zot!!)^Hs#J?ah1*W#wRsl^Du=9iOk_R0|K`lZsRPmLB=0g68IAo1|J{oB%nTe%^ULfJ|IpBx$0#093okufje+X~A~s6B z!&Gtn9CQ49;*KFJ>hGiC4(}cGj~1?ZIl?s^uvey#hm*o8;XED6+=}`(3g+;S3?uzm zITTen0uz5xq7fjgYD7eaI)__#hz0Lypl0SqbYHYUr?JF0&KWuJPry_TDdx+CuH+Dh z1XGyqL6zxU;vBzS{{OlsHUOv@&6y=6Lbp$j@gm9fd(Q04Ffu22?`L?_vgrG#P9jO9bb znkQ_4>-+JjS$a3p=2xa8A}~+Kbn>gp*fbbwT6eh*@q8B30jc~2UBfKk$braqD1QUY z=88mm^;Lfnk#za?-F?JMhar+RU&N`aqa|}lSE+qhx|kNcd1yOgUJ{*I0)!+J8cwhl z1Fw_HRKQcj3g9yj{5(z8Z0|{D0Uy@YQS=Gp6q5xy7Xg8(!){P~N+B^|{|OGAL5m8E zlj{W^X48G?($M=>7C;Quh7bHGMQh0)ADt$xupl~RZ9jeT-gV&P%#isr}i0#X9 z%-T@pNUF&bKurXvAut@PZKyI4-^bs)pam$Mj)!Pm-P1R!`%|s%u}~Alu{&|_kWQ9* zcnqxi`KeN0cK#69Injwl)Llvqt(#am0c_dVZm&)ofc9cPG0EP_VZ}W;I*LuDdsA8b zA1r)uHctX@YOxOoO6_kcV_6r0sKfbh@n^d@nP$|U(3MJHKA^o=Zoo355UqEX`!U3H z%nrwiz`qa!d%-~YEab{prV675_D*8a2SaFEn3tXL=m%1#qCN+>srLIrCGj(g~{pHF` ztu7ssa^=d{&caY?HSSBLl3hFFX>jpS>axnza?bh1KxL*BO>wj<0`53iFLizO*I37? zTgx={9&3!sq-44~QH&=FJ(zUnSiCTvC~}UcbT`j|bsc^oos`I&4|R+`mgAp9=J$v2 zAHT*wiOjQ8`H!dYPa^XuBIHr+U+_;NGwV41V>Q1Lt!FH!L#6|YnA7b>QbGM_}nF;pBy#cV20p`wL~W-8jKSWd+TD%Mf4 zor-N#q^L+zQKq6m#XG3Dnu_bGs8GSi1ltddWLC_k;{D@LTu;TDK*Y>(RP<9pq|Lks zuEI0mU;^JV8T$k&3J7 z&$m)>2NkzbvHc7b+o>xF$UHj8{5ibBGst{1m?56o%ltCPyn-2mMFyEi_A-AAGH(oK?nKQ&rup8? z$G8=ddXUMCu|U&7Chs7Vc96-6IfI&mnY*|?5ps};xR(hy$iy3D!l4IHWG@qJkclW`_HScs%v7ZPMDElHLj z$IvI1Ag9tNmLQAh6HAbD=o3qj_4J7)$Yu12B}gxQVhK{BPb@*+PM=tUyq7+)1o<$1 zVhM6LePRjnf9MlSkT20EmLUI^KCuM(A$?*A@=N-}666o`i6zLmvG~Li@(SPb@*Q^ob?N9{R)*#1dpL zi4m3{N7@o(9evs{9>pb8uq^p8eL9U~Nt}uj6}zZl`Enn9B3+XC0~Pm?xcMX%uTt?> zDw?rH%`Bo~4;5EZLDD7jUXmu)la#oPKCy855q)Ce@)Ajy>!zc4Hx=U#MKOVjf1%<5 zDp>Svwnfi(=+gxxr&d$JLMTC!=msioq~cf-N5@mag6Z@0i3C&TmsBKXq3ELGPAWb^ z#qr0WIEsq#H0PUWy3bMZ6DnAI9djH$okG&=R4VSL;xkmRNIRUGJ$oXGQ|J>5w@2vH zUi$7mR6N~);>Yyq=#x+!L&c?3Y@y=kRQ!?(7Kgj2GK<3x(kB*&&(Wu^&qwhhePY45 zgQVjXRJ@gnzk4%^i>de)72l*Hdn$?^Dp-L2H+_2RY!thw`2HLe|3SspMiduQaV-@U zD$Y0!#aUE*jf$^R@fsCl=AqaaM{yw)w@`5_6?2?-l8UX1 zP&`GSe!Bq0uc)}T8O6J(n7I(eR4P71#Sj$@)Z%z5So~i`pRT6j?Noe`ibtq;xP?AZ z@n03h zHLFmppn@J;%XCsPfnYm`if@v$h;Aik-f|v_om3opK8i_He1M7@s5p`89Ye+4RNO%Y zJDTX?XXZ%48h`3L7@t_KoiqWTSW1;hJdmU*SEe~PNn{UHrcul{oBgn~#W%Daw(5!P zf%6;M!11@(RP}Y{v-ZA=zdXYArCocH*5f2=RBkj=>mOc?LW$fcN4ooxzl^C&#%8?> zmzHQtQ<;K`OIfk~fp2KS3iLKh&hZ1_HN-D`1%FwI483r+WM#P@!L4+|0iFd9sq`OA(r2jED$BYXt+BC#}nV@YMQ*2l3~J^7Xxw;FDuxtfOqL| zWe-U+yArsQjNfJ#W5s-|h-x_B#uL0DkK?ljJS)Cvb&RsOghz{om zaxR4|=OMjPv4u?wV)Vhj03EYKkQFOO*P)Hgx-u`Tcw?>7xG>#2CEQBgNg=u2r<=y6Zc~=l#Xp0*LFY7A@ITR4>jkQx%`Z?H? zI?Vu4!r`bmDpVUARd<-9>b4+M(SAP^s_t;2iW~(xs_=6#s`iPjm)UIh$=EjOK5tIC zM}kO4ZkaHo)Ak2r(Aa=dVV1H)aF`}GUY;?>%XfnCLe8f!cv=6LlcmXPrL#1CKETrQ z;$_S>+icSP&YX0=4I&+R2E&j}W9hTd_yDD>98VsUntp-t=57kA`ff+ab6Yp1K68Ll z&dq4`nwo1)sZ)a}MV|G#DYYJr53DJlHMP>5Qf)z$qVtZrDYXNQ4^Ya7QtjrH`nw=X z(RozelzIe>4JZ|AZy;^2P;G1teuX(^27)j{CuU(VvwqfC$JUFE+H~U!KL;CM(Yfv< z9;55fM)FPONPd41lIbuq43af7>1j0nUxL&7%yIh9K{%yj-MVqQ6OI3u;Pe~jIQ?1> zPU(QWZk+zk45xLUK*^a*|(0b#I$ZJ6u zqkxOLF*Xj34KUWMTzj=nNh!f>oDWEwTOH@4b+okk>UeW39fPXA+cgS2sT)fa#G-5E zB_>+=j9{!G!hFf%=B4xKT_rvzYH30)YzO{^)rXDACFYoH3Bn|W>(q_O+tJv7--dJ0 zAQ$Oyy0G!K*&J^hgYZV7MRntCJsKO}EsX0?;welM8!vt4c*z9eg+i&q;AMTnX)sd^ zmcBIcbFjf&hgg#Ms-vZiwn1~WT@!>hiaQH~Hq8XC##)aF*7m*Pywe}7L|{ZA0a zC_1)ojQx6l!Puc2j5h#NQPtP9y#c|(bz`i6#`^`2HJW2=b`ZuWvbt`J^`P;7fw5KQ z7&|uzV-#&(H^$CK{z^@x)FCcQ?0As`297=n3Sbf-*?Um-3+Z}{C zy0I|QnA`Vu+0Et{yD3+1 zUi?+*5b4?GWM!tEkIcH$%vYU*cwOAw#dX`xHeCPSf_M3FTH3Q`S!_N%YBRr3&LNN9 ze0ou3zR1Fa=X(YcxOiRSH&nd8L7J$wgcR}5`2Kn-G zuzIo4(R4oUMAMbqoz|u027WjO?+7)}BQ|vD+fF#v-K1WG{((7Y&kPT=)Ew)s@hpo! zLIAj|Hh?D=`sw{vewN!G*x#E2`%+ZE9#aRf=lB3y{W6pj}WknnwtHA z-C+*wWl;fp!pHy{M<|a!umk46mZAdoO(O*t??w zHa23ww)zA66?0&}6cw;1jS#SlgVyYi&4K-4RKPaW0qmL8iq*0VPnN1DzPKq+9{)M;lfqj2e zz|I{pU|alwz1JMrPelc6V;#Vnt=hotz?0_S{%cg=o>m9AW~(;9LjIXKus?|k*m-pT z>*1ha52HWl{?#11KSu>!ybkE*R@)JofdJ>r(VLBJq$5x@5*w*0D%eW?bZa(;ttl$l z=0^ov(jT^U=CGX~6>JNlf^DZiY)Nz2I-`QEIV#wS{;*wb4%=I!f^A_Puq~*TC7cv7 zPB#PnLHwXOh&M+C;-ZK^#3MfGZb}d958`LcLA)<25Es`0;=F1q7Q5q_fdIkzZ|2~A zJu2{8>i}Hu|JHK=&tFHVoq#X0wWyeFFZ#6cG#-i#lOa^Tkr=sNI0K4x*a}bY@5X5>6qncbC;4@!p z4r1#Y6~q8f`4)2!H|=8(msc-TJeQhH#_4s{xJ;!U$LquC086mX9Og`PFt6Wg=SmI{ z##obe1H9z#Hiz+D5yE(Cq%Z~?MBi=>wD{g z(PK+0toY^tGyY_AAY%~%xvL%^&#uL`Qg@2iHB6M}S>{kLixBDu>w&s9X#=(|mzV>& zH9{cY5iO7b2K-yhfy_k+-{k}Pn-;EH+C!z&1z^473Igr1N5Xe`e1v0>>op!OY2{aj1qcVXa z1~S0Tn{5u{DG>ts=SV5JFu=}hGY4{cgh2i^S|9@~p6%v9ZhPYb8DR00&4DaL2;^k@ zesc)NPfgo(VSvSRy*ZGT2!WguEsy~g&pqZqemp`Tr$-B9fW`BKIgnqB5Xc$P0vTZO z{Ky>0XCnmi@MwVyuy|fE2lC|zfjlBwAOkF(8J8GaJkwD%DvPHzS|9@~p3}^MoD(6C zZIJ@GD8S-bWe()I5dyg~S|9@~o_2E}|L%rhvBh%~szzn;+!QS(11z3J z=0GlZ!veWDz~WhN4&>ShfxIhHN-hqtczVr&?2Zt~k2`=&R;JjQYmMa>~U}R zybqG{19jk}IktFz0q>W@qO2oA3MPJ$|wO)h{gE#{Rk6tr}JJ<*ZUH>PC@Ro;z4H z3Qm>iw)cv6{G;9r-Z6K`RF*8mF$=_VZ-W>Gs%k}(=-y2T+=lUORkN}|0-Fm)HTFI2 zclQT=>hRMyvf1p-r{&>yUi=jNede7PKkL!WH$6J!Zn{pEG1o4!Kki|v+<}?`MX)_O zV&xTgSg~zW%{w+gz#{jlMGK1OZZ2qwWq~I=_v=d4e;O=0weTgc6c$WUVsVC+tJ*26 zrXbY8nn^5TE)vgiH`_`XzwqcV-A()4Az9D_Zv&j2gWzlB5UimGKXQ?jR9&@IL$|V~ zWqa->P1T7v*YD&3^qrQIw`|o03JpCHSFjK49mr-g&*#nOGf)qwPGzWF)rN;Nnal%u zGxwokPG28{M!)K3!G7qd8@&1C0fb3ljot}V(Y-+aKKMHTe|N**JwVk!$uO%5mK8Je z=pp(+haRTm^e8<>kIxN20wJ`f>%x9z$dWN(u{- zS}^qIGip^S6Tq0w=HNf}X5}szazQl<8j;H;A-c>ys4C_{)>!6uqbx6)G>soO1u;g9q!6ZdlBeqRUX}Luu1hp_P>iKjR?mMTK zi1?8xfR@xBZ9{!y<{p(_@Tfwc6I9cH>a8uQUTR78R zq}rg`q^5z@0nxwi*tVJ}Yib6pPqn6IKrw8hgMrAXdgd92ShkYk)<=03%m&F=hHhkv z3PgaIMPgd`Rh49PLx(?9Wpz>Irr;y%mxC}bFSRl+?#^c9t*ymqOY+QCC5MW7}cZtW&w1Q6suq%<9C> zSv3M}mhT~ftm&j+OCHNOjwKbOYVbfU?f&B&d%Pp?382dTokn{U(liRaVss3PBw6Km*6NO zP|$0GEF(;bSck$`vWOK3QhI!y^f+I4wdIQWn(d`g5s#q zF6W?or#PCOE2&^^a$t!J@Hfm`vhSg3<+3a~r?TSM)G(npNGwpRTCvnXSie@56eYrq z@Ca$R$;D=U3dG6T*Or{Pss$P%Ph=-Uu6nR9LZTs|23CYBNmiha6VhaaBoTfn2*<*t zuWFbmXJ`K^*_p~tq{9v*)RmnnX`&-Ln1*Oh(o!r;l(TbSb?l&ZO^2OMW}3^+bZ2&$ zsZX69EEs3!1FL2yCC!>npjp$MH4E5T2hGAnIXic+nw^=nWM`(UW=%^ooiq#B!SK*l zr_{vH2zD~7X6IyD>@+s+!s-gEJT0BN5qKn6t~l<@f2F>54Pp$W=nZW$r3f%p`A@~6tzMk zRB#iwK^M}HpU?swZp%r_Ub8ftmIZ=@8uY8#KF@ZsK$u4A76=pNnsuZtJFP7ce48Ra zO$-UW5t;=I#W)f%g!Hf?#aK#3v;1T^PeW2|l7xeIP6tXXp5;*_lp@o#_PZOm|@i!&7Hx zTCg+LmYsGMD7CTaY_@rHD(p+d0>#ItB1S~NFr6q%DOsTC81>$^JhihxDUHHrVFbk% zgvCs=(4h!NokwAqMwFkFEKoQKJJFV%683y9TsnXDTBuaSF(r*GXW`eVDe#liNLkTv zvK^Ld?A(R<-1T3&p8GINlb?n^Tys7=b@uYZ*+=B;_qN$W@3H_ytVG*eUYh2P2$xDh>#u-#vwHiq1t1LxlPJ`Ew0HGyo&zQr_wuL+I z!@V9#LE>BuoFoqM+QtH`{=`)Ru-TE?4qij3qEoxJOgYS4TbMzuUg!a4yjF=`FmKgx zsihezi9^NL5b9cMHIgxhJKh%VoL{SRYlgc(ZZ+dvh~vc95a%y)^-Wx*ae^^N4sfC^ zK-`c4S{gB4J!WUAuwTY@OxQ6KTQ&qyjoPW;HH7)l8exX{a1qcq{Crgq+a8`A?^>Y8h4mH=FQPgwMEO?ZPqeLXRlri!Ir_6I{7T@ z7swGuDyr}fZIfE`7vQ8NMT4ClImLusUpB11K$S|cD@B53T>=}h3PdWIurX@MFc%sK z7-Ef*q?n}${+MS7|0;){Vre)f(`_mF2uk~9SPH*%e){oqmqJe3%_U7si^Nn*s*=}; zRDg{mND{JTS&o8Sv{@`4_7j|5ET|DK;=Umn!lbRe7@UKdwj8jjnrr8!ho6YFRk*S! znq*e>izKHOgGRXoJAWi!{4Ap3irgXr!LbUOVWD_H<0Oqww%Rl>U==Ym!a?X0;(v?_ zLwd#FJe+LH18d2+EJSQUqB>wZ1$F4oK>KC26M`Ww1hokMm}f}AIZnY^vge>@+k$58 z*|kfTuPm-&{s8K{#3Y^+rNzm1Xa_9Ss4Yfk3PPU{=ZCxD%6^n`@y`aMbF(4{ZPW~n>@qQVTSJY9EIIhIn#m7GiDA=Va~UGsvX!* ziERvR>FI~)xoA#oqbS=Sx;dB|kL+Zm1K6YZ7w;)x> z#@lXdwF`-p0f;LFh(mW*p2i>8#7U1$(yTu8PzvN3Su`sMSN1r_{NsCqAHr8Hcil$n=pD>-cjaGM)XKZ? zBMiZ2EGWktE2@tnSZjm*@hqa)msxoqQt4(C?7C-`V9b-jHVgJ`!fxrD*q~<#o0KG~DCMaH zrHo4p>;bCq0yEw1x3OdqCG&LhO)gXN0pG%m# z1Lf)}(zd&D8GeASYw*LhCny1*h;2-%auedtJzGiY6q^e*$``FldViio4O^yY?E6+u~s(cy~^Z{>)#0_D8 z1|lSc{ksr#b+BQ@yYgy+uVS#<+dUK~4FT=0s0mUn`%!)AWs;XSiY>&b3i0AJAL~ke zpO~c^b=kAf_isaL-3W~f2dsQo-cEogVCgLuwQC9c7ZuG3rr4kj^WQ`%-(7VnVcog% z{neH-QC)r`L8^Zaai9QxUA9lv-GoNZo7;$@@~HpK!!43`w{uHpNoAO#z#|lqLvHx> zL;ly?5Ywac^!R+NVT>Lu44cKcZ<0n4o1(7W#RHe{&z&OeAD`j1^= ziR$0Ksk@K{P3K;S8gDx9ZEQL>VUL{;75o>G(^!I>;_3kFL=~QCjPC<#i~?LEi&79) zK|{nwuEf+iR&(2~3Zm>I`BN^L( zD73N1D!&W^1w1xA;St`^YcXlWl5Xh_$A&{y^G`m8qm==7SkzY0o7>>-CCkujwdK%P z&fk*R3F{ZU$}7NMg03bWu!IBBk7L7YiEbyGAe(oG{K*D5 z|Kq_6ES=$D&1wx^w)i>0KwDpc*WuvRF*SJGY8wR^kD+6zwI&Bg>@7%dpYH>6^K9Zl#^H|4Pr^fX!3V+7cmR*bmQ0uh zAd5tUhSeRWaG06D_Pe8GSp}}3RdTG*x4%g8P8qV>798t@7$#Aw;4_5l`UDYqb$6Sp z*Bl!Tbb;vrM&WF(1B?3i!8!kUfJ{u&Fl7oxRwE{GjKwU#ndKto7F5|uYW zklby4x-IgL2Q+-_?!fX}KoSkkmwN72P0`B^oY@7oi*QB2M(9+yx0|G3m_<0e4=YKq zB2>URwRv{{ny!+H{0yl@oPaK=%N`wYx54thA%|Y>Mx1EgT6C&4SqL4F$~^EuFB&^c za69t>W_1gzKJ=pwTwMUMc7VdbehE4HC6f@)wndelO~bTgSg*kWCjbdbxtS{i z(-U_D@W90cu!xIm@*p%pO#fUP-lwn|Pq;xouwMn^Km}uhMX2#Da20`g1qmHRr2@gx z%OHoET2*cD(H%$KZ8cI0Edb&fL7%(=#Ye?(_wdyL@V2tGTX1$xXS+l^cNfNF1%Q|` zOi#h_X_)kaOB+Z{Iy^oNlx{Oig@)wOCrthbPrmaSw+G^^^@gXzC zS4O;zVgVL9NHq_K`Yrnw6oC>rM7-kef(1QgK_*p2)nvFK1g^utt2FBFXs{>&@~V}5 zleXga5q;5v&a*q{TN6-WkVX|QFaZ6qW&db0LpR!Z=LNg7gI=U3=#y}*!4jqPlk_F} z8hzPucgEuSmv-OZH;2Nn=y(Xa*Vz~zevAEze>MJ|B`-}euw^m{tNvn{Rw@K{=71{0UD@&batV$ z6P<(T+>K5SofGIhfX@BsTtep}I*+4s4V?lyPoq;qr;5%C=sb(guc7k^bbbdN51lWd z^Ex_TLFW(Ac@v$lqw_6v{tBJ%q4W3X{0N^<>ol#e3wAC49bw*d6QB`L&)fq)~Mo*nlQ)jf)86|Z_N1aho zXEf9+NWlt&zrvueFxV>$@(P2y;?TVa@Qd{KL8!h0LiHvH)we*Xz6V0}Bl>gtGbT~= zeP5hLuzr|0?Zqc1PDk*GiPIE5F>yMBPfVO1#V00CPvR33r!qb ziHXwzd}87>hEGhKX7P!M(|LSi;)H9FmES}OVNXo3K8JoxuyB^!7c3my`+|i7PG7Ka zpu+@9f{@$XVdzy93PeAEE7eZbhnRNquvNPDZ*L>c$q94Hm#!He_w*y z?V`1RlpN}p(}H@q2dD}9P+2shG;r@GaxIat_?$I9L zCac>nI=f+W;*Q1tr3Lobx`CbQT(kRepb3X#^ z4d{&Rv&pf2IxTG3w6NKov3)f;wm(h_TP`hZq%*efB**r*X<-{r3)@0xY(Ghk?Z;_h zn@9_r)frp=VB-GGMu?h9lRw!5w((|L5}wNM4Ds&d5cj7AajFN1xn_v|DONbv-x=Zk z$q}AR3*mGR2wPPmyB!}->vx8DEjh$1X+fOn0pf|~O7suncZOF@4zH3Hypuh^Yayfl zvH9u6T4#ixNRIGhX(62L0b#2OWXJ0}!+SkByw}o#cV7?iPBzPDbi)9iyYCG2>&b!s z>DqwCmj6$OSc$tuEcCOTZ(CHopgBd@_GpxGOW&Th=lqY&!#~^mRS*6*Rz=)O8f>}5 K%>-~U%l`v&koD03 diff --git a/en/.doctrees/pseudonyms.doctree b/en/.doctrees/pseudonyms.doctree index c3910f937233e47236803fda91aaab80cd65539a..c0fa3c542208d6138bae121c549f575ae01499bf 100644 GIT binary patch delta 5210 zcmb`LYiv|S6vvsNTee_YVQU3i_R-xw>4Uc0(g&rKwkWiLN~LI_LfhSP_qul5?k@Pk zQUlQ@HL08>F=?VAK@BgXjR6!~N$qeQn!x2^5*w{^$z`y6?B<~7S2>y|FAwKvz~-e0}AvD_^AeBIvi z{QUJDUZ20SGjE;CC;8j+T%LT7%VA&Nkt?;ix^umbTzP{pcYQ~`qqnWomm75~Px3wH z4oH()1Jb=41DVo{*1%xAr`y>T1oa^)&?Y6b@mbZ{;J`V2Up-$d#lWzG@u5%d&U4TtH32~v{$K0eZ=iBg7q01^w9l5;qkbq2dx7e2D; z_1r{%yL^`QX7vX!V;!6;NQRRI+2mV{Gm3GOZ;OMH!a{NtCl-nm?-D1z#|cQWxW1Y4 zhj6&Cmi(irguLHEcOmaVqY3B^YKwBn6tI+94Wi0arg973C~7J^h||U7BY^1YIrdUw zQ=lPr%fyH}4BPwT`DKx-A-i}csfps^UM5@xmI`Y^B@&Y4a`s@p=fhqWaTbmjXOosF zansqEFYAL{ERwTswIVT^U2^ zZ$`GT_$kWbADZhR+oISvGFO{nW$BiLy%?D!?_v)Yu@A14&YpIF{ZT*9FQv)hQOGQ7 zVyp3VSpm5K`^sjLFA=K$JQ#dl$xqx~8-t#~{?t>!Nhg8|r`aQ1uEAC$YPvKfwcH_~Yb}&0BZcyiI_c)#iK;SkD z$2swEjYoC*OGP@#fT{DWiDJ6x%!w@q`j;C~J)E;8Mp@OUq``UFWPTJ<1|wCBk>Wy$ zSz^Fbsj%Zd4d!GVo1;%*GAwErOFl>cW^i~XTNVSnTWQtr2zG3S? z{1&nSjfRWOhjK!(%~pzSU_mC?f)j6h({q_OA2e6F##cu`boCom&E#cXefSRbf-&_y zQPhi=`Y`;oz&XA;0-~$;RWBl+@ajkJP@g-dej$o_8B;$BoeNiFjeE*5fOG7|%9QuR zj|&&x9h}W>g79rnQd1oJD-)OZKu?Wj@_u$g%6nMjg`Ub;lViOee{Y8~z^;vBHLJ*B zFx57YQzP!$`^l6Ux(O2o|o?hs$GmLyzH=U3JBUctpov24lYe3#J60^iZ8s0?c zPHYq{G_keKL{|%x zhdD~7MhaYGnDqk28^OS)cJ(#I1^KGoM27^*3lWMrTir}4d^Af3Cp(OEmwyPF8trF)>e(?tIi2sgt7cFN~zF@czdbtXDZ zkJTDJTod$>!xb*BQ{NoKWJ)HQBVe*PjCqbWJ9fHAVAO;e{Vr{b@}0{>*9wT%Faqzs zLM=Aj?nHQB&Y({UoDDpuNDJq>#{ff49lZ8vDh&v%7kQRl3(M`Up!)>IZk|!B#;EpX zK>K4hdR$<9!ZS+L82F)rIrX{qu(-=ae-Ky~dDdJt7W%PzZ1it|@fXi1RbvGGl+&a* zzIqLDk?J*GT-^^Av|MSE|{m_SMsug!pY-{8qoZ3%ef+B~GXOGY-CAVWjT}ytg=>xk}9s cZnfQCMNbKg6AHt8=SOn*W4un`!l=LXU(LlSAOHXW delta 4868 zcma)tOULFOas9-{%l0Yc3vRrwHuwqS3SUO1p zj{P>LYzS$lsS(PQ80|HpPL5h;*655)zQ)EZF?E{$Y0ByR?y}3du(bD|bK&0e`+UFW z_xtTR_l`a!7eJFG^{5pLQvN2u^IUZNcV4zn-- zR_oK`G(L?ziMQ!3yu=o&n2F9B;S{|ayTkR8E5@OKKdj+!*BVDIVO*p%ZpMT-C`+=E z8#vJ_oj6lE@gqjSp>#~Ia>WQo;pe1$@=#P6^L`)Qjd^z)4MKNNlbk>v<3x>AC77z* zhp&@Mt%EpSy7+N`Z}k-^=_Cw-)4Z9}28^r2XDK^k*|Z4B_>>xV1a~R6+FN*wYnKaC zMpaXhqLo?;qxY==P*NTV2d#lYi5ML!ETk8@A`5(zI-i_^JE?JGrH|mbbn0?%u*wq* zT{*l-S>tSIu(!Fo$U>LX5hcVU*;`nYHG3m9QIj5O;a*z7)aeSL?tG`KHa(fVfLgPjKx>{RszWJB6UB>7 z^g(V6+3sTv3#qRPb|+2b6jCsnrqSTfH}L zDLKxn4^L80^Qxcmp`Jn2hhgX9)v;6Vb`)TDgyB9u54YGuz~$%7cF(3Kg6C8y%TH0> zqT)gy?9JEDI7D|!p^px&us3JH3}tJxbL&RCiyj}h@+-&@$X-%JP7J-iWEmkdhkjg| zLdd|7dRcIQ3InTLLf?>~u$knEM3EItyF{3ULmLh)IMkxv1|0U_up5V?I2^{|Dh^lR zTG4M&h}kV5qEig-6hk}3uud_gQ@A?xXk{%a62xTm{ial3NM zV$Zo{vHrpp9EM?F)nD|d*I%4V_nh0suW;KHa4FZI68ErB!3q0Hcyb+%mPDKI4DAYR zsBf~n3YEBHwJOBli{#|}r^KjjqxUE6JpG%rQ1Fbv?U(R@@^vt~YL2Cc26c_sfNFUp zXmdIM zUC7;*U~Wn=aC5akLuN3qF>?P(D1S>Se7GDl9hF81S!>|Jlx%6W@Tk(_P7WU-7sHhs zIEw_ch`}t7hcUs!ay?fl!7O7ik#aHDp4D@938sd@=;UI~uhVlcOE52vW1zaiU!k6?*P%31$B{h1bh7vxFOxAU?pF!s7cVB< z?+>Z4dNCoOw;Mg%$YXDCC?6%q115CcdOZn8ih67_nme7oS0=h!79OnkUzWxy6BKMP zk`$I=WhlH^u9?&tJz2$KidamHT#Rv}p479LO)Mr>E@pPEp1jIpI#^7c91P}WWPt+y zERQ6;Eb0J@ikE}JVvXAMQ92!TZ;$w8P~G;q1WOkQI#I~fdYY4pFI8=L7yyG;cn zjXKiLlHO%Ve2N@H-A)Z0Xfn}H5~k9}Sxl-N46f^C>S#x^j$CF@Kd`7YIVf~gvBg9l zu$WO6lP(8iZn1G{HG9k}A=v3T<}>6V)LU~oqXfY-2%8+l#a0a{S`A#b1Y=_`nes3x z+*%2uj6sMW&Hi5L2HP^Y773z>L1fEu(d|s*_DB%)E8m;a965-FZ5r6rp1{2?!MukU Se)4;-=N&s=L_^T_s{a78-npp& diff --git a/en/.doctrees/relying-party-solution.doctree b/en/.doctrees/relying-party-solution.doctree index 52dc9cfbdf284a6158a9473d95b7b7a14c2ab5de..be7a11daaee26cdb4795186aef68010ee828948c 100644 GIT binary patch literal 145877 zcmeFa31D1Tc`xqRv12Q7VkaR1LXwFb5=Zfj_RS;#d6!pNl5NFqkgjI#Xl68Ov_(KbnQg+HxD0G4L-#%z*d9QtKp)CL3ceZ=aojdoQ zk;je+rp@)}-m`t{`ObH~^PLy1fA!imSFEA`)vhZSQ|bJsHc$aRQITMS;9-5hM`{s*YhyPyx%@_UZO6sbIR#Ka4S5DgJsMnCvFIk~c)ix9@ z456};x~4p9)!M8|rIennRsaGGd0jeD#_(!a#j{qqjFqiu#@S0x{@yB%dt|qvQoP;o6g%Sht^kT0rbt~>TJ1^t^kFFysNCjKCpLdEEakG zZ0Y$C&|&A!NUD;{wzWkfk^5##oe#80^sU2Jcdhm8Gyl4^CjR2c0|-69TIyz?D)lrV z{}%jrEB?D3|J?ypZAcbMIg7?hovoy{rS7bzo|)=O-JRN=y64aaG_a%U(?D(QY-z=k z%}|vNSCw_CyHe`_^}U?00NHVZES|FC^U-v?kbiz8owMd_z!-~l;{VxS<<7l@>3F&n z&)U;-CELzVvkEz@G#@K3%n>4XE~XQe)Xqpxzrx0PR@aS>=bUfb9F+}mw$91|VQmgH z;5as}mD<{#{*~IgYAL-^>oA9m8ng0=bi(3XUAv-VCH34gVf6?IFe)(H=0}LsX>f>5Alh~@3#|jzpR86Y z>Bw9*9f9`A71I$2M#auUK}6E|$l0o0u2>PNeXNI}Hta~bkS|0M77Czb!Y-AmR?d#( z3wiuUqMTkxOI7gTh3i47mq-27OYQo4$o;j&R$t_m{E%luYdFXo$z~&!lpV3pS-E1? zE;Hm=(6cL&J^&XVb?<_w0`D+q;M6j!Ln-v$L~MwDajiEN@pj%S9V= z7Jm^1ujTD{C7QIsMc|r3KH5Fq72~r2P192S)ixH=i8z(Rz{K>Sy;D;OrdFo;o^?Kb zlhS(=W}c@?cu68_ZD`wu6%fZL4qbtn<=2$PvD|QP8y}m_*%b?#)H*L5Y?}ab2q}HB zZe1(YZj|_lmWq&U-kA$G>if1*Q4Pi+YU*9J{pW!oZD0~vPje$n!_J(BoqdYf(|hx< zMV4BHqX7?&p004@;x8C+=+cELRcf14YFd>NeAPO94Xj9fJ-s2mQiQL=`=cWx4r&$` z7h~2OglMj?5KBXj(wL?@VeMJfY^5`qhW6=%Vk+Q$p|mv3Uu3g$bJNOJowll#RG|dp z&@MyDiixBLVe7MVQOk1SM!j&*@Q`Gi3o{^zoLd?qM;A3AA=BNl9tT&eP&bOB(U1o# zN|d5yA&%YA9v70-_if@k4W{*?MvY4BJflhM^v1edgB>&!ik;qQcOZ7C4K=&8O0cL= ziJe=U!wzZJ)?g<{O-tVC3&svp^)1H^4NPL^wx+SuBFXAAkgUF7$pUsRfMijl5<9my zjh+5h@lJoJWc5Y+gCq;sq3@2aZqXFqudowo8ao56!j5-xS6WwT<-X`Z2zKau%dz83 z=yx=Uo&Hwo9W)fmJN+SghuUa4cBoM)S?vw6V{7K2n9-yCv6jtRtSJwMZc@gf)Xe=+ zedbantO`RYGwO8`lgLT@+kBi*8M}2o;NY^|qv4Ln{5V z4NPL^o~E(W*DCDv8DOU`1UvM-<=E*{*y(79okkj{Woy&HSpDi$=@*v<($}Y|giF4t z9XFO*q=DRP)O#D^sgVY1(JE{ZD=4-2qn(pelbz3o*Zh9`M_bU(>>W9F zFm`x4*3;FE#c}^&tgAcL)iu~l|L#4y--Dv{HZ~2*F3D0a98o$W4V?=y9I1Sw4G}X= zh&g!5o)UjLU>-P6Fr9uSusscdWionfgrsfHSYd1xMCGEIC>Dy*?k*3cZO%s*UG=vP z+z&Jjx6?fJEurmg2rZkp*~}Cj8QZv3LP#QPmCIENyV8yJ&f9o{eGBol z3m5uZ2N_DGo&PW-4*DD7fVpZW_Cyb!a?Mq=v#6$IM*0Q2Go28VauR_+QO=@P|Dl=$y%;CwDt?t}&S6Z$!Dx zR->F%qYLo{yu3*jaFf&h(gCqwg4kS#60qThfK3o!V-&V3xNq;dIN~B@cT$VTl7(s> zGdb9^)6J_<8^x{soXvuQIv09kT`})Gw#8k6%Dcez`{qD>|M?9=Lcg;i^v`0}%E6Xx#cOfBoRznE(5(In3j=2<$vBBjS z0G^5WN-{{?u!z4MSX5}%YC4lp-RFj?PObD2WaImGM+W=5haLKm0F;vPsGXoF8MfrZ zpPl%R%6S0UNF~{O$D>B?SepRQ0q8DCoRIeA*zb3bT~if3H11;~CngWL)M4XR2L}7R zqu#&>qiH?$rl}FLw&jQ)XgJ~o8}ZoQqs)ql9vB&QannM)T&X6LF=1Dw3!T_4fgKV} zS?QvqZJJ=!s2A9 zTCPNn;MhoZXQV=Z_~GYj_9dF5VlI5}*Ae;JVTv|aOA^w34y2hsT)SqC|9JcX*r_WK z>57-iqP89@mvmyKc9VZ~wURpE83VM$rrK3vtJ-zWAhm&3xZCk@J>nX(w(C>vrg4tr z$Qa=`G9hrxN4T}&XBjM<`5IvNix-x_0AHD}5`J#Ve3|~iaf{U59Aoz!+Qde@3FNir zN>(xD9@y(ADKc6B6Tvy4I1bYwdOB5Dj93wU)H!P@VwLA9UfPOyC5d9M-3CIWkYw@L zW21W_SSGUH+mGL~cVwizBVxtlg;D}M$6hB3*=%8v{-TIvtg7PNeij7WTD!CdsfhGX z21NQ6QAbhcY8Sm2k*=Pt(kgp8o5pz|c?>JH-eIjx^ko_g@SN*&?cB^Uws?);^iJfY zTA4=N24Oi8jWAzoqy&jF~-1|Zv!Y9f1O#o4iE}K z*rc2T?$ItjL8Fz@7HbY!B4i(%jhRgZ+xl9w4fq}&5sI&NB|BZ#beo9QY}MK@a}|Mg zQ|3ziqnSYaTEi#09i}8Al#~tsBrgYpq?#!*V4PZk$ ziI90ZLC6jiVDalfytQ^kOdZT%XeiIx>cE3{;vikCi!o08WY#d`H9lEKwSGjxe^cha z=^wX-K3bj4{MaQ!wb#t-pJl8NR7m5kr?yLJJqKuj(z+0xm?*Xj(Jz$W`L0~0(z}nzt?T^I1Lr3w9%XloD>A-B z?}>Ir6K*+<7Ns2Hw1|*nEIXo*7Vj{fx%m|aSbChgzA00~Kd@%D z*7mjrMnx%VxH(?G0mE5l!wIIZun%5B00i0xk9Ty8LyuJK$nFvpM+-=rNGI8W%8H;V zcw8*n6jxxKXyL#u>sDJB#`s}bU5Y6BM;97Tn|+o`i6SPk^sIK;`3rDy5^6dHPcs}-=X|H% zPn~}U!(#CpTWd|XreOQmreVW5=FC44U-)Dkal5|0MZw|Z@k|6n$U9nmL6ibp|!+r!KmrlxBm)(J!g5;ucU zX+~a5S5gs6_C?UQ~OEgYDf97A)7 zbO}5BW%B;9%`<#soI~4c&M=E9t86nCE6i4qexZ>!YJ2$}&S%>pUsnnE9SwB@!*51Y z*X`lxkxKhEw*^s;N2i}#4Cp9SHw}rY?oUIZJc)>)c$(w9v6?33tg9ZJU(HDNCZ2{A zs>yYdaT950@F#L}Aj5{TnBn|~+5vMUkS!sdrC-S^1r&kJvNjl~%z4zCv%^m_^^Pw>1t-c&`)V7e0#`=-0_b4IOKQ$?W)vatyy5Z}0fLf#1j6#>T0lLv&1{ldysiGZ9)l_`4-9X@yKrMaA6shj;EZySS*}S&8V3!c{fag zv|pSdOV@te3}BV&@AeR^IQnnifGk4)(V&?Ad)=jrQpIi@gO2co`*6v=LWsnPgq4n?tZ1=PI%~(F}8JQzt?R%6S@X zBIMo5BF$69+Cj>a3Q;#yLeBdXiKy-Oa0Y`~{0SYsqUECoJgVzmoLOpCze57$%#+K=_eRevLrft-m$bPod$|AyfX9Q*w>@nn|+sRWg z?TmDGQnUz?d*v(DT$aVv%0D`b`MJ*1WBaKmCIOYW^6To^ia;6V4T$zum{gQIg@nSAv0+)^UFd;fITc&RII zRdfBt0|%By7jj58mpJxdI#b>=btvAIjGylBPwhKU89%vLnw>}``c6K$FtuP6=2C?d zxslo2Wa;p+vnTf1N2gCbe0=U;>cIT*aqH}{^uCkTL#HddPDba43)5$Z$0tud*nP0S zv~;p`x?C>rD-Imlcep1W-IF|i;K1BS?#M*<{$gb)*^lIC^Ft43yJjcy@u3rEk1SeN z{^-P!fwK$Qo+AhMP%~apd0%uz0(h$>OOX2s=Sz=Djdi!3{PbTdVAvWx%lzD znT3Pp<7cabJ?Wv@boy}efFT8u2Ul?_U}L0Gk^BL-mbCu!128c@uh>q z<8%EZmBXh-E4u~`R|_ZiFCNRL6X~h0>Y=&b-tNqJGPV}69c&W61q387A(o%Bl&{E>z(aBTQ!I3?K zI4g2Ge{^zoY2WDSeFw9%dkgyyK0JSTTBJgg$FRJrw6>l}08&SC5s>)~k?qr!$uU%v zMDD%Jn@HMWvrwkP%q#GR+Zt+YMyWl%sgJ|fxh#5@MeoTVdTj4P?9NN$#4Qgj)`(_) zm%B&IaFi2pu2iTN>poG05>oYMDcGj&W5ZoydBc~;XyJ+!8HFUjUjncv1gu$SJ4 zf8^RvjG&Ri$ovt?`n17-N!eDSeo&ig>q=Pf_yxqQ$Glrws{5onqc?PPj3zodn0>67 z)tRpm6ny!(b~ND_#(#zPhCbb|qG+gtiWXpM{|Sc=GG8{R^+g)oO_|TLqM0w@A05Ry zkk@r|>|ya+?DU*3wEs;Fa%iu1m36@WAqp6R{XI6S#u~ZaU4Y{Ung1}TrGXu6!+(|l zx+(K1gH}Jmi*kNtyf#}%)HBZZ%;!*0$Mg13+^_HG==Q~U=X!#a(2lG542C&Q)EAXWw_Jqd+Vz-%2g<<6b&m&72&euBn zipk|hl&!I7LOL{5Sg=b=ks|Wq(i+FJp62I^_)vF5ejTScjFWjovpBs7T-WQ%bsxb< zCD-*jT=ypiU<(J{9~;1`V+aR(G9NUkCAjYWtY|3Ljn#7V=w}B3OxrD8e`)$lHVh&Xef8u#GRgP2<#Nbv1!E> zuH;+_guy*LJf@(+ECV)^Gd-Lv6>^N9i`G)MU?rqt)^sqCb&+~ga`1Bo1ktfP0xUn; zES7`G*b*%{=&L2)ijm4`f6(E>w;O;hIR7mMu<97v1q}VVK`o&r-^hxF^5I|j@u8SV zIU|x$N&8^p9dkir2W_Q+;${6RlOPkJ zfWHQZH8G2%VY9CIi_D7qA{bKNk|K`S9F;vALuHB8d8vrh?Qv+yq932FXe%+v!;Ey-5qM`i3 zyp&%4XgFu;Q!7kT#z~Y!gISX^Gi-*%b(Qdu&dhLLqAiERq}y86izAO8WB8_RUCh4- z3eUPX4X*QyMlPgz9u7W6r>W1erh?a>pFtTAfqG?5EcfAQK9pdV)aiK$O?`wl72K;v z&)^Que?7JpIuYJ~;h5-_E?JLff;6YxBLH>RcDuF%eq?}1Ap_r+i1hj<=!4fcL4C^M zus&VR;4K@&jU27dU^MDDX-#V`;#n{Praqe8bMB=!XnHHzK?jwI64X(9WSQgUh5#T=QIK9>-7>m$^LUuP^{yaM{ZZpw)3S1{}T2 zpqAjWm$IUvT=oLuGPZkSi4$hD1cZ-Tgv)bIb7zea69mp$xHxMEMdFL>va&txJ-OpmEig#UmE}u65 zT=4Fv4WQL=G!7hn!l0Jm-9KeTLwWazpN533vcQgHl2zk%ZgYo)^vP-FgJQ)Nx2ibn zI|c~Wu{Hs$eY;t#T@23h-$c1?lZ&%lyC_@n-f*vZGm3^;8aj?9fulBqT7t8#Vnsta zYk)XQV-I1ja&_p~r;$-|n&B`oOV215eXFgmcqM9pG93>mfQOD|@o+JC#eWmv7>25} zkZTvj)p0Zh9KFn-mbA-Q(NL~>O}z%vxXPc2us6$( zMq*Wvvg0Cvm~t4*Q5FvJ;V%@#IZB?91Ieq%pmQa!68pl!+xcFh=W>PRva)Zzm z47Ylp*5`vRex{PY(;0xl?_iSAz7!4M1VE&j6#kuuX&4C33wOt&-Ydt`8A2 zN-9N$={1bcVCQY}+|$fg1Hx0{a%&Ja;U95(t9h8}_?SZH6V$uH<*uf2X$9bNig4*4 zv`7gXEF@jpg^V);ebCet6NzmAc=Gde*!-ErdjvYldXI%R+`F|pDB*q+_(VbCdZ@G(0|(R=>8{+wT2BL}u6 zH;Zk_>Dg={KJVU~+)eiqEbi>=w4{&k+3{=|L4ecg#QigOs^2qr3I8%30Kf;=Uo#R- zEon=ET?#>JYFp~g+IsLp++KOCwh>t#=BhZlwo+@$SPK@V(Jxk3YS*UHb15W6ptgoC{Y>YEQ6DOnh_Kv#4j+yt=z1rUV z@!qFV&*F&iYZ%it--i2`v1sFybz@uA*{+Qp9Y>K&$v5cbeMB67yz5FT6*WMIphGwEQQil*5Q$Z2B;9aXrBT6I@T({+HQkd zf=8aiiiYwCTklFfkWmoqa7mTyEU`4GTT)ZN1S~RpL1y6MOCKKlso3elG_E)=X@G7W zhgIM(-YgEA;Jo0XVlmAXTjQdBi|JSS=*`T{c-d(EELSn9yZQQA%L6$Ty<*K8GQm6S zQVEyS;NBlfBTDyGWI@tw2i$?U)f)*Q@zK4^IdWoRl9EOqk8D3)#lih_b_o~QRExBj z>FIywJv$H>L|NGo@mrwO)nv-g6$;=Z3$_?O%-WSj8x7a>t0L8T?q9a?i~C#4a6{tu zLo04m1_3M$*!W0)ovk9nk;oKW*BT2R(niigd~%fg6lbXuEH4`%%}3Hn8Y~)4SUFgV zSXq>?Facy}VkuIXEh8bZo!}g;S%H~XgO5lX&}!pKLZ+h!eu*)rerWZnjc_e>?@e`3 zFj$>d-(bM*;wUQ(fL0V!TS4f{#PkwVX%J4R#-dnnsh@)ec@@KMh#k2O+~GJA)WU+2 zA8S_|9NcA7I##yo%@^{~JX^@ZH-=+>R<4+Z+miALN=E~8zbL(|xop&eq?Ju7RDHmJ z`*dadJQw_6MwQ*K_UuNf{lu09QNTT}6Y!%M@d z#MF3Uw)bGs&YkFdu;*Oy^r`-?sh;fo*r`-k;=rzlkEMqe61kI0)~VCQ(^I3>(^IL` z?9{IE>52Y@c#i(>8XRo)46Omp6<`u`}bAi z`_E+$=Z2R~FX6wbech+0j&@D;qV41N-!Jv$r8zi7iGK{C1i30QF9Nn7%e)xR+LaX? z^Ige2ir;?zh(~oYX)5F%&Vc+r6dq11oKyTnF^kTkL!64+ny8@w`p*!6>UHHy^)YL# zl?(DQ$$Rjmkj8{6qzh>^pHoml+@Q&fQgTj7p1H`qD%`EVCV27KBr`mwA=a6`YPU*{ z9ZOFi6&S!C31##yyHZo@1(n_J6m;##G|W>?n+~CyB)DYLy*9wDD10npA=T)!LR};T zb;NdJTjW+0)we}{(L39+P#fpsAY|%?(F-dTSE577eh{h4bwD7_%(#SnW`-uL$ zy(7Z6|7Pf__?c;14D*Zx)JE3E<=#kSjccLwsF`%d4{5IzNFyeF;QWT;aPcoQ)aq9+ zUL{5=x%WyMyr@EH*WW|~SzqI?gTz_fm6~}QRd`qCB}l4CI$0!0rLJomDf?h{!A`6k zx`HuyM-wPSMojng}%u_+8urwjvEz(Bi%vZi)m< z^~9J&U5$K#TPaYSee}9Rxh`PWz2Yc@RE(^sFPA8L;wNt0igEt7X~ub-PCsom@ap}0 zCnIiyoh5VW?2dJ}9XK{IxsxB|#m`d zf(gKEp~|m3p7ECwwlcvaNe-_CtV)jaVlUdu)!7^| z4gKf+<`R2fg}x&~xs9_0mQ}}_D2JVAV>7(GjgW6T@L}>zF;}Nh8#FOEo2XAFkQCML z06RBlD7-m<>MuEf02*OrehfSa6^iG@!89ULt^*9q&#u!LiVcUig1J9D*$qxyYV+ zt=OT&E;MlkOY@c}*ya4)bc>=mZ2(DKip*j|k0qW%VvqbBB^@Yu^#KK5;`YTv0rnv- z8LbwJg;IsLiNc6Bbgkz*C^)=Wz#$0NW+qKmhsz#B&-!Wm$;?)_3eGD5QH=0MO_QOfk|EVPw z6HYQi(iaU4j^IxCsGnw1B%d)CeCmn`{!1?rDe+>V8TIpasGnmDAf1(8cWDbAxa<-h zp)wfC23)0k7T%%g5kf`2wJv=D+SYpLcElF1I+gQk{Raig%M3sfTM#crQO%)!=w03| zh_8$wx}A*z?!7`1A?;A;h?>b(DbC&Fd34SdFb9UnlR5+6U11FVZjpI`vi_5Hwjy*Y zl!d1_tJMA&hJ6%7qLHaG%t04+(deXm73hysRS?=t{EH%8tMuy-5OY7T51LKwFZ7mHJE z{^wj$4$zxaNr%!IbC8n;gV#a+06>l#)Y3o>RvO~e$E^mfic=p#%3F2na_-d=}7*6f#g>k)DlR3B`X>#PIrt}l(mO&8@S1_qMw<8 zAES70X0hVVc6y^r5??>m^IbZmYQ z*nBT*D!A9?uo*kEvy_bQoEhxz?w@&xnQ7w9&|pvhOe``Xg5`T--Q5p4Zp16jIJo!* z!$oRMZGAeQu+O=USB6}~S-Xnv&P2ZU6@-@8HjtYKH;L9ZkMG<4tOydK+B=AJj8Y`)ksb=IJlOih|wE zQ?L_QYMz3u*9H_+-y{Xu3q`>P%qh6jhk}`>vH`miJ)AEAX?TqZxTQ`)6(n3Nn^7?z zf>iu96R9RtOmGKcR(zbbx~ju!nAWT;PQx>0tVv|13|z};4P_iAu9_3^tPc^rc{+4O z{71l2-k_FH#Ph6Z*t9lvD>eZ}uvLc$D%$zQJp=HVW9J!g6_B7Pm2;nIL^_ug-7|nB zFOkuaqa%^_gA>P&Mo!tYkqM_J;xqQ<Fox8(&7R&Ei_-9T zY9l;5Ex(Sn94xP5D~krf43X0pkV;DZaFBzwgDzNq48i&ZHpXCZni8zqX3fH3m?fu% z+kp8)PMucGd79PIQ$OcXcR^OmXYjq@oX0D-)@u1H27fTp#iIJFZ0vf`*3WsqMvFij zNcWJ#{+x8paM_2!WxwYGg;(ioTo&9xOD4I@;=J!9cl{P;l0z8>^c(TPaP77QMZLDB z7hYW!KLRXmHmD`A)W(X2O>(ujsO@ZW;nPgx^3RKNxZ)T#PfM_aW*s%R9fB8s`@vI( z?und%oem}$e2AtE1RNvRlNLWAS1o<9?pQBvs*4K!4>?mF%|^-_3Rir3fdZGYQ@~d_ z&=Ef=!&N%B%YY?xI)4;&j<%f6w>vs_P+wJ&WX~WAnmA1C*24SQ;9IuxAofrzkKTGM zOx*=(;WPN&Pz&?Q{#tmj-cnUdMgC2$JlGHw@iGj4UA20JRA}KO8@pcgf@tBvx|N4O zo8Qv0^#pX5j(yD&@D-~iV1EDs`8O8;b z;@IN@g_mQs2_m=yZ5j`J~y`P{S}ZkR@h1d?CFiiV2QBPZ%o zsL9kw&b$^mcxsXdUoBW!U!jxc3 zz(PbU75ch+dS+Z3Ob1&x42K*aVC2x z1lnm^jHy-5C&Hsz_P|>8ZkdVkHQX}$CdS`z*~2UQEPGh5Bmufz!gk2iH)%Dq7s^QZ z-v+o9%bxEr-0Ea#{j!IKSGVj@WL*m$Rb%J03)Wk@%>FrK_78l(@J^h~$?UDpdVAQl zXG`9XL6=OqSKGH-PnxNftLjjSGW2 z5YzLk7;mq3qYwMkzVmAtW0mtO$~Xd8HK*cP19){={UWfGH>f4BG|!5L&ab1iw&Sy= zI2^;mow4hcLh?ZIN}jYwXbZmrlzgR_bJ+>UO2xtzCL&QExVwcdDxP|U0b+G*eF@n5 zg_dLM7NOaOySuwwnr%4NC>Z6fY~U@^Yt*mOYw+HAr&H=KNUwbW-y7;RUfD;lv0fWY zr|O&3YwU$0+$S0Qy0Y?$wa{yS%Eqo2ZM|Nj;nnFifwrx+>m0qtX{rF>gbY?XItP9k z9QbA*n7rU?@*3Phi?mwRSF5eL!L8M*j#gWX4~DCT9~r=_W9ct|rT;dlC9w2gtZ1lK zi<4GkimZY>^LB+2MlqVj^cYmO~@;^RufJ!_;vN> zRRuy5PO`D%-45_;r=w6(6BJKEcMW7j3=v z@LeAYv>_(O<(1&13l?Wx621mWc&iT-UVxjEgaEI^Km)JDe=)4LnClQhjj;464EZ{? zqyB=}?wT6|*p63jE!*9K4h>Den^DwjVq7G)6KJb*OAuMrw8d%J3>$tOZ1{hhWy9bO zS~6`}m6Y$aH3kaEX$xf>(8tZGc+`iAUa`}K^{;@XLk6{kupVGVL#M6n2dr{Rn&aN& z7_LLnDmco#g5rq00a|oe{~EB)w;a}+&)`rwrLS}rpM9~O1}f<#Y|y%thb5GJIqEc( zQ1aDOp)R2$b?r`YE+&up8f&;22rMX zLpAVuzOuwV?`Gfd;vD^%9jfdrrOrir`zj}UQ{$t%$M-xq{P6DiJ=x-})V{u+6UR>^ zPn{e&wQFBl)?>{KpWNG*NlqV|pDqmaJv=)(nT=PE9<(wCa+QIF;mJKGODDQ^Cl>aP z?-`Nx;-v-ZaV$#X!APVJiQI(KTSU>#lRA0AB~+C6f1zMMP0x6t19h}dwvOrT4a zKuRLN7$TA0ypthU9Q?f|u8!WTZ6V=|5<^CLCI?p{d-g3t-$a%Ne5=o0UzaO}(z3XE zxJm3SM0plppM?3c1g-?i;Pj_Ren~0y>wEh$rKoUcH9tgo=tEP}+&C^W<-<*g(@5na zGSk~~|K0ziBE^4(kb&u1J<4(qlPIc>AEIIGO7 zLVV(^#h!R~&yd}hh$iF1-O;{yqBlA;Fgq0O9-2+qR@d;*P<)nGp)`W5O7E=QJ3Kou z938OYsM2j&(czx%*=Vml5bqjHB;vDOoN(S|Ag|e((5;b==CPenjh;*Uz=zFGE7Z}P1jSvZ3_XeF8ut+)34A0xKQ!u?#rqBFiK32@2ktPl)Cv5T)6l&9G1ET z|G6>>Wc~q>XQc877p`q2D0ujcLP{YmJLzoqA zno)yRMIg0cuNDSU!|?OVY z7?CL#C|fW~r%Wpfwmg7=i!-Y}anRW28Q6wo#gu0`N}+z;h>C7~ng&{jv@j<_tT|8} zPx(g~UC(pF=N5OuAP@FdDE|uE{_)8^L%j!W|9l1C8}2&t%DQ9tCXqkLI|$-wJv2I~ zBsO;&eO8m(KQhDx>rkO~{*FPZ7d71|dX8L2m?Rn+U~yhL_qx*#33P9*4X>J|>p15m zJjv=XUTacnti35**NA9;1<`(%I;#Z|r3g$-mtBqADOkAeegxiiYiB=xDl=&~%SMHG!tPSkX{z-+Kf%x>%7( zER*Fn8dvgKVgh%dzH7tjF0;xG_a9~$I#0c+C0axHzSNXHIZLR&AWb=g?+rC2udHiI znLKT^@%sga09~nh`CPEbJR7@S)Kvd9m1wO#eqW$%YfU>g!ig6wcskEMlX!O22M#aD z8qWszAnd^N6K(kCd=0tZz*wbdqm0A2Z!xFauNlCrqvZ8za0@bYFRaTEYDW5nQjK3j#`4bI>sl32Q&m&kYy z|1jB&PQ=&YR*u6V$%h$9TB%Ercth$EpUfN7Uyv^OGQKy|CA_k~E?I5njsK4!Kvxi6 z!4kUU8*J=)(F>wW>N9T$v>{T|!#8!5)bhFG3RjJ-kg;sI!5V-Kr2oKHc-mbcBGrb_Qhy_=jj;;LC1gF7;4lfquz zIJE`RGmVfdA=qX>38%j#!;7vOy|OEoO*DMW0D9Oe$7`@a>(l)`#QXbMTfyCGydT_y zW)%e&6-j8gcdT(y8N0NW=qHlUbo;E*0%MotR;qvOQkV3t%bYQ$&h_RiDh>au2ISVs zwS&kd0fEc=VtChoi*d*KdDlf77s0#!8H`p;B_8kk=M1nd=8#V@kb?z6Crl3!=FbeO z2|4;0D;he77mM;_Re0A0 zd$r2Dj?6zS0>Rf-i9A)|dp#@VsPA@sGQ{+4C>k_z5gv3*_YtOVF{mam{Zv*ol*8UU zl1*D=fl!8$MLU~CG!wr=a}3c9uvGXZgnQ^EyScE8Wn7uL(-+g(ECO$oXI^9?UJ~c6 zDdvZ*%i>s^p`o;ug`ESZ`H3=eF5`m1QhK&pA=?L`Kq5d0HjhYNso6X#V)`d!v`WK2 zV89VNnfr;%&uW&;MgsK|&Jmxh+v40F$|W~;ba1R{QIW=5d^S8BL7pk`)B z9$4Iw`?8Im=KFAv`T~Yj{VI;l+7P5ox=9Vosr_@TcJPcR7Om6~vphFzFga~C7>NsH zH4^pCsr}kjjKqC(i}xNZ5IV;U630A`K^2Sujbnm)5H|36h#ZoWDLVPe+D9>BA!~jV z{g?qBg^+#N0CpW^Lxi#q8B`M}`v5B%Dr9$yj8&sfPJ7`n^q&rl%PWQaO#`gxpbitL zf72|e7n(b^cHkCb9`nnB4}Cf0%BLv~*{qdzq-_I=7@90=QM5UeWhbHT$L6T}ff<*i zU_db6h*h3v-eT`rE9hUI@@3IlqN|rvI1CK`GOQU?gFi*$LepQkwMY-%oS9*2ip~k2 zxF9_`RA^^Z&~^6>jRu7AT<008(^7{4J%t{pPTgVc;k%>HB6{9#zy?C8{)!Zx`3GANgay6Mu$J1C&;HLQs4vZ{uuLLn-Hz@KG9f zKV|LwTqWhCU6q&l_V(~Aq{@n2pZI|&KK`x&9d+W25OKcKEO9OZAG3ofzI=TB(;Yr$ zr5rxK5uXgr)h#I6oVmJ-P_@~hn&9I$Ry354JL}W%ibaiAbz-{^=Z56sxaoR|OS%lO zq;tt`0zKL+=ogwx5ch_&N4`8Vj|-4w*E7U0QJl@akyVLufi;P)%BKtY|2Q z9HjY|yF#!&!L{P-_#|JeAOKEtw&HASm2VC+#YfATlSq1$OhXl7=9bLU$|e_Ae%MGeYyN(qN<*O0mD|b?? zy1S!TLM=OSBALtCERO_{8adB%(_ zQd7iP?&xkD-LQ)kgcJQNJ*X-}KpKZ7Pf+wW)U1qE*U+bgpZwYgOW!YT24&;ZHL&Y^#(aGV|pMB9Umr zWM-xa3m@|yW1VTX@5r_odEjQbLi>wVoIEMPA}`0QV2=XsM1T{IVn)l@daMwK;X>zh zo(ENN-qErXWbU|y%Od&lHfw`&#Bv+TAd|Zm^tVZkSt>#Ac5er(6})92d~MVL+cUYw zjey_*+!BBvIi#B#V9;s#zEuozh@uf!g?=SM9HWg{v3`I1D2dSR3{Sx*y%l9pR7Sz1 z?#}!nWze|is5dXgeFuV)OawC^KRZi26A5d@!S!i|Yn_c+L&aHhD$*c$VAxLY$eJO? z7?DHb*qeRgc{2M%1NOs#f06r$=bmsELpl!?O2Emu*y9^%-663iL z!b`C)cgCF9iU|-2XC7lJ7lvyTvP!#O1t(>OX$@~?4cR>X`w&YPBHujX`s*P|2OfUL~~O)MYkQcxu1QhLUC2zr-od z|0EaDn-;R6n(ZDAQO|WbAm~2cmCU1UYt}r%PIngZOHE`)COo?L+v}VIno~z`T9eF} zWFd=`M-+zQM5^wH*b6qUgr}TIJctWhp=S_8-FI^AAq0*i&?;Z3L?{3qrW8zX5vc;f zTSynGW&eCkJ8%?-!q}k!(DO0iB+Mj=C{s2vLegV)_Dud))?B@^Am=Ewy6Hisj{ z0;ULhi>()nHu4J95^ydPWx3&sIKg-tg5qcpAeC%HDuE9Y{(u_;?O=?9Zn=QxaZZ{$ z!HP5*Balzn){rGaTX1EIMaQCNW_CtKbYKc#5`-KQM!@aL$0cj<`(F@Qj?s1m&0GITLnz#PtlDVX5wWF(aD3^y26aU#FhQ_dq_{2AO|vLR6{L!JPa6ap80 zzGmF6EgEYdC$4%jXjr*WeDVOKCf#2MnRM%ym}Qz*U&hu)neSr>Baxn=MYo|qWOM&C=Q!7s+xLNZHv2e>f4>#Lm)(5 zD_OfCQg6<1Fl1V*+EauQV~g0REzBTS!c(n4#8p7#A+2q|nu`KhGJi(&NIf(4rqp{5 zk(?;{beOBzI&x_&c6&pK;!0VP=oU9nF1H|+a(eh0V~Ai^k(br3BooeQLhzI}$Z)sc zcUIByX3bpmj-VO8OqFQ!KZ#be!La`b$_zzc&x&fQZK?y=tV3vV*38 zu>C8SrtlkbxTY9bMc4O>i!E2TwsOGcBW^~sERbfonsL%YY>j6{{G)2JZfF8fhK* zeti|gxsLGRa)|_wtGTQy?_I@s+{eN=W}4B5i=+=H(e3Ijt=j)p+$h~L+|)haY1+N~ zy!2c^J__q@dj3QIh%+;4jU2;x8B-p(r1DLQ(HX1P#cmXwMHD|GWxp zG^ud?2EAH^`=eD1*Q0R#hGVX9x7=!MUn}l$YZTslGaBU_X_PN8PF%Hx^;H_OAj72tjf=zm+?c52qP+ULtmmG2Ax6&W(G>RN>sqEZ{+|+wYP8LdNzS zVQvrZx^3J5^Z24Vh9x6cWU?QpQtd{OYa$AFQdDjWxLjuPdj#KUBaUCJV|H^7-Hj7^ zbI)!5yBXNl!;V+BEJ+?#Oi}Ln223Ds^I1Ys?KYnyk6hsio0_^6-k}i|yNOH4`IaOU zjEaIOl+q9Lm>G)1qwp5mKcyH>(nIcrxlD@S#Hir5aw;Sal+h6~%7fNudxy3{>8p13 z8~bdMCS3m^a2^*vVe^!?P5Y}fAY2Pn%_5r!1=h18MA+?i9Q8BD#`Yd%+v2XQX#=s| z9oXKMTaJ3SPR2^HVFX*^S1w^RIXdEHj6L+Iv}X0pD-Bpo_@bygrfmCHMVY#BYaah= z+=P>YvPltBR30!GD=uE zH5_#me(L%Kq-LeylCZkAK&D=aKRP;2rFhy@DH){U727|%qob{D5^|)za*3r)YnL>R zB2JC&)ApA-cY{;{a*jxoO2mrftSnC6QSb<2eMu8gyK`deo?^Vq?C?GHRLoKwoP7=l zT=G0#i2`~N9hWa77>q)}X)PmSQshm7cO!bht}GTx^I{(YLn-8O3=r{o<@9V8(I!a- zhbRTW7t*Cdo}x^o29j+>>|8NhSSm+mCJ#?U5Imeq=eaJsPbO(!TwIJL`(sGV*g2O) z4_0ZZvs}(bU4>ap$wU=r2rG6xl~3c?mTK72T18a*Iid_sSXgo7e8jm5#Apx>N;yh( zU0Q;Isw~=wAt3zl#SROmp+6VxS!7DW*x4II)+Dl&EeS!<7(HgLEXxszo3eQ9JtbwL zc7UIpmCxHHt`PYcaEDsDh-+cEz7;5E0oA~-)S0BvZBPI`f;`eloJi>qotH>qA;92bqtOLc-=W zW}DlBrQA`RA48q6jRSGW0VSv_^2vWB) zf~2kzVn^<6!a{L}l@R=}$DOc}SfnXqhl8pjPOhtD%Wh-HwQ#0SZu1A9>Y_~k4~@nZ zWg52s%mIesYMi*>1GyDk2+>cNHv%-uJxAkK-HZti|(Q;hp_-c zs+DM-9Reat(mrQljiK(Z5xypM6=RdN6vSI@3%BX?BdIU(EF0bT+1DPUd^{0#n=DJx z(}|1H+796TPJR;yESZ>qCRQlTwe9Afl_*`$vom59i&*!u#Z%|GC{|5TvY_EpLtd3Q zZo^HqwaNA7{r1wq)a?Fv`dIqlz7r3Rb{|cTmT`CRaHZ$)aj8i!p%E#h-xh-Ox?>%r zq8lIUc&UdX+TEUqIXhwT7Q#_j$(5GaxoNfu=(xiWyDk=T&f&$uRkrF(pD~65-FtM6 zyHiQPjgs6>-GLDN(dt5Yji?*uHQM9=q3FQJ5F)qQD&-eFsCF~|)Zf5dqC?Etx)n^S4;YR1^U~;w#7eFWb zqgHa*iuQK*4-UtNX1nY`e#JE%fkKz^q~&zZqU)K@xQ$Z7i{%kK= z>LL zUdoDwre-m?9^zeSNdWAB`SN>Ez|dRxP6GgRxPO!2e!D?64esEXUZmFk9|o<8>mdYt zwd#6^YdSjQEasd2=NlNAK>0>l&@qbs4qpxN{Wk_6>iB*K;rr_b)dar3%8G{a*(tho zo{USmtwSe*=djAz4u?E;G^|p|TDpgJTTZfEWEO49jKLtp9t>L|Y%kwK+X%F)LCXXx zi6*(99IovP*1poEKQ_R+j>>luDu2){Dven8%N*;gxrpJGj*bQ@cH%)p) zc3>M?OaS1G`YAP%;@3RVR=&8&4jbAwo$jaj3hZ245d;jR3u0wL8LqaQ4$PS<-oesEp=!(|^|RXV5_3zkBQ{6#Grd{*nXK#_ z`E~YA^z;vKw-EC4(;K8jfRL+naaC=Shc+eumXD7dF{Vb-2HIA1=}*MF{cGgN9eE|3rDs$>G!8(6J2&P2#Qz6Qv&gVnnXN`S6@6+YkQ3bWzEM$OFv9Bs_ z7`Nr|pj~y_wx^^D8-fOtCB?2Nsgo~~+xn)=m+2oibBJVyJT5mhl(=0FQr*jrnnkcv zlT6Q5d03dV2TY18wEklVT50Gar1*NJhm zJ3rirKrPIHTkA&XOm_d5Aw!QKxK;;1BKc|;SfT+6M*Sh-Xnjrl8nk?paR6Ec#HIcz z*o06o;!=Bn-6zZd)3E`88hhXIq#Zi&BE zHK)KG3PF0^d=oi!oG>#2lKm!E1C3eE4`39b@=3ogS{i?7WeOeczSrKI=;_3 zdt~q4GFgeVk1339a`#l0qReeTVZ--k7AwlArgFmk9OxVFAMP6H>Jin2rHa>m-Gf5| z>a}i#mx?NAB3+R^!`nuttF(%J%VZYk^$fA?^Y&7Bc38qlWrvQaFM5k#36^_xMp)opV!?}Httzo7S z+rET(dm77D2AflYnrL^$o=nqCX9OX_%RR$y7iWk0(kck|)F}N=){v=!k0NC-xvJse zR$)D*IV&#?KzaMCqabgUDC9>;`Beu_zNLSIDJx61W1o>QP)^TzMkGtHwiq9DPg>FP z-Uf^yi?;_cgeoK$tmWNj^m<4<)Fl)rauXV-P3m+Eo6s+SA&v*PudaOYT z`TD~0jVr%8_k{t2Om`tIs}l$&OZ)%ZC_%k{Y5q2xobK8(F07$|x(jQ+5lO}wEyfH0 zBWlP7pakVllYfDREDr1$v!J_8vN`$W%x;hO(Ub1de!n^OiF*9v0{z~CJ#=kBQ_y%- zlwY6xodIjg$`_yN@qDs5xSt53^Bm1h68%X+Aom>+O)+S*gkon&E7O$%Rt*%NLZVVB zRc&+jxTG1~bvwspG)jGA`mZxfIJcr)>R2=ypMhZ!*iK_5wW zT4u*%uzzy4fnK~2HYqx8(3|9>rVP?txiFo>O%}!`!DXwI%Y!xCBkS0{G~+P>*!?4DH^vJ9?lI^dsHF zJ-k5gP@mr@M=&~GpugL9=YqP}zx#-9T{Pb46Pl$@UbwZt!3Yzh$Ho?V{8<6}#B_(J z+SDvs>C$2vdS3TfN=NQAk#U-?+y<`5=iw=a4Coa)rO=3}w4n*=uAZkdmAVgkSt=!s5&p|Z6I5iD;QO$u#R-Rlgh`+3*H^^z&+u1O6O;=C+ymv z=97aUh}5b`_Kzfno_%M9vywfR#&*t9%&sQVQ6BK%4jExWNz;()qT9oGE{DXp zvB7@VFR;BuT;{F!ll=Q~NQ}gU>tAQH^QUI-;c`e!#G(4-kQfzR?vjdzKZ7;5x7vB_ z4~a;%Cv?Bya!5?mTWx+@22Ub1UJi-Tgk1OYyFdAV@iSz6O&5Pfb2%i2B}F(>=Yw`* z-u?S>ptc(u+V4v|Q2TO7%;k_6jbB6lcu3#I3Mn1ARO0h5hs4BVPpFCen%RvTn>rx*PQ<5ES2^DQg7($<)E%LBThNcFNef9;WC#)Vk9$q+2wLbjKmE8S4B~I zLLlg?`WDVkmqTI-`O6_Oba6}PlPe@frJXq$l6Iypl}>Q#w=a8g(rBr4j??vOei_8* zrd5k_S?`GO)WMW$OyuCCq?<@{LYHn@NJhv``%?~1x;IE=+_?ZPD-0z=FjSwI=c8-& zTwE990)a)05^<03t4sc$l9!HobBJaB2xSlT(D2`jUl_7z<04!j@Jkr2{{;fCGr+b; zJp5_~a&YP`J&W!qh%m1-s3sB*KhBDVCLT7pK;ZY#Qs4ywe}DppX~W-Z0DunnCkgJ~ zHmIh-9h^=~Tp&<0XjNPwAlR!_7YJO{(SfjT-^AA6!k`4U*P)D)t?i%i!4S*;XaJaw zf7C{0&w#l)G*l$<85VW+j!wwd&A(NU2BR?JRdSa<$4NYhlHdKD+9Ua2)7> zeVPEf64ipTEs`G505f8rzvehtO%i|5A6xXk^uGsVmGnm$hyM2(z%I1Q-3IXLX!;DH z=}v=c0!??YqM`JE$`QKcIx>kI81g1=7ug$pRn*>Z0I?3nX9WG_V!Q_e&kDe94CFG*S4n7AVY znx77skUC&>l@+hN)Bs;P5q#C`F}bR0S4g$+xFuD=Dl`UVvFez$4zeSyd)0fY5;F$~o| z;c{?ZhU#kDc$&-D6>VGuWA|SGvCvPR+p@lEKrx}9{+Xez8DsaWMBHx~R1*s7A6U^) z1!Z9DUfZq!_P;G_3kn#TVb`E&nAxH0q`xG%HyKoG4sP6}G68um`%XbI2jcatlrsr+ znZvrnV9+|OUn5xWF{q}&+E`PPdJ9rMt74YtT-LZ% zIm@pjCVn^fXnfd*iJO|`o$hKlFUs=iMp-`HC_g9|MOs1EEdkE`1+p~F{gox;)2DRF zluchNZE}YJT?F6^V|(TcYuBu)txG4mS8VCh*}jh7d5!y$(*hf&*5E>uf#dxc%yfI+3Ms9hVcme6fwT6{WMyGFjrrt|j7(b~qc zU8%r2F0a(KB3%q%&X!}z61!tNu~OS`(#lrt^2)1L?s+kWvYp+waJ05*&d$?q2!#@w z*p$GXK5*{liumJd-qSRipU0nV;!oVijlVWm3h`;Wa)rK@SJ-N|c73u?sN@S3+x6wp z6}8QDhd{oXn?6VRS6A@nS{zqQ7pLQe9Hq-HqrF@B8#`;WH`9w)69ge(u!S$o0Gt{hrhYfD*3IxGHMU)yS*O9NLpx>+qdZ`UX6+3FnHyLQnkPqp_^lh$ z?wX84AZ-ija+>qzb<>G-nXZ8ZAfz}@@hT|{OipUo0G=`=fZY#?&znWbX=Jzod=EhZ z&@c2;wo9ZDKwxSx0g7K;vKG~!;LxokRA8L^9QZJs&ZR3WN4DHuyS8W-9SuP6TtjbW ztumct&aTv+DswgCbvagC!VNEZwq>$XdkU3g13<~?ik$<6Dxkwv>!} znx{8T^LNSSA*dE{?7UryrR_?R^#Q5xOjUB(&K0n;H47n1R8lL4Hr8$hTjr4cSV*T* zVbd(V(8^=AE#)QLt9cHmjOS8W{8w3d_4|g`u>aMr%oa!lt|{lBy{FGsA>U<0EX z|8qK9Kz3-3<6Gk?tnlJs0xowzH^U`r&sU4+>srcXm9BsgTpv6JPAbIH`6T#3Dv0Yz zWgvHfr(8NmjGQf4Tq>_*stNp)n}s$mSC%k@lxf za&4=)&;*Q|O>*7#SZ$r1UsyR>ovq=@c~UEoWw0ggYea5aN}gbq=4_}baL`r^3OrU} zGYa@EStebY+LzjqI-MF#Ev8bb$5W4{-jI4_wRXK$mSuCI!nL)trIpmaT3bA2$LFJI zu=7glbnTjI-u+^+cD>M1QDlKC1MVnzF!gx-YY24e4OJR?(&^*MM6poBfVXGfbPcAQ zm*2Q%ja|EipADxA|JdDK5v#(~J)0dLTFGqKyk?D6+gL~^;&ht{s%OS;rdONzl^1;r z)MVy2a4DTtyBdM(U)_@S75*!=y4N0ZlK3DdPL~aMUN;w?x)92 zdK{$3etMju$0R)x^swl0mL7R}ynr6hqsPzFW0@YWrN^u3@n(Ab8a;lS9`B;Zhv@ME zdVGo=e@2h5(&NkY_y>CY9XEi(_tE2b=`Jb$HxCk2Ca`qQ@~9jhVyrh_vBxD?Of0taLLy{x|q3^Dp%H z7Cruf9t&WLOqm{ExCM{T(c>F*pU_{^;|KKNd-V7qb@_fgs>L~qU5_N`tF^NjiFD6k{`o$#bXXzJ{sK@CSlc?9z zFD6lMqhCy--bcTfM16#QF^T#d{bCaJSM-ZX)VJvulc@isUreH|T#H{!qPEg6CQ-N1 zFD6m<(k~`aL-dPD)L#0g%#Nz|+87n7(r(k~`a z@1$Q$qTWxxm_*T?Yh0q(FD6m9D2W=UUreIbl2|c`8mC`OqPCHMF^RgB1dK`4OQDZ5 z|8*@M-=|0Cb$E2s<1_U596io#!Q&x%yn-IDqQ^J4;_>(N=)4|}ZhCxx9v`H~=nZ%r zqQ{5m@yGPIhUE8JdNBF@clz~}r{M9I^q9E`k6C(rnI2!E2b1nkkcczsrVA^%bpIRu zBI#zn)M{wOXg8)~7a*$5gxemA}F* zbMqrW-2|p$j3&9XGtx=9aym=ZJQj7Gi-ppBrz1CzikfeKeh_kTQ3Z-(Y`QXue{S( z0bhZlO)20;dg-m-3f#L_0j?QsLu7X2GmWjN^(fjBD{A`%1GYDK`e`=@_V!i*d(Q;}wl5gi`^^O>d@yYP#~ikQZ53?Yt%5B?mt1p~v3;`%MO$LuurriRx^lbfbx8pmG^r>BF$9zE zE^`pKwF<=ERgkZ<9z-@7M6FUX7{ce6LwJ9yAnaQOgnmRsbXhvlw-8SUgLv8;#8a&T zv40gH?x-iCxSKq1N2Ov8-q}`xH_#&R(uLwe$SUd=%)$HlR)IIP3h;bHkW(+Z5D(_h zx0*xv=2k&Cyb1^h>iH8voMnXAvi)}ZTs##F=!eY#{ZOj_-MI=tJL&<=SfyMra9=kE z?yIc=?pdn;g5f{Wp29gIh|UC~k?LoA%vm;?E$76SRq|9{l=B!M>0 z2I4)rmWrNKNAhGUXzv_!ODuS&A$Mk8a!zRqXlG+Oa4TJp5)o_hHT-~}WJ=qV#2&5` Q&~9Gnu2;~u_0l9g0CAChUH||9 literal 143922 zcmeIb31D1Tc`u&Cv12Q7VrOwkf|H4y5J&Nh_RU#9wq;vhWLc7zIGEAZ%pJ{)XY(wQ zWoig(mDhPMr3fg0meNw%LTU4$EQOX*mKJDf%TA%}^tG>hDSz71mVf`h?`-#;J9qA! zk;je+rp@)}-m`t{`ObH~^PR_6zvic|yz&bAU-gDkA(_gZiCFP?E+4l`%hk2)?<#WqhtLuu^LMdM<#_Z+l6(|u)rZVxOom)PMkJnTAaw=1bhz72S<+ED- z=<>b2R)zkJF>a{`XS1i-0s%r`s zhEQHkURRp6s%=)eTujYY$^e0eyebthVR+SRVi~Jc!b|*KowKt1*V=fc;QTRb#ZDFN z1S_-dOg6KswP>u=*>ZAA@}5fa-egzuzU0>A{rlITfo&C^2C7%h7MCsA z3{~lHRaupMPI48Xet`28AUjNu#gcaHR5%sO=YA@b%35xwC!A!RmfV!Q<2jA93f)+LMmQPZV&bJD{QQ0b=~-Q-ubr8QCSyftE>zV*5*J1 zj$`9mu3pvCzg%5aDW;aI9p;cxV^%Jnid&qkt5BT0Y!}04e25^ZFs|tQa0A>2w`YX->)ZhNqW-=*sP}fhoQ$4Z zPFl$qDpV&0s@MCXdchaf>q$@4p!$Wx@C#Nkm&(nBp^Zvl_i(BV(Y6a2XdSTrbfsKQ zh2}D;5VTLWkP1OC%61M4B9zL7PFL(w*$PSRW1WTCutTMME+2|pD1ef2yI7)HSv!== z=kOnia%w&$Rl%bdt_P)FUgoD>syEg`?yoI2`XaCBhddiv!$ICiCKDjgiyj)=wKKeXbQjGXHQ*Ro@YsTNg}IlXxoMr5W^_;Ux}IJmz2h_+;DH1oQP)avIR|Qofi(aOaVEBl)gx} zu9d1cOMHZj1xPmU%!M2EeM_;R2ICMl`BZh!c_2s|m_*iXZe(fLnbWYdTM;`tnu9H} z*eV4aj+<9)uk809ZAnYp>BvQ?v2rJT$cVI0~e zNLeAC@E~k;W-e@5F5IXW4jN8Mwz)6^lE}HEE^>5H6A}{bj`TRVT7kMz9F2xNSW%)B zE(vk$4)?f_q`q$v-)S(d7d2{BV&~aSVy8FK-5Ttmp@!J$4R;4(huToHOREHn8kN}D z+#GgDyS4^9L26p^PG2x~n5u6%c4%M{J9jpXofb(}pMhlc1xpsNa{(la8kN|&t7+`? zw~BZA8%kDRxIaj;fF1ho=;{_t@%;)rp{B7j&?@YBCwHZFl~(Qx4>Z6IeQ!B-oC*Ez zCb84sD!qe-8uCtm1HD6Sv>ZFssFbYsy4bNb^H9v_;r>X=W-Zo~2Sb~baVRx&e^{Tn zR0%n+^C4+i8k5%0`IsDhcoI)rR)D7#X=oaV*ZNUdP;y3ia@#+ugoY7d6kyj7hSi?tdEu_9G+~_)Jv=#j0XrO!R;>6c#4iC0U1EC?0eAVjb!3G+L z+Gx23qDG};J*O^q{525jwh%ux7*cYhBnueQaHL8o?qNgHu+$RC;>}7t-B%Y+^|+`- z`e(34`}lE@Tlc8%E)40KrzJKJ4NPKZYtz{2ZH)~y80j^Tv0iY8bddRBhrYMi2BLvU z?A+fpcKTX{ojwEX^fkZ^eQ!B-`V@9L>SCv!25Q;bbTCr8I#v3`rGfPIsVd=;FKWk) zr50%*_Zszqx_GLmfm*Z*8^j8V?GG!*vyvefj)GTV)P@^BEz&^FDr{R_>?FwY86Dd- zGUW)BT`7h$_L&I&%@-{E)0wg7tPJ_yv3pbQ93AhRK0e*~TzJhN#(%U0eQ)o`p?#49 z(MV5MHx|eJgORT8NLSZjFa0|@zQ=>2)iyQ_OD@S$FC0;NOd2{DVmMOygzF+^k`S}+ zn9H9^&iQf?d+~NLlCsN*NWM7NiG8k4+I;AY7p+7&Oz*?#e8~={vE>zBuxGo!R)LHrl9KR3c%E43TSJi&DOmB9AY1(wO^p%Id{T@(3<6%dt+YP^syguA;ukhVD=U3AsoI&eSI zG~7<})VGATw=T47-exmXcw}<71MD1hX=OHo@PSUd5{{?vH|C~PoNvH|7px2dKRT@< zg22kyeE~_s2vP~Fo!D@qh&ZW*eDRbA0qfYL6t;>97yQ~w2mDD1ehWt{^4*Z8DGqi3P5)T7)@xW#>$qO!BU_=8JIGBSu zgZZmej|tXECMdYz*Iqg(*eOwPKHW>82i-s?-{lFMU~}5k*rAE}CVU8>dxCMj9S_g< z)Ps0UDU~nGyS)X@8wb|sHiA{gsMPCJ!a3xIQwx9CMS{+mJbZMgBj*}}DgH*3+iWGw zSv5Q#tHaCdQ~@_R-7g&w`z46YbtnNFt_#={0X9KltAhJR&%_WHDZ7(eJd(&)a+t}% zo}F%94cjPg<>qV_6x2E26X}Y0=dlg$3RK<&uHQEY>W9y77!vyJb)kQdSt}!x2OWrO z<%L<(;L)^I%!Uz}Yi0a2)7A9Z1)2QYfu>tRW8Q^?;K8~Oj1mO9CJwn2j^sz$B!5oD9QcZLT0yN4b6kN^}Dv9KMdC>gfo!=Ih_ zkIH!fSxY6^d&i?j?^v4v&;jTr#jHTOAne^NxBA zBaEi?)SIS8%-WVCex&Y*M`*;yn3)zD%azJxh=fKEtBao`@!Lb(h6|^}$1viN*X4#94|yUCnC5Y23dAa+d>S_4%DiM6`AmD+o|5c9MMw`!t>s1}S1_!z}jR z?;Zb;Lo`-qk>YM~a-h5zF6A>U=$-}T*YN8dgvIG%rBn_b#KDNn_E4Gr@Waow>`ORH z#a#H{uS4>+L+UnHOA^vi2h#L!Ty@12{^RinV7o3R(%CG!KECJ4u&DS=}?!i{x5%W&BAp8|Hj zh*${>@Rj~F;b&9&Q}hoG6eREC7`uP}IyT~UAg?u7vZLtMMWk;S5b0|~9YvXIUG!o^x^}ig>&R#( zg%dIIpiy$Q!&>X;OB74Ytm||2!I?vBc^1O?l+aPN_6oU8o>C|rV&1|~_i*STgg*Bj zop@v>8eu$`{yN4bgM`yRpg{^=UZ+;D?hd!FyhF+Jk>-XhLc_7CmHsap-s)LUFgG_prwi>U@rvC*mB{No|GrP#gy*~_lF)LW0JUE z9A(h>zk2e5cF9;^Yx+OkKtBIM_9!K8vh|2`No6ni2~v3>Ix&&l3(+s6`)Xnow`_Nk z*tkzrTqBstBiV{+NxvZl9( zSldh>w6>uIgg`iLOM!5;9b#>Vwo>Ew`zeTB9t9yF*A)c4Y)(O34+Zf6L*j}RM16f! zUBf5P|)(5<~8oDSh>Uxis4KhH5F$~`PmNV0FJaB)<8$+b8~LP;byW9vY;t=Tv+RhE3iPYaF&pDtE~tk{2ZVzNB`^68lsqOUk21Flj7MyLzK+; zta^xcnDQNHw9%?eFy*hHC}YavikR}esN@WoM$sGx-wY1^B{udIb8vlaolc_Vbc&jX zMX0N45}kUgdS;qbvr@PLYL(c~+=**uPkW z6Q37~sd+25NXKDI@B;Iroh7c%=mnu6^+O~ZyGn(1#4U-%?baQi&IM#FO$Ma}fI ziuk0@y!a=sch%bIMnGEoL4oq`2A~K>%nxX6Zf(AQv)AVMS7vkAA$?M$t#-ujoMm1R zHC+?2jv(lXxEYK}Gx9>JoD5lF!H+NHB-TCHDh@_KHFt)=@ppKXPF zT_fOkG}M}_NkgSIb=}?=JyL1k>9!zh@#yq(J?ke}+=S|;Au-kcCr~KQAR;K9<~Xmf zrfV1ZIGUH1>`gokPFIubG~*`H&frg^9YFE`Wii9+3$+90h~pr5Dnq{#6^fMrn`LY; zP>J)XHyweWX4(p}2zk9QT`K%^81Ra&nsGEH{T#+N!5k*kmqevoeL3W)ZXg|v^&?sD zVM46S5yZX;(~V7u&PtBR_6b`4_~=KbiW(}&`X-P-eEk9nd3z0zClux=QB+fy_jwiO z$ArS@=+NxnT1lq`PJLnZH)eG;ShQJA5$HY0yqY$l1WVjEet0sp6I&ZtMx|m&r!N-f zBUCeLrixxqd64!y%8;dNzbyu^O7(YF1FSgu?*#^A5&Dk?#q{6nFI|)>cHg=SAaO5q@l`Gi{3mKGubQW@RohK%CcTc7hU4287nQ(6GM7)14 zab!=QHD~QPJr_HEpt5Ipct>JjF1IgpY;r1_icge^WAowg;X*ojDAzqUnK@D3Rah)U zD}_vE;L(Grp74R*Q$zNd-lIcf$4ie+#CM%J-Lp5l7=Co`~1m9r|@{=(k9i(~UyhPp>`cP{3(aQc4kC6ASN39NxQkZX|nfs(VkNJe251-ltPTXER;1 zQ@PmCk<$kkEGsuYb#UPHe5U8%zFpMb*<8;+d|!CiF(n9_v1IcvHiKByPeAiGVHy%4azP}rX7{+!V9XPzJyKgSN zBQ}^iYW45#>6y%y7PH;fnZX^W2j}*7ZR@a)9Ik<*i7^V1X4$E@ka{`pGZ#Mo5NiL;BvJ@Y*$1{W6-6Z;qA zXUC?GRR%|P4I&KwL~eX~c5(OEiQW4$v!nSv`_7&^5EWUTzE1 z9n3z~%5sFb z=}+Px9mP73H*|FDVu3sCV304g|40pTXs>mZb-?~-6fgw)@7bv8YvfvY0V1o@e`8Qf z13TD;|0n^pDg9xCRzJjxa(-pJHk*&vGS1fY$52qm^VWvAU)|Bs?ThjD)e7TRb~|{! z2d@qB9756N*b9-}>CFbU1fFkaMH_kDH(Rqmcyj@%j6_E0i);ON^G(S4Q*GnA-@^e%o1-Bn) zBZU0M<$Nv@qJiqJ0Op25+-0#WociQ-eBzP;$l;6UF}?tIu0?KBxKdLkmu9QpS_g8u z?!UzsF;46ISnI(eyBB4^KQs`w+P}{ft!ll-VF;F6eZ7W={q)1E!{D)L3>(~mPz<-S zR#z(0J-#A6PZ;7#^vWIwxo7a&P^8NSu<95>RDb%kK`nuy94p#Tq@Pa`pbIFDX;D69 zc9wE8~>9Qs71#_4w_rrzlL~-4+0s3{E;+#SHRn6k`B5+-= zFW0>fBb8j&>u}v~8-Ohwc<(WQRmTv{ETrFMP)l&#Z?d8dxo)DC>%d7ibTiZDD$q1^ zWO7XUz&Zq1MX_hwf$4!w8p8GJcv5>;(6WQdFECW5$MBDw{;TV?j-{Tx)-@WZ{?}Oj zU=1d;D|N-R>xLRw6hrgj1oN9tE*#THf0nfzJP3_k!5y?jjrRF6^x8EJL-#pYY{P3q zHM#~xo3o5?EF`_kpq9YU6|87OhVCM^lluS^Mvt8VIBD~YoteeNc4WntK&q@%WAhai zcRa@cO*(fx7qD+>7WNCx9ayvUcXY7*;*O31!6#d_C0Z4>HOffYyRzTmm3;kOvaXI$w6N&`38(sPWyunAHK-|Y{B`jH-J^g&<mV7lU+K>;w z?8k>vD&pv%Lg+pu^<+&?0{YOGfZ_ve8ud*NV0 zjEpc~sW7$Tl@Hf}K&CIK3~Pf0Rl8eK%KRA%pOUo?7%-jANjt$w?`xKmE`qEL`O4Z~ zV5Cykh8$V@x&hci*1lo@tBxU@;Y@$Ypq7xe&$FTpW$nczYx=^DA2;QK#!gsD1I5ew z6(&I@LIHmbPU&G5Nx^iFSp{nr5o46BU&+MNJ`TmZKQthsP8pmzP5*1Nl(`7JJM7E5 zcUNwg59KF_{mb6Y;(T4oN zyp&%4s5@usQ!7kT#z~YtfmxF?Gi-*%O?>c?&dhLLqAiC5q}y86izAO8VECqOUCh4- z3eUJV4Q}v^MlPgz0tP-tr>T#zrh?a>A3+%qfqG?5EcZ!aK9pdV)akh&O}&pb72K;v z&)^Que?7JlIuYJ~;h5-_E?JLff;6YxBLH=;>UM1he9r)pLI(apBGT)dpbuW(1obJ0 z!}@eNgIBFJp6z*`!D!U!bO3bvTXQ=7H7nXs?*7A1B9vYxD^%qul_kHYk$)Lby zCncn_V!R-2D=wQcK(>y-L%`t4W-)j%xJGMA_PVnS{+9d zz|lE_T7t{YvZ4*S>_x<7Z1=H1-hYDp!Y&eHt1grx^|dv%GwA(YMm-idRAgDAVz91bEnNfIT5$91jzw*Z7QysF+i@4 zv17p4$!0NjF}TX#J^xY+RdJQeKmT$Az@=Sg0IiOr#o^;OIjJwWJ-# ziZ! z-8v2*0}j95EDoFCv*4n)AaW4{;O8^y7p-1RN0*lOUq$Cj-pbE(yv67ENA(7IUa1tO zqt-cOMA(dTJ|fd6)qXRt?HsHcPu`D=F;3srXYmXHxV!=ff$OAR5M`i@C=(YyEZj^A z21;(wFa^VAuU6%eS-V*N3~{y7#%hC7iZyO)Yi#$5WDJ{7R8Pk60`KYgGf2i@)g~f? zAGJ0pQk;s{4On-iB+hjpB{12od7P(*1Ms;C}g4ZQ-y%?>K z+F`B_5i?3EMTY6sjn81`ZF1bx%vS@#Q{r-K5H{f-aeJ$InCj$&Lg&-eyTWCE)3~$( zaCw|?=^wO62^%aVUD|<+GXs6l)D#nmZ2)-kb931InZmzOI zvGYbjJvh5-I~i!2+oO70-2uo&+bzBWbXwhSfG{z!(g4_=-Cd2KQ{>=dc9f#`{CDj+ zznDf2Y)h^e+mg}QOg?tXy*as)64Ebh@9easkMFs$ObS7O(Nz55nS0dlndb=qG93WG z2iIRS5=|{>OMz`SKx%SJ@}BBy@IuU9exkY-SsvypIJ&l6ZA)A87UfSbl$Wd5CsT7t zB#20sqgHXQw0w@8=#8Om=QOCTp-Vs0x#k#U=j6NwR+E3KQJ!fq%39*2_1=D==CEV> zmup^aZT@)gZPc?kBK!nny5`$(A2Swh{9eu2R&=&&ZAZsAk}3HHy}X@>!;g1eO@$me z`*j0k3px8$26FI*wmu&eK$l-Os3i>8Ut~oa8n6auf|kXicJbb9(5g5SESPH(EKqs!M`qAn$zkC29UV$>`Lfu5VrT;8>r_dH z&whl@h6w+m0gyVvi$M6l8q^X9|2`|)kk9Vl$+UK;l1srd4e^_l5F1*QoA!JU9e0;X zZQVo-rR{FJwlQLKXiKE+P^*#aR)f}vz5baaW+nUqp>)k(z8vx(#w>->Ro3B=hYe66 zbkVQ@{5sakz}kR8ErGROROyi349yLI>j>8IYc(hp@HoubrsjJD9pUdaLM;2@`e3-S%3pN_A=~qRn z^W48|;}=&`mf(iO#co#2rVIjD8nE$^{yJSjh9i+FxTZB0Jfw}Bh4^GC_bJX&$5~!B zK$;7s5;Rye9JjKt6tS`>VqpTv(8OXWKU+dVVmr<`TC)PvOW-5Y2DI9^nvm(}f&al6 zQ$Mu&ta`YXx_46z6bx3U)mIs?yEw{91E3Yf@r@w#Wny}XsWb>DRDDsbwbai*gS?Vq zw}BnG3f$p16V$?jk{@eV8|>R*Q#w|*>doPP@Elvn!Z(Ive^$1D{DEM0x6=mh7p0dq zmyKGGw6aNss;3ONPgk}tbiog1RN4Ki&#jl*Pi$Efqo<2eTK4;A^IKu+v%9s_XMSDD zY-fK&pn~))+nJ+C#g$z(6nw~pf^IEZv=*fEL(%N~8c|gGbkkINiAJS#9CL~^x2wx1 zjvqZ`9ghthSR78qk5A@jd-oOW?2*n#d(IS29P95o-jg{saV*&t-@D`Nq14cPJbQG} zI(DLP;`mtQ#PMWu_V|v{iK+hiSeE|p=$ZJjqi5s0hr46hQ^VHY$*$PmgVc7S&csQ+aPVp1PEINx0aVlnAyYq$URbHfa-PKzCwI#qwPVh zMoW8fsZJ-2!<|)}CRgo-xj~WqAXJm+&}6W04s6!3 zxeqc7q(6#t6KYn(*&VG{sa*UM&`h%yf{jISc85A+`vBLv0a4W8V{xRtvCn@Q)EHxp z2KR4Fjoa8Mf4=6I4uCj$3;gh1M$dxD0_rL7<_!>~i^gjJUa^(nT{>ig7;Q zG~>Kpr=PYOc+H;C>5$uCXUSYTyCdCgdk;-bZ|6sOv2)>G3AAYeDBF1|n0q*F#>9p0 zE-l?gsbaQ=>KB-xt2qxPCX|+za(0Q1PSN7q4QSzAUAQ;H>n=Fopp#1zwE?~aET6R{`?_&!2B6lI%r;!w_XP} zfcf^F`g}`(rGFU@G1Km86`~clan#k<;kAB%w+67%A5G)-KW0kd7+Ht{GaMJcybX}& zEcT+kRGG~Z)6jq3Z!WR-Rp{G7l-oFyXIXW;iE`L^Ha5e{+X(rl10N=LzPdVv+MtQS z*+hLNfuyK@^ZI5Dg|`Jz{S|u=KqHK79R6c*Iix+9xKm`9SjLe`z`b@%$Amh3FB#{x znC@=wp79PxdGxJhIF2%DXSmU~dnQ^vTB&}nA!2}BoiD9&FF<+ z^>7HbOynZ__|JlSHz`yHBsx4wzjbZvmk4-vlU zqg4ITH0uAv5{n5ZnIWl*h6YD)cl)THW>O@Nn+ra5#RUJSFA*v6VxbxJ^A4z=9Sk6y zm0y2p3m&-a5+0#47!n3trF$0Msp!#wihOHb`U14A^@iIK8@%dN&a1T_6e#BmKoMII zXHishXzzc@y9M#*BZzKiqkwxapFl`E6gr}2G8Kw*_jn$ia|O(SA@Zcoz;~CQfWKR0 zUZAZ1q@Ar0oeE{4@Awgt(K^Bhp|0jARAw`&Sm>0!$TvN-b(r5g;5MhX&dm6%yJu!x zHwRxe;);d&8HPMPy8e0{0g?o4h0a~4j$FUm0Qn-Oj=Eynsi%3AIvt7uYcBt_6612H z@RsH$oH}na7^HCWt3g(t7V0@;_Ji}*I>eP=-{eDjr^WZL01H=vZr_dH(kIP9e$-&_I>^5ZkdGSF(m)PY8sgN)27^|`sShFL ztvdB_O-Dz0vEVCK{}Y1}{Iv>Y93(%94~Bg8GX{X^Nd6Fzykt;IAo&%nXhU(jd#tRi zJ%rm>8FEw1%)pOPcp$w{c4s@i*{`Sr{I4_M^?--#+%2hDOE&J*{Vi5EIMhH`LDWr+ z2Z{F`%uzZve-GIFHP%#cugzgI^4RubBDQ^Iu)n*1<|H%I#G9ePp8lCgXi5aj_eQ$A zPdaYID<5-k@dbv9c^x&%I`XQ1|%q$|zSU;6Lx-SUYYN&cd$tnZ7gRlSn9 z=mw4c4R(?9LRlC8!B7!QATd4tD;v9B6t|2fVtSr{>RRTL!u9Jo<+%oTQ&EUtwMRw+ z(%}KRG36AT@+rHVps>Ntcs|ydEN3&FXpK-9p+DSLxeB~(tX?BX?j>gW>lj@fta|aO zQ8E2DsOX{~agm~6ck>i%zhNa5WWCm*p!y~$$X+N4cB4Z>jTlBzuYr-imJQgI=;3?` zNW-g7zzsDLsvzNF*^G+$Fr?zMK5XgDTcN3#;10yB_)^yDijK-+TC*}Z4bPOZCXwj` za4n}blyR6iX->qr4-via>WcXHfhEhJmcY^rSkXq)+VRcU1Q@|q9U`bOr8zl=0aqRg zijrCPnMR~@Nzy$7Nb(XI8yO!7weOocG#)x;&xWROLjip4*s~^w$!IQCTx8erhDKyV zrFQHp%%zZJU@;PM&5-#V+kT++px8Emk4AM*ej7CzbnK*7^T;V&NW#0~G~E$;NY#y^ zZt0O3p2M20J;x8R6IBRYK~G2mft_%idt&Kqiu^v;5H6=jP-78|s-8nz5030~xm@1< zV}mA#Az#iIQr|Yay*?JD;qk0`cy?N@vX=E}#LK^8D~krf43QHTkV;DZaFBzwgDzMf zfndFajWHOUrUa|HUbAo*X344HHeh~(Q>RsPo@TZ5)XsU-U69rC5qz&}weZTVwOT&I z;15Q+uv$LN#;zA_{ha4(vJ82$hcXW6*WiPprLqb|y_Sj>UR@SH1}t4+P)lIxM+~8jCb{absO@ZW;nPgx^3RKN zxZ)T#PfM_kW*s%R?S~hC>%L?A?+-l&I~`0ic#@_K1RNvRlNLWAS1o;!?np0fs*4K! zC!HyeW+UYdg)2TaPl3zWDd4Ld=!hSe;VPZG#egMrI)5B=4z--lcR4zDP+wJ&WX~WA znmA1C*23G_;9IuxAofrzkKS4>Ox*=(;cDbpi0bjmS0`>4IlDU2*&Y6vv zf1Yufwh*p1v&sAy=3Gi$u?536qy07sh0O{lS>_<0G#I=N z@@D|@34>Z1$ia$2%nmmjv?})3ghaJ)e=S{3`3lslFevGWL>Wh%UX2fieD$OOU^|wo<1n71N+aXimq}9w`C?nx74R9-#J>O!u)ydHMWe*LnX4#|2dKGw7jh)jjSa0bv z`#H$$JAJ_La#M3MyV+T954-kk$@?+rk}3CU`}!M6GqrNHJ*?PnpqA~ZyP(x}JHFRt zJ6_p`?XZ9z4p^-5Z<6g;VMV%b2EWcrULpv#3$wB7MO)8yG`t$N6KLC5-RSJ|NvbMP zI4PUq!q0;Xul0e-ivW!agF6t@^D7x|uXLji`_#VkYXW1H^DD|Y0+=+XV%z{;T~@yU zELjG%1eRXFiZ+~I$7pTGXH9W9hJ`z0*DHzSf#Q`sX^+qreg!D`N-^iM6OQGwg)2-% zqCRkU3tLn?^>PEm>e%`su=SFbW9tr~*@nBjyIh)WI8rYdMlsHJ%#Ue^%}42qt{rkb*5AGP3krFLJ{uw82q}j@`|<4Yae7|*Ne7ZuhH;o^qN51 z#_A1@UgI=XfN(+vD;=E!zXT5ac^{a(;A`?4+(C=9TE$nZeIH|Wv|7c{YCkZi;r9&S z)v@$tVCf$XY6&d;9V^;UtHnsGF-2BJo_V`WiE_4u=oki_kw+?uB2RXT`y}SF*z>1z zujSIV2KsKwSKnQfz7!vBys7aLPRH<{1H;#&RwL&~a~Q6p2?y(H!mVuJ7e*5f)oMcO zE=UtTgzt4VA+Ow8O}L-Iud6q&DiE4*4;#B)^df0Ofi_JOa+)d*2L0dK^ct5%;uUbsoj$ysUT!#p1gr$dJ$k(tP^%ul;|Bdf;*^XCkE!$mxb7N~muw5I9dQFUr#C8I0 zHEszatD3erEt_G(uYnE!Z?kL|+(ApGEvuaLowjy@0&?0y83*)Hb1IJbP|+)Py0Cs7 zSbD^umJrqlS|LLp>j%J z=`23`B0Y6f(it{rUCJ9Jlzbd@no20SL=|chN>bPE1Xr%bG9RzPEFWaBDCn5|CNNt; z`(6#=Q96aqQ^Gu^qchvL0(@_~>X~IuSi|Dw-eYJ3Bi)orzV(_gU$^+48{r@bs>u z#UouiUDR5MqUZ)5>)E$AL!{B=o#o9 z;8-jt*-(z`T|CrN>^af9>qLL=XlcB7Y{zWZnPbQE*7#!o@K|d9&XLonO4-As`S!MR zVxRFcfi77Bkwm`csw*Hs_#f!CDgB8CqUp^$+2D$UztrT`QGnGAB&A{E%rMX7fYX3? zAYK*+%J{bseG^$8@U1p?eNC30w)3#_3Oy{E|}Y*Y@@) zN>Sm?YQCTH&^Js?bMvIgln*x{P9v2H$V_j`{dfP5N=yE215!{_nMhId*C?uw?mxYm zGoB#FrJezoUHePdIf+;Xxf#RJ0k0;_82Id;fEUYknlC6Woy;jYWr(~S>}q*yF_X8D z{|5JRC-VzA+!TexWjy*1>-tM*L<;BsZh&)rX8I90T%sR1*Jh^Q2GcN2UONeixe7iK zu60kP;-p~huG!f{Pog_K6zjFZeYQ0lwuY=&xW^t!^!CMPhpfIqUZGs9l*&=$q)X*c z@i9J|9UL3mX{C4W9El&A8(A3JF)}x{GZKkd3ujp+OmB5c^epr?C{arE(DZcDnVw29 zT)xf*U5VJ0V!mKS>==IGp4mtt6_2FKk?s(FgiG--4ya^uCN*hRB&K~a@>if%@WB6WK?f`NHT zfikSrd?8xSpR#kF&p4LcsM}8Dw9U-otTL|(@rkh(dt%)^Lv~+0oQMr~hx=mj-tf@C z>`=ISXf|$JUBg2|u~}Y)(g?CDy|Z@j@a({Fc)*IGO1EW&hkLqb!@c%EtZOhHkIi;* z!nH$~8;y&%E#~)u!JfYEp}v8BHox0v$aLzampwgQ1O3kAeVK)*+S`ZkmS-S`~rRg1uT8NDaf!*Q5G+3`%)a-5DL; zfDeXPew_heI+oiB%gYAU1eRaLiZyF_~B7cx~5X94ZXmn6XECTC&R+HOT8RCLTu zO*e|3C)W`siG~JPoR`kM?zBS!-5aaJD`x2$&KX^(lj_Rg)E8Z(+K{ugU?rD45TI{Iq+yEi%79%UTbZovmb zZGRVvHrm6`(R2@?>DdO=1e$JRMH_1S-h;T&#R^ShnJl-_xRTcr6SxEQT^ml%F{|ug z=(!9-=czZfL~97&mzvTiX9@Keq$#KHy{@L@m32)ilc%jTet(uBKv!yBJ{S7$1#Ikk zQB(cbRHC)o_BB=PTN;!&s#u zhcXW1zTTW}uQ7mEN7Hi%O+RN)O`z#XR=*ITEB?;D^($8bJoj!B)jkSL9dq*n(SU^ z6$cN23s1hP?yg&vs`JO`-6&va&1^=|=B$~mgtprastL5+%8E8rd2gAb4LUgJN$HKU zeTL8!dEY5`U)(Vi%V)7yfLn-Q_0X_=ZT28ldMf$9$$2BLnx!$gBZJl{?A44@TOi$Qgj@;176VE+{XNR?qN_%) z?22U*4IeXr9=6Ky8Z6NIbbmkb{&v<@aJL%o2lt>^MZrZy5EJ)~)h{Z8n64uFi6k`l z_^i^>K|xG%E7d;a$2ISVswT;Ln0fEc=VtChok#WcQdDlf7 z7s0#!5sX$?%^vUi#|*G7Oq35Zkb?z6Crl3!=64OM2|4-zE81`lG4QT`8!ZWd{k`ko zMFGRP^P2_$=y3NE++Q=Oromlb(p}#5_ZhS*yz7F!TIF3w<{uV;;A^Yg^elz%)vT1G zzHh-NLriZ((V&To@StP5k1&0`K{bKtYgy5T9QL-6Ov)k)gff&Y*qIEXnfM)=6Nqkr zrNS>E+(j?h&4nc_<4Vk(zL3gf5O||J^CA=RqBw6&F+Xfw7Q^BU4W+CM>>N1FkCc#e z85ax|Q?r#a***vb5&=T6c|`I`&E`=N(?2GoRT{qAfFpD=_Y;{T&63$jpw@DZ_*l(0 z>DGo^a&t$AH+sfbIHu5rP(~ZP6&yJ^Vt^H)i4PlKLPy{LA#mKFnvj$ItY||FoR|W? zBIBxLa+!UVhZ0G@22V;L;@4(o6bf*qhI<2QW`^W}#T~gX+vsV&4+p8I8B+DDIM!=J zkT&T$H7uw0BC8!dn{+%nC;0KDxzw4;BcWV+M(1 zatx|q1ZW%++=H-z&qL&poJ`TlSJvK-5er%Kqv!_=@F;}ry#}!BC>tV_z1yIgK-p8Q zXhR{pPh_kbb8^}XhoS#;U|e1)b{^pk8S1*w}$vhg6O31H-=zYX;TePm#FL^cQX|(t|f=W|*3ybHYb1NRJK`Zn=#NM_qT{RBu2S z&kdfTIxTHxEd{GFp~tCHcUXJl-O&e$o;R{;!98g7yqKau5w^afFp5#vhys;%P`Aeb zbwU(&8sI<|g@*`r&oihdQ1>t^+E5gR$ZMgl3sH<6BFIF>Ss3UgBois;XJ%yFv9vkB zNh@zasnnPO-gIOhsB&7<&4uy|=-=KKSURxsykR?6YZPZ+>2 zxbkBLFzcv#9-->@4XO#Q{17YJkSibG4GBwz*zHU5o+O-pSPT{6M961Dxk`2xjs$j3 zb*Yj_q+%&7Cvekz83#rdxmSXm8i)jhgqBecm-XgzboeNRyPq<4Zmyhk(yq$Oe0zKN z6;dU|u226!6d!-rfQ~wGMu<4yYL++`fsffi6kk4GeY?ZQtdzsY*Wi<(hiw&#Hs@j6 zL8!XIpqk+0ADQuSXKfl@v8eH?PHY$A+>l%xH(gJ0$rb}F>0GjtKo2zw`i15a+*^mU zN4`8Vim?h^w+dw(4%uS>yR_mA;MLKzi_r8ugKE->V?`Tkx_vbNa#sk}C%9Ie9iQZD z6$HR(&Q_dlt?X5ST%P?v4mP+ILFunzl9bk zc~+@ZvE!1RTF{c>qPH4gQb*4oLeE>8MbAaxBAjjX)lPqau}UsN8Am&P!T@$@hZ(@D zqiHXp>Gut)Njr=cZOBFWhFk;?Q$@Z{#51(z*xi(gGMQ)0*djGWoaK)0#?cMCKv6Da zq!o(!n2pT$xj8leUG#nxhkn<9N;>Mt2=(7;7WGYVXmC*xM!~m1>lgJ4qj9EJ;>Q#l?~#d#;~J~WxW`3^3N zn7^=vN}dFcnU`829!Zj83mKPFZ~;oLF4{$Z(fRr_68-H z2xdTjc9wW1)Tk8)*9RG{bvJHnsCdMjiZlow7`ELzvS!FJLFAA)_GX`Wk<30(hy8Hi zUnD`|xhI-U)qrdgsa&B_hE6EOiYeTaT%;5PJQYPqw9S$%iQE?T(?qb$1XL7lQd$Vg zWH4bD;Rp!HU8a}_alk$B?$U)ykzzBc0*_dzU>3u+EidjaNr_5WYNPh~*aJKzh5IvZ z$iz+2i0dp95F9aLL@?VkaW`oEy}Jw>c>%fcTnON$*q3`EPI$!>=!9dB5tRK>qf9;u6HU$zxwdXUHQjuXA43)5p2pFM^ zApC!_0sb#Fjzm^M0Up21i9Cx4M^*b}PLy23{v~E{{wEoU-n5Vt)tr}YprmUuLC~$d z%jx+xN{~epVhq33barscqk+G^$~mTa{2E4!)omer-p0l7lsSoq za$!UCF@#e09i2Fd@NtA&Sp0dlfKu~-4#>Y81&(F4;I zs}*G$GGvO{ksvU5-R<&1D{*Nu(M@cTOu>6|AXLa>mY}!TfU#&hFJCDF=Q3TE8?KNO zlBXdkh6Vvr(MG%y_#o~NxG~TU#yIGf3wR#wq&XF=P`xn%`Gjo^St7s%7q?h+IC^Gg zduT)lCJ!b-;2~iI+^#%bvIf5e2H}V#3o6)2e#MAA^rj1|Ye83WHX<<;Uw`O9T6KE> zTxAQ%oI;5rHYGeKg*Z=mz-$dKuq(ZVP}I5tB?>}*?BIhc!P_lE7n21{<2!Tlv062r0x$L&4|HbvL`tiE60VylD3|_($6C=OI+UaG$ z&%xDBI<{uD`g#MJ2*=2486B|9z9Rse&N`Ng!%_2}ZW2AvgcTqK;TCO{l7@rmhfbOO zI^kz^wNAO9eMNEPtX|dRQ`HUb&Z%#Af)9ZZb-85qrckXp!@-crt*W;OCC1jVVOy9% zuC%9Gfsm_!$VOUSgJlO=)tnHylX$niK0)3xtgsZm&Rgu)s-l&lqHGoa0BIX z4pJ$nhd*Tu5$rJXvf9;T!Z}R{p3(-{*!lOZ6?D8_GZ(!hXvRBJA=>;L(P}mr_U}Pb zQ1nSwR8wuoJCK{V0WB`utGa!l>(DEn?W;pu%iycgNu!7d!QfY+DD(XNKbJ1u9Hyty zdVTKq*5yaXkQZUOm@@9JqamEKPH(ra0F7(dE|yDE_zk(Srnr9vT|X?Yw_MrU$^n~? zxEakdPnzZbJ1@;r{Y#&f*fVZr=VMfjfzm!k6(YGkD?o>bZ}5C^NH=cIHv3VO3I4<9 zg=MF2YS1g2D}!QY1yJ1M2(Y$cEX19AX@UoPvqE_)t`_yuvIsbtR$RewucqCy;NjpL z7CGC*fiF3Zb?Ti{`{gSbz#8uUa2jbH`Chw%;oLy@aJfW+$JJbJm0w%Ic-)7>IA)sB zhYO?+_n_OATUym0C~lN)8E)#H?=A&v5fj1yP7cB}s8%#8GmN>xG*Qu*$Zbgt@)r!By{k1E*U1x)Gy9Jg_t z$&LVRH7DP_D9Ws)mp=WTXa@iql~)5WB)A>bE+jawoi?_w00{_0ayh@1JCzTo8FpSI zcD|e8wh4Bw-$Ocyea>_W4|3i9J^3$WgwH|d_TaAD`VBCTFREi$GJZv-{BbH(Zx$IR z!f+>r<+gy!WhTFe@SQf|`1Lww_xI2ZISudcxzm3)1KWDo@ye7W$r}|@l*=11fwRT>a32dZR{ zQ-s3n*+C-gb~}#xnL`t!<7`{pl{;-9(z^}Y+j7fM@7Bp%DK?B?OT6I{Mw6o>&N24T zW7C?|Gp{gUG2x4%?wGReUlC<$#;tk$uX7Vl3d%Y~Oi`KK_^%^QUtM*53o_$nwzyxQ zT2G~SLHCd{5eef6BzMBNZj~_3m}Qi(a%wp0sPWnB7m=Ekf=j{*4JUW5j(-Ef+Rq2 zQaHeb4d+Y-QZ_R+bs$tKWN`c*seW){QRpF=2fYx_mm;wev|I!MU=cfB=`2_U#N>6B zN|`XLLkcHc!3a}l1SDe7?BC;Z}iw6+XBFoyj`BX8V zA^ZU9G;%_VV+-#^(I6RPv$Hm-zl1pZ zU96gBA|C%BxcV~3{&;gNxa`zLq@lyIpJptp?-U=qKuSqYK^wd}&ovW$0pr0;R9hrS zSma)EZ7pmgkDRwYb?-Y9zA#}s`_8*sp|Ck-)JF9NrQpMSQg9jE^i7*E@U3Qh`v1@< zUE9-Q)Ele+{u4VfD4T+Fd^0x1%N)(ypc-FJWr&B}HCTGnWO%>^Ve6vKGvS4Wg)jwVV~L4m12J3?8E=NoYTxc7XUDq7Q)4Aus5xBjIdE7iluKwt3h5ggAiXBanbcJMDCZ>) zMcik%ss}hb!R&0nQMe+uxX2C@GM~7!Iz%X^SPMEQdIne6sx!IV&2XSErmk~$Dhaq& zlG~|!e*^rHfg~1D)D2rit#g1-bl_uXAh(*K^(qgl-OPXdwJ1u*PTE<<1v>O%enF_r zD@3*Gu=T`rSL*ojE_S@6-R&NTmMXJZ95zNII;zWqFYV4@K)RciM$?n%@9Q4u4G(q? z421iJaFOkBZ+s}6Nc40M&ck&>v5b|KWy zf`aF819)mz^Y8Es`C??KpJnsp`DLgVZCr#5^)JO}g#*Tuq5kCt*cNV<#~H}M8!o!( z`@e}W=M1We>=0*J(T3R}3^LUJ5?T@f`)8>CWfU-UFTKS803Ggk5!`PwsHVXkY*&fw zz6%DeiVXFFy;_x_{<@A1X*u{NAo&7DCQ!as7IaL|FX5{pzCULGqK@x(6Tbh0Z)D!fz|tbL_R|HT07Ix2sQQ29^IqSAe(tB z!{6b|O(<;0nKzCo=ciO_T&=MEJI zKkegCoZe$VMV-^%OQh*+mNXZd)9D@%y0FWauct9up<-8ivJ@UQfM3kxlLj#BsCplv z>X1P-!Nmty(S}^Szcx!Dax%^1x&w73hdO`YM~4~w-VkcZHKm4<{H8ey3=x-UA$NdHM~f-j7q(%o5O#Z0d9gB~Bs*J82j)x_zrfg_ z#s?>@9Vf)z#{l|O0~QiKIO>M^;2yh>cu>sEp{ma$wX@m>iMb`&5g4F(_1=apRC52c zTbViXqK!`V^bc?+98!eS8)RkUf8&Z-`rGcBolW$>yEYW-wZeV2H5;~utXR0m9!m7~ z#b<}CzQOjkb8V3}wA&8H9aWM$QMA)-m%~DFXrA&;O8iBU1)cM=_VInEN(cM;&lHm7 zk@4Kl)SiLt&c(`+zI0;G_}P46Pi6mner|3!Mk8xams8Y7@9^MIZ(m;`Jk&o72Oy2k z!mIF5B4*86y~AC-v3^$GsxUz0n1o|Z9}GnV%pxd(RY76G_6_$A_ViJwNNI;o z;V10v>KPvF>7{opr!oyC7w(!Gh#osT(sMA)T9{|3d}wM{80dWDMGx&lPMb`=M5!;j z^*?(ac@doaT8Z&TfKQ<^k6$KO=Z^`&l*oR#fikJ_`IHeOQs3wEySh9(s-SwOg$z_G z@JQX`xU{X|}^{WlgN<$a%j9*4kedvGYjc2U>{75X8FUDC|9}g&;;Ww@x#J*f+ zCQ50-DIE@vA9PF|+Irdz16{=P2=HibW4SD$Cy*lyWg_hEv{SkKLQX}z$<+XLnnI+J zA8wpD!i_Z}bSAt1%aEZ*GhD9&Ad!5n3oOw9MZ*0v;b?VL`x>--lA#A$1q8)?5NtxI z7eR3}Fn3Vg;?svm#W@^Vj^H#7uKNthoa7=;By9B^+%{>j11XkvSogs)7I)ZrFHR7V ztR49R0^8!@gkq}>fA&H7{46;a`ycHrodeZ3=R7WV8p8yz01OzyT$9~>Pm zk(Efh#=__(cTagS%-jYPKl(s=p{$H*Dksd(fxhAX;jV$M9#LIbs(9VkJvcO=Uh7tP zv7ka!Qf1jQylrkv-M377;gp`Cvi+33*f={SVWhlBtxryki2ev#`M-AB*>CSJ^_@|d}$?DB!0M;Ba}5{s?u?!EG1VpJlraXsyJum z#OVufe>D_T?fOzue$|1KZ|UD)%F2@M*k>dRAVk_TB3Xj9#rU9m+6tFO>o9^W-X6pd zs*qreN0Z~tiJ@%3{cro3{un@bEYyzmS-U5PsVwMll6=ECO8y1TQoKg*+S!IhjOBfO zO#8yV<_o3g`K@-G+^19wsVcRq?ZVWcgDO(ArTHN+X%De+i&ccwTC$FVNgR8sFusHPv^TdG_mrl_b)+kG=J> zs8DvY1_q>U-Z*hq{#bV>TXxz&D_o^DpV-;m2>lLB^z1EMZ#1%;7*$OQX8GOyuahg+ zhqUg3_)V0qOJPshh7|XfhgU9`1$-(nYsAB^HO1Hq9~SWxtl<#Pcl=3utWFB++QRaU zE59@Mg#m+1chRNbKH@6tx&LjilOWq&#{0W5Io&m6I9pu-br;rtBYKZBT7($@M%0iE zKncp9CjSBr8C-Q>%!2MV$>!vfGrPdr5b;_IjQT`9o;Y34o4$+ErZ)wRS4Fw|(tjJU zrmS%BsUFKEnuGi4AUaPF+a%GSAp~;gsBelvn zPpQt%(7ut$gNOynP#C7(f)-d5r9?M&9BWyTYmUbbK33}?!+xI(C)5!l;taJ;Jkrvx z_o?y})pV;hLfz0VWBAa>=!B0wt-gh6U|Q9t`^S)gN*}04x_gFp?${aLTMzn??%^I@ zpm(UxZn2+gt?*b=_#BQ?YR`Ta~30ZC7ufNfCqQT2op-0hFlkIUJi-jyni_)=5k0( zP_UEKke5SZI3}Q&v^hRd{e{{uhr|GF%A&s<5+lXQ{V!i#Tn>p5IPu@_kO;dR5+gC8 z{;geLt54#G%e?h|l7C+giIJFa{p)OY{>1D(Tn>o|IaI$K5_75U4~a;%r**&Ja!5?m zTWx+@2G1ZgUJi+IO`h(9D%xxOq3;05uYQJ%uj%4%B3=%OVM!5cJ^T{C-hVHL#CS2H z{=OU%!%=amL~7RrM_dkxQM_vKb43Ty<5|19HI%XgOXD|qpPpq^F} z_n8yUaXBRB{NwR1hs5}+ggWLd74}y_wT7-<4(eLpWVjp>qcDFtB<6BR3)Nfz&tI;)& z7Ui&(<$g%4H*lB;t!AZ9?sf;@ppk;-jM;lJ-q%lgwJ-+>F=T6P!8kXEwUR~zRA(s9vl-=J$!~Zq>!jMH97vTbd|AEnp%)_1w z1gZwu7Kw+K7|6k?xAZK!pCQ7$!l0T+Jp58tv|-|5g9`-SftCco{uclzQwQSIWkYT&*(6TBBl0 zpZ$jc4s^giPk{Yfvw#_~&u2LfR+7XY^v4#xFa4i=w?luFap-?1J{Z#fb`%ZDE?KMg zzd&fZ)u5W7|IMsuL;Bxx5J`-z&@^&j$P0B{WUup8QG2@q#5%RVNMH;$3&usDHgaY8 zQv3NBtCV(>aj5+Q1K7n}a>4*!9Zg>%G#xXjCa68liZ-Nn-+p^BgqU(B>PS%!Ybill z+*tlhWI*%N0aH>3tgN!)m9qx;(vk3GLc&6`NN9prf{Ti@^n7BeU(_!x{hW_F3rtHd zbE_ur^Gi!VbS#MzVH+H{kKrx}9zRA$mjIsMoBJS4=stE=4 z6;`yNf-*36uWVNU`y0EfP{42+{%->Sbe;4qg8RP=sx=2UZc>?oJePc@pt~K2SF=*i zB(%jG*1J%&Ig{ht1naX6s%fy+*OVk5!m$660S1L(FGQ)L?Tho7d)fHD%SEb_J%eHjsY^`n*gA?7A@|g-<1+c6>h*7H# zw!E31u*L6BNUqXuAlSdIdK;2B(@EN*oxnYvxcMX=on2(7AD7Q9r#}eVrGE#bDOGRv zEeKm2#b~^|m>Ui`bUBRbno_<}jM>ZS-#~c`DtTq~`dFoiZp%^eX}o%!e3MD#?B((5 z+LB!^!#XZ4S2rSE3}DWbB8eiq(LBCfU31jRRP567tC#P835K$j-L^1ZT{mav=r)9W z5lyU%<1jg#yV(N%xR&=6Mf0cdXPfvFx1Zy$_2qmlN>{GX*V1yDbZYg+L_S~6<;%9~ z%l<2?>*+3rTqPSlL-|*i@#cCQS4tu!=cK zZ-91fD~mVlkTD`=6GY2P)$3EaLZwW5EP1+OV!67yQpQa+%hhM=AEI`#m@h_?xIZFe z7lC6MW~{tiy&+#I`?s*!^TpFd`nzDH>h-)`pZ@g^p32n?H2xBhlmvP*fM>b7K4azP zDs#A6aVR;P~Nx}xsKO?bhB6Vgtxu$wOPKD=j zakqR`y$al1T_3Mx3sJ>%Kq`AdF|NfNa*3ds8`v9QHdi9jJFf~QoK?+7&t!?0Ht<_F zqVAfELm+MQsZxsb<_*z!szld70uWLhsCbPO1|}!f>i|y)5`g2nkajSQC>ceD8^CuG z3V?p0pORgqG9WND7zf3#Em{lePjKi)5-KoGZVr5yNo7;z<%1jUt6pEQ3yuaLc&?*2 zvsQ^tGG~^n&yu;C@wyZ#EaHZjTm;cuoy*l*s3aQzN=D0e78ELjB5UzJd~a7DP|!KkmlLcHNPTCroXw!Kb!BT7LKH72m-nx&ZU$Rsk^NXm zr&3{2mR@N2iRy;ZBCg^*gHy(H$qfDj3tyed6X#!7%0g*JPgfw;B_Qf1_Ba1Cn#m(6 zG)L{`SP~1n7--MM4OnIP#` z$`b!(@)j4ytC>au+hk{j>WAvD& zN1PrOJxy`96Bw zx(bh*=`l`^{q)#@**pDQdfe28#|C<=CkASx$6tbr(%+`X*XZ#TdZfS%=>$Fg@D4ma zMvpJh{_7WrX5+m{wBk&R{V2FK!A$5r%^a+N{C5Ff+D#_bO?Yuqt zRtV9%Aw(aB5Pcd#^c4uvUnPH-{63eUD~J)91g)oEOoDEwUrd7TqhCyd`sf#vpb`4T zBxsy|F$sE%elZD3(k~`K75c>_=%w_FNzjw@i%HNM=@*lrx6>~sLGPnqOoBc}znBDl zhJG;#`a1n$67;w9i%HPG(Jv-JS6_u+OoBGjFD5~E(k~`K56~|rK|}P5Nzf?$ViGh- zznBC?=@*lr4Eyd36Q*dp24d`6iotmw_2m#XwSt;Kb+S61mpt$j>>#WJlv zZt=DyzFbjlgN+-@SIB~0u3j6<iyW3z*X$JUUrlq|_ke@_SC(F}JPD%>t6G?U zV!GxXE0fp#dTVkWRz8a*n11rLT8$-F^9Y5sJ4i$XEo`iw8UgC2F!N$GiN)=qPRfYW zS*+x+bn9Hm7f*G%Qoq1p2*a`}`M%>Ha=10by?!r=C32)#Dm&h~$F?-~OfnbKru1WtXfW7mA0o#C$H{N4B+gy*L zP0cp-l<-{_4A}l)Hh#by*sZMsHgv&&9S8cuRlq)H1;Cm}Er4wV?zhds{YI<6y>A8Jn$fm_%>Ji2 zu>amFV7Fc{V0(k7pIh!VwxVuC(Uw?I_g^qz`+|Y(GzWHDtAOoT0kCFL+i*EBW)AM| zR)PD#3cxj!+6ESK%pBO6Rsp+h1;F|^D6rjSm4Z37JYe%FP8aQ8G zXAawPt6+bmex{>XJM*Xp&)ySqLWIZO<{bYBr&0ORSpS6_Bs97DP4~ zgsoyC7{Xq22)kMZVc!ZM^dll-$WrmX`B*9##DnG_?rRl@{VM=*TP+dA4dj74Ds$%G z#ajj5K#Raj{h2v%pKcX!53T^XNG)&(^$ZR6 zcMk^x_&4SN{#C00e0T)_`lwMh-8axPtL`(N>aRf2mQ3}JtN=WpHNAgKMKCotn}d7% z`GL!0q($_>o)thGuH{&S%GzhbUBMs@nuFNaLJ&XPN)Q`t`W!X~ar{yRv4LEkG6yl) zLJ&XNN-8$+oxZ{x#Fw@Z#6M^yhz&fZzhDmH8!uH58#oR>U=HH@S_tCjT1mwQTXUZ` z2k|p41o88&1aUBU()b5+5dXG?AbzQpAPxnCc+FO0OXq47Jr7GqoBF@fN)Q{^s&|`% zcxMYi{EHQU=wpv_>!!PbdGnw-j6*Gi@oO!Gv4MSa#2m)S*1>pi%att!vVnz@HwQA) zLLl#LEszatoF~kId}RxPyw3%sO=rl&iBNXp?%Gr?mZ`+)gx?&FlvUdeg4DN;l?Er7 z!OHn9O~sft_8_9PXeKEiWI5_&isPu$V{*(Hr^alwvWHVm=XaOgJx7-I{?Q+tyL-?1 zeZJrGJHI{WUV3hj4{ni=Z6Q5xJ@#J6r)gVlsj2$)6_uq+7L{15ip>udEvn4Xi%w^A zTTWV9dwrYJwP8c*#s;V8s!MHfq&XUF*7ka{SliHSZnK%C%}#TBeVVPcc7xL#urF0~ zZfbOkq1A42+EeZ%F}m8_J;l*%Z}Nb)BFSAV#?bzmeAj4?j`qaTzx~~n|GO=h7#c6W zDw@g);8sF3oJ?C!N+D_Xc`^(g7K7%9aL+wrl=LxP62u8&qI3|_ElbD<_L|P%ZF&nY zrZP1%&{Zd$rFTsoZk%xl{A7uN?=8vXTa454ag*+fgXQVzFo$hX8cDuxQ zX)cm|3yZQ=U!*2|OlK@y&s;cux~5WhfzxHnvXW=et9CS9oyg`EYlgg7UuD@ykDOON zBU);$6I^q*hrff7QBps>(1>>-EIZ|agY-+;Je-iX7ZzkMqd9sx+d|I6>Fnv`5<kE4E7P_YnX?5+)iJNkf>5y*2;T%2rot68=N4!fe zp32?yb*jB`bg6W>@ZTRnrq>DYcciCOACPtWTx zoR_KI=lRkJ|Ku$izlg970vFNa`D@5#wB{`$CrWWelp+_=n}tbadw@BZsV^ru3mV2( zM?hfp@WLwc3aj2bM&0659|)j6hpP92s>nXRIsyW#?=D(Ejt zC#l*TuGV_Hn;suGir11Ou&AV*oF06kcWT#Y7DG)O9O+ciyfrA z4>7M}BeP|ymez|DgG~oETd-+CXIQ{ zGN4Ni?vew$q-%pW%59`d7T<#oWN|zRrR&I(Kgl-k;62#}?)DxVxRH5mU^RMdU}Z>G zu{j32m)xd5N~kEJyU~S;XK7vTdf1?rH@7J1X}GdfCrH=fKxKjvPuK2=jSWq9cbN+J zvTY&qFNr&o?^GHhJLvr}`;cX6C)vlc_fodS(o4s7`xk{uc*(R{#sNjbfi?|{tWrbk z!&-8Pg$^N<^uiS}O8=k|(#XmguzZ<`Tx2Qd8A^08O2qQ@2=h5i0fR|Yfi zfwQ&2*BL3MI-StYQQG_zy-AswQsH?Hv6De0D?wmdhG&L=%BB_iInTx$Vb5!N%Z=gp?f{b>smcjfSw% zBQIP{Uu$NM9wBMU%vi}R7Gd%uVuJ3sXriz|M;5SzVm~2DZ&7AqD$I~{q=v;*GZ@$} z1hzetO zSq$Y4}-~9fFV{mw^9RJnnG2cf5gGL)mq_w ij=7&<7ARmsv#V4%%^^-9LO=FV+50qJDq|tNz5ZYL09She delta 4725 zcma)8_w)*%z>Y^4R6IETW=lHJ~oyi~1^$mF0>kFCk5BwXG2< z!P>K8U({;SFJfyIiME>fN{!f9Ya4A$6AH1h)|Rw>FllTgoimraohwW4ewo=jch2vB z=FFKhcTYVe2Zo4tr}n_x+fQgOr^3Cojidk;+J7KDU{AN|PYC12c_YNnv5WVP_u9m6 za66Wg%lJ0tA`a6b>=Fxg+{C7G@e&L;+~j6}i4&flSfB17KjTD)k~mR0@iVHExXZW0 zm*CZUL%gBueF@@8c${89{$eU4&JJ zKR{r0Z>Ez(!r@GRs0`z|Q2m&>EAbLV$X<&X_?9~E4R6=hd+JPf-)d|frIphGlRT>9>t7oQ8Thf@=1#Dbhbr*J1a?R0M}!v zSIq!9yPy9AEhEG(+EI(cw1a^hn_lduzY1qHdE-QR22{FA$R#-AvXd+Dz!gQVA(&i+ zW3!T;%79o(yoigooR{$DB>V;1$zhffj)u28*D|S(dm-M3pK?v)0n&9>CHs3Ug37&& zqat@%_+=3qej~WkHM*}PtJCaluk_Fb{j*F7XE`A`nG>06808Dfu4v3xS8CxF-f%VVMTPU1S==YA& z&-UwI38bGx^?TvS{FRAg7CcJucq6gWPQxmD6ifw6pOa?OTR^@EUMt898KmmsA^5Vu z9CDN%W%_fVAc=ItGYi&|6Hv9Fh@9^^wO|n;6MLR4%p|0{Cw)=)cpc8A)#^}BQQ=lH zk3pDuI86_65;l$4)L~PJ5@p!z#ikXTlh_=`<_78~CibH}`^993aE!@fC6{EeTuHK+YmzMPx_BF#UbwaF5s89t-1)TL zJX_o$v}o}l>exYy5Sw6dg;5au;eK&^EZ&vvnwsibkFPKU%TsW3zG}7@= zwP&!@06Ug%6FL^u<(#!q z-P#4ZwMOzfPk5Chn1UfZqJ;N(LMKNss}r0su+B`sJh?6Sf+JYe2*l%r>+7xLI#0O9 z5v;)w&TX)gUwOhW93fVXfJb!C#`%Q6t_pu54ReGzb%GN*UpA9yB!rC=k*T4Ozbu$dO${+v>V*1oGg-zXie$vYa01h$J-x@vJ3Xy!i*5Ieh2Qs+?*kBy2L1(>&o6M=;G)a{!aUy-E+7Dl7db z#BJxdJSI69%#ErH@;i^XFC)slYI|XT8&y-_g4ZZ$b$Bz$NhRpGq)H9Wiz)C?wNWrC zIMX=}q>5@`mE36&jY5tBlf_|7_F&wZvpGX3Q83(o#%A@X3~Vt#YK=|UqCkj#1WnWQ zVB8q4aS3}AjJJ43Mlg(lExE#B1><9m0sCszquSS`hugKW!dV6842Lmg1>?$ajUIZp z+JsvQ&i5P#+}nb4=is(j;ZFtT4<3_Rr;b5yw%6H6800tl%V7w8@|VLLwME(MR}w34 zZsN^dYUX%~QyMZ!9*=Ozh>H#CiI&o!hnPkSSqzNT!lmq)bnh}r508ysnNkWYEU5r#00{s@&nb_*C5id!oF1voCJi~s-t diff --git a/en/.doctrees/ssi-introduction.doctree b/en/.doctrees/ssi-introduction.doctree index 725e2a7e3c1df3036c586e24d1237e8e86b331df..f30ca77640085b63501f01384e7268977e0164b2 100644 GIT binary patch delta 4858 zcmb{0eN2-_7y$6yVGB+tYO%@~eG4s698g9402D;5%wbgKx55hY_3}=oNI}85;s**^ zQF!V!E}LI*n+`RmQ*m>OnK8O#8l7>On-jCl#l^+xoZEC+cK1@~UDu@VANzy0^q%|O zbI(1!5)K^0=Z|AmgKGP!UB^_Pn;j)dNqXyynU?8OC#THKPJAV6>dZ8~Xt&#{)6C}D z;%a+MSy@tfgz(Rtys3qz?KrK383{So(y#j9=rTds2yN zxQ3zD!_(l%&jciRd1tG1U$iY65@NE1}WTb%_ zKFu&1=>B5DMm(U4sfv^Z)`?b>?PrFT%pf(-HiS+Hl1q?Ap2!X}ATFzhN9Mz!tQBaX zA7m&&=K4i8P1?pIm0-$lLsfo|VFX#~7cope(x2T9G+5q+dP_TM^23A^W<6#4F&l!d zE=^ttSe4pVZ5qa$?v5Kr$Mk|F*)BFF+P zz6r8}^vbHupmV*GS^?ZDJR zT>{sLdp*?=2RVZ+D~p!emXx|0UGz32+J0_VyJ^}!w^b~O>RCp<*ZwISsKO`Yc|MI{ zqM=|Zo1;0^eOa=%F&r*4qmyu}EO%h{D7mCP7d4D4kL`brq$#zNdDTvG?&U+kQLa{> zB)?1Tu(^CV>VOmFi_jVOU~wlxf4e`b7>!Ve`;IgyD1=58xTJRX)1{Tj_#vHhfIi5i zOkAb-W%_W5K3srxmG?9>ut^STl4wA)bje+3D?vti@@^`~lj$zHC(Exc$d>z$svOcG z5LFunv#M=Kg1vS_U-`4GmC9A*OTr9-eUO2E3(*rVRmq=`GV;WKHp!7uqjS3ky6Qt< ztzC!Kv(_4FjX(}~xJj!YriALMdkIQv;?a97^A5{|2WG6K;LMJWv(sM;JUt99ZPY;e z3In>vGFMn8LJ8AVXMp&X(da(Q++!FxyHXVqsJc|q)r%jZ~J5 z1?xE?k|A`;h*eH#o_jXixEr+}f!Oj{>lBd0`p6}Y`F;3-oib-jQy zI3(SR=;IZoV!`t{VGbh5No?c7qNt=cr1CdRYNQw}dwe*vTo)jFO;0AvfI^ z{60tQXNW{4gmu#pINc=RPLBD^%fO80fF}f0+1V`Mo1F5sSJ9i5C6j_5bHu}5A|l{b zOOu$nSwI6|P>UhNbJO;Ny=^@mJ5pH=LmBnf!5+s$}^{$U=Xz!tacbrbJM? zM&rSK+50pU9`5jTCmeMJ?klxR15aGhIDu2*y^4Okl0-VUr{XCbkTHJZNcj9e;2`>RXSYHnJXAGQ-KK$J1p465v`QaJIG(aPIYx< b&GO<>m;6r}XP+e%%Sv6j7MX=fJB$AXfx`z9 delta 4449 zcma)6vw@HU4>L++vT~+zJLV+fn5Zof>9AE%r}al@{Z+~iZ28u$w!DNigFfE zCWh&c(!^B!*)-0WGZ<84R;JTLlY?6Mm})}*Xr`PV_x|?Lz1vQ|{bzr>zk9x)bM86k zp5Jc=-@|Y9W92SoNB6OQ<%fxIFR2)1Lr(Gt5m-%=a@Zyd;*82Ss05ns_?Zt5iB z%OxfbZirW{8x-glDHPsvil=2m+GC8Kc(Dxhv^<*;qrmvJmAwux)(0*B3mPv+F&m%L#^2=)aDJJkaVC+8mFqbq})>~>t?4HHT*CEhW!=bb?} z#IbqH5pM7%4I|PzNjjO000xS*Ff?DKd4}%RU1FLBvt%6+^`8Z{_7ImFA27luw-+jM zQ zlWhX6QH+o*_AK>Bpob@iMSIqf;4&_OaKbkcO$q6EJCXj(@dy?TonkYB^pj_7on zkLe9}pHc^dl4aNxho!5dZ03cw*oAaFK~-r)JlCRjXOc*PC(f%cUB7W%rM<~crvt%t za+_M_T?{pa@~V9GX~#fiXEa=`N<^pNNmX8;W0j0< z=lF&dw&=-2But@~=(eSGA~Dh>-X5$Y5FenqA5qare|dd1M18Wb*(CC(uAF+e{q(T|JJxAEZ=y1ZYYOD)1B z@x-PI6fPOl;2p-&w~JIUASP~^Px=EMHE7`A){S_LQfh1ItOpB)@Mv2StgKa;=p%`i zxnrq zT|R&e$ZXIdHEh~p@^jWR5EeJOY7rq%ScMW;bsVGC$*VIUbf*r@X9?L1LGKGe*{DOM zEMYA}Fvt_qVXV=B8dyR-Lomt_RL$vd>opVVU0!vt1^1mL;5K2$6CGdaSy3 z&qc#5;Uk6+B~M6)xAz#(_blNyLx`3msG2jNW3K`I$rAox2xd9LqlR?Y^SS|rz|kg? zzq21T6JbeX5*ZGtN$xIKqvEmrw%Q)G&0^jC(jvH^YIFcHhD|(H@E4 z=P(yoOcuyvXf*r4jIVQ;&l!wir9CfO!a`|x`9GUdZ3zGX diff --git a/en/.doctrees/standards.doctree b/en/.doctrees/standards.doctree index 19fa3f4fac2c131e04a6443952df90ceaf2b6d55..21cfb19abdcdf9ca241f9ad29ec204ae19bf880b 100644 GIT binary patch delta 3395 zcmb`~e@q)?7zgk@S4(jUZs|aQ!Cfg((6yzEpT)rt7KYaYm#3tBLd8gRvb9@g9dmINs>1ZSd3-9;vq1S9yGHK@0{5huu!+ zNcV6s)Ys=Y(H|5;U5@^MGtl2tIMQtw{r!XX;U2qmDrg_+cJ>VU`-1lWY;%ag=T3%2 zQ%6{QbTphRrgVfS69a?218dMYlfr&6O>R$DH?6nua*IX&d@$+z-^&V#rfhLW%=1>_ zYEBA%;cS9hOwIoo7I8V>YF^;BY!Q>C>ui@J8bq5kk0w_Ie5JJBWQXNLY?tSaXD8xm zmj&kVf~$DjH6<&DV!;(xPTY!oP`ZNK3M>h8%2#FhZJE zDXx7bc=f4F?jM!$H#K(ZF=nbW;W3=8vBs~DP!hge?^5n*n#TQf<5Ud~1vKp32qy~} z+Lw3ZSS=3+sNf+2uPwAeA5C|Yw4j}KV{07`XQ(hr1dFy%iq-WNc#{gR6CqPeVAJ7Y zPaRyP!tA;*>)Ct=*21}H-Os~K3VcaQ$kJ27uluXv7b^TjglsJ#>TLrKmm4?c&^?mQ z(MqrNA`5>$V1=DbiLDhW#`}M7!KTGTy>9&OAP>cq*iDICJ;Y}XJoqSaFh*20Zax~U zfZ0YKB$_@EOUp}?@VHh1v0Jg2Zp2q=GT=o@ou$+hS`@41d=n2BDDf5{P&lM#r7DJb zDttr)!LC&V>rY~H64pJem;s%eFN~}!-p(?vRTV!Ri?fw+kDd~C`AfJVl@W*;QNLyhP>9jJ=7f!x1@=aO zGrkONQbnGNk*usrJ!L)ARl!|S8E-3wFeN|HPTqeImmha0A2``R&>QyFDlRT{9s3t6 CLn*=l delta 3086 zcma*pZERCj7zgm3vvr#ytfZq;2D`T}YgutyU)b2#fOfBi3hS&6S-0uBH7QqOadVMm z5FjB0NYS~c7~_|zm}nS5mnJ3}HI^yK_=*9EBw~yj6Qj{Yqf4CLbGzE-eBqui_uQO& zpI`syCATMggS>T}7)}~4R*fwf78~IQcR%TZ7S9JXLt!CkH7(GhqJ&ww${I(aIN?<0 zq1L;LF6JI*S-;xHnz~RqdlO#wTF7Pi*xPKpq7|!E`AX_@l-^c5l{skeS=L_GZq>`= zR4fkP1~)!fI+>iB7>lRXUpeWEl7-A&-)m$IDK08Xt&2}gBqt!yWXjAoJxs`aX1;lS zaXB-F)5=`t^VTFWYPiPUV)jkg*Y;Bx>pZL6%5=7m6QlN!4M(}jE>|T12}nVwDH4AhZJSa_o#nB_-ALi`m7kxwx3QJ#3S zLq9|+VuF_PZ zXme_YWVb`_v2p|{ z7BR&R(|auB0#?o!6fo}9o7gCM2N%DMivQIuZii?{B3TT4S^#9b$QZ1Tb&{{K@D&nj zMTD6iJ9ze4$RAkw9Vrfdr3GsC+h~P>eLnL$^dT@tR(GiE)F&!|1zFo?p>-VNK+G0V zW?5xAImTaL;N`I1vgX447`D)1P8lpHvP(Zq3w*ZO0C)Op=!+cl0%Er6Gr2U2k6Y*~ z9P<)l9u;9yk!Cv25$__RUW8Z~*Z?PV*{@>vAU>lw0s*j=|O?pAXF(*79wbP3nF^h<1J%Sxj*jU0tPWm3l zTtUosJ%%Om4%_JxM_flliyo0nvV(rd5%&<$Dni^F3DAEyVi^%TM2MxQn`l)T+pPH$ zTV>h*2Q0JPCT5u6!)L72!#NGefxc1wkEF|Qf>%c!G{iAM%(!FsXTq@%jdSHOTwXDD o|8ll0uJK*;1VCQSLUZTWRLS8(&&AWBE^U(F`|+Xw05z?*EdT%j diff --git a/en/.doctrees/trust.doctree b/en/.doctrees/trust.doctree index 51f78e19185e7b78107eac22ac6610ad05de7543..ecf10638c7800b1a43672166de80975803dbc7fe 100644 GIT binary patch delta 31047 zcmb__33wF6);6agWWo{>60$Fog=`Q)AZ!6-UqjeI5Cj4QC&Nwx$fAg%5DbfSptweX z@QI273Q-1d0j`K#uS)PkMchD8QA8BIfOv(!PIXu4>ZwU4-}C!C_Apab?>Xl^r>ag> zS9h-L_PgWq^LfN)V;Jo9`8s3S)K;zR6Ne1#Gk8GntkJ#F`}Y_yG~4bdDwmSCh7AhJ1Z;xo7I%q8q}>*r*N|KtQNRAi!`mf zsQ}uBN3h=il9YR`i_#j#LMhIWAJ3E#%n~a!DGe<7_Z78B4ljpmPCS+P&&h%8{N8RkESWTPN zEv?O9{5>@Xe=vK26X<+{eWW6NDGnb;eT=ab=MnAwZr#bl95u%9-x35d{HF^D<75u% zz8y%3u7Iq21e3R0Zd2C0WaZDNj( zO_XUfaz;R?C@cb72@m~VJB^Qxm_|COgk>^e?NOKr!nQs< z+?B3Hm4|vl$u+AiP|PZ~)%K391119RTd~_l?!X9 z^0j-Hl7lK??U~B^%_>*apmL=rln>1+3ly`;6}3{Ce$*AR$)74|otVzo%{u>HgU$i< zF_fN9$%Cb7I>vGh(T zH1>}pj5v#1^wCkh%tm?UR9R^(afK<#H|f0$#II8&Q6{W_Vck~o}6 zEbv0&hco6{B(66}96jr4*l3oxp(1K_8z380B1bThYrPQp?wlViB40O&JT`9-95Rb^ zRdgvl3B;umIg*L2@IvIH^D`|X&zeO3dqI2n#w_y7iu8qvK)zIo9K}SQsad3U;=x5M z?d-W|5e(GcT$BYqTHw+IKOdB}W@gF>);OlIki)G^oj zLIeG(*6zuU6gFVvwgLEQDqe8IK#m}5O)y&HDRa4i%#}K?*kfN|17Ebx-(3q53Rd$xO=jT9R_($ra$QWm0Pp z&Sl6A8<=+%Yz?Xpm5_Fo=y>lQ$ff|11xcdo?9teO}pQ!(RbxmI>zo---0K7tYC_QfS(Q_SatBoM4&kOJs>P zPxir)rU|_*lgaeFJKMLauF&qeFfiWO6*LfQmjx_-I-5Me`LuM$b6DI+BMy!7T9_=3-eI+2{#ogV!*tpXo?;d4k!=VZ?Ni*N~5s#!_wqFB3V1L1>LR z#hcIeC7-CoX^g{@CnuN+J)!G6~Kw`Ri67=acaA^wlv;#a(} zwIh(gMvAQz#PM%r-bxXAnkH$I!kbzK-=|p9=8bqLS8C4JJCgRQS}35Z*7)uBklw0V z8%?$J?W5r;Z7Hv2p59J!CyK%R1D)e)GNBLuXE>Rsf-YmwvpEqW6`G;jrVRSB=i&^9 zt>It^#zLr=w_&%j>f1AB6ciTSy`@pyNU=6Tp-*@%^u-;6$sSL-zbrXX=x%o6yS%Bz ziKxLp%})GZm4Ih?Ei>;k8sRtZdH?c-F64I=^i~G_t3<(-YIrYwv8%zme`Abhu>ft* zSWDfRMc4;hfLi8%l;Eqa-&eJ&sZPM>JHICx9NL1ijiIze6p^9`6f?zrc}ok$D8E-@ zQ$HE0!Y{{KTHLOx70;DgGQ49~Pg0~p-ocRPn(d#ZE29kTDZB4s1aIHnlC0xcVkCM} zyS2L=c~ZqM;;-@+|K&Yr$g3(XpJyn$&HM^2&HTQ{TUz)<`Nz!sexkyE0c#<@A`6^_ zU%U_Cg1z^U|EPdpX293XieEM8Ma4-a(cXS8tci0V+ujiS0ZxBy(7rGT&@$hu+CgdL zk7KaKGKBW?HzMc5eT&)6Pu9dT6YSxYus5a~d&oio_dNmgR-6|1TCNuP+IYxTfbL?T z9k@y&+y$t~9WV@ADs&z!bY`;xOjN+{X7GdkQD@F-N6sl5|1q+p-mK{`P(R<;`FilP1!hg>U^wr>(ll@{aO1e=jR;3Dq644 zW_I(q!;TCq-DBdWBv?E3cd)i`brbEgzx_4)nFios5))b&M=0`9sI;qi$HHz&xn}=1 zOe;MzI>25q%U*`6@*`~$SnjG zaN1f*F^~&*FhXc-RdX_`k!9~ca^z6^y!^sBvu73N+jB>a7-=ueFXC#?%%572XD?bb zC*M9PZ_b<<1yk~h3TDsBpsj~PaHC1B_-UpTmiKf+s5V|g-L-L(*7{tcf4n<($Rz!s zRA7nSO>V=x?YD7OwxCBsoSRgvY*MjOw>nlXpeZzV65H5o{Q18~iS+#)E#nJ6IDlef zWu|?snA(yro`d6xnl?+#vWm%H#<0^h+VZd3g-a90Su_mKiv^a%u%K+FUHmEtzC=io z0G(-q^GBqtN<$QInzO+c(0N~f1P!mUZ)`Z+%09H5b2)IsOdJ-vh0|3|Tr(NDv5t%* z_&vr!8WCJo{SXJ?8v9r>?_-ah&n002n9#)+XsDnmL&12ZDf_2 zqDrC}tLnv~JlM3f?!W}HR*72qg%&M)u`fAY+)HbM62GAomh$V|9SqoIMB2ZQ#FA=|z=Fk*LxRULwrj?%8~;;D>qS1V^>d z7=<|RN~Ue+risjNtB%T-j9paJnr8&xw6wzclhe}pm?Yv~N9Hrao2m;ZG4MQhcTbR*f@t3-U~>*OpuZ z5wIy-szskz)TcQw5gvY@O#Sip23NUMsKa@G+h=b}rM#|2aat?^?qcgGL?8 zaw7NbKupOj+{UAIZ%Ev3t{t~p*WV*kC2B*ORz+ex=fdfQcc=QWrq~&T=YzGm*Mqbp zg97ALQEme26etQsK>9OO4*^+`{6`G6+b!3ufux_&+Czuw`&puJ5oJ8f?{`zL7%a z@kV||Uc+i!z0uN>j>&$qUhBQnYpbMJ*P1YckdxSdUINxEFqUb)@JW>h$<{rC1T z(kMt9a%ZAg{an-b-x=S@VVvhLsXs4&+WdJ1rOxOe7DT4?5JI>mX4h0cNJ2BO3NwWd zKHxqOv-wtiZa0?K9Rl>_HNns}me*MU+Nmo+bObyyE3{KV5WSE z=w9kapoeWNQy(dz!wICpB>EeHgd}4riDlfBy7qk2BB!d!acnY=HxYe&ERCuQnPhB` zV(e*&_Kpg|Sun^*MDJ?qJV@WD3rpJ?%RsjbRnIAvIVyG5gUL|F^$ zTGmQGh)tJfn1tY}8OAm|fA0K(dHGZC&N9s<4dPT9bV3bcc!}s|Uj&)6<}+M7ku@8> zswr!x1&>=Z`BB02>Bm_nf3Kv|2$fFRsMAnhB0P}G?DR0_xvn;Zbg&h&8hiv}`#xj| z7ZPanRxIMZ^Bj&r$=y9WfG3C43YmdNUg z=>L$o&J8xtD+6^aJ>U7E=bJ#P9M~slSO6rG_a$17t7yFk#lIsNcSIMc3T)R80WccK z_Z-(^NH;{f;4KoJ^ayMSZQRU4Q)7m~cBb5E>VfFDB$|%YlBT#|NRd}UI^6NYamY3EEP=?njuXV z^gf6_j-!j78`sR-a|d$L#KGP}^js*k>}1T1E#m>2Eg3x{E#1^8@LJinsX?Ir| z_33iETfmP%S#^1d2>9w`xz9o=A=S-7X_5v>Dh)=W1_``G#PT^F%i^r$SDXnk3mNXH zaTYor%kH>H^W}Z?RxBiv@sdhoR4R=^l}1UV3}ttZ^m-sa5L$= z*qa!AK{3wi2FPdWjbvEod4S{toO*yfm;zl$n^5ehVt~wGmdOL;1bu+)n2NJJEqp)_P?myF^CE1{|uK?{^$L$ltT#2rmD*vI= zTe0WAc6tPQ-fN)v49Fr!JOaJNfyA&^5{i9S412}AObmMlA2kkpcqEzps1i6GDfnK} z{6aMpL}x)VP0xf-AoQbbNP_ybye%a7)eB?M8RD!HhD#bt6mb!Mdo3ca9mF&_YuYby zCWg`OZ6KN?h4H5t(ovTD6hl1w$$6Ouc7^7a#FPt<IJP*FvD4ttIFjK`+X@rE4!2tPTIi`bk3w%E?B5;@z9o^l zvvy?CGo7F(i4Mov!J_3t)G{I*JE34RG+d8J6PryW4%&y)liARmbmV}dCueaG3!NN3 zQwOZ16FNhNOlK}F>kR2+h=i2Gkt}1vB2+Y!2C^3)2s(wLDmv$M0lU96Cd{N;*l#eK z9_|9|qZTlo*y{_@*r?f^l+oq$2}&HjQl>d&^sk<<94hHUyDfZcZes@Ykgsq=W||oFs_{0;Ei@ET^VVqWYpClI8kv07MY7Q&oAbTjjJt@F08GR8@JsrE(elE*Fl= zN$-2~;9xjG{>9r{#!wC0zZ-#LsCb!*&{Il!D_wsMfmQ7BQWX(M6^_WZD_j-)d z+O0a=PstQT>ZfEDaQnnvpn0@>s@wj{d9-#mFA>w@4BY_b!o+>Ar!-RE>)9m9+Mts4 zEy`NwwJi6&p4ZTu`YA5O9f$pr2K!VRTtE$2cF1@TIr@x9^P;DKmx)D>;f|UXJsLZw zBky5+Pj^26VdRpe(M6R;7f~aY6*7$k|6f!Sy^BsqbD8*L#_lVw-qYJLT=3I-+ z=L_9Vz8>nTiZ;{AtfZQQL*t^fBbP$S{ZZy|Xe<|O8D4%sl}1Yjk6`w&-l`H$IoXTQ zU_thBo$O-vn}uwwCdgi-BKs1`Uf{KCPWEdk+e-FxDzbk>^m2*p5mDxalbLMg=^Txn zWs-xqlFpsYg7{;J*N;@Z{)E#1E!lR0sa`Fwzo2b`*Xug3x7lwNUa^|s^%oVdmr?d* zuVo{zkV;Q2hF}sNt=QB28Sz4B+>*OP#EIH5$HxDZQf zc?HFH=Ov;~c8#uq$|;t-*Xr>hqIryB zh-en07>}$sL_~Hc zro0F8T|1V-WMZ3$<{6^|c_4;|_H6c>g<7n}sC{Y~3?~y~6jR+FD15xP!u7kxPor$} z=!-l2t5wwg2hmqb)OL!gRiIP644dD^#N}x9{9mBw}XJkxC1SZq13ga)BD!L zEx4%C#K&6KMW2G#fR;ZCi56I2OVu*hS~he-6Z1o5PGWccQVPQX>e2ICA;A*I4G^M^ z-MnugSg`CH9M}Y70NC~u14)y~Yh=;GET10P4CCpc%`hFB^R^Zn{4H(ET#kRhG4|k% zE4>WZb8sE(dZ%$c^$Y|6bmJJp16b(hfev=;LY8fVKorxKS7*MpZ-FBK_o@g9(ko*8 zi){lXA?j$Hv5hf3OSjW_cxE~iDo0}|;QuDQUAYfFtqU=FWx40I zMlD1`G?#AM538Z2s%{%g-2twdF1C9H*;qNYr*(I){+vZcj@h$3@9$+<@G4!OAAl|Z z169I1TPhE5jX4BA#j#V2|2N@XEqG=0xi4Y5ykF|1(O5H%r zY#*^=zP4HWJsY+^7|lB z*{$;0-{3ZoVZ5>>DyHg{>ASy!Q>0_=434J*{(!ln+0!MsXZ|D zKkx`ytlMFDV4<4_9?%0T`8wV%S;Z?`o}ey3J48dI+~ls3{e5n3w8lH&MPO&U46D( zIe+8v`|9xjXzbtcxMz|%NotZm`x^$4Z@4hKLGqVqvvjws5J~RhtM!;1L>J$N@$%St zjb6MB6UZMN#1cgFQR83ZO>dmNVnyd~oTZ2E!2bl}4vXX;r(eRx#bhTmq~-p^I&3XK zY~O?$v0Y_Ap0i}S_5|19x?~4?PDX{i5RqeQMyAt!$Qn6??vOxz>yx$6Nrn3$;wW>bM!vm^fiRS4_msyaa39EH%YVus^v+j+<3OG%EQnlz11i`@5caj2VfQy9 z*DdOP=&Bb=ZUUTC;Vwtqf7gsli^9npvbq;(*9h_!e6NCi6k)%u8P+u~lGrW!{^i;h zMdASu|G4+b#}N2W4s1lF*>5#QC3pKgS`%2-N$V@W#mL%UegJ3v1H!2Y0( zF=El;SdvsfF_A_7Zu)vGiED6x;J?|WPz#(KMgJR18o)v7YbWF2Fr8v2gCN)Ss-5%) z_W5TVX$Nr7m61R~>W=#YTV~L^aGk(zSm({> z&lDC+Eo6TY#)$^7g59oflgMmXwiC5_9xvQVZe9Y~YsX7Cdts3?1TPm*zjJtLjY_8D zoi22y;$<4vo`RR{Y_r3;6)#WYh2o_so?YhR1C|FmeetpaFU#>V z1FIC^1@Lkkf18T`%EQa&>=Nqy6#qFpfn8?cB@)dJOQhpd$t6zCDo)HQCz4Xk2`T1e ztl~rza}tU<0ma<-Vs7{xR@KeirZPtZ7k;Yt>U&7bGwSUO~u@vVs1;Zb47Ee zZ!tHbm>W>cl`rOs7jvD9nZB-X)5tVf#(lVrFzvYyG17G(@_%t3;=AW{AD+d3aUbHV z+jSq}dpva?;+vFoAL0vxbRTA-Be@Up0ZQG6_>83!AJuo}1ukP(d=A}t8ZY=bv~wU{ z@Bw7!2D~Jq$7ArqeT|Pp>b}NjQk+ZC*LWmH_xk<#m3tjG?R2l>c?R9KF`$Gr;f z_2GQ+t-Bo;RJz+S#nj!7nZE9JOqg}AV;-k_9kUeXb#}pd$GHIM8A{itlmEatx}p{7 z$xe^F*NQw!jwbTEUp$ivalTFCvPdj(E~T3?NK)^EjPsIuGYV$qm*%qL=4_gLlR>gE z%zV^{)nOZp{51MotW=zC)&ESBvvN~w@)P+=l5!TMWTt$^Y76waP*T5e_WXHM@=N(& z#4^dcMQ3M{*kBbl?a_e*)BTwwpZ;$aNwgVO+~D|`9AAmb@-gTs1Jk^rf~W2ht^&GzlicE0}xwkRbYM7D-@Fl$llPZNiF- zM7LCI&kYLV9FmYbMbfoE>NgPWa z%tqakVB%|nIn{-9p)p;UHf)QzJ4x^}dPQ&&E$>8HizrU;0%sg#N)W9i2)eB+@u?~F zg6Zk5q!;8!IQ=CYd-Ix9$?Hk7>38=qlkz2;$udq-O*o92jrBfeoTXJb!@85| zdlOfsyd6{J9}>i-DhNJCq|~Ge$Jx_^;Z#UCugW;7Uf_(y-CmQU-VlzElx99K7c9ptOWM74A#agFvmdB8C(+1YgIUqQ$ug#VK93bn*t}~kVH5o z;e1qu!@FF2uk_(yT?a9+%M#cn8LXpMV1tM2n$@TAxg?JGr10|=#&}CoM5vbMdSmA0 zT*8I}2_mWr0xhK52741zrw5aEq?3fxUc#|=_R2Vh6GV>FSkI%zYimN(pC$jB}4SIB{A1*-IbivCMY5y(n+q1MGc}@nV^&|IJ&P zIg-SXa!Jw_SyDG|BvBS4+2jog=YWor?Vg|->2OXTub{sfMZ)Qz5iDW}e-+S-(URAxSuI}9M zhW@xGwAS)k8|u{9U+Y9`19ApHA0t2K7(2j>{e4rTUtl$A6vcY>(y#QQkfIFF?(&gs zdIP*|Y-!t{eZ-7bx$PPqqvE}uMEo_ksF~*jv(ei|PP^{#cKNJ!8Nj|1cuC(_MO1TQ zQRG@^Rko^ZMcI-v6!JDRW_ePR-l8ffhkj+{yKK_uPV^iqZ`>h@xvpX1?1`Qa`HFj? z9jg_>Bd0;z`1&EFM$tZ-4ph-|!Z_IJYj#ZsU)Kr$dFNQD=SCoc$HvC~wrwH9Xqnr- zNoxV`w36zggr&K$%pF1oM5_jbk%aR1bKR`raDqkUiVE<%-h@VU-pIS1!6;*2-?Zov z)_11qQB=!V+ao)vCw-rlPhZ$Qfz^+ir zHqh6IEJ$-iS2~L7Wx$}c)E=g&JX2Ip{FO!hDzm6oQSG8SW6RK2YYV!;m;fN7f(5yG zP&UjC05X$6LVcPL_pV%1uTE6t>R^6|HZpHbfv(2>q0uo~O=sOY4j$JC$wYHE+cn)( ziMjcMhrx>hKwbzEq=1Na~S%6oQuH`OG2!!3I^n2J?mAWYBB8A2v0ddUm8gtEBwHB>WqFV&KoQ+ z017p%d90?fqO7?q()`qb2JPrD^MgItFpf+fl(Yv2BUIXvzhPEKIhikq8$6{Ci>gC$ zFO#_NI*z0zzd$5j$ENIK$)ctsCAbx(gqOc|S6gUs$Tk3aIvUrDCb4d!iK{E2#(Fv% zrNyV9voX`-oIr+PX?tVBytKr&X4RXVdQkGzuKbKA4B`|y?vcpEk=OaivY-oEeX?)r!PbDdF>9!2D{<#){a7~olr$YCh*=^#XIpO@nh`JqkZ5A!>)e<>nAF3-QWDZs}X zk;75s`&ElH&Ma7fndXFr3n0(EO@b$5a%e=x$uA?ZIg^C2f zoh^qSgXq|*qOd_Fg&Fpxfz`63zr0HF%6-e*!2QILV?8tujacb23g@Mzm_yWZQ!icO zWQ<$U2DSzOc`R6vu)n0kfdC-;1&B*(B1Tnfj9o%Sso~aI!Q!Ay5L}7bEmjVM|7e6w zK(oKJYka&Cvya|yG^!bjQG*`BReDBICJxZFNAQb_Pgn@)4oV68Qjpl(eGodZhM_dJ zYha>6$ukxo$6fX`_fu2hN^Gxxe}C3qhddD#Y$K2@pSMQiFc!5wC*#NHj2{@PGoG*q z2;N zp;R+<)TM?UP!0{~wnWCbv@Xdwzpf?gr?X_9Xhhvdrkq!+$I&Mb&trG#kQXBIBw>fu zmkLeY0`{d+9Y;&G91->+J4X`R#?dw%N7QgjB^>S1S+Yzt5<{-F_$aJvAAmmp3U%UXn5IqoPiHp?Ve&WSXu8|TW#1)jxeR`$)}3pWgA-wDNJl6x9WP?WKiY&rJQv12t!#6>vvB?9T7lYSMEbX@UK+4za~HV7IJMQ82CPHVM%1&V0mDp{ zwP8GHODEh?)`LtB7KClhhSdQ;Rs{?4%+^k@EdaAoA z05y%Ar<^M{LIGpN)4oNmRI*}Th6HNon3f;Gc5z|maBCdd-3b$I|4IbztF-XRZqQLv zX@jkjxgXS5qbH|Y#*Sxv8^&)5&&e77b(7jkvYzu#4TZ@X;LQj;kqD5RHsejJv=RRD z&J@c_xZUxT&r6GqoTua2;xNq(9fDsFEc`o94}u*5bbQ?IB&nm#NiR`5hm%P7i*_fy zqXFMam55n61&*f=!4rGsnXYg~gS!oJzp-2XbtS~Uuq)3bmO*{WIOIC=TA0!A*>((n z`QIxe0at<*@cXl8SgL?_bffKv;;wH?IHZ~t+_KK1p@Uo!-=Tg*4`BUt@H<2;dxr6K z_2@mcrx&|RhrAP!Cke%6hG8nB4cryacSC;Pc)kVui@=iO%Tgn5Z+o`1KGEwShVT~! zi~ru<&)JhYEuTh|?RI(#EiG;Iz9Jer=q2%9JH7Af;QuOWDalEF`V@TlKJY>}c2)=d z972C**Zj0ib9RUsmv+TPdGc_ZLay#T&;V}%U)`Bn$HCtSTjruKqgHAzdXV@kpY^x-;5sZ-zWCZW_?KvA?T=B3-;svHLPN)q zhL=!7DMTP2`TG{;I%gsC_L0yFE)%rdf~Fz?&9ZFACC=%vUvXl0ev5;vZn&8j8=oI4 zgearS+q2|N_PR#-+e;g#VL9!1$eZj`UkIGS_pF3C3mpxnml+6?2( z(+!Oc-wkB%n-o|MdDrQXg8CrXYI^2N_Jye0M%5ymw2;lPYLzRiu$UOzO6Z(PN+bTJ z8=ANH4L{{~^)Ig8Lg}WnO~MsF)r;UK>p?uLA7Rg1LLg`vaNLTbXkPm z$#t@`i)YWy&Mp(DMHEKHM)23CLL)X_QFF9T%{WqXq)^jJVulB1#8`O#9=1q;I*5%Y zn0xKk4j0zSEMTY!Dpm(wgRpG&+=*Jtwi-t+#IbFPU7K}wH712N+3ng;iCqu>xSqYL zvnzpMUb5S@A)sCQ69Fgw+c;Bk&VNu3av2T+A;pDrD$ZD)RIK{9&Z;J)&gXWkKC8s4 zcYgYoU5zkyUz`;h5-Els{IvDYq?%Fq$=J~&rasOfv7W0Y#D~V$f5sTweyzju>KLc~ zjK)7}8{00$vXn^bS8}RPG)`TbBd4RQf(%D2B$ASU*g5;GdYtjD^P#ai7T;#{_&JUZ zS2P)7toX^1uN5Sb>_Jo@^R;}mH9!Yn|I6{vSy+rYP0dJS#bepV_&@7Igc0{^h9qoO zq#$gSLKw9{$bf{EDQZ59+C(!?8)MqF+l;Bd)l0I@%b6&SsQ~5qtpf_&WYlyrN}dGD zkF=-Q_Rggb!a=_$WGO-T9-3eUVNK8csk1Ah@O?%3e`+{RCUxGnbNr@Bh^}9kclsj< zLchlfPL`+rnb5FJSyAmlbIJ;7POw7sdz102*rFmtslCN`f*GFiMvp78xHtaD?`erv z+EqJ>DiszrqEmG7*ufI;6dln%F4UqNv9Dj*>9VxhWjuE^6Pgi3s5L!*AG!X|76G*N z#e}6{ZxmOxhC}Td4hpED3<}dwM^K~l$2cJ{Q%a|$OF z&MDLmyAK#gt|vl?pvq!Zr9vcEf*y~ZeI0VMaacCz$5&~m-ZRk}4^GW=E2E}Yg^ z4H!kVwFm!wI3H3A+Q(ZfESXIeWeh6Hq71H-Z>t5<)WaWjdE?s9(-jsiX{im_EIOJ7 z;&jUaR3z%V`dha>53+&MqB4^D>U`&<{#97 z#cu0Rj9(&Z=8gi1mg{Hv9h{}%SvlXc%8zNDG zlTVRf#*6&Yo_VvzbGJPB)Z<;xbYv|-zbBphp zJgFiCKUWm^RHr}(QsAgiz{-wG`K1JK8#fiylp7aoL_?V&Th6j&$l9rnFD!8;?XDR9 zTnV_LF259p`L~=cVl?AdM^Y<O$ZH1-LbW)rhg@ z57*2v3%qsDFGoX`8rF+=Rt#jo5{1(RI!<#*`aHX7vjcPL{UZi$2Y6J#I?U)wKpTSu z;`0!5YF$x;t(&8!jlsqhDA2i8~`ZjMR*PPr8w*?*8S#B1ut^OyXNbv z@}BcF`ldw}Yr^x0cyc6SHSx>BqC}jRt+|cwhin4zSSi%R4SQ!6&$4C6iC6dniGT);X;!`lcbGe{sYV+=(>eltd| zSlx^jroz$PI*x89>BT~N3v=si zN??v`%NSmo11j!Y|tGscdW<+|V2wQ*rnUJT{7vPL7TIa0}?lz7yul!SOUQsOI0J z&B1X%OB@{8&!Td+y7@bnOp^_9kSoRK=;WO?UfLQ~MN{uoHuOCqd{t}UtX3oH367Ax zlko7+EiN%`vX&SUUD?tOoaf^?fAfL7D4IR22l5gcnM1IzFtL)t4EteTt7Wx@U;arB zv|xR8_Dv!CdXasyZ+ACU(~hl++dvmKCLqqJU~%wy*LG}nK%AKZ$IAPc~e$i8S~o;CZLgsF$iKf|v)CpPwlW;)^j62dJy zHwrrC9=Bmy8+cHpQ#!0hoTg`Zh`MWbyRMjE+Q>obGQ(fO3O=*q<4g(@1h}NIQJiK1 z5~5)7fT)Ph!S<~?@qPue1jv?U5@3j}G7JA49to(Xt}hjzvJU*Uf}&+Cfwf0=^x zut0JI(G1daUL18pnSe<}H75#qXdc4u3uy2jJC|bwYS7Whf5?Mg?1&C~4k`Jeoy@~k zk@(A)fEJ?vtbGpKc% zCIJr)mo=9sY2w6`oeEk4el@Z=p#H;T#$Q9AnaS!22yk^&Fr74P>C-;2q2^oL(7U!u!WdoUHGY+I2gAJp9$n>!9F@imB^(|?IwY{fMB}?R`9V6?RdmAXcylVzjTmI^(5IX znrNoh??`r5kg^5Wcadl(*CU$fw&%_e_%H!(ZO_%_FuP)V&Q7)VE}7wXDrqIzs5_Ok zO5u5hj_2=5ouzhL7aG-XKSE?v^jZM@H7UxNLG@rEq(&SK8iF6`1b_fY~65ErHUkDkFk>~<}cN5_9 zk(Z0rBi6tZP3p0_X=J1sz>X75GkD=5@XeM}g;<9|KaxU4inWswFA&$R#qf}84VjB? zQR7<|T6NFmBFD-^-S;ZQ=cUtb)Lz=2#PFT_%Yjp1TFDbY>SOtYUJ}3R0 z?s!+{j-Lqp9|Bws-IEi=iq2Z}R5_mTgUcXYjq_g;`T1p#2EQrnU)HgIk>vlR7BwtmPGCd4iRQ4)HgnuOB*6P3{7B)%pSSGH4=XyTK1`R)=@9O3*k$)BWHRER7D zAe0}uAKqaP2v`TuF9dX7&_Lpz`|}nxk87#1*J2c2S6xi>9+l zeAgPdgPqmI+V3R(JB83n#EbbV#jWYbk#1dH@CTtca8tr#3Yv>IT7eqChspfIsAY=n?o8T=R)VdUgpP1Y*lX%OvZR z4i)(w1)T4uk;3tqNe$)z=Tpnz3gbFOn6s|;nGLu&Wjl41YdR{Idbe>H0^#;&Wjrss zy*D<&P+(pG;n;tuLlEWUd*5nX(%{&Cc<(V73GA={aoq6>b?9N2&yQ}wZI<`9z*P3R z&W3u9wx!+$Tj6bdvc}tO8;k+hIm-jyC$>Wbu*(8N`hW`kd~iHF9Mf5h2*9PC>eoC$<7FjVIruacEVu>tnb;PR_1?w4$i_TUEL*V`%*Z@=gZ}|?}43GwmLw~9#(B8NR-|a=wPB>1#1kl z8BN+q98>j6c%a;M%%ox$zyC6H!qb@4R6gZ#EQO!H3?6n&$HiDbz)e5XH1?ZL`gp&} z+kS=X_?{1*@{?as7n+p?aX;*-y7H>8M6M& z2^xINT>>@`)+@}d^J8u%G1r<$MzLtzFf3zij5^NkHP>K$K) z?F9Ht2R(`ki2_EMVpQ5d^DgoUKh z62g(-%pco zniR=AEK_JCyI!+2XV+Vx1W>am)=dqdTs|v`^IShBlaVks>5AExOWAC>y3Bo-z-gp<)f)=vYave$F&7KE{(N>=lIQOtWSh_OCSF|i1l&? z{#Y7IuYDW?$FrTklg3hNKgY!1Kc=y4*v;dbveEDYpVJhF!yeu@o3j1@HN17xS$lxp z-X0k&Hl*H1)FLAUFPC{CKC6~ji~jCTeJT`R4dwZQj@9MjsUOc~I(+du-K}be``Mmd zbV;HO(4BN?Oxtxs`2K7b(<&8f7OoAQF>~_t;z{l1%`C&yrU&S|x#GdT;z_gdKPGrc zS1j1>{W+V>fMvoAq5m;5=o7kx;X7hHp>#P$T75#7G*T^@E+_GAcAl^3auDC#;VGxf zaJ;AP8A_LybjhYm7u+K8bfimve3-%0mo8u8bA+DbbSc2o>YiH~F2n0dJo@4JiZ1a~ zJC-iPamnf#N|yq<+(MTO9P2$z>9P=47oPcad5tcw(4`}$FrIdFaZ{BhbU8pD_tT{j zeT<>YTDp|bB^7P0?{SmGAJOIgG(Nv2J1Zzz?IAi!1QjKMhSh?C5@CLcFug>WT_Q|g zEzB(urj`gZR|^xdJ{ndcEL$zCDiIcy2y04&B_+a&5@A7!$4%;&2-Qo3+9g8e5}|Gh zYU&MX&8EOI;WG+d(`Vu@;WK(Sx9PJF=`Z0kdd;@!GkU3^=`(tFjp;LbU5n|nrsO!` zGkR#z^cg+Z=%HueJu!5lhr2xwL@vWCJ$3B4Mi+Xz*VEVM+@ti@E#zT(9?|qIJvQQL zO}?c=Gp3g#=%es5?T49Orc(!|mnoAoy`1FpGOc@sm-~yAqUmNz2~9UsR&KhPl3dfx z+2m{CWy(g-%Xpz_#Zyf5^yV+;uwS78-`j@u!bR-mHta8KPE)aIEHb)S&n(`vJ##b6 zTHb8S();X2&eztwyLkHKvI0C6jU1W_uI~&k6}S zLV^}IkhTJFc`j?hYj$K=>>UO5kU)h8`6B~aY;wHRu@bED>}v(#KMF$QAQ14eu>mZa z|GN`Q<2QF;P2nv*wFB!Ul}HE*0u4&z?{&uc2A_LFB$wsyNPa1o2+LfjnG^ zK{1@LjEDv``72#m60}nAn%nV`#c}&!@cKf31*We8lN79p>D=hb+%QqW8n0lvgU4E) zhgf)`%SP7%1uHpttZCg4Yomf?*s(Tt50d$&d}Mc)0{axGJ$9(%)S%Rg=*cqqfF7vU zVFl}-3YPc}Mpb$cvHHQc3d|`5rfEeY@l5ip_Fz#gB$p+CFH9N8199@K?87YCv`9Tc3lcAVJcoM827$Ui7Ru)zvg zfdaQ`SYn>8Rp# zs|rVujh^emhAB8hOq?$MnWmN5=J%-zI%gys$fhf(Q%%&|fT#tDzH~fLvWBoNd9P8} x3s)=HtE$9y2Zx=02Vy^=U~j7uJ0&>mx}y>MZwmIyCU#0-PAqKx*U@a`{{vb0B+LK+ diff --git a/en/.doctrees/wallet-instance-attestation.doctree b/en/.doctrees/wallet-instance-attestation.doctree index bbb090ae830007d07eaf9d1a46b466c40252d9f9..9573f2d65cc85b26de60804734e2ad03c5f5338c 100644 GIT binary patch literal 91013 zcmeHw3!EIsS*LAz^;lc7<;1dOS$13UW3|!j`ynZ@lhy7@+Fk8xwOUCl1vBcI>7DM` zndwpY%s!NuBbOt$f`$+?aD+DpcMu2|0s#_2c!UFvJ0RR8;dRH60J%r*$PqX$kZ`&G zSKU?JJ=5LOGdpXX;QZp&Y`v0VL@>an*~U#NCjdklHa)GJ0>sakiSMOxMJ8AB;npU1;})V{3c%^s(N zU1`1GdtdFa9(C?%oj2ax)6?_(jb!JizV_Yt@4G(rwclM;cRgQK_gHr?D(m#s2CcuY zN>EulOEN$xSJivXlx%g%<+7orDrKNRAn(vJCcv|HrSr0B;wFA~6y<{bYj>tna{oxl z=@mm+W^MMY7xJgfl1!-XE*Xlc7^_OPV(lu+S$dLn}S}x=}J0(eaL(1rVu9K5*2cCN0>R^xUr~57EFPnHkVE|N99|Eb=gCPDP z{C61tJ&ymL0I7B^>qbE)Sm|R`^{Dz}MSV)`Q=d`0)MGO{(ZTUbKnK=cDWfX$Zs?V6 z&nr9Br_~+6`gOKk0keyQSz1-nD+w*F7vCyr1v#q#$DW>E{Ga`0_D<@_v}UC9N-}FG zN-@b^D9FZ2kGYy9LY!LDGG+CYG%zfv(ZSyJ(&J5A?b{}0D9v`rc@V7A#Rd|`;Hp}8 z4GdSU9Th{XTHWz6qt4`FM$5>yR9km;SJkgJiK??;z?4JT&LBpp*8{o0gg2NAm7)uI zLp~TvCYe{tWyMIW2Qb0m!kpmqvkhn;-Cr!i-|Iynko3=lkiPcgRWOk}tE9J5#W%HT@>r*Ic z5)`AX6k#AFttj2BC}vrfxb=~5!E7j!sTXxABclOYW)#Duw+f0>)Qk9!R9RcqxGA`{ zeP0mf_}>(&-5DervA19ajaRUW`X547Pz%_JD^_d#s&h*~lvH z$PEiS1)3!J5YnBv@S@w+tWUZ*A%ZX(LQUs~d zi;4bZUynTs&@j!-pS4@pGHGfDz?|X3cTWr@7+RU-d;M0vO-AqgG4edj@g9K(7$oG4WhzOPru&`S+C^;NEjukvi&g+F~swuMo9qUa#4NB zI=cmm_yFV7IT%WvtdBZp1b35@MK~WD?V{004UHZVH1Y@(yf%E&Ln+bfsM{(jS~-H$ zK6;H*IlUeUrI$+dI)64XHs+FMZEdYb&O&Rl`f85`#nCV>_rkrCEBSKovIcY03rnQq zzHV$J?Hl=gHk%aAX;Q9~Ro#F$sF+ZzQf9e^U>*5vLY6(W5jR{iJkP~udjR6ZITT79 zzp6PJlI-spaB0e!zc@DNEnKk7UuVA`*0)G4RVqfJt0u&2L0 z)ImoLsWX`9kE9OuA%>H7DHe6gsdKnF>X3D94|Srbar)OoyV>I}C_c7_{j)=*+NO0z&6dhXilHVyH^f;v*u)EQ|P zb!rE9VReO79!iWfpbkB6J9XRv{fQ>2Gu$q_gN_=?&Ts>}Lw&TJI@BrGtRtb+QGD*9 zGomMkd)hW?v94+;bU-+V+%gX*{3DlW!N+wQBp;QgxHq&Fm%|2+)9GjnbZV1@CO~Sv zA3+77XGABj|07!X=;XK4ZKIQGshEwf{5EK^9rEK^ zpr=A<66iH2M%!h9&{2(k)!XOM1{R3=XuAcXPPt}19ZH>G3xs#uNS`_i3B3`T1q%6S zBw7gRVIcXa)E3RMyXACxCX`NLQq(5|PcCIxx1Bmef;!!y)Csdd zZJV2p_SDZ#g?;f@ApiVSwD9N`_2Z>dn=Fubj{3S#I)z!FHqF9DF@s_Y!XnZvbjU-a z=vf%`;iXTTERZ`3J041%W%7I`rzXZOxk{x}j6_~p@4>%%Nyb0Dc_l07DcFwXnsV>t zT<_x2V(%LfCVv+H(VFv9gJTz_d(J0&2KxFjIUXME>Fe+5>l+=Ue<$b8){v+}!78EY z(JXPpRi!s`M`t_0;l?KsN|*&A%=A@HJe7j;Wdn=viqWGf<>emT$o67ktCvrJpsEG4h6p=yYu?DI^QTJyp(R`YFh{p16x}%+-9=Xl zVt-YqAhC;YSzp2Gk6$H#TiL^H=T8?^;nZ&Jqa4lNP&6H`PPTxipQ}nSZETcisihuO z#g8ie>7u$-u6jPq(d`RGcgE)G%$CtzQ8w!FT=C;cf4X>{=IR@prG5g_7de9cp$Jk! z2DH>;yjuL6sUcscTrrR_<6Aa_sCw;`^QVjExhkQd<#sq zRW(!6ONsuz8caLghaSHA@49$D*EHU4_w;R!?O-UjY}{reQ(|o4jEig*wzQJ!LB2q* zQb}Yq{Ee|m%h(HWi8VQoOpjjKK-O0ot1n<_0$C{uEbA&rz)CBLWdn&(Yr3&gLx4SO zP)f+gvIl?PO&9$Ij(!`V;UpOfCCN3C_6t}FpPCrDGCt+fBrKLRlvq^^ZCR63c_ooX z;s_CmsAZZJnP?HRSl(%OIJBD9JhbrNb%`NN+Sb9~G#C!00Snb!nn+Av^^8@tvM7dR z#`;yISIanq@-i}i61Mo6N}g8aRuu@2na=Abi3bL!MBhMA(!fqLLr*<4aPPSIU*y8j zJ}@{PMndVpMlvo79$OHL2P{*t2zLhKml-Amd$cqNlq9SFmAr>W_sRd1xgz2oBf#zuJZgp{z4avV>D;y6J{ZVPzg z%DAiJKH(Cwjg+=jC1HzcVl^Ei$9qHrFDtz_T@;5oip_nHBX%+ru}g&5Jmsi5k~g`Y zMiM0d9Jk;-%X+1VQ5>S#>y^`lg648DtFR29-qnGgzMk4K?0)YH)ZT+`&@&h7XSW6h z$Np3(_OEB2%GkoJi*dcKFi#pXnv;z}0%^E%KFBKFO^-d8@xNVc`Z+f7Kfy70eJBQ# zgu%r81&^_b?QFS&f6btKH#s9-T%5mMTtpsLD<9)ny&)8Pin+!w|!FP`(5 z!th>4Mu%#l-pQEavv}f8QxLPhImFL}LY!d`&ri-V?kAx~~CD*<=BYNPoAXVAN$1uAikD%2*adDpKTxuIsoH}pxQpf5PPHCn(bEhvo z@JS+;?aL;#qFH9%8uGFzo0d!?rRJaViy;r%wk> z4rJct70)B<&{gK&OH&R_q%oH!HaYf3x8a$rxnI8Pjyr;qSvmPYl-w_(jd~#WA^Hb< z0n}%5AE2MuQNUo|gFPK`){sl82gId!V6Vy|a(W{ml_;+l;Uu2!i|lGCgOp5cOOfQ1 zUO{%R+rhk{uVQdCj(cxj((`N!hVLdP%5e!Z9@aXetZHfH8B+q45vnV1NO@&d$xCZ0 zCPUu-_^SjNlQ+zwGCk5%S;{I901$mcvc=D2uXT6RSVhx`GC2KVQ4%laCFxos^+=5nAA0$^*M}q*tUUs8_w6TR@Xt|7`Vdpf)XP9MAz(Io&8Xsi5U_&`)@WPv z5Za*WYv~`an#@5<9>z_szt)TAm|3?;eNRz@Wp{Zb_+0BY(C?sDde6%uoci1mQ`}knIAe@pSr`1{~jHJ~OX>2%i z{cFEWAD6NfxW6!?3h9LgBj}S}1n5h7jpi-V8bbCEd_`I$A5fab&h5Ny6EV7fIe{!B zCe^gWVCP#X*KRJ-Mn5-H?<}1wi%bxVZuE_^Y_5<=Ad%uDV*^nj=;>9_ zj1QsR-9bK56%6J+(%=50rKziZ-?r`A_ucWekAPv?x0`b{8qn7SFrAx*`yA88#lh|A zr4|6Xv&VhkCRsBY{tz_$MTT3n=lIQN<1q$ee1_-fe$INp37;fN?i9}r67#2+Zioq> z2p5y_`5;Z-f&x%9i)%Q)ym!Gf{&QOUZwgcR`!NXZgu^~gn0uY&nMZ2plrxLa@?|}r z*Vo82c>NHzg`J$?0xS@@AY>3ChBh$|ZEK$b?@!0T+wc2fD`k$8fX!X+L$!kfZ9k_f z6M^$r|5V~PySpcsF-_2rjpc6p&0+ujDgQ1s)y73B`H0Ow>cE1SzkrDAM$$ z3v<#{B_%CV{*}~)_3>kjym>9Fmf29UEW<%yVMk17QOJSZLOV8B>#MEG22D+z51902 zn^zR>T|@Z>JNOtlvHb!`2gPswUcx><(p(xlT}rr0d&k|4{c*BrkYEkldTDAUzddkdB}!6QpIIAZ;JQg5~t(=2(s` zr@6-%ylrAR*gP-7=8~%CvD_e~G!*kGW@{us#ML|tFJkJ!CV&bi9Vi*K0+Zpmd$pXe z4bl7Nu(?TK7QpwzkuY*GI2ekDD;3j>;L)UW%*$CuWz15)$|n`=CW4R!`d)LgAVC(! z8I;io#a91Mc6U!vJS)S-40rbEpP|$^Y|RJ>n}SC7P7@zPLG*y4u{ED!vl&Cdd=^d< z7RFfcfd_LL%-$smE`pvgM$k+n2MPwr+(>J*;KDf2JRw~v)tM+nGu4sOJmWv4^he`M z=|4OdgwPZC%?UmBP3KgGbToZp3;qA>?jG~3XZB)Y26I}h&X|}|F9*4(u_a!i6$*RC zEJE+~VjBFB<91MJ!=7Hl)k6qxO~y(_8mqbRH(_ZJGa$#4^=K;u{(y3LylOs%^+=!k zj_>>I&%Kk0r{Ctj6T}RV|G^f>!iB%LNrJkPUuE(T%~?nC-^GLglK+92lK%?ihR_2- zra3*p4*A?SG7>~nE3O_aB@w&=&z)!xhHsj=A?E}me7>xqLYagDm0E$#3=r-`$WqQr z?r?6BR!jzkl$|LI{6%KdgL?LuXuJQ6w#;(2%ib^0I*Ojwn9Q@dvR0;~0mM%|lT2r5 zKs-#wPnLv$2{@~cNvebbYNV5x``F10E&^Dyp_vxIWK$keHHq!{VH&9GdAlqd$RLub zO;iSz+-zd0q$0K^b;)^C2Za==q(kkc{yuby+3>NT(dVbZ!T{}iZfl(2ig>DZcDg$G z0VbQ#Qs(I7&oF^h_b)vGVR}^@8i|8Yf1+D+>W{(?x%V+@M>8g_`dfe3-MyexOegvq zXNYt4nqGr_5Qd_xpd0!2Y zxSrkPA)Tu@f6TZV%^yc`{)n*>gV|>q4`yFEbQkhZ=r`o@<3k0D64 zUefGJl1+%eDzDP||C*A|Cs_Sth@c`mqL>>EHp`GUWZr35aV0+vtN2(1l4w9l5>(O<8E=*J8`{E1RG~WC^q8L>Bc{a$jtx$bOcr z(W;J|6J(H(cakRe1JZ!aO;qg>NmcZ~F}BPZ!ulPuBT2lcY!mFcTjySR<`E+50cQ)n zmnjj7eL%_BON<@?Bm=Ee9bbD9I;Bv3U&<|Gl1;O6C&S90Hbo(B2h^INQN-lsD7X+H z&8J$Y443?o)=2AWNmqO=d5UYv`@cN-B9wv3RZ}Am32p4XPRneTUf@#-Ifb23$d(~X zo`ItTwZ-I0V>x8Db|=_`0y%{}(oom%G3o5Y`~nNHQzCf*3WbDh6R8J4h}ZBx)+1eY zoFlV>fk$>HKcv|nee+O-5(9)Ew=fTviOq_D0gZA*E0*PkX$`7BtgvYm4QQ+pdesfs z99!?1KgVJb)D1AlI$0L*A@`lu4M2X3VQhlMQWngBshm>8t}mo4v0j{+8{W(4B^LHb zr*(tH0LywnLfq2lUX=vrG>3molECbD%>v|Wv3}qxwqp>up})WOk!!-|;+ybk$AmBa zF`M}=Lcu&*^{TBAW4nhcU#7Okl@DTibHg2~rRC0SZMbtYOllX1t=*K3P~IrvM3|k( z&rE4)I(&wIr2{MHN*{Og!BjRaXb?9e=${i1;Z^^{V$qk zHOg1zz9j~$-$jIQ`75~YPszI16Dao9cB#GZN#hPp!=l8ehG|&)&mjc|6}4#N-2`(r zxi$nm5oCIQ3^F+hS??pfy*V8-y>Z}r@Dho2S{jG%h}{Qp=dNhV8iy_9setd-;=}im zI`{^daoM@7Wf6z>D4xCF2Who?gj4N#YTc$Gm7UEaLEn(NN{e8&LODJ;=_+~9HH*ef z#cF1hb|jD;vmzFm-EEb2id5)QnoT8fV$jkFBN*0U&;zsY%{7`Yaa;Y#hbftVnQBP;qQ^onxfVOaLedOlixvAX3=q35e#lFPk&0F%+ z_(XPY==$mP(#>0omzT8hm5u3fxl&r4Ub>Y!H;`9`RBim~=-8-Xj-8zynOq#dSWHZg zF3eua>ssH1>01-yBPaXMDChexPWGRky?XsLqP|xLW>c#}YcnUVT$DHF7l${NPA+E0 zFV3g)rOd|2=t#bJ_DtXPxs!tv8&}N1^(&^KUbsBkr;clV$!SwvJGXRZx|CSR4rQh) zljHiyk%B%kx~`nQn7TZ3dNMWHH#tAKR++rIJ~B6OE0?S+-MoBaEu~(WRVN0^xzyNF z|LJQ}`DEc{pL1vruOC=9pzolAx^n*+I^>+mb;5TrR1?DGoD`M&45=;#e>#^d_eZ3h zVhbYzb>VYxYbUf40sZRI032MtNuG)haOS?s=_pP!hwBfB-Uo7@z&~DETL;!?pGP^t zlPeP@(|1qF0;h#Yzm!A^&rtO-yZbtm>mLIjw50|m9Uar3AmilumeYX673{IWY2f*k zGb+}PKCteMN5umZ8?bYs!%x^_G5+k{Nq%>@u#$7@jE@~?>K`9Z)g~-w*b*{A>nvJ| zfDm>*q@1CpX58?W9B?vZ+3=$3Ys|H)9eP-%4MLw~I}#5s?dAEHpwxjFl=A!5D3_As zL<6Nh4w>Q`A?*=5_lKTa)+!Cl_Rv>1E}N73JmwCE$K8En zW?3njw4#FK1GbromeL(^x?}JYn978X!5LfH>_M0V)x>CgiQ_Th!6QmC7VOLk|9JiK z6RD-a`E>unt(n5$_(DE0l^>tJHdriswh_zcz9HeEQ~eX5iBK z*;~mo=U1T^_0|UOan! z{`_LGbnf~{C6QV^p%(g18>8i0quS+jgM({hXV+#k=cZ4W&XmqynHV(mxxwMm@XfK| zn-vq4CC!W1=SJm|mD8)r%Ix`DdjH9@ms4}gv#0Y~>cmoia(+y{d~Q`yrsk(hi>1Ya zQJ$a3X>%Fl>IrS~#8P^6Wjed6D;u}e{ws>SbgiHjiW@hz(aH42(tP434ws!Dn>#sa zRFL$2HctDTjh3{CyB(ushq&AE4B6yn-Hy9xJB)KAU?aEVRT=(Dm0_iT-fmBF4 z?YMXi#w!1i+U4IQ^u68Pv-WwbQa@j~x{O_&2sI(FX3u$Rho6Fu*b!n&r4rU;u+e)h zYIvovm4A^|PtmFtmb^5+ENoXOK!}#MlAA~YWP>nPy)r>r1#_g*^*eu1hr)vi4=?Ny z_uNqGB{C2VTskMGV4m?EzSN8MMEDg&8sT{nl+DG4$KiRMXShXsw$4)M6q@=x+q&I6 z-{De!Ac1_|;1mq3*cloER3;Ya?2|#AI#jf0yvCuWVoy{dhUcTumNyEyn3YmVH`t<_ zD0z+=P-0&RDiF|W9}fJrW2iwQWD-90B7~GHE-nlSE=2cu?z&>M&Zr(uKSzuzjMNaL zZ+IoqMaU0<*PQ%JKz?pAq@wYUEkEDnl71*mdhE&t{@D^wI>#>bGF5#*1-UY|%2Pr; zveRKr^t`C2;^eKKm>mGlB}SN? zAy;0$n^8HMUXHwc2O}-yjw4Jto^M9?fm1qO(nsm%&9 z;e>|3{e-^&gahQnV_O*LTvCK>!ChBYeudFGnre=${30VTWaYVFS&2&x_v6%~nL>1Y z7m77d>b*BMzDH1vW6;5<=)V4m7_ff~Z6F*1_ETG6fe=s|?(j8B3f1@n5N80x&olZ( zlRCD5e$W-r6Jg?MZ>1pttaYqBQ3=VJ*HhLG4jymCN^1GZcq|7DN zBVr`W@Bk}DF-X`B?FtmO`)hIH@^&wG$_Q0g=CLlX$(;Wko+uBn|b`kgcd7J+QHexx0QTSD{A2m^2~7k*ZHPB_i@p@hUqD zIY@}!1bhQ5*8V!kxfJc?Qp7NF#b}a|JDPBg%@flh!v&(%01{-;b#s#l$?YCmL7x4Z>40!zx z_XS7=2OaP>%xUUBW7i%E&QkL&kva}D*V-1|6nOn|47?mZe7KGe3$=XsyG0$l^=5K=8R3=sHUDSv2(}tf5y*p1_1#!h2U*&r{+5x`&}9)~(%mWlhVJ)#}VqqD<#*0CXU? z3;%!=_uwDSX9t4NEUL(!5K`$Vr}WH59cXk4#STMX3w+RlWJ9C=9bb6T+ST37cH1$2 z_-dl%`Ux9*kL3=uapiar4`R-hdKoFAokPE=e=`VpJjPqy1l@t$GpuRub@<0mYd@NM zy1OyutSF9q=124*b!8*k!CJYfUc#f8s9s=@G>hu_7;pJdjn>Vl2$ci5Bdpil)A+|v zm9B=ALOx%XD<}IcG;O1JSK=9K|BbWl){xm*< zf5MtJWZU8_Dnz3s4Yv2tGAx!xFmGTxzSr1h&Q6NgFbj*T@j9GcDRo^DM}T&YnaChu z8IIfsr81!$dal_pLE#o+!X`p zJM5-)E|x!0cc*GQbE0N2C74+5-6x)B*)Yz8n7fH0)nw*c?!CyFqQk`+&*^r}%Nu!J z7M4r=Em%0br||&gxQ+v8>USM+YH#jNAnhM7b35y9b+zi)?e@5cXYl>jUBs^Xo}LJR zvz6gL!XH$LWYWSc94rWWck_Y5R!2bONQ zjb^`vKEA&(vD9PMP84#*Or<(Q=Ikf&ifbN7MSdE0{5lyr9|OWF?VzMiav#A3U3zmk zU#WdXv+yM%37jna<4q+DnwdL-@gCMRNC$obPyEE}@)5<_N5MawU|vXJg&0h6)S&jZ zVDVp~!v^}G9^gyZi`U!7^-`o(A|VEj^BVSJQof7y$e9xmez0zuq_Q72q&ye2G~GLETu4ll=~_v=~HmQ2N?WGbA9Z^dAzAd*7Z z%dy;WL^l#7E&z-s%t#K+!%1xI;Sq450iHYJn{V0TH)F9P%jg^J?>JW5W<_+b+a&tA zvc?&kci+jHwxmW+TrO(J@aILB zH001bqo8BRg%HPRDH!(&0Mvv+{YNy9P^ib)_Cq>O82Q%#kQE2yRcOmPmz_q<1ayDa zR_GoKUqiy+7xGlV^0_U-5=)dmijTy!$hIg&_qsi1;BJcBa9-Mf2r3=Arzv@Q7|p}w zDW>vLCqafFnl_H|K8TlNQv3ndv?b*|cnKR5idl9NH9z3ar1K4hPDHd2#GL>DO(^Ra znuinDdg{gvdkp3aww^>0C$4tmhHX^3{A-a<#(9$qh%?ZKf5aU{t~ACk=d55ZFkV1y zy{BZ+%?9Z!-bqFsePRjBbL`8pMrvDNqI=yQ6?Jl^d2pg8gZg%3I(zB#4m1y!qnJuc zowTf^Z;wy&uVqbJQqn`@s4`MH`4q@J;K>bKnj_l?MSUNDXhKn6Li2C}Tle$KMcu$b zA&Rqmgyw5?4+I3iv_%M_g_egJ7_DQeg3XrbUbjaTcBG5ToO|rIpwWMCjz*u3+_$mrY)J-$AcybycR7Y16)}f zwiAkc{oba`?Nv07Ft>*Q3oCFTisjXZDu~ zCtIUt0=m`qLPtbGwK3Gh)o~~{!kwr*Q*p|gp*Wi3iage!nSkz}wH3O9d?ret&#kRs zzn(Kk<$y)B5HP*iR+y+zK4oq4{75$`(wW$E&>A-s5Pn}T5z=G0?U0pX*_dEl#XmUWt{MIl!jGn7P;S$?XKuB^*c z+?B@yYc$rI!QSb_39%@J!#SAFWN@BA2D2R60cvMxV9zEJvP*Ub1*_}mJqjGsDw|sW)mR>qrnOW7d*^_De zJp|O)dv>nVkp+hghSc_e7B)yCxqmP|)KDO^Uu;q;p5cLrxyEU6sACb_$hyHhj zXoYDRIv_0Z2Zm(v2R$=Zsq^^+QZiW&tkFt&gYHg_ySLWq#?ZOBQh6$|ZVZ%i8w=Aj zXJ?DIhOQPe#fuZk%Jik1LklN|=W-`cq=tsvH(6Kbr>++-ogO^7dS+U^mc2B%GMZbO z95MzI9+$_!I9Xi=yG|yy)Y{@8TXYk|FK$sZfy*1*CIOy z7bSrplKdD?n+>%S2tLGmJ-VLG^GX@jhUk1wb}T1T0c1?mhAvbxRr0J31N?keAQ!6S zsowez_I*Lm=VQ>*uM#goB{*s0$OYdt<^&)3p8|qn3^ZlJAP~mXl8NZq_s?lIfd% zMJ59OGWy_aZ8aOiK7vOLmV$B)s=pWm=z3H?6yq%)s;~u_ca!H zKa+nROnww^#fP((`!0!*sf^8!(Q4?cH?-b>^*bu z%{MO0PtHwE3|$#doEw{(zmde5u^76jxWH=yx^)-FMqXCC*pPx8RH(mJFZTe(~Rofs+ zm94w!V3=y|UG(ZpxgSM1jV3?Nff59mwc9SNsbs3O<%_a>p05QxTH5^vhNLaWh!X8b zIK!kZZP6cS!!Wr%oaXf1LBEB)_!)rO$Yt;&_z@uZQ}Ge}3D&fsI=yAgFyxKe)u*MN z;l7idY1)9fjN>tJ3U3#MjA^X{(`pn|w#%N<^xM?x&!T%8-;s45-HWb0j zfg(sDAUnF#=`FNtD0wW|nQl#X^WE7WrqwUp6q{24DZ|2yP)FT_cg1?M8!Mt zR+RlDW9e8bn~F_{O>|RdnaiFahBpmb=6Y)k2h~~Ts+&psw+ipjGX4I@R;~|gXtL@L zYVk0D8!7rJ5!7lNFcN!$omrdsTk!7nF?i>M22P-kx@om{;4F)Bw3x5K-aSkoXeZAkp+ZFi2`MmG``^M3%02IA~x*MCLx zaCTX489C3C$gcit^hlQ!kx|yTp@8u7ZH4d%b9tTg3p@PIOPM$aun9*aPE!Hp&il7U z$5`U^XG~_A5U=Q7x5+e^l@#|=chGM^qu%CdbR5mYWi4jvHg(c2)9`Zi70ofn%p3z! zF`dn)S<{xx%>9d^Qh;67hjX?5fnaeCpKHRLWYIjF#oJUdV7;v{Mi&F%#u&?k;bjE` z_1@7|$oAS51K5PhIWq}CnVP%e+tn?8JC@*P@R6njH@eqtGGNH`;iA5SehV7?LUT0w zAex6ucT59Dodg-MXv#Q-;%DR2`=?pcmJG#VY;s7+iP!&umANHzaEP%f5K=TYaF-P65Z=IsR44^IPZ4Q zZ$YEO`BWNDZp_pnwodl^tE7OH9x4xpe@2L7iAW%%x`dZesB~^d4M%4`^i-VAy z%@AB#q8kY@k^x2&ivHDT9xg`KgAh>-DbJc-l(3zpM&Co83Rv{E!t%tJl+|@)WE(Qh zbSB%wOJQSd3k_Om64Y&OL?t;BGpEgIUe-g>5 zm})?sw5$eijZgOt*0d!xxZk4&D3etXoLadgNp9q>Gvr za-jr`nhEGWutn&i#n(}af5j*sODSyTMEBYzrSMG~u@y$o>RzRAZwO+2sySl)ms(av zQ@|nCe~M46KVVJcNwOc?1PQWZKWk)2B0^B5f=gGnVo2ztJ*IeK=XdALc5X`QK)AnWXttFO?$ zq9w)A+owRFn2y*H)-;~p)(FreW9(#JB;;`cVrhO5ATdFSY9d5P2MA4!N_jL77aevZ}CZu}4^v*AW;RZb2G16cE19RtTRU&lQJHtWqe(Q@=x&&NFB)2oPhm z6fk~6dtn^Q8j4atGA0h?TSiF-9GYvVxT7eijDVKR$@oO$mIB6iw-v^Rf(H%Zc!WL| z@chsg;fbY;8a~pLGDi36^EkdWpT2|ruYH*`p_R@)+8nWd3(dpTG^TZ?PTFPZUyi<_ zS?5^i-;6I1zs{PrWSx)JRLF7+jeX$pjT>Pw$MLi>KmF&juO3OX3 zB}?tEze z7`!IF`GkAoeI<$z!Wc_$I`EO0hSb)Z=w5w>v~BkDfLtl7x}n`-OFv1RfLhW$XIq3l7L?34M@bFM z!?hr$m8DLCtZX#>9BZ~5pDStBv?XiCLVC`4e_J&eA|n9~ak%7J|6n3ILk$ zG+#vXaN=4I5eS0S(xk&`p+KR}1w22nMR;N{=$(w}(I(hQ0<{?w-Rt(K&BJza4pT`| zjTSR$R!Sw^@T~lWHxShP_svoB-$rsbrs_~9L8{ZrR5YxwXnr_q_-paG{1Mi)B{h6} zno35>wOhJqoz^US=2i{c38wu&0Mmp@egVxRRFdV$3e$j-o~h!CBUE{MRE^`sqS2Q0SbMY(yiRnw7Voh5z7YCTR&{H`jP32>FrBXg* zhdmZ7s^HU27zYE*!&zhQnodY!>@*y#DODJs! z@2IRIr-zLg!oWqg5zPOw#wbL>6^T*K(F2{aAeM7v>p^s{+hgSpI7K&;wk9R1+yrK7 zTn@t?3rc>XIZFOVG>=fD2a{lIl2xb)FuEa61uTEoPFP}ET|y|x>PGX@k&ut#<(QW8 zw^-AbEalM#julPRIlp7I6$IaVpeY;LiRKZ^KT6xC9r^Prco$^Caj?W0%CXuCI1jZI z&Mwysq2eq>IpAqgz{5F|M!LWTCD-YS|AK({*cKs*tWQx5d|QwDapRjS`^{WRzN&IfnHWEeno; zI}bo&O4t-@+LD2L^0cn!6}e~|3CS!eX>ECfGPO}j8v4mXkz8KlH5Tl9u{rj=6U`%p zhnIQ~#S-}hjhT_MAs5YMc5WVrHvS6&;_quK#E*oiABt^r7^9j9sD8YyP<4qSM#pi6 zAA)sQfu#!j87lZfjCbfN+`{-T2#7zlMTlc5h=q?dr6AG0`b=T`OU7I1iX;3YV zsTg~6omv`h=?S}JJjzhrUDV5p=P+*Tg+&aZ>Ab8Jq#HLv6Gt$o>Jmu-mz=!?(zu;f za*Q(jD>#1JkTRN?u9zl9h)yc|!w<7VoE-6TEH%p}O464U16!mpXUy9Y;x7>R3IK=} z&N^MXxRbB{!=%!`Om;YuY+Oy_WZe9HW0~g@Oag?JzPhqad=ZLhqZ}@xRQkbJTVi(q zov5SnmoZf9vuJ~+u9W6JfNEd%;RgR3&&1&dZzf(i8DzqE+u~^N!*QxUlluxGtC(bj zF!b12#Mq)!w_GR6{RBv0?(jo^!md8DtzQ;2ejFcc5DlrJ@d2XoA-vYed_~dNSHX19 zK0pGRjG^3fY(xavMKVxJ?+WY(n#TTN!k&u_DtSDD@9jhR zn9NR1PEHMLmv0#(M&Im0-@y6em5Y5B3d%}hZYG_(W*<=CDU5|8^KWM5(~l?{(`xE$ zTDzc4pSgSs=N61y>Kk)T5U78cn?4`@@Z8Dl8hi73R_ot6?_te8mch2kOwOq^p$!o# z!Vx4#W~Zi3=O)I-C4666I-{uBnTuo3K6~W(x0zzb+!T|?KkaSoZRxbUC`-2zV~?^Zrl#2eUG{7oQDxQOvdf*ygt^Ol1p)``E4HJw&G&(x>_b0-1A&17If8^i;D94=4Vf(X zr_6YJ8Rv5;{-Z`l2Tt_&pR74*1UF9%p7b0w@~UZl)wI$Hvz`NjdS5lIuk6!=UNx<+ zY||>-;5RjJgXvJ6+%b5%w{zXN`p(kH9mk!3^K)h&@q5bdG|oaH&4HRiny1l8<3gIh zEedIRdOK#X)yFs;#{H({yu=eJZGSiLR2aPUI4W-YYkbz927^;nJTTptK|;HhS2Br= zLNi0pm&GIGz&nrX`~MJ4Mt!HW%zFFpvJN>OIzPw8TSdH@`#HR>@KjgPI2b+a@rbT^ z46|HS>ItCk@I$xLI!LjVblEL3o=K)QlB}Ng3)Nf!0+#zRKxJAF1vb<&ID?77Z8!5` z%MsyVSUXLYdg;l$HJwS^7w0SSx+ZZa(acHnpIX6*Lq-C*UJ zR#mH`QeIA+s9KNuA0!pS(2b;ua9kb-jDl~#D~;o~?$ayf;2sXwJgMm-_iYd)YoFb3 z!1w(RYF@VPC-_YeNd)KxloEvwi)oEfc_)%h zaQre+L(3%L@h)rYRduJe596GkbZ=RAL7J_-nM$FAU2u-jfvD^Tg(Hn3ykK;5AG>1* z|G|3qR>{QNLr<<3NS5x0!r&C9r1woGA<(u}&D3n!yf2CPCmlLQ`|WHfcX4H4dScxR zd`xHno6e)(y-v&IG7ObjeZFcPpkMe7wh_@n8yHL-X29`#40%ob2?^a#N(I3wW+8{H zoJw`}{%5RxC8gwA0K(^9x`XMaf|)?RYCX&+-MDS`ls1s+TBNfcd#l!i)RF;!mdUb$ zvqPb6RcklyC!XpX0!jB7%juf#>5kj|)4Y4yOGFa80*_Hs%FFB<(E47rT*%{Nd&+VO zN|Y(9)tTMaVTfe`DPN9uiY11mSt231ZQXBfAY{Cr6sN{jt-JGdvbA-uS&*S;H!DzU z6NGvV``i9Anb*^@L)ybAZBB)96vI|GP??bsZ?9BJ_{2UyXCKpGn}OR9AU(}ITwxa; zAWMN5NliPgfCKLEG1*qeyO~9T*c4K<4YRxf5L87e<0B8I(P|~B6fia=%S~4J; z)_&@lSZ*r$W!t3Pwst7R)hbG0)1e0}ZQQID(F)hTsNRn>Q@Z&$xZeX(La;A=|*1Z!;Fl`^X88LKm`D(RJk1}Uzp z*R6XiMemI@>jB3!CGegJyb~IBmcFz8HuPBio(h4!%)fzx3eaaQGqjpcsIpc9TA(dBb=`7B+& zM3*npO+e4RwbU8qmr|EK(E`xOGqsyD<@+@6u=`u~1>vXwFmn>Z}bScy2CSBe} zm#?AAH__!A=<=O(`F6VeFkSu?U6`*x9!xGzUV}!L|F8p>-=WJ(2(jkgOPBB3h0D9? za@S5=zC`!_jxPU~E>(K)F1nndr{i?VP**Ztrr>Vo&X6m+(>`4ok}XatoXdR`wYi2% z#o9vxz|zN=NWXVe{otnh>znGwHq}pVs(-PmeqodGev|Qilkt3$@q3f;dXw>alks?y z@pqH)c9ZdSlks$u@pF^$a+C3Klksqq@o$syZj)VXZw;7FZGx}~a+TLb# z-DEVq&FFbM_eoIfcJ5Q`N+i5pQ4f+Gc#rx6(3+ow)_fRR^Y5TFzYneXbM^D;=a|Z< zU$XV(UJ^j2F9+!t)0d~|7t@zP`o;9+P4tWD%Pjq3`f{CqF@4F>FQzYL`o;9+ZS;%j z%Qw+4rZ3+~znH%KF#Tfs@_zco^yOFR7t@#Dp1%6liq?C4J?`OOWiLJ8>mUBGQ6>lc z!P>r@Cz$!d%}eVQa^kAiJ!w6kw+BwlDt3)K_rHaPksk!=Gk2L^S6zVLf^CEFfSeJF zKHP=n@O|cn2{(t|7BdgE!%p_`FHIktsFbk#kBa_jaE&yeA=x9aL>7wHGZYyCGPi_Q z6K{w>z|Mzbt_B{+?LgD06+k8iven^CLGHBd(rnhJH<;(^T#*Jmkx5L1gM~NG9iqT9;1Eydns7BtD@YZ$v24l6per9>sgXWcqCn znfOwqn|p*KJ{0Q#F{|M6#l)@={hTzj{Z?rVs(1;Dk8lf@H%>{ts$NifjY<)-;oddf zSm~wJ5pfi6IRR(Y47_JQDE2mrG6>SXF+OSE(15gc(icEfPRqu^C5Y2=4%^8La~P*c0OPCeWLf~Ud}JZh96QFgV4 zXk?A}$m;Dv_FxOhz9|A(aFn7y_GB0noQ-Idt@tS4ZWqdrw1D#K>QT;T6S5qQ-M@~H z-4C=2J9e57jR;MsXO#5vd2WBtKs2(y6d&1NXcw}Nw!q3b$PV`OM$PPz~aaVj~pK2Gf z(zYQx5{>NX_{hGoUC2JMO~?*6(%G+ykL_e00CDUFbg90=g$+aJPZh{z!aOf2dukKGg!MG2Dv8Xd|ut)%eK% za=Vayx&>t8Xf2R!gzg{5NB57~h3+#gpc{|34RrSN@sa&M?LxL|+mIcM9%~~VjY_H}uXxbL9X0Qbmd+SkTgF!+zmZLH3i;rQVT^J6v zfMF05d8(2YjpB5C6wkH`#o-oEJYLU4Gn1fAg^?>}nfU0*?Lu#)1@r=BlqZ`t(88~Y zkKtR|h2dxm7zQy=(@U!j=84}PAH8pF7kVdJKreuSwtOa5)6pXOzW5lv)GiE9wt(SC zy#{)B?J4VNH5$=>A0N?w+b%>;wSZ`MJ)$|;C`2Ro>G;U~X}geneS45=JksCsXzY>x z@7smk8(KgvAh7}o-qPrB|H)|XJrW>~;3c|Ve{EIUai*~w&PlF8%=OHXxoO;`2w zba%SC=aF?qKyadsC^T2OcvbLm(ABq*EW~cMYC8fr?qLX zuB^?nHk+5`^GD5+N~mrsl{Hfdt8Gq7GU2Zcf;xL~*X$x> ziv|8qGNa8J1*2jV3ub58tki3_=Z%6^A6s8d0qOh9YRaq_6_Bu4aI}@w2laM$b}HYJ zDu0UtJ{&!&=#}|=M~9*)Po&CSPj(3Mt;192TkF|l>*)AS+kg%ZRXsYW-IglXRnZN- za?tV0I{h(y9k70>C0D@g9ATE$we(!VNEZv=q8RgPRs)Wmon82U_Ltc;QcR|eayqXi zvt>;yB-sn|YI&~HT*wk3jxHLRihfk-9gx&m&)#*?P#(UjErhYb?w%Jb^X;QQFR;)80D1h@M461)sqWMc)ht$ zE!dEU@}aC{l6kFC(aMP>4<>LfOh`VzJcRba{Y4`DolXQiN&mPH=^H;@*OSlHbya^> zl3M4a-r`B>MNd+1Av@7T>Ssyd7u9mXC}b0`Mkd5PVN{^nS}6~!1JR$ZRw{;)%^M1= z&wR;Hpcoac00W^I1?5^*Gb^ehtdDvfWk~y@2E|*x8u4b)LWtv3WKeul-=bZ)aKfT zidxQU_Q(wjI|`a5Cr3{lPn;Y%L1RayWFGD6Dwec@k?AaGl`gZSVa&2_Bp_=AEnP{> zYLFsGO|g*ZNp^QyqW}%l!u-`X6^%@q+5s>=e7Nq(p#(!KvwSaG&9}+uy%QtPO9Z~8 zkr+zeB~6U#M0DTO+2p)dQDHjORUy6aJg7lb=YS9^O^y`cd@Q$%MuQDBx?j@BAyDwz@JR=yWUGC4 ztE6nj1*v`X8mtR?-S0~;o#=JuRAPA8Ce7mFVyBvg)?|wdody)gz_{E6_fDjPxBcIP^lhQd&s?~~KEW;brOsG{UGuuG0_4#ZaY1M*#krIuL8mJ;wDPeMT>`C-Gh$NryQEnYIBAz+QKy1ByW>%ZtZRFy6J(}^?DPjyhnf1eQ-=T( z)Y%i8I&IRd{s@}YAFNrR&KhVIbti+eMwm!ChKiX_fmEgCW$R=WVBsJ)l1vlR5+KvODM~RCWeJ><;zOcIr^4LbLYz zQb%*ShkQg&40N__)M8yVP-v%g4uxeNNVrEX*+Pu#7Dz5CjS6pQH7AH)g(twDV@{c5()Lm?K3`e?faqE3ZoJ?2XtZwrKX+en`#3Q4_@ zngt5EXe3)m>0uzbsMHqCvbq&?dfb;zep1vX`!m#JeY~W|X?x^z2Zh|0r!77Z0Vb%k zKQ?vx+T#Nab@oNju|7zLh=_Snhn~0D2O_`(bq>U)PJg?o(;tC4{UOw$=WVA>zogDV zU+VZ-ptj9ThdP^Qr_#PSERcJCDqA@8i~4a=sZAEhIY)h|FP;1>P@869LzqFa1z{O! zmOA91QSdB``f$>xO%}+Wg&p#x&MbL8BcmsV&)Z6+Rm+LIw$zD#izOBRbmg_Inx|kp zmTM|qBNJWIm#4d4fiU^Y@gJ=@KiW4udAjpVva`3l2b1H0q0a7}&hGA^KKgfL;#32P z)@xWLG##2HZ`i8zO5y0N1vtX^Bzy@oMT9wh$q`Sb;C!Ww#dodTX=s(%&SE*+g@vsy zT5agcl-1cvg6=1BMN>=Uu*Q{G)KUpGpQQ+@K5sS zK(NObK}yJgmO6}Ai=Q(MDvO^K3{CvxXnhU#PHNf8`&&u zX*Jb}e1R^ln#dUV8)K7^u@>MGi)tR39$jh~Szi^bzJR3(WThmqtg9gbE3GAF%Sen` zESBdQ2(XzAN(r?*>%iZ2(?)+vpx;Jl1WEdRNpgjxeG*IIqbK?=9v`)7;ulNmPb_F< zW7bepc`cDf;s_CmsAZZ}m1yC!Sl(fE*uRiA9JFxXwTU53+Umg&G#K!u0SncfKan_n z$uU;Z%Ay>S8S59cE+fMSA9~nEjS|u_8l9~SA^jy5>os=DsVjP zi{lAWa!bGy7mwRI?h-C3+em3kRTGw&CKl2@a=ckKaI(^Q(?)SXpcwCi0RRaS?CxwF!?rtLp!N=Q zy`I@vzkGFI2<(sgV*fJcsSHnz+ZZ?N3iG5PqdB!apFkR}n)k9wx6@+>X5w!fn;wBp z^iK#3UgnFz2w`yI?4-lkM0U39!M|b9y`7v9CocSN8yA^})yl^NR!{h1)lXPWojk4# z4fGtbc|*cqo=qpT3}wf#sUH69!hh7R0f|l2lHIo>X>^bE3FK^K9utfS>0iM8a$mT6 z3GT_^3)4?KOrd|TgG2p|P;X#NaalZhClz7Rh`5L@n9!YG&(=71p8h!R9e z+bP@psGG7PE-5HjTMswR$kb~O1@x1ktaSm-2^*Z6+NC4Ow5wc2&S1HVJV1Dm8H2lw zNNY{7ba=0O)`LPa$kzuQ+1&aDnpW&b0{wa zCEWqyRTU8uk->_DVI_ksL+rFr)KsyGgjKtPv*qFf?0xx=^XBRD*A}$AvZ%wqclIYmin$oTU#OlAk)Hl*-0}n#L^#PPuAU4jxpBvx=%v zUMgJebR&^El`zVUUpPN4$mWSashY~8V@!!VnLzB0@%86r@#9ku)mDl^hRScKGMR&=9% zB~U*~ph~N-$zdz1soeYUP^2((o0j`&$GzHJr!3u4pyDO1Oo^j{&R&lsWM4uj5lz<@ z2|$*xT)iOjbs^_+>17p}Qx1%=HA{Mq1)uez~=*3aRZ4j_K7_7l)ZAKe3-9Z01)no!%(t(>o ze`{}fT3xW@OpfegV8)nfRy75qIq5J)HSFmk8N&3Iw%XCCi~T3qs)+cBEvF=5MzLyQ zV5J?E@aZ5na+sDQrc*O%Kg(=2kK}V2oUQ#UE~%=0?~4vfA$KoA$fS532BX95soQ>S zhs^ZjEzdn;d_F+qLx6bsOLJ|5Wen@JTNC7)=WfTB>`{h9+qRu<{{Oe>BBV)UmeAC& zcj{WzC~G8NCVaFCd3V?XL|fBfyda#4rl$2qCyb<(i!}C7+5WX#rVlCED%@X~QH}J% zfDv>_FJjK6yg~C8Wf4(m2)?FFlMkqjV>5EzvWXbozmY(e5;GlJVz8OZmuuIiY44gH zeRdN45Jn|ZcMMqp6N-Ze4=M9RTkLXUQCoO^utVgv)1nDp#{fkvVtg&zp7A45K5dT_ zDTcRuoOvh&GGPG%r*4w6xd@cy4k7`=#-h%c$jgse==f`5vx|3+i;c9g9b4?39?Ru^ zO#ey!fIC zxe^Z&;Z5+lxj?eHM?a$Tj;^C7-$)4ibaZm9S(+xQRlo3!eKJTUJn^ypeW^tkO z%R8qW<-Kc60o`JHf-RZrybQ)IKgxN>Yhq`^5DUdSxgfQ ztgtU1Jcz0Q!4yzTy;#j>lqx(rj1wAvw?fpz?tdk3%xTK$^OFvuc9flLcjD4O-3n>gpcVkAmKqLY&gvQC8I*H zz2Z}mFQKVRd7Eas2-2Q6$akm6Zi9FV11&@n?xu7lRAp)eu~}y_2@^o!9|Y*Qry$*R zyPqIA!IOey-?RnkK6DW_vEzbt51KMTnso`%+951iPG644a_pkaZD;VdiREDPSs6B0 z^kN>%4NA&DeVRhHK>}o4&9U$zrygtqsA1B9DoArM8Qk4#?_j*ze^XmIZ|@hNMF9#Ay4;ZtljQ`Rt_h0}zEF&2Cf!CVHjbBRKT zpd*aoHPd(%DCi+`gRRj*2xD)2LfTTQGEoR-Dwon%GyX$L-xFO*|NXfjg`U8VC-m3~ zoV&`94yI3Jq5rFc2ZtT&nO#_z!JHPWGbX0gvtBN0WQo^kg~FOK%g}qXn0kNYkQEeK zwx-u`^$@~aRI!qg#%eD7O;}pQ49M|hJz5HZKcE~AuUd>@oywp5=O6y+&%c?8r`zVf z7R28SVH>4gAGV$~Po4#|eVI&Bq zR#ZK>oJ8;nJm=9M4Bs?!L(U0C_0V@d-d!v(N_N%W0s{MSDas0Yy_}oLo+Ra$)-G{Y6{!N!Zfg0%v+VlKn9r~Y@*nuVkgKdB^|Lf zWxtv?i=dFEl!{P$rKcO6Vm5rhYxMbXu+T&Mo?IO#gd!eoot?H$zK6+Xu#|C~{0SzI z`i{#FLzr%gLzp;7^(VT;Q-9Pl$o(jzb}(b2s({3c^12D85mAI!da=q}}-(2pnos8Nyo4MwzJ`bL)j&mu^*R5GmMh%v-pR~Kmg ze^JZl6RadKL{O6*QOu17n^{O3GVctmxRM`-ReUT0DYU9Xvu%ti*k3@2et4Pbiapa| zUW?@fq8_M7Bg^%Ro1ju;3A1=2ixMKauP}N9lPJ9$RHu_ zBu(xIqyhVNsDL4os^|eXw#*sA`W><(NxVlb6YRL#6r@j4HG>6w;M$#nw6uw&$ zvk7Z`8y*gJv}4g+og>>!i8u489cminA)$@6eP@=<(&xpLLQP?_53*&*l4sy3L2WU) zGFT3orQHcOp+HVyr_#TF;DB=K#MvnpVy8s%c_TfVXfVg7Q8b{jM(DLzhRw0`p80bu z7D3$rbF7nP0UvVTY25(i#~8*YSS)41^q9(N1#DzO$`b2^&)o1{rdVQOk94|NW--7@ z(IX-5^4D%k0zaVOKawOc``xerc@NePY{ljVK^Xe&jgM>-{#0}m{scGSm;aE>e5avc z4z0RrYvkDOpvpI>t+C~Um>zGqLjkbd;nfXyc7{pg0fC`QmScNzvtVddr`P|-je8!LLtmAtW;WRay`JNFg5-HMbe zqjb;!Gru!^xBoAj)}BxYjt7s~)A zCzu9aieJ!YX^owAgVP*Pc7Ysu9(?t2gBc;+!TawZ46Ui!ix_Un>Kn0HjfzaUH$-6d z>xmFHe#d9C5`tTY23bPSd{n_nufLQX{6vJaCQfGG=(lS-IpZ#uMtSZ zld*o3aCRkQbwz<`_jwZOw6b6zJjO+hd`Rp*8iPNp{)?51ntm*^lq#Gp^%_%GmIkj)KRue88al6DJlCBVxprM0J$@oP z(SP;WQt8_D=?j;Q<8#ZWkE_+v!s*M`Q&0EiwSL_=erafUsB8|O8Xp{)K7Ou{7#W%x zKc6oe-IJ%UpEy2vr01k|rsv#9&$01KSC1hoe5rRlwa~vfcKG5sb@}Y{!1CoI)7j(a z&ZhIF%<|ySV7_qbWcSsHBYh{9FPeQz7tOLhd10tqKW=mL%(sv zE19`@#KH&=K8o%+u?!0sI%I`4lVjG`L5Q%>93Nx3M5SnMvRs@u= zb0WokJ)WlP?a(<37_gy=hA|2l@x3}BW6h4*zr&X$4L5BFr=i0KQn$k zdGgG{#liB>aN)#6B6-qCj4Y|S%jwzjpfRHBeV32-_D{|Bj?L>m=ZfRA{nhDnr>>qo zGhHY>eRZ&!NG%-J=ev)Uhbq^Hj0;cq^(_vcS{%ahiFZv4#kV$YFN7g7_mhR^B5aY|1P=-rizsZw!z%9xrw zGm=bRNorRor_Ua_l$=_=I$2T&PL20p(Nn{{)#cuS*)!*|<;!#PCx$0ZXhW07^AkgJ zmDJ_Q#L4B;hjZ8R)hnfJ^+e_3>GLPkN0$40$B&;~>h8~;KB0D>8(6rWJTo^sK0IB> zEk|@v9)PXj4$3i?gVK@;30LI+Ss>x6?7|^?nIxMU-3L&xqCxIbdRzmWq&V)z~OPg~zXR;5MrMG-KEb>_MK4-XCq~3YDZ(<0Q z(oVZL)?=V@52pKF8;>q;VT&Q-*2$zwk5~`8fX$)+0V__((7Dc?mWDA1rGN@nIg2#P zV6a+5@KBI&N}I_QT`i%|CT7$u#es(ChSx0&^SpotOW=`B9f=YVTqIh1R@rf|R?aKs zAYvU2i4JV?&v049w34khi5ws-RI~IytXN^GOs4L6rA9nOHl%s`5{hX!=qBPLo8>(_ z9y~%8DPWRBPB>4DIK~7GnR0Yuw>5SD56lbcRT5d^Mbt;&RX)jx=|4Foy7R1xm!YZ4 zpKsa&^`kbsdlSfl_D)Lg?;&Cm;`L}ZzItIdRdKZ$}d!_qo4!S31t zLXc=)SfMH!sK{5*mnqX9dCkSVtW5)x%&Ns<_djc=pbjX)n$?oXO|a?!4C6#_lxk#x z;9gDmPT=ezLJk86=!F1D1K4ki&zl*kgNeq)r^e_D@p+@S_`Klckn%#1#gms)ke3yP zPcZ6{<)v=R%RpktPhzb79~gR3*kzIOx-d!`Wfn=`qaQt+nZf!}TAP_sX3NES&oKFZ zmh8?GEEF{hsew&mr*E@5S2)YT^vquWDIo13Fb-ocdPLh}Je zWC+a@-a-?NBKD`LKQo1OhK(qJK^q#Js|=eZuCJ(z|)cL?TbK=M9D!(ehp7SvDKf_m6bOsz5qSk!3}TInGp2Qo&IL zdv)S|y2A%0f`h~4h`Imm|q9uS9SoAsWwszSMAsWN^rVwDy= zj@q=8aK-W(g$lRws>JMr5isMtcz+WwrW<&1`AI}X9iwO<_!JXS6`C#ZY%Z}=&YlFI z0gtqKMc6!YzvKsHY|q|P!OG&}n_{OQsxint2+GVPJ90_^fl+C-qMXDzQWlk!C&V&S z^Fbqc$H>r`k@QYtR=y(-;CXT;$xt}YGYlNn9If;{z$1$4GoD%w02ROg&^IIP3>!%4-t-ylg|UkhmKTu5q4-MXD}`szWi>pxYKXS%c?HqK=& zq9gqJcZnsU+LNo3NQ+P+Ev>f80?$K;9YY6iM2gC^!bU3as;#NV)`4?#XMPyriZ?V9n?1Al|>^{ z(d%QIi85O^0U*qz@DE6_4gUza;t&YIXe6t%r{Sia5QbY{Nfk58O`y?vFzd?2Mb8K8 zk+ocIe#aHru5CPcknMYA{BTt#%ncAWmanl6ZEWK+ga;Al&3%j%!Q6BY?XLs@yCb~S zNzm=gy_7Z0b>Sa3t=(vDK6nrzhpNV1b2p+Fs4EN6^{kbR>Lomii0XL;NnBLVMtIAG zYOrn|AXIkd9%H@c4&om-RrZHc3YoK6p`7fu)XZ-|Z(+1>^YR&hvdlmUCJRS!!Gb!B zm;J+H8IS@_EUaXec47wyv#2OLh*jB-Qzn#=^SuLuJVuX!zqOYo4c^)k4ZbHX4c45= zb2tM_>Nb8$1V0!X!6cac{^$t4k2MVy!_H~FI-f#B8|ew$YqvdDyY?#0!r<9jjvd$= z_ce+4CtJe%`M7wmIb*TOO){2#O9cNSHi9Y``)AP+`~qtl%GjsIQO_L(q_7!}Eofka z2^})SGXQAsH7#Y(Hn7Taf-h3+Z_q7APUgMSA#pYP?!(V8 zN1JaG6E31m&KkRt`x5-Ov0I}!jT_IZ%lV=zZI=97vhYX*7IL?75KY}~qXrn(18MhI znd@k}wZB!TZlA-cJB{zR?jCyd^r#1%tqlDEzF?kc=H&|(BG8?Oy>krjU{Ap9KV%`~ z*$8iO{~^PghFYLNU$BNge0;(0#-lL*hokzP5rA$+^*bWGp_gPSf`GSv89EUpw)iOI2kA@Fx1+qf~tfYGowYkLe zlP%%-d|W)&oRMZVB^gP-C4zqu8^Jsn`Df7)`~qtls+3VV!*w%ibBX7z9pTFB7Ffdb zU*qDr=8QyaZ;9aL*a%(&^Dab3aEdhzW!^qF^Xx42j%NNv zYAZ1;wuE6mE{1E(!rOC;b8<+u{*WlXIW~$FFtHXL#T%??C=Pq&R%PBUY|jN~yKxj1>`9Qw}?eI#_X9D=dJmz^LW9Sm+S=v5hz~kbs>89c;;(70mQ- z2T^dXqOvo8_y=UA3rMhrykI)fN9$Tg!n)d}a<$J>;j6~Q&;fuyE@3vDe5&Dq$)V?K(vIx=?BQvN2<&SqoJ9pvm|ZEPE&h3$jeL@>{epbgkd&^XhG8W;b_$L67_PI|+&qWOk34^2Jd2u)2f zP+JXhdGz!Ggr+J)Gq2Fp0v<$+*OVFF!Q6D~?RS8&#RzY4z0I?xp`&16XsV7rd_q(I z36CP8`j!YlH>3LI2yeMi^*1Jt(3HV?jToAOI(Og*EiK8a?>RJCF5&A3-ddN#SCFUv z(QtC<2WlIz5fS5eeTb^OmVL;D%Hvj+AON4-+AJ)%+<043?npe!4WhZf#6>g_)QJ#cr-=xr7gy^(yc|)j zyIIqg)cWBOPC&Mc%-S<1Vhxt;3d%-kDT$o|Krz%iiRS*quHEZd=t#ij^Hjo8S|u!z znDr{gfk-N2F)O&&wNaUSR1?)0Y2DpS$}C|)M(>A`if@lc#s3t@(TM6pop`B_Yhb$B z7p=@QkK`u3UR!^zzF%K|Qzl+enFzLJd^me+bPM@CtZ7Tb*@I`A>Wo+hkA^p4>Vg|d zlh?T=)*$v$G!GcW9-?SuS}Rwm{6)q-nTcLZ1)_HK0DvP1_2_D-^LIS+db`riyTjATqw)vtoB@UE9LSc2D zZF!*mc>=P4780h{wH2m4Lb^JYVXUpO3Y!kS6@Y~`lhA!nTcLZ1n+@6-=Cw;pfEU_M z!uNx1g>M%LI#yd)wy&$ukAN(og@oz7ZH4I}IgJ3(#38M;*PoX<5Riqolkk1Gt?+Gc zh!w~oq4|M?;1g|y;8A`k1Y6ZA;cN}8tx@GXIt`+NBOtI+rj}*iX2jMK*57F>tb43t z6MhF%2xf*glhA!(mC!|Ug7)Jh5$E)l6BOL*+DsGgMaAJlB}qx$9`i(>r;?6aw#M?B zI?&wTYl`T|Qzz}3DBkQV-XzM8Ucr*fCj}e9xQP02J8Rm~q~IaAwrr0ACC4z~##Ulk zhcLA)Y(;20DdcGY6C=JggXaE1USrOq2xMX~n$y_9Iyfg4lNRle057bWgzj2fp?erW zux%U-!xOv5fE55nXenWQOPYs1}nIkw3| z*qFJYR5|cgQ1hX%c9PKdZHqPB-Gk-3G@1v<&NiRbtET(%``RkMAIu4^*yp12 zcY-x-NwFVj4sH|C+5ULJn!q-aC~t^Il-Hqo08{ROa1_f%MV~k2VC=dlzx&ozem4>` zUc)FHX)V@bMsTk#WeaY~Gcc{hJO8F$8JLq1axQoVrkz(fp&vl@C32~5M|{S4vS95j zO?m7H&WzW}?+kN>mvEFfw(}r2JI|u7?4Zw%rh`72e7VbTtj#wl3v{a+dOH{N(@cJH zM?ox+tc280PvnF`gsf|SHe4ceJoS@4&Jvrk)g9A~sDzWkZvpQw7L-fpPS$%rvb#PJ zL7G2~HfU-KM(#ay<_igj{khtMC2QYxf>OQ3;T|F*-ciCxv{O7&!o5o2HRS}4QKoBX zQt$&J+1DeNR@*Dl|^oq`=hQSECP~)ZZCA3W+O;qg7rN0qAB_uS9sug{o~oyu_W4jeV@w zh^fEsL1ag&ZTrA(ZOAi3uARATYlEn)GQxLB+;<2F``rjuv#Z;9yN#zyp)z^=cJj_8+J(@=K3 z=rI-&9shEF>j=ooqTiN zlIR|cjqXQ)?&HzXeS|d)W!?P_*0Iwp(m1+>p&*$T)I{Pl+!8)d#>Ho?*|#ZQ%od%@ zvu{XL)!3;13Rw5*=%~JuH4SCm?h8|ANYN;Z!#O}JgoET>NGpleQcGA><6;$qfx%7r zH2y(mq5PYAP2+b(Fo1j--!w;{jg&4g^5`)-t`|voIFKh%U`4NSz5-^RsJxK}V=VrR zc+|U=ELu$$l7BxIn}5FssTBCJ0L2!5@=()$ugkxUZOYH$yxqMBBJDk@>}4e$_a34< zsB1`f1}Xzru9S}H6N!=R=*Y8`sLG%elVc+2pZ-Au}~OI#o^| z8y`xQhZZN(hnEYvq5RV)&rWNzvlr&`>_T#BIX!v& z!o+lMu{*VB=10#}3TH128sqkxEs&jI_Z+UzbUX)gi7oj6o)N(-kiegT7!Gn-WN?y< z?oc1%f8L~{r+b^p$8NVwLiTpcWVAqvFToO5A}9Ut8TK#8N`LHiFWHfFL=fRF_7>;x zUaxQ&IHuNC8u&7-y zkH=id5=Eb5)(w@q@N&=K;h`S<-@p+VJOqR3)=>A6-Xq;T14lZZ8rR#X^sT#r6{m68w5Q{%Lf3P9PI?{8C3oEnvprN+CK^8lSF9Pd@TL^N z{~aQL#8h69>5oaCoXfJ~o2X*BE9mm|>7v4q&J8}ux8a;=S)UjM?I=G0r~hcCsg_wH zGTUVo*j)#wNYlB=l6FPq! z$TXaNZ3T^J&HdND320y^jrig)w@mKf3rU5i6+DZ>_swjJC@{}XHPA?cjX!X6B%&cm3*5Z=ZYb1DAToSA~lYP%(`t{ft z?j$DvYIF?$AJ#NfWp|IE+A{`!zI?=YbqO~^urs8UWZdt!hSvX#i`JSm4nbgn`#Sn9 zG5nX<7`}uU_fOF={0G)FlyTF3hb>W+38X}@ddIBV2`W64*&$2&FCw{j)}YPq9m68t ztq521^rh(o0_U~qToUo_yTk3h+r%*rhEKm-tvM|CZc49f5n? zH#~)=Zr^av+WUsi^EzM2M5fi$*T)^Hue_%hz$JW+i00)Iz9s_Uxl8yg!#j>ksF0aj zitrkDld7y~sF@0M3I7ZF@No%$2#+GVgzty|wA-36T)#iUYc5><^`69pyM$%dYgCso zw65hk-(#Ad4=0ebX6nb#Tv~)NnlH6bLv4`jAWZwD)Qh6gAEb?- zR_R_!G;^%HBY-C872HTdwx_L-ZBJ=b1XYI2WIk2%0|~*QRYDL+bpIu;=mz(?MkdVn zfU*nmXf%c9t2SZOiI)irrVKX~lXy9z1A2xvZOK$T$o9KcQ%LVsnhw5`iV)aHis82c zjF4f}X-1w!bAJ-!JO;jaAfT{s$S>Ab`Nc?#SYp(TWV0FqOFy{Zw?`y_Yp@Nr@i5P%y4lHH0>3?GHsZ z%VOZ;W?UNa2rVV!{tN)cP^T}Td4M{hdM1{J?0vcHWTO37VA^oyeGD&090B*SrY$M&uJbt24oAN$qZMVoYE~2|g{f5>IuX!9688cCh@q@g zXzowk+9NYFR&Z3rMjZ>-JcKqg!`SRvTg++Htu>qHXV?07V2=>laM*Kvy)liZAuMqY z@l9w(;`?OyN5o;G7T<$=T^mhXkDU?7D-jU|>n|w|Zwn`>lTL3zbANG&sB6?o%ewaF z=rpgfrY-5(1LR0DQt?Cwqy&g$20_ZeHj=;}0T40t?HAG9pTIR)=CoL5`6_a}Zhjyk z`1C3v2o_py0)L*-I?|wHu_d_IwNZt2>4GfM&3;Q7{e3(deJzkn5!HY?@lu0Ue9xPG z#jD8qADLdkn#c9|tI_rOuUONT%PJkBPP(t|LwnDhOAqRrZLKr3KIBWr4NGl23huaDpX&^f`nIGy6rLfci z8`lJ6fo&vQpJ*#wdysH2Tg|gm!${aT2^+(OVa+6TztdLeuuW1~pwtIs-|GDM0i4c3 zdAV7wP{qNM(z%S%R6_ZMRYDnQc$&dSLZ)|O=4A~}!M(cN&ETdy>A_m~_HXKy^l&-C z!URuxuu}xA`gQL7>sq8u?+qHOIHu+uJluzsB^YF82{T%{n87UP^riEPuBjQVj8ezQ zl;%17ii&n73fYuZY~fT=Fzc{I^YiLap zX0u1Ejlp{n38T#{JReEyzQ-r{{`=S+#@dOG?;r|K01RsB!6SXW{fWVD^>CtJ8%QP8 z!6QQnb!c!fb9i9rNVlf4or(mpMsHXWCVUZxeDTna)tXJC_bO=LN&llwqI)qBLkC1i z`u^ga{DYpw+W6o9^hBvLnpi6LmU7Eer^il>7q0hTn$Hx@ok&(spTE{Wb!1>7cjR!Y z-?9If?TkD#dbM!=Sl^L_lc)77+4FsKL%GW%{pG&I@#3kI=N7M4&K?_`x>lOVv-$=E zDS+eK`Qq?|AxT^LtZl|}YwX})|3FXA04w9bH^&Yh9vmF#?dut^H^<%-I8gnjz`Xzh zCr##~AtsZytL1(TR`EveW4O9@spUS7J03gJ#*a5xRo8~1S6$MJI9M%RESEL2R4imD zvw%h-I3vtQVd}@R%hdt?IL%0XX(;D6YMFnYu~T!Mi~^lnl-8VO9TMC@us>eoFN;a=BC7@i zSKE5om6>9{9AV#_wZANMy0x5F_Jo6wa$(+S_Ma9o0^76E7dxpsRWz_+Ono#2{)giF5$q# z9V?L*8Mes(yM130G#!DUZf(#=8w7FTeuYYg*rvr-IK-b4gh~VuI8U!N@zhxR%v|Rd zt2Y1uzH3XkoFUO{3!QUuUEy!utH3~5*@>ftZ69IzZ_?)SHMm$ z+TqpN(XbGOc}Kd6$w;A+U+zEvBOwm2yft30VScak0}-3o0vTgVF>>wxd9YN|;?#?oDMS)?B|km-LRxeE!LqWYQ8- zsypzu7bV*EKxi`g$bEXf9W<+5S|h3m3EkdEbPmpb2;Q@RM_*rSZW3fzMIKNFsN<}zm;srk4MMwM_AKP8}jUMxvVZXE~;Jb9OypM!Ox*j zBi^m-r${)BDwH;hKzLe5l@W?NI2xG;XoD%M9Ae#FW}8jzIE9!wBdlB1%5vcOcZET+ z>YPa&k}mlfFR zU?^EKhwV0b_$`Qz!JjcIW``wA%KnD6#RF2j)~I($#(!*$jDHuGj4=c!xG7)2v*ySC zO}!TIUKe44!WZzGA_+~qmiz438Y_#n!CH00U3Z}=5ekuMD&vM7+zXG6$eqf3;wt}^ z9PHW^K2hQEkwa+ej(Oc!`}oKMj{U|@0f5%yBQI_4=>>?7q=;x<@sUgf!t?mZ48uFl zh*=|J^-P4op%0(<$hYHB#Q4a!MF86E9WY#6t2>velXhjG`t=n|Wu9&L~&YBdn>H zoQ4v=om&Y15MYGJvy)x_3(fu6Ra0c--w~R?;umuimGhcRgbZ&e&H7)p6~evD`{k!9 zSnCi-J!A)Bn_AixNr}=_LizPoLK#WCeh(iBn(mRlyTmKF*EKQ?zB_{V-5*QV6g2mj zwUFfmkb-TDq)ysp8eWLLf;q;`%x)kRQ4a2BO19Z7I6<0G*I zH@Md|GGNGT5>xJV^jp&C1Mz6|lW6WQ-4P8Kb>d~ff+@od#e1UD`zKh_mJG#i?8aVF zDmYmf(dGFPP4^wczaV8uD@o+f0gxCbt2Y!r+ry(0E&Z{Y$I-dL*`d zmeD$rn`p5mxYspO1LX1v-mRnGl14ioh{d6;XztIUh-yHcc&R}vo6Nq^`U>VgSM@tU zpope*6KmR%sz2DE>R2>V%Ph+cezlO6;6_r6E&z-eiav$r{$f@Kg{9B6G zAEEOYM(p>|+@El@2mQAq?6n0yu#tr9%d3Pe5*z*}qirNl#$rQouWKXt&XaTbgv@zM zQf%jgv3Pkmn)~xIq7qOiEi1uxyd2T&Y++4XQi5H+XZwm#BA|sN?kfO53`KbY&Hag6 z+sX$9D|=h2M&oVy_3>4HJy>kHO*+D897!20b_DmjHp(E6|K^$?|CY2`h({|kkW&%W zfI4Ye4NB4JKF^xAqz2m^YQRn>7t-JSK$7x@@VOX5{{v_qAoP16^hnJR`4l<^sSB$hG;_u3|3p+T4Zi?4kw9*sVV=Kk6l z(I`_V?K1E$L|?%i<3{--(dFP5S<{w`^1g<>65PI68(U{)P|bmt{G{y)$hkqB)UM|1 zYHTl!{2RbAQ?44JwT;fc(A7HhY`?K_PpC;3wLqzJ=fR{N+u@wKI{$*^{_<7ZERhlR z$#F;O{R83P#rWpKi$1SEK-!SjPGy$SAhZS3bxwOY}OW#c+qtHHUvnNrax$Q5_L$C8pW z@hJHWn)_=(L@P_3cv;zC`f+P^6)#5|)h@B7Em^Z&7pBe#Rhm4DjrNnnptI83*)3Em zpoJvv4FC|s!F(f{`xCczAAulQt&DJ1O9k?MF5&sURl*aAL9b_2kEAvhgMxcq8?||f zRZ+y$l2k;-Oq$hFsaSR_)%iD&)clor)coZ@?nYD{>cmTRTA6|R^%cwyu7)3u&gGwD zOIoTBT{gHXJHb!-dMq@{_0W zL}@Cayyc;GLb;Py@`KAYc~;?~Zc4l1_gF%+b(PRW5~#n5D^S6`u8rBaXQ7m|s^xf? z4DW}MibL_J*pKG^k{8ijP$%s&7k+&O^MRX-9sm+?)b3zY*1USTy z?e|!+$iSy#7>8Lj_h(UUAI(%MNr+6&EEZ;FSm8u|FU{{U(Du7$INKWD6X4(B=*^z- zJR1(PnDHz!%3{v6o`GWbK@S?|Spo_dq1WJu_4irM<2js}DsQE0s zql%6s95!M|0~gpvGXI_7C+1Di{Q z9Qr+$l>B5oN+@8?@_X%sC8E_OguJY7FfX};d<-u~w3HuZ zOb(8 z+hzzwa4B33Pm2N`yymGg$p$6c>5Be>gn0KVA&w+|{~TBRf_q&X19cx?Xt81*Y@NWM zR8=9dzRx8sPsXF=aWoH*(yd9Pp*GJU8*j_6Pq*{y5sea|;ANCrnK}CP6)X$fz&!;( zA{w}tv!*Q>xJQl^i+N2gSVlrIOIjK=&8b8Jid#cJStwG-OSHz4eQ%7%zSpC9fbfVS z4RW)mn4mE;QYotibC#XRC!me~f`qutx)YRYoL>c%_)Zz zD==QBGYt`BMzI!RJg2L43!}dvA%6cVA&#UV--eIGQjp+YT_!lVDKCOyl~eF<>Qw~e zjx{`qZ=s!-W!44&z{YRoG$GsynHylKB&??2BI{*~i6+X3tS2PoaX zTA<~GjA5p$D4$gH^Kz2`REInY#0rN5z=%0_-{L4;~5H{w)N*?b-|B(+ktPqA^_kra8!!=avW zj#pH<7fsz2RX)>HMfjB@JUj(Kjvbb!So?N(rEKz^A^%mA)d$kGj#AlJpe;Rf+Ok;U z@XKUa({D(^JQjg4Zc+K~Br1YPsQlupK-y=Wg8|Ec;a}s$36Qc8Kr5Ly)Y7{Wk^b0- z{Er4iT&GGLKsmT)>0AU%cIaS*k@LL+gVyN@{J?>M%D|N?rDOU;VkA2{GBP?~T)18y zEO(Djb@!erTs+r3Ij_ylPmHB=SNItXb{#DA_)6=f1#S7Xo;sB_CXLf4FI>lA41?#p zhgo}kyXj%>^cnw$PanxHvNxY$2N+;+g#cersnVha0ZP8nm-mj3jvmXMIDTBg_ms;g zH9b3aZusRd-}_9*a~+)>3~g*SrMG2aJyu&hft^;?A%~o`R5;P~$>xIpS4l$F&Xd;7V~$ zE6|B2mX>%eDxkfjw2UFko0d&z3X0K3xRrQ@@rIo(!nlP#te9>5KG2hOMu~S=&@((o zkT3{1I1*Q%se^k0jkjlUfSAU#Q=W`6)O)z6=SaiJD7bmJ?}+1Ml$%ELrqR4haY_s;Yh>l>227Jo7FOw)SLaaNU_mwVDrz2Jvjg@N7^rEE zIo9ymQItR^C{rWnr^RtL>;tpKyf~$1vZNJ8PjsBr5Vo;qs-ld#49&gx0hKH=Be2Ll zdEIs!Ca;2BU{R>7Y#P@pDynd(BK%|DkYId!1TeUyytYYF?rD;g+^}-+;Hi;mrK@vM z%jXkwh2mnNs|d~+nZ&HkIgxLA@E}|5Dr-2@S6kqb20r7qPg@v4o$Sgo1@C5!EH6r7 z@tmSzw+$L*q{O1T1<#kvISQb?~(mE9+CoRlv zvnI@=)A+ar>Ru8k!Bv+<+$1;6*jCngui2gnxs(eQ<4ib0W%Pjnvmy8p*hb?2%Ms|# zCHcc>>b7~ink0E-n0ATb@Hhzc*-2QXE;jpuzzW&5EMNsj4F+(rXm3kE0EvuQsmk}2 zk&ted-Pw}zDF(4yR<|{LP0-*D2Ml%(za0T*E^G8LCTod!2uS)`(8iIk2S~mItsBRb zYcn%htWi~1BJIo!me-85PD4PkT2|63ojgYS;Y=8YLiT9K%uKahIBIB>*`sX7gn6_` zKH|}I-auSFfdeqKGA-q@b1#k}YLq~j(s>4**hS(FkZ*NEA*kJ9gJu)^s}YF(@ePnH zoINCnt%TuacTev$CQ}`67ut}(SFDnNHl(-iB}jvlkz9m`BQ(2%gys^hXK+qSnQ?6b z;!$flC(pgx&MVa2!Luy*SmG9qEv|0~$=EEvZ_{H}bb8#2rc4V@bHQi_@KQyochlk7 zh7SQs5Vc=HZl4HDVQmx#-B)y+I>=#W>&yY>TY6=y?nffn6M@q1F>aq5L0b~(G|U0p zpJzq$9|-p1-Ies4N4#CP<-P>Be#||)*eu2i)Bak`b+dUiZJr&FQ|@(0bG|Kx2Aqu zBVb&^Q3U!r*AP6mffKK`i`HAym84vk&m>dJNp^(JbM@S-&{OV*0E1b(&$FSCsiPS| zX*F}=CcqXxQEh{X;U=xs*-9W)E55b1l^@lV?^KM)Haz~g)#%odTmFh zn66fgyxBQhrlsXVre51{k;?R%^|#h750uTcCTg3rT7f1m#WK3sOvUk7olg95hxMf- zx}U?J9sJK~Igh`#REp_jN=?tvQ?t%0OV{q2Efy<=-APi)LlW!eFst-<3x7f0xU;O$4wod`m|h>dt=6Hd zdHLu1+74~Ws3d_(rD}>s>uc*XTB@2we_I#TG9`hcMOjnlac479Q_>n?R9``1P;!&7 z{S3#&qgB1OzFL`09In?MbU#RH<#Mr{)UiaL*UF$Vftjw%{2MsURwiEm&h@^u&dEis8ZON;JY*o!_pmqj--=-DnwY$skAAK(6XZEHy@*%pBCxs&c-VM#;GKVPrCL@e*&w%J))#um2%I}5E|yO&xr z0MIg7(dNOS3OKR}_Y;qH_k*Nc%d_c*?&*%*{bQngnm?1o&f$tma0yCIhI*y_QxQ<|`(St231QQK}VBaLJ!sT)~6kN+UTx95u_`FEQ0 zD)j7H6>4pQP--Hp?TsG_A-w$u$&W+cShbJY?)u@%r^z6|Z3p!XM;!8+pS4WdjoLb`uuw;uMQxL1O`yV%M#`~*eqaiqma`hH69i`m zfP!dMU{uiuQZ!9i^Zois{g8fDAJrFiU4OIwdi@9Ww^VC)x!TeI!5Y_YOO@;T$y!HR z*V1zd15#Yquh#CY7MwR0Yj<(el)!r?@J<-m{`%(T+t6eE2df17toTN41F39=KF3Cy zXXGDpxe1I-LNtch%7t3)8)J9 z@(#LuKV6s~K%=~HS1@;^cpyrYIO>$vCvqQKht?mZ%R7-5k^4cqd^g;*+;`FC@959J zq03*<<Akp|qst%Q$n@Oj=<)?>@_Afp;_X~KI~ z^bfD-&#&m8UC}?kqJL#Y|K}AZOe;)~R+td2FacU&!n48zXN3vP3KN(WCM+vVP*#|b ztS|vtVZyP(1Y?B>#R?OM6($TTOb}L>5Uel(SYgaxVT@m4OkZIPUt!E%VT@j3OkQCO zUSZ5#VT@g2OkH6NU17{z$^E~;{08IK4aTb*j88Whk8UvjtT5i(V0>9&Jh{R6af9(< zCHGsbhtIGpk^crG{S8L;8;s;P7`bmSQr}=?zERb8k%@V?{v%M;4?tBv0#*GKRQ30u zs$bOqkN!2Lr~1EHN_yw5U=35!UG$47>0|VZDQO@5VoLfH{bEWwPQRFvUZr15Nwf5e zDQSg%F(rL1{bEY`-Smqo={x8bQ_`QHUrb3qM8BAl{wn=qO8Q&$iz(^v(=Vo^e@?%c zlKunzVoJL1HvD2rx}AP8CEZQGn35i(Urb4d=oeGc6ZDHI={fqvl=Ri~iz(?G{bEYG zM8BAlzJY!*C4CG1A|=hyqyx!B;uq7$FVa1xkI$2OGJX6}sgEC$`uGX@#q{wX=@-+- zourgZA8D>+>Eru_KIZ-x{p#L~%iq$k|4ynmNPjYQ?7RcNm^yx)w3DghA5)WKcjL0- zE?h=PMNiS6Ohsu4DfbvsRdaL_TW;IKxKJ9QrM8q%W~nXB37Oimuxf6Y@TCA)wYJ6S z6VSL(+mbe{Lxaf=vF?!fC)!z~q4SQ_4r3&Ii1}18FWn5*^qz*Bvh`+HkDJ9;*-Ll1 z`iJ=}S7_F7Z)0El$t|@G_@?P%l|0XS?T$1SXROg4Q=yH=`Te)jsQ6Z(KDOR`LwyR) z79w_V+xRd`AKtHT#?)jP2i?w#+j6?3ueWw4xRdh^oT!$NMn(CD2K+e#XegH3ppbo} zbT3WC!jN5{H^v(>zVLT|IxMoq;tM--e}kq$+15;$)Y^JJZ@RT+6@ISWK00x7k|r>Y zi6>k@npuu-yOkE^zKWg^LnJwL&5-GFD)-lTDpoeU2z4-&P&}E{rc|6)B&oLVi%hC5 zXc|Z=(za$&>B}4@YS9!4m#&#?%Fb0=-ZYswEFXU9^8Dc+NziWd-Fw3TtS z-AIC}(FywMFoM!R7K@-*PqPV1BcNMBX}L|S-6i7{Vh~_sLzs!<8`pN!O2Zg0&!bKv zCY-a&N0lzUIIne;s|Cc_x)zJ&xh~4EOo#|&C4p(M>3Pq3Q0Nj(`AovOe#C;AlDOX* zow(125VvWF@UVM=nBn>=iPQNs3e=Qo0x!nNy+tFFrbYO@w6uokA!7S{=MxU5lBj)O zbkyprLrve$2fneFw1D7Ie+2iHOOPll_aPYB4@5`yC)rl>ygL~=T0;YayUawu5FiguMM(^{xD?wq9fbgE@bzt8L}Z_ zJRTj{)9pg`p*2HxAXtpE(UHxx3t45&kR1$0_O;QG{nmCN`|uheI}oO`?}(1<_qPk# zy)7X7MDxHZJi~o_=t&H8hT7u~MMw9i+lB7FHAFYWNc~oHbU)oLbRTH}-NO;M8=|#; z9v#&`Z5OJKwt#8`w<0kVrnT!HjqFz3f~IY8D;{eB*(h2IWW&(i9Ua~K+lB7qEub5X zw;?(^6dl?Ab|Jfe&5-R29&67?JwGeTUWbq(}Ho^_*i5g=yo)1ix1S@F5KpVaeFvA zZhP8=TTi=i3$Z0Hi;mmjcH!3B0&d;SwuJ58N#M|lQZV~2L`QL|T`2aofMQoOifk}Q zsO8yU42#h*%(n}}{uVIwVj|nu*}srBf>FE?9mO}c3&nvJP(0MkL^G415=4P3Wwt(J9v*rb){Uor5F_^7yijMbpt`2W&^Ocn=I(EWFU8~(8 xGpX3lnmdd_I$zDuPM$1ns(CzWe$)O5{I61fV_mIvWN7Ca-{D2sTh&zO{{`kiq0j&T diff --git a/en/.doctrees/wallet-solution.doctree b/en/.doctrees/wallet-solution.doctree index ab20d49c2de3be218659e76b2be6d5be2746c895..ef4e19dcbe08987326dfb173bda2b6f9493e24dd 100644 GIT binary patch literal 74552 zcmeHw4U`;Lb*3$8Bu!hAEeQ)`*|F#P*b5tyZ6<5Rn@=MJw3$E%AhyZRj*#X`}^*@_rCYuI`E$Bue$mw`p>=ADVw>{rG%cz zl&p;5)ZC33D_t!brAqDHwL9Kcd#<+E9klgD$EwI8Z+#K}-uui!=b#$RpGdDT2x*O9g6+1UutpEh-^4eU+LHFDZ>4NS!xQXk5l3o;78#C3i z|6^89&)dcv*BQK2EF5vlI)S>eY#WYYFBr9|yP=|I>5ZBhGk2J4-NBSX6Mn6i*crlI zCrQ9sCGSrvW6b4Bxk}C|ISJdT)ZBH2T*;`N9H`C$=+`^dS*Mb#0EJd5P*-6e*t;o_ z(B3j@zeNKbjvUdK$W=@ z$lry3H{svS_;(9XwSLaBi#qj{K2|e#o3~cY+sqO3c5|k89LN2t zxoh^1*W9&LJ6CguqeDiG>7`6AqYJKfuO6Thp>`udO8%+zx=Q#YSg zs5U)RZ*Gd}#ippcFY0zFSIWkrjU2FhJXe8e8|4DD4p@JtTB+o;Y$2yX z`xMJL4T4cIN>C75uB1I(HJpmBN$sOQ1GQmjj#aX>jE)MZnK5jK-YObe$tvL=iE?fs zCsn}{tM>(^Uf$kJy|~*NA#biNwl+nc-3)mKw1$to$wEP^n1*It(u?JS;V|-a=-Uh- zuVUsLA9bX0H4GwJ(a=j3tzv1jjIp@Hm=W_Bd8>Q6zYW(EqF#uGC=9kuxoleiQG@RK zif(5Of8>USJpr7h&YU=QG=6;Q7>ym3vU4Pvw8};)mr0b2O42DC7_-EUIC!mOq$}|` z16%~Iu}bmL)JQ^%0yIoZ_2+K1a+x&ML&v<~BXmypl}pmC|GUyWB^mD)^5L6 zO4afhsekx7Sd;j=p(Vad!q+1Y#wRCz)GRJ8CiE<%CTlGuauA#x#^of;JH1+{BL1DJ5(eRXHo7L%% zM9!|3$O(&@Cn2fP#C{)FJ?Iz3(P*d+D@v5&jwgh>y0#4z;0%lYR*nH7c=lQ+L=Q?b;vgv{TcPcgEUdhgE&wu|pk` z*m+~u*y)pGjYW{GvG$S$?5u)hQKJ$&H+PMl@qY2nct^<^i;uUHEMSM8`?|VML;SeH zj@C7H4)zN>^@F?8x=JgL#SeDC4n6NXcKiYTmM*a~-Y>m_hC1@jcn7^hZS);G)TorK zp_bS&Lgt}2qQ}P*eH*p7sX7epP{yIu%;WL!$fat?ab0vNgryVG8d{0TA-X5=w7Um9 z^+`ihN9wH~g#{&Ngr}hWqiTfk6xP#y!;`P6Z*7UEr<(FppEOau9@^HxM?o#5o+{jg zb!^X(Ju{zhU(<2Q9n;~&_L8i-!%|5DkW=AOYAh)KzO&0_-Vk9 zk{cyiz)%QBs)pho?otR#eUU8Dti;ppE%DTfi~6L0CK|L)GcF419`!tcp|IxZiw#5_ zli1nYHFgg4#|D~69Ec!e2f!WDBi0N%^t{hD5Oqvq=Z>ziGuAKcj77lCSO@IT^S)ze zOkroZC3aeApuWvbClZabQ>9-58YnzJRW$Kr(P@iUD6PQ79 zKv;R2l?(-N)P5F5Z3OYtCk^D!!uGYq&Ky}jQzwp1p7VvusM_&@aVdenR$0fNWWmVl z1#-3{TvJI-oleeNm`UCTH~BsIM=|Hy4oseTIPpj-v43O~ljHG;#K>r3WMtw1{hd1f zU>%AE3`7Z?fMlr~z9_v(8ak`d9jSccEfI5;5cBZk0e>nv=PNdX?}nYo8I`$&WoMHJ zY$Yk$kj&WnTqRET<9W+5;(5fl;)}*?TrXtFgK8F?IwY*kF9toQ-cKI^N=jD#VF_-c zCAg;rxHCQ%MEd}z8%vFF&WGWopFW%qNb!wK(lCPQ zixR-mmH<*h2Bb8gyn6hclS95trD`K%CKNUVs|NLy_tOXSp%sGZe^&y#za_9Nqh}^b z+Kx?I(>)MXh-#*6mE)r$b&$sVhXJ~V@A`1x+cn&N^Ym>A?SYoi^0>_-Q+)F5aUa+$ zbZK=qfqa3aQH^JE_>HkCmk|ND_@Z7wrbkk@k@ZzU^aUi1BP%72u&#jwth5oIvym9J zXxa012pHr+DX!ad0r*2Veelmp@cY;siITCFD0zao{R~3kCytFhcJzdglUBZ@vG{^v z=jL+yY{7`9kvKv~B5XNMRVQ4u2$si0gJTQnTmTp0yFN0MN?Un1Bo4+~;(%Q>=Z?i6 zempQ%QDjjK$xQkMBbm#1gYq0Qf8v7u9HT%Hxdj7^>Z20I zLoH!EMnWzaJpR~GU&cesrFa`DZL`(5VAJ?Qx& z5n$7lqv~xP8>NK5GNVoPQ6>?t4OMpRF*z}ozvWaYL`GbGmpu3KYksvJIZyy$whteCh?Ez)d8`QYVv*GlScQrO#tTuvquu9L;JGd_q6Qy ze(Lv`$@4Q01yo_{Ru4{$)%SWm6D6ea)Sa$+%x%ja-`lds8Se4))M>U};tx%p2yoIu z+No6M<`SMgm9vtFlED6mn|iM7>o;#iZ~Cm6sBDpAm}n@#XpK*Nn5QL``qnFno%>p1 z=M97%VZ6p2tHAm7lz)FD%xlt9D|yNtfMJ`<)ZFcL@5U*2Uw(GV|EzmHX(H7&X;+as zX(!1Jh8>;Bd4@BRd*i$)pxHg~pp>lp6fYCt)d3s4$Y>ys-CR!-s=Zh`Fn~0=f)RM+ zUi&y3>)JUFUIFUX#``k;H2>e$Ty<5m3{;5@0G$5}>X*4E2rpeq-4VS&jE5^?K#q#*%Ur`%)=ET&O%U^!}K+saha70sHX8AV2$UE&m8 z@6Bo3TEI|dQ+{q5neco;DZVAc$T)aOI}eAML+QOmy@dR{QkGuN*_t<%(P#lk#nFID z7^j7$gm%oJSt7oKCh>7<9-VRwy@(V(hucE}aT%6A&2RRJv|-6Zno%O_UsQ9biGqPi z0rI%H*J-`1&*lo8;YXdLo_dfNfRAlu^ueRd6*M6cvK^WfqyBybM*Z)^mWn$!26(nQ zoBusLl*z&u&b8)Fn##3iLQWz#G+G`*-PX0D1!{wR%H@4puA=D$2W*N-K+XZnp$0i~ zb7=sHIkN`$C8y}yb4c}fs1@c9X^2sM8kCWTURlIKmmu>fF`#yGXxn3|6D6lYGf%%Y z+jzQ~vkh8;rBGY3t4;-d%@_sl2!UZ?nvcwRO8+L=4)soM<%(|?1_kraL)}p6%i=+?1F{DPBQ4!#Phrc3Nr>RH z_D-KT_R7n5pq~JW8J$I}V(Jx)Cnc>~%3)1S0l+{+F)#cuSa%KZORQt?JG9@}CXd zb2pt07 zk)xPcLL`;3sw9rAT#VAfFc7w~HCw^LP?9-V2rSNGWNq6+J%ceHGd+uesB4w%3rt?+ zM;kuV!b~9x(ULZ|H1ewD^YdHm|z&g@FIG7f*Fo(2`--59N_AszYmu!m# zJy)Q~G`&v>Ya04jI|u)u_|jy#?EMNFK?1_ZI1c9-deCMWwrMojiNLa%D@!i|St)G+ zg!1$p07ZlR;W>wmSXQLM5kXC0QUo&=hMk7>eb`R|!Htqs`QE1qH#9M$tR4&<3AGi$ zHM3O;p{Bst!KJyrBWIAFq!3*#20SS454<|$inU8<_MG2KYQl3ut#`=4%?3N3?6Tuh zf8E)I8c_?V^T`P6ElwTYksrn%=(DZvsA5FEnGE!8~(_V;=%wdo+~7<1PP3%%xE9j6d){${l82a?D#+ZEw!I~(4T^XY295_C5O12lmEdi{Mb zd`|s&8FPPhqA>!C>3P1Rvp`0L2GSi^ngGWa7v(#h)ZqQZYjK!>8jH`Iq0Him<3 zvKxUIgYJ3Zd44J4w3zn?bC2X)i{@hO+zScqM8J(e5e!XCP`GK~OCYbFm)#n2X73ZB zUC#^0vp}PirNAzH84J3dv#QuVO614FL7|r%ObIa$7f{zr@vKJ1yTVGTfFDF=Hz!g$56}I_dXFUqLc_gUDlCd z0l$mxEMd1##In+LPHC(+aF9iT2puJPAihSf8P$z?$1?@~&|tZ0!@mN7P)^EyzVBx%E8s)Zh6zt?5U=F&3ePzED4swrF-5E^JVSxr zdSOlY7R)!g)?3&hsiodppz+euvQ^|&L2(GyuU3i{9IZ0^#PKT#N;nY2GDkZaim?bn z=a4fMi6_28UU)0v&tz{Ko=siCz{TB|@E^hYQ}2H**tiz(KUT%BRnPI3N=|Cobd zfKG0vDYU>|bL)khuaKY<34HFqY8_dNNJt!1Yl4FA;62fZC9Trk5lHKOdoP42hL2;L z%SdlE-M!T_v)y&Py>qmNuw|OI$f=g`oR@zU4-C5^ah44CjnumxdBTvp5k`YmSTHiR zlUK8!Zcy=OJudTuctN^#-5nR3vadwg_9jmQ2)acesA;Vz2x&W&P0=$iiv%+ zF_po_POB!hA%O|MVSX`QR;>Tc8kqX*P$o13Y^QOm<+r>{C-gtXj$%HarS2%J4Qa zhe2M5UfRlvQw1QSoTAGe=ez`hPj*HCN|QDzhm`vV^DmgFF2(H%!GL=0H9;^XvDF9? z8`deMEQlR^N{3RNaNY^k=`TU6t3mT*R<3G6TEL!=O51lMlXmQEPt1^C z5h|Q?oh1fgflH~vcebvfu=3srSn;&@iw#;F2YZBLFMo&0D7!mFx8`gMzELnj1G!~d z6q^pB*UedmmA%Nng5q2tOQU5HH)ltw1ZS@<61Kp0dYV@{z)ESxm$OijIAH;`XnlIX zxhp2eK@To0BX16@IQIW9pcUu*Tm;SuYZL7Flb1|X$2k`!F#exFo|Nsa-%@S~vIyZ9 zD9+}xRe05d+4tmBXrXEJj8%q%PuCuSa{<};$f8HqECdD~$-R$QlXqwb{G3^--{B zXr^-7429Arg&pawK;7Dhh7^RK?;1kv0ThIgQhAlf;b-F78P1N~hg5iDQOp8)btME% zEac5&Rk&j!$_8m+#~d%=q!m2ux37Cy zBvzabt>L>pvc&nWkhb$5= zALL71HIy;v-qMjqP2m40AN~mMD*(UQHGtT-C;yF=0eF}ITmgdxSB<)ddTmVFZoN04 zu()}kv#TgPKx6Bl{2<=yicNgGxIS|=|7(!B{O3>*Z-p}@h$FucfnecG33{uA1>rt3 z-NgHkFg`|itQ_}T`6AICrwl>6=#b&&JMkR&ooepta@Q~%Sw%zDUGuonniS+?d&>h zU_UXQ=`>6xq|CIfqwsS)0)D(1&rwtjdr*(m*{$y9C%u_howEvA97}M$U~K>&7uI|d z#L-esE)CJ>6x972xEZ`F{69%`SFekii7{7fTO5A6M@=cC5T;k@{;hOY^+^2vmi+VT!{kn*w9U~ zy4=Uvt46XAsOHVgqs{+`%Q{NLCgp2~2SAEI_@=@_F#;Amp3gV%{JnKNe__cEJcs~Ci;)32s&)jQpEYT#9 zckaNx3g`m$$nORoQPhGq^YGluHCD9<@Nlmi(M&qmIpRql`k}^5Do<7bA>g;l3BF z^FOmwRDx0#I$H}?YW!wnPA0|UI?B0>3QAqAO_i`w7kvCGRMV!0(g5#`fOYBTYtR5k z>okD-(=(7TZ^Tpm;s71*i6R1b^&?^++s)xcoUx)lk6}tJ?W4ppbW~C3=OR!jEEm{XD*vKK ztSFrHhI)#fl1EW`bJW%qR4+drp_d*XeX@a%97jOAJ_=5-t^;WV_XE`0@aPL@9gcOkbDzAR>MpL#hyPX8PNt)IX z^1?KQZxtz&T?t)92Y7}_AvX5H&e6R7)mvCibSzh~qC2gL)HE8=#g+`PU;T~T>ns38 zbA(3u2v>~z@(guO@P>VXtZwWXh7G+aTg;1q`s=>w!xx1np>EQVwpu`=+%5N`gGtiu zF}U{z^2(ZI-e{O`()sS(Esh+^nLr)Ke(JT0S)b4UMo3yHUFpfyL%bBqoh?ZlNPPM~ z=o>P_+SG055s~>|ZC*zbl-f(P2S(zRCSHOV;Sox}Kh5}FZACmP5T#Dg*eSZ#`UW|uldLU(?enbqmG}+J+gEVVpmKwT7{a$NZi%lO4AT7vld?yq}a5oGOpEQ<+hnXHB zVL!GZFEPPN3|_znNRj&*D!Q zD|f*wy=wp;2kHMhI)Go}svVg#F=HZ+(Mv-Vn}zz8J(hKV6ELA?$|HiSDBbOA3hp%< zx@CES`#asjz3POmER_{u=~@9e)HQ%l0Kl8^Ry(tmG?6FMH*(dEgq=8rE!lMqeM62E zZ*GNcAwf@e#$X)7Oiy^jX<5*nIJ|>`K~+Ohxaap3CJy(6iG$r@q6<>DulhY;GLS;p z8m+6k>&UFBom@jSnH2Bb8-YLX7FF-0Kfy%*(;>TZy(x@2-*M^RiDEIrUh8ZzZkX1W z3YM-^llrY__jCl>d7h&Zs)hhM`4swa55No$l=%l5Ztd;WqT3y?=)R8`rjIQ>)uf-j zjQed2!S@r+ni+y0jDUB~5d0a2yS*6@HXc&o?w^YAmZxam%T+rnnzn}E=g>wAL-6x> z)XDhqKz$`bryD{2Y=pN$pthFzfFbxIx7wQ_2!Fd8H0WB1+t(xDA`GAoTK;u(0KX=B z-N_IfnigKY^JgCk`|gy#R*er)sw()_Z0tb$P5PQ$*Ecb<^xPuK_@Ydngyze((TDR)Vm!4E{+ie<9p5u6i3Osu_J!tQCo}<_{GPpNoLQXHm!ZsSyqr88PTf%!e@0BjM)>`yO_*feJyRR*zLj ze;!}PKmXwefVodFMsmr$%)PLL) z)PK}1)T>R_b@|14WwVGM3dDcz8pI+9`_1Se{v%iINZ1l0fwbi_mRulWXxqr;L!vnX z0$z+VCSsI+f*q$1Q7AEE74cpohL9cYxnWfcSU0Lyu&{)l)c&3_7O9&+6lQZv`>))3lVKvk&kL=>~pd&hHN*4-~^-k?4_dbw>vTUW?);F z*u{$?w3U)Eq>C2=pQThfYAb7C6EZ~OMep#EALL7kdlxUtL4T{e^zR0ZKPo)Pl*OpO z0jDe=KeG@R^4;xCpq7J+x9fw#hu`F*5t!u+>VQM&>ztf1)ESxn2SlIq(|B3BHr(r* z;#zigYXcqp*3vz6_v%1up6E?`DGiUSBpb&V^7clIXE+GiX#atb;n2RS=Ux-;n$}gD zx!1lo!bH$>uQhn1;9l$O5ZmcF#Iy!!V@gsc(neXur{GUA1;NAD@`-&Z6)+F-^48`} zqQ%yn{9hxm#s^Rb^rSun9f-|BSe~QqKhqmQ&*RCrth%Ev9&prshP&FUqi(9PrSF2H z?#~Hl%^Y=K#e+^(t>?Y^GQ-_o+)Gu+>j)PcRN8MF11!#T5b`2gy z1oht{bh;7LZ%2451Zr#T5pdLfQDCJP&uu%a_x1?b2!r@GQ1e#2718>-g{yX?=3OnV zUf;M-UOU*XepJslVOP|KGScqt2_tuPi;>kP`WB9H!(0;Ct8xghzpcQ2bJt*hKN#Un z(ZRmJRXZ}mgiJB#K&{w)!Q0?NPGQuZ9)YZGHIM1}eT9i?PnfW~#l&hez_3^{Xk=2n zp8?GL6dCNsrAmrJqfScYxJu^e<`spm_jHY}9|YsP5FK6b;;Nk(=fXau0Y5@Jhhes? zAQMqwb?Rs=jWuy%cLRwOp2Ywu-kP_Vz>T*sPGpOys=VhxOf37Rvs7`)8P)^r!yGA- zt71<{%&KVDhD2-+ zPflWiHk8k&zE* zd*b|`?UwUbTTxt(1Nusp6s1-)(FrY{DkS_)*GPB);{Th`k??u0+DZJ~ADV&VfMFm7 zz#!2^)qJobOInN!2{{}hA8g(zahCq6^H}ABJ=1vCH4DxLEcHE-Gb(dOSeBe4mX5{w zN74m4{54LebVG&U{8akZ5hR+#;YJH?t9kLFnq)oLr#|^}w7+0%hv)1^`_*Mk;_h1^ z@P1Ff9)T}B_XPpfY0?+AL5YR_oZo6c5An=w!9uGoM|;8+SBlss1zn7N`=ngOupn9v zwo$7qN!xl&=ZQ-gO+N}WZNXa+P4#QIYDY<%IH#nFKqQBpxA+-{OlAn80&B(#P42j@{h508sIp z=zMF!kvAu-px+0{dY-@9ejIaA2UVMq&i|bI`m)G_jMpt63ap-zRlI${{jfu`1w0MT zXZEmmT)?wSx|W-SZIo%$#Q*#XQz}gR?XB7X>$HnT{1&&>9;qJH>9d`z56|WNSt3Ko z<^0mByPUTN9K~PZuJ-D3PBgakU2r+C-K0FR;YC6Nco5MKdo`+dvSGr4^?pdpzcIGj z^MGd{ep?{6Q$Ar^m-B8P(0Z5iZP7u!r6*9|7~!oDsJ_-{7Gd$iVBZp0>BZ%|)v~iV zq*!e4o#HbKytqS?CrW`n905;ZI)4y!elR-l$GB=o(`4J3K<}~TWzkeEGI}m^;-e@$*uwYIgsubqXYVJuG*1wH&S}G zw{sHZZ}J{2@UqYj@QQZrD=CcPR z;QkF)?MT8K0wnZK6~qbj1cD-9yDAEv^_x4}1mOXI;8}~eI++LF=qKP=ZSrj_SXnDb zJpYCQbx+rzegvTIjt;8ERXdU{9#|X^9JHZB2?~lGoO|rSP^L9(?=Ig`P~X!N)JM97 zx(foguj)<7h2h=0YO^W%mm`>;-juvyUO`ztp*>xXJYdkyQ#y9%F2zgY)G=&-XIw%S zJPr!=LQ+#rcDzvnxRNFm{qkMY?_=Ov2_HKeHhURzsaZP5B#>Kl;V-dL?b(>74Z-^} zbVM8C<=8{}=nfVe)1C3k_!Cc*A23hHr?MxercR9K&Oc)xv`0>z9ohd#>9I#g&J>OL z;^~v={1f6mIO*v<@=?|=5FLs=7fZyRjSXSx64jBL?bJ=46CREe5Dv6Cgmp4q)TVr6 zRA;Ct-4@qx0z4Yup}#|Edx6@Uj$`RL_nGg`SC;7R)KUM|CA#sn{ji-sFgcfcV0^-v zJ#*r$oqpid#H>BBcqV;lsg$26Jal||#+aKsKkvWEO^rS@l79Ty(u3KB^M@AW^V28K zr!Fm}&m28}dS<^hGP~#$PCQyEO`kuQJLSLG1KJt7=TJTsdk*N5NucOFBcU$+)4L5k z1TZBq5X2VUq1WYq&9O#LhZ-@*w|mAOzuhwiMVGo~UIi;*lKy*&{{o}*V<_x6CdP=s zy-9w{BkqulPj}7^K=XoU@!=?+!4U_^S>4H{eLjl%nh2zK{~kr%hZr?ac^GOM(+ong z!a!H}Yhijci~PWOAN)ESNfjdnosdEdv2$zTus}E}5Nz1jnan6t=MEei^YJ-#ZhUmV z_c5T0*=eXDsTb`DVH*k>1U!q!qoHX%YfbCgxkNcJnUL%hoHA0S2o#sE`nGPw7n7ce znG$cxcDxBs)JEv^&bk()*%q}4s-JKcvV_s+SlwX}9$p?jcxYl2{~JFH4G8x*-I^FV zy#MgX==kB-bKaEt%6R89W~0^~>RDqC^{lOXF*8`}Tp8~e4Wx2t2);7jRVroYNHW>R zmQ2zxd1bsKerYy(UK#Ji)Q+Yduley#O&_1>Fnu(4o42|H$REM+x0l_G1-*nLv9dEpc3qo3#*$Y+*r_g(GkD7^l72fR|`&x>KchtL#? zVScmT*>H+t^25U{me}=J<;>XzA7qCewihiwLXLHVv|Dz$TG>a=qK9T?rnPB01YTqV ziDRUig!(_oeGcs?=pw-8eO1Cgz`y-){zoD}>Mc~E4{$jD{uP6u5G^|Gvs1I^S=d4O zEij_Qc|D?^zIf4}r(h+dI0X(!w5mAVl8%$7RhhJjFfxLU^e;6roIkiF+zW~MnBO%Y z{l66f{a#kz=Oy~JPH_3n(>u;=xO=b8^u|B!77^X>%)hkZna3|89mdN+RV)))iAzH# zGF~5kd`9{O+vt$kSqL?D(-3aLyWgm8}wlkq>IFAmLH2eCEZ;SfVi;JX{VAvo}jz^y3T!qJv& z9f#NLQ!n?6%Wjz>VUH=GWmYG^n;weIRVHGe_J%9K}L#t|@b zcX%juo3^vTK8A=P`i!w1JE^s$jca|iby8b5e=Z0xW; zcX0N=h(0+00y_k_3Or-1WU%dZ zuHY>KBs1grR~M>%9eEdXRX(%}{m;LqC?Tb1P_d5(-Cn4eqa+CfZs1wFn5^8mK2RMS z)xS@=4PTwi7~Bh=s0r)R-wXexSG_0+^2sg61*PJo1OkdUKo6A?>Tjn%LqMCinJ?w9 zL#&Rs(f9DM)!h?OPL-Aw^5BmP9f#^u12mLLja#o}caxU=xYV9%@f^mi3LUSV;Z0+` zG?VW2Eao_JHQhySNgaIfs$tc!{bO-f&-KH)IvNVfG{H)t0(9z$) zSpN15RbM-PKfxc?jvh+3y1}h(gd}vM_%^greD3lqpMY(NBZ4xtP9C-(rYKNWls+d< zfy8}h2}fXKjq=RYRB&l9Rv=&GV^5Y~Xu;09c+N=UxFQ^$lrG?aMbG-0EM;sfhqI8d z2swA=oY%UukLN}(QE|#Gj#N~t<-Qg6$X6Qg1xn!%2-!@7s>4zM*9!;&BKUrir~y|# zh$4g^rdK}d9+E=nzzKr{M1V}7vt10k*GbCt+{rmZr<0wWWQC3wUkXYBbvu6}ju<|P z$pCciIznxGsJ1p>UP8AeOp*YUFAFH^D@1_St$zoQ-=`oK>-!Q|;a)JrgrF49&L*=} z%m#e;fr#(yM(5^|$hU2WfIHbZh{#6DLJ-vNMouOAST|4P zOPG~np-%9(^OJbd${09mmDoIV(xZ5+@nc%$?>+X^g89+>emY~C^nrQDsZ+s@d2VXY zhzhC96V%N%E(Q6aBi;(0xSW*-C-2RG*+GCyDI?f>4?A{ zQ#4sRqABj{R_-`KU0Jp3J!$mywSUJa%`ZT5Bx%k>?Cm+~ZCDlqz3x$F!kym&HiAk) zK!UYzz%KWmz>_VX_`v*D0GR1^!1$8nZl?(~IY<0?d+?|y^*HD|Q4<1SF8}fxsLLJs zhJ!`f|KWdVuiO_b?%?oU7Loif<5fdi`>KMbD!AJ{UX^zewo|DYjYmwGYeTM=lk44` zv=}j6@%Jvvq-K}I`jh8s`R&(2Eq@qacih)Et%xH{P>uR0ss-Ivvcs|)?s_po)bgK1 zePX7o-7TOV98Hy!_vo~{N#3E;_G+iyjo4;@d@@eW-HPD^7=iBs{vT}2Qp(ia^?baL zqp~77YIE8h_dmvuYs8nZ&vI!VKV#m{s$IaZ%@r%1n$^?u^wg>G zksI!|Im@chV$Z;nlUKW&NrRQD#ndIZTZ%X$&D}zAhcY&eDbm_b2kq?=cW{a~-$~KV zqbcws{L%Dyv-g6!vB@^dmR(8lz9~3j!i|}FLH!(Xw;Gpnz!hd_RYz7Da0fERY&DDa zwk+y4uZ2dthF-*-K^zL7HVC5Hvb%+YPKe8;EwX%S?m)FN7e7>UZwx<38MbZNDH9`k z0q2T=Zh$L|IO4T91QB7YCN11l_oS|g{M}$AcZ+DZ$@jw#>RxuQqy9TUk_q$_08h=` zEF+!3b_T!K7^RxK-8Ryeok?Zbw!>#|JS}jr9{zHiElSwPWw3w~Ud2l_bG^F-i}9_L zf6HA1Zgw|ks>L#L{5+-uQuzjs@MYJkRV)9!T;7|StI z!8e&hAZ-gdthHg@yf&4|Idr%h?KLENxj_m8%Za-Q@HmhF;XVe_cr{aVxdPyOs^;#X zD}2Wba)3P4UXT$_Bx_)2eHKE*=fiDuZvtBuQ%X9OKQ-l)iAgTI*EvgA zV|^*5!rwJ_UBM#G-{cf^$l23Xh_wSmZRg+OX9{W7x`*1E(k2!*r$KumZoo355O2@p z)Vs^z4hwcn1^5?g;4&Dkxu3oN4E5_&?78b^JtdYPr#aY^ds^IhiK&G(rvRNZZ% zy0pZPE4yoEaq{4CHZw{j29rv6x3fW0XJ+E*E&Nm(H@HD_9vxa+OyH!UfCn^9(5pO8&1DEo z9^vqShC*nXoFPMK|e#QK<`S<46&2O9E%5Q{=Ek8iT z^;B%5Vu*^HsYp^myKv?2rs6OaC#X11#bZ>QqasbkMJmcv6sdTQif5?!Au4{5iXWq* zM#cN7c!`RSQSlKfK10Q)srYRweuIiHQSn78zDC7YsrUvJ|3JlesQABBY@z{vkcypD z?4V)~6}zc8K*b0Z_fv5X6{o0pn2IN*=U(rXqnk(nOSF<*=Ctp zW|`S#nOS9-*<_hnWSQAxnOS3**ionaR7%q+QMvSuZn5FEcqWGbvGmf|r?umzjK*nRJ(#Y?qm2mziA4OsdOF zrprvC%S@ijOq$C~mdi{M^Z^)NW>PFO8J3v@%Z&czs=1St;Ln=>1w#EX2=!+m)V~d( z{t|@xYv#AiZ?Ht0-x1=xiR6RDc_&@5IPak=7Uu(W#o~NFU9mWyqAM2XC+UjCIZIb8 z&K0_1aef59eqD|E%;{J-dm#5w=ZD5~z}pshmVin}?DpfQi&81Td$vPxw=F-iyTkR8Q$VcQgE zt%5Rt_~z^CZmQaYp%w?_SNWxFq4qJkuq!m1xxT(F@5xne3^p?kOCXE5=3ax-@Cw2T z!4z%7QSbh{0o^-lXJPzdXBe1~-mot|s7&YJZ90x-i*UNi+iF&44m3Fi#ybIctDBhw z%Fbcbhb=S*$4HXaRwV5z&bzjg6!jNDcg!{TY~(aYjru5U8EwVJyLy1G9UIHJ-DqNeOPVq%$D#u} z+Am;lTqR%+Bu3iC;J8LO{)WJe5@0&W^`bUegXT&RRgvI8-HJPV86Ftz}~!S zz>c?P)W?4t9o)a_7r1=u_E2$%2R;=Y++Xe& zxOesdZZxUwU?G1YI=$?kdjPKqk6IoDJ4oR-qC@x({ep0!2MC)HFlUt)I?NL{ZI5iX45DgZ z?3P14fY*e8fGmwTCpv_?`vu|Q9w0o}D1pe^#gUF8S;DxKHroSwe{?|a=@+0! zdH{5|5zxGD7uy5(WOU#j?-y`)^#{1lBYh=0a8LIOxVw7*u1SUklA5)N@zKNWsrP(z z0N>d!0PpDmz$QwRt+ftH^h43X`#`_IySE4M#u_D0j)Lj9spmQjg|9>h^RxW|^S&Oy zJlqIo-CChI)(W-f*guU9>mRQSRe^6A{700<3c41Lb*yTq+mSs_p7=kF^`lBF-P{m)PQ>`MYAgk*ug5g(doA@J{ z7|@Ns?mDmSXvLYN)2cN^jM~&VkvM4+llr4+O%tb@Mg+B@#_1$hg`RVFAKv$NoqhkD zeak!V^ZlOt&OPs~p7=2AwTINW(Xjhx?}c<2yRzB!ah0TmmE`<|c2ah)&~EOaAtA0f z=`enzyFy(V(!tK@;~OabfSb)o!u==i?D_AB}iufE0IVt+c`JQqORHkqR)h~d)w{9$TMW8g+8eQ<4F0r?2MT77-}A>w>}?M+YQeOog>pOQ;FQ+=oO>EQtSXRIE1^PIYom;xc^boDYN%uopQ^gpQH&1#L%HFD& zNi6J6#j0V086hFkaJFJu2Dy)mY*sr=L0xuw*_@{@3D&4A$+XG^bV?ZRb!AN)VcIpZ z^GZLf{0*Tqy{T%+G>}xT642*=G@C9}p%?q1(>eNu8^~N1NGex(>u`A}Js2o8 zTa(Iif80+07$`GGojHuf)xHyJhUQR)lgsFx9|`Pg?Lzg~I?syM{D5BMSj~`{0NB66 zi6=wqEYu6G6WG9-Ts5YL71ia_8-Xynfawm5xmq_HhC){T4jN*>e$p7ogDW5LD&2?4w*}s2r7hMs zETWS*N7)Yf2JLp3%VvVcoQw#=fm zE|6p)NLI3~KP^l2%|ZX>FJQ}Gjb*E@$1wA{35qlEx$d2RxYreDd6!G+c9k=?pR;1_ z?9^p5HSL9yjnz1_zWCQa=vxMMa!Nz=SmOviiZQ|5A`{(Xp;&JD`_^XsqZB?CKoEt_63u-n&8DXQlT z>}Yp?W{;vOoq;2+h8H(i!*h^4?|IFGkA2WM7eIT4Mw=z~^qK|+rK5VYX}FOU_U1$k zH$tPl?RK!cwpmeE!`xUcyZ`;TL_T}y35#CmYmrmaUnq~E+8(Tm? z+Q*jkr5X=F$HL*pzGulncCfF4bg=L{X!v#zOOou_m0of(9-8#{k}H`u4#mBkx(2??CY%gZ#~(-U2#9n=&u382RPW?$B+j)(s&GQ*bAF6wBgsy7$)G? zaTu0jSd3v4hV>ZMAWFjUK7M@e*jfzb+a4j#_Jumr;*3{DKyM)vWyz01&I ztAzI2xV1KJtBqTN2u|9#l{Rjpjaz8r@@-tYmCLqr$yTn`%9UC{rL*M03bKLMkGIrY zKR@F2Nc0bX^2}tp%m% z0&Oz@D1^QEtHH*6tOeP0fR>O%krB_TWNhxiW=z$=aL6meNh-+|K{;BGJs9Z15aN&* zMnDVA6+z`%P?|1Ku?avf5#-c@Mg;@m{+EYElIi3X5wt-I8m$B5kVg)IHQFPBeyIhe z2Lr(xRghyMqf^6>+lL0Mh5vW*F52A0PmcMk*5O%c?i1!d|2U5o-y z7$f`AOuj)&Oz<1TDmLS@!AP(^ljYOHfn*g)Ng_!u8bN{%M~8fP1W+6zB~PUAN&Q?f zKfHrrH0F~9B59rUUyTdT}4XKlJazs=Gnm5vS-LBI#q?6q{Zdy z!tpw%Bto5wRJer#PClI&eD_&o?kqV8oUK)%)(9xR1s!^wO{QB^q}R2iNxDd9N0K7? zri!#*Ly|Wp>*E|lk-?g}@x^VEOI*ERxBHhuF zzNd=>cX1*eIz;Sw6FYrI)$;|xNbm;tLz=FFq$!ZpvGBg_Ha6BbH>_}a`2Q`q!)jO8 PIX&eiUaow}POAP7L^WSg diff --git a/en/_images/High-Level-Flow-EUDIW-PID-Issuing.svg b/en/_images/High-Level-Flow-EUDIW-PID-Issuing.svg deleted file mode 100644 index 470e7c733..000000000 --- a/en/_images/High-Level-Flow-EUDIW-PID-Issuing.svg +++ /dev/null @@ -1,4 +0,0 @@ - - - -
PID Provider
PID Provider
Wallet Solution
Wallet Solution
Wallet Instance
Wallet Instance
OIDC VCI Component
OIDC VCI Component
Issues PID
Issues PID
National eID Component
 (e.g. OIDC, SAML)
National eID Component...
Wallet Provider
Wallet Provider
Attestation Service
Attestation Service
Issues
Wallet Verifiable Attestation
Issues...
Authenticates the User
Authenticates the User
Requests PID
Requests PID
Develop and Maintains
Develop and Maintains
Federation API Services
Federation API Services
Federation API Services
Federation API Serv...
National IdP
National IdP
0
0
3
3
4
4
5
5
Trust Anchor - Accreditation Body
Trust Anchor - Accreditation Body
Federation API Services
Federation API Services
Requests for PID Provider identifier
Requests for PID Provider identifier
1
1
2
2
Requests for PID Provider Metadata
Requests for PID Provider MetadataText is not SVG - cannot display \ No newline at end of file diff --git a/en/_images/Low-Level-Flow-EUDIW-PID-Issuing.svg b/en/_images/Low-Level-Flow-EUDIW-PID-Issuing.svg deleted file mode 100644 index 34bfe6965..000000000 --- a/en/_images/Low-Level-Flow-EUDIW-PID-Issuing.svg +++ /dev/null @@ -1 +0,0 @@ -User's smartphoneUserUserBrowserBrowserWallet InstanceWallet InstanceWallet ProviderWallet ProviderPID ProviderPID Provider1obtain your PID2yesobtain a list of Trusted PID Provider3confirm the selection of PID Provider4okWallet Instance checks that the PID Provider is part of the Federation and obtain its metadata5create PKCE code verifier6PAR Request (response_type, client_id, code_challenge, code_challenge_method, request, client_assertion_type, client_assertion=$WalletInstanceAttestation$)PID Provider checks that the Wallet Provider is part of the FederationPID Provider checks that the signature of the Wallet Attestation and its validity7PAR Response (request_uri, expires_in)8Authorization Request (client_id, request_uri)9Authorization Request (client_id, request_uri)user authentication with eIDAS High and consent10Authorization Response (code, state)11Authorization Response (code, state)12generate DPoP key13generate DPoP proof for PID Provider token endpoint14Token Request with DPoP proof (client_id, grant_type, code, code_verifier, client_assertion_type, client_assertion, redirect_uri)15Token Response (access_token, token_type, expires_in, c_nonce, c_nonce_expires_in)16generate fresh key for credential17create proof of possession (c_nonce)18create DPoP proof for PID Provider credential endpoint19Credential Request with DPoP access_token and DPoP proof (credential_definition, format, proof)Register all the credential-relatedinformation for verification/revocation20Credential Response (format, credential, c_nonce, c_nonce_expires_in)21PID validity and status check22store credential \ No newline at end of file diff --git a/en/_sources/defined-terms.rst.txt b/en/_sources/defined-terms.rst.txt index 2df421bfe..fffdb9a10 100644 --- a/en/_sources/defined-terms.rst.txt +++ b/en/_sources/defined-terms.rst.txt @@ -2,6 +2,13 @@ .. _defined-terms.rst: + +Normative Language and Conventions +++++++++++++++++++++++++++++++++++ + +The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. + + Defined Terms +++++++++++++ @@ -40,6 +47,8 @@ Below are the description of acronyms and definitions which are useful for furth - Electronic attestation of an entity's compliance with the national regulatory framework, which is cryptographically verifiable and cannot be repudiated over time by the entity that issued it. A Trust Attestation is always related to a particular Trust Framework. * - Trust Layer - An architectural component that enables IT Wallet system participants to establish trust, in terms of reliability and compliance of all participants with the regulatory framework governing the digital identity system. + * - Level of Assurance + - The degree of confidence in the vetting process used to establish the identity of the User and the degree of confidence that the User who presents the credential is the same User to whom the credential was issued. Acronyms -------- @@ -60,4 +69,6 @@ Acronyms - Verifiable Presentation * - **API** - Application Programming Interface + * - **LoA** + - Level of Assurance diff --git a/en/_sources/index.rst.txt b/en/_sources/index.rst.txt index 100c7d1ac..82ff010e5 100644 --- a/en/_sources/index.rst.txt +++ b/en/_sources/index.rst.txt @@ -60,7 +60,7 @@ Index of content ---------------- .. toctree:: - :maxdepth: 2 + :maxdepth: 3 ssi-introduction.rst defined-terms.rst diff --git a/en/_sources/issuance.rst.txt b/en/_sources/issuance.rst.txt deleted file mode 100644 index 1effd9399..000000000 --- a/en/_sources/issuance.rst.txt +++ /dev/null @@ -1,57 +0,0 @@ -.. include:: ../common/common_definitions.rst - -.. _issuance.rst: - -issuance.rst -+++++++++++++++++++++++++++ - -[What is it] - -[What it is usefull for] - -[Example] - -General Properties ------------------- - -[TODO] - - -Requirements ------------- - - - req 1 - - req 2 - - -Attributes ----------- - -[Table with parameters/attributes] - -.. list-table:: - :widths: 20 60 - :header-rows: 1 - - * - **Claim** - - **Description** - * - key - - value - - -Implementation considerations ------------------------------ - -TODO - - -Libraries and code snippets ---------------------------- - -TODO - - -External references -------------------- - -TODO diff --git a/en/_sources/pid-data-model.rst.txt b/en/_sources/pid-data-model.rst.txt deleted file mode 100644 index 2968e9490..000000000 --- a/en/_sources/pid-data-model.rst.txt +++ /dev/null @@ -1,400 +0,0 @@ - -.. include:: ../common/common_definitions.rst - -.. _pid_data_model.rst: - -PID Data Model -++++++++++++++ - -The Person Identification Data (PID) is issued by the PID Provider following national laws and allows a natural person to be authenitcated and identified. - -The User attributes carried in the Italian PID are: - - - Current Family Name - - Current First Name - - Date of Birth - - Place of Birth - - Unique Identifier - - Taxpayer identification number - -The italian PID is extended according to the `OpenID Identity Assurance Profile [OIDC.IDA] `_, that enables the binding of the PID to a national trust framework, giving all the evidence of the identity proofing procedures underlying the PID issuing in both remote and proximity flows. - -The PID data format and the mechanism through which it is issued into the Wallet Instance and presented to a RP will be detailed in the next sections. - - - -SD-JWT -====== - -The PID is given as a Verifiable Credential with JSON payload based on the `Selective Disclosure JWT format `_ as specified in `[draft-terbu-sd-jwt-vc-latest] `__. - -An SD-JWT is a JWT that MUST be signed using the Issuer's private key. The SD-JWT payload of the MUST contain the **_sd_alg** claim described in `[SD-JWT]. Section 5.1.2. `_ and other claims specified in this section, some of them may be selectively disclosable claims. - -The claim **_sd_alg** indicates the hash algorithm used by the Issuer to generate the digests over the salts and the claim values. The **_sd_alg** claim MUST be set to one of the specified algorithms in Section :ref:`Cryptographic Algorithms `. - -Selectively disclosable claims are omitted from the SD-JWT. Instead, the digests of the respective disclosures and decoy digests are contained as an array in a new JWT claim, **_sd**. - -Each digest value ensures the integrity of, and maps to, the respective Disclosure. Digest values are calculated using a hash function over the disclosures, each of which contains - - - a random salt, - - the claim name (only when the claim is an object property), - - the claim value. - -The Disclosures are sent to the Holder together with the SD-JWT in the *Combined Format for Issuance* that MUST be an ordered series of base64url-encoded values, each separated from the next by a single tilde ('~') character as follows: - -.. code-block:: - - ~~~...~ - -See `[draft-terbu-sd-jwt-vc-latest] `_ and `[SD-JWT] `__ for more details. - - - -The JOSE header contains the following mandatory parameters: - -.. _pid_jose_header: - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **typ** - - MUST be set to ``vc+sd-jwt`` as defined in `[draft-terbu-sd-jwt-vc-latest] `__. - - `[RFC7515, Section 4.1.9] `_. - * - **alg** - - Signature Algorithm. - - `[RFC7515, Section 4.1.1] `_. - * - **kid** - - Unique identifier of the public key. - - `[RFC7515, Section 4.1.8] `_. - * - **trust_chain** - - JSON array containing the trust chain that proves the reliability of the issuer of the JWT. - - `[OIDC-FED, Section 3.2.1] `_. - -The following claims MUST be in the JWT payload and MUST NOT be included in the disclosures, i.e. cannot be selectively disclosed. - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **iss** - - The PID Provider identifier as URL string (the issuer of this JWT) - - `[RFC7519, Section 4.1.1] `_. - * - **sub** - - Thumbprint of the JWK in the ``cnf`` parameter - - `[RFC7519, Section 4.1.2] `_. - * - **jti** - - Unique Token ID identifier of this JWT. It SHOULD be a String in *uuid4* format. - - `[RFC7519, Section 4.1.7] `_. - * - **iat** - - UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in :rfc:`7519`. - - `[RFC7519, Section 4.1.6] `_. - * - **exp** - - UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in :rfc:`7519`. - - `[RFC7519, Section 4.1.4] `_. - * - **status** - - HTTPS URL where the credential validity status is available - - `[SD-JWT-VC. Section 4.2.2.2] `_. - * - **cnf** - - JSON object containing the proof-of-possession key materials. By including a **cnf** (confirmation) claim in a JWT, the issuer of the JWT declares that the presenter is in control of the private key related to the public one defined in the **cnf** parameter. The recipient MUST cryptographically verify that the presenter is in control of that key. - - `[RFC7800, Section 3.1] `_. - * - **type** - - Credential type as a string, MUST be set to ``eu.eudiw.pid.it``. - - `[draft-terbu-sd-jwt-vc-latest. Section 4.2.2.2] `__. - * - **verified_claims** - - JSON object containing the following sub-elements: - - - **verification**; - - **claims**. - - `[OIDC.IDA. Section 5] `_. - -The ``verification`` claim contain the information as sub claims regarding the identity proofing evidence during the issuing phase of the PID. The ``claims`` parameter contains the user attributes claims. Some of these additional claims MAY be included in the Disclosures and MAY be selectively disclosed and they are given in the following tables that also specify whether a claim is selectively disclosable (SD) or not (NSD). - -The ``verification`` claim is a JSON structure with all the following mandatory sub-claims. - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **trust_framework** - - [NSD]. MUST be set to eidas - - `[OID.IDA. Section 5.1] `_ - * - **assurance_level** - - [NSD]. MUST be set to high - - `[OID.IDA. Section 5.1] `_ - * - **evidence** - - [SD]. JSON Array. Each element is the electronic evidence of the user identification during the PID issuing phase. It MUST contain at least the following claims: - - - **type**: MUST be set to ``electronic_record`` - - **record**: JSON object (see the table below) - - `[OID.IDA. Section 5.1] `_ - - -The ``record`` MUST have at least the following sub parameters: - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **type** - - identification of the national eID framework used by the User. For example ``eidas.it.cie`` means that the CIE id identification scheme is used by the User. - - `[OID.IDA. Section 5.1.1.2] `_ - * - **source** - - JSON Object cointaining the follwoing mandatory claims: - - - **organization_name**: Name of the Organization handling the eID used by the User - - **organization_id**: Identification code for the Organization. It MUST be set to the *IPA Code* of the Organization - - **country_code**: String representing country in `[ISO3166-1] Alpha-2 (e.g., IT) or [ISO3166-3] syntax `_. - - `[OID.IDA. Section 5.1.1.2] `_ - -.. warning:: - Note that the sub-claims of the **evidence** parameter are not selectively disclosable separately, thus, for example, the User cannot give only the *record type* without disclosure the *record source* (organization name, identifier and country that hendles the User identity proofing). - -Finally, the ``claims`` parameter contains the following mandatory claims: - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **given_name** - - [SD]. Current First Name - - `[OpenID Connect Core 1.0, Section 5.1] `_ - * - **family_name** - - [SD]. Current Family Name - - `[OpenID Connect Core 1.0, Section 5.1] `_ - * - **birthdate** - - [SD]. Date of Birth - - `[OpenID Connect Core 1.0, Section 5.1] `_ - * - **place_of_birth** - - [SD]. Place of Birth. JSON Object with the following subclaims: - - - **country** - - **locality** - - `[OpenID Connect for Identity Assurance 1.0, Section 4] `_ - * - **unique_id** - - [SD]. Unique citizen identifier (ID ANPR) given by the National Register of the Resident Population (ANPR). It MUST be set according to `ANPR rules `_ - - This specification - * - **tax_id_number** - - [SD]. National tax identification code of natural person as a String format. It MUST be set according to ETSI EN 319 412-1. For example ``TINIT-`` - - This specification - - - -Non-normative examples ----------------------- - -In the following, we provide a non-normative example of PID VC in JSON. - -.. code-block:: JSON - - { - "verified_claims": { - "verification": { - "trust_framework": "eidas", - "assurance_level": "high", - "evidence": [ - { - "type": "electronic_record", - "record": { - "type": "eidas.it.cie", - "source": { - "organization_name": "Ministero dell'Interno", - "organization_id": "m_it", - "country_code": "IT" - } - } - } - ] - }, - "claims": { - "unique_id": - "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", - "given_name": "Mario", - "family_name": "Rossi", - "birthdate": "1980-01-10", - "place_of_birth": { - "country": "IT", - "locality": "Rome" - }, - "tax_id_number": "TINIT-XXXXXXXXXXXXXXXX" - } - } - } - -The corresponding SD-JWT verson for PID is given by - -.. code-block:: JSON - - { - "typ":"vc+sd-jwt", - "alg":"RS512", - "kid":"dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw", - "trust_chain" : [ - "NEhRdERpYnlHY3M5WldWTWZ2aUhm ...", - "eyJhbGciOiJSUzI1NiIsImtpZCI6 ...", - "IkJYdmZybG5oQU11SFIwN2FqVW1B ..." - ] - } - -.. code-block:: JSON - - { - "iss": "https://pidprovider.example.org", - "sub": "NzbLsXh8uDCcd7noWXFZAfHkxZsRGC9Xs...", - "jti": "urn:uuid:6c5c0a49-b589-431d-bae7-219122a9ec2c", - "iat": 1541493724, - "exp": 1541493724, - "status": "https://pidprovider.example.org/status", - "cnf": { - "jwk": { - "kty": "RSA", - "use": "sig", - "n": "1Ta-sE …", - "e": "AQAB", - "kid": "YhNFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs" - } - }, - "type": "PersonIdentificationData", - "verified_claims": { - "verification": { - "_sd": [ - "OGm7ryXgt5Xzlevp-Hu-UTk0a-TxAaPAobqv1pIWMfw" - ], - "trust_framework": "eidas", - "assurance_level": "high" - }, - "claims": { - "_sd": [ - "8JjozBfovMNvQ3HflmPWy4O19Gpxs61FWHjZebU589E", - "BoMGktW1rbikntw8Fzx_BeL4YbAndr6AHsdgpatFCig", - "CFLGzentGNRFngnLVVQVcoAFi05r6RJUX-rdbLdEfew", - "JU_sTaHCngS32X-0ajHrd1-HCLCkpT5YqgcfQme168w", - "VQI-S1mT1Kxfq2o8J9io7xMMX2MIxaG9M9PeJVqrMcA", - "zVdghcmClMVWlUgGsGpSkCPkEHZ4u9oWj1SlIBlCc1o" - ] - } - }, - "_sd_alg": "sha-256" - } - -In the following the disclosure list is given - -Claim **evidence**: - -- SHA-256 Hash: ``OGm7ryXgt5Xzlevp-Hu-UTk0a-TxAaPAobqv1pIWMfw`` -- Disclosure: - ``WyIyR0xDNDJzS1F2ZUNmR2ZyeU5STjl3IiwgImV2aWRlbmNlIiwgW3sidHlw`` - ``ZSI6ICJlbGVjdHJvbmljX3JlY29yZCIsICJyZWNvcmQiOiB7InR5cGUiOiAi`` - ``ZWlkYXMuaXQuY2llIiwgInNvdXJjZSI6IHsib3JnYW5pemF0aW9uX25hbWUi`` - ``OiAiTWluaXN0ZXJvIGRlbGwnSW50ZXJubyIsICJvcmdhbml6YXRpb25faWQi`` - ``OiAibV9pdCIsICJjb3VudHJ5X2NvZGUiOiAiSVQifX19XV0`` -- Contents: ``["2GLC42sKQveCfGfryNRN9w", "evidence", [{"type":`` - ``"electronic_record", "record": {"type": "eidas.it.cie",`` - ``"source": {"organization_name": "Ministero dell'Interno",`` - ``"organization_id": "m_it", "country_code": "IT"}}}]]`` - -Claim **unique_id**: - -- SHA-256 Hash: ``BoMGktW1rbikntw8Fzx_BeL4YbAndr6AHsdgpatFCig`` -- Disclosure: - ``WyJlbHVWNU9nM2dTTklJOEVZbnN4QV9BIiwgInVuaXF1ZV9pZCIsICJ4eHh4`` - ``eHh4eC14eHh4LXh4eHgteHh4eC14eHh4eHh4eHh4eHgiXQ`` -- Contents: ``["eluV5Og3gSNII8EYnsxA_A", "unique_id",`` - ``"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"]`` - -Claim **given_name**: - -- SHA-256 Hash: ``zVdghcmClMVWlUgGsGpSkCPkEHZ4u9oWj1SlIBlCc1o`` -- Disclosure: - ``WyI2SWo3dE0tYTVpVlBHYm9TNXRtdlZBIiwgImdpdmVuX25hbWUiLCAiTWFy`` - ``aW8iXQ`` -- Contents: ``["6Ij7tM-a5iVPGboS5tmvVA", "given_name", "Mario"]`` - -Claim **family_name**: - -- SHA-256 Hash: ``VQI-S1mT1Kxfq2o8J9io7xMMX2MIxaG9M9PeJVqrMcA`` -- Disclosure: - ``WyJlSThaV205UW5LUHBOUGVOZW5IZGhRIiwgImZhbWlseV9uYW1lIiwgIlJv`` - ``c3NpIl0`` -- Contents: ``["eI8ZWm9QnKPpNPeNenHdhQ", "family_name", "Rossi"]`` - -Claim **birthdate**: - -- SHA-256 Hash: ``CFLGzentGNRFngnLVVQVcoAFi05r6RJUX-rdbLdEfew`` -- Disclosure: - ``WyJRZ19PNjR6cUF4ZTQxMmExMDhpcm9BIiwgImJpcnRoZGF0ZSIsICIxOTgw`` - ``LTAxLTEwIl0`` -- Contents: ``["Qg_O64zqAxe412a108iroA", "birthdate", "1980-01-10"]`` - -Claim **place_of_birth**: - -- SHA-256 Hash: ``JU_sTaHCngS32X-0ajHrd1-HCLCkpT5YqgcfQme168w`` -- Disclosure: - ``WyJBSngtMDk1VlBycFR0TjRRTU9xUk9BIiwgInBsYWNlX29mX2JpcnRoIiwg`` - ``eyJjb3VudHJ5IjogIklUIiwgImxvY2FsaXR5IjogIlJvbWUifV0`` -- Contents: - ``["AJx-095VPrpTtN4QMOqROA", "place_of_birth", {"country":`` - ``"IT", "locality": "Rome"}]`` - -Claim **tax_id_code**: - -- SHA-256 Hash: ``8JjozBfovMNvQ3HflmPWy4O19Gpxs61FWHjZebU589E`` -- Disclosure: - ``WyJQYzMzSk0yTGNoY1VfbEhnZ3ZfdWZRIiwgInRheF9pZF9jb2RlIiwgIlRJ`` - ``TklULVhYWFhYWFhYWFhYWFhYWFgiXQ`` -- Contents: ``["Pc33JM2LchcU_lHggv_ufQ", "tax_id_code",`` - ``"TINIT-XXXXXXXXXXXXXXXX"]`` - -The combined format for the PID issuance is given by - -.. code-block:: - - eyJhbGciOiAiRVMyNTYifQ.eyJpc3MiOiAiaHR0cHM6Ly9waWRwcm92aWRlci5pdCIsI - CJpYXQiOiAxNjgzMDAwMDAwLCAiZXhwIjogMTg4MzAwMDAwMCwgInZlcmlmaWVkX2NsY - WltcyI6IHsidmVyaWZpY2F0aW9uIjogeyJfc2QiOiBbIk9HbTdyeVhndDVYemxldnAtS - HUtVVRrMGEtVHhBYVBBb2JxdjFwSVdNZnciXSwgInRydXN0X2ZyYW1ld29yayI6ICJla - WRhcyIsICJhc3N1cmFuY2VfbGV2ZWwiOiAiaGlnaCJ9LCAiY2xhaW1zIjogeyJfc2QiO - iBbIjhKam96QmZvdk1OdlEzSGZsbVBXeTRPMTlHcHhzNjFGV0hqWmViVTU4OUUiLCAiQ - m9NR2t0VzFyYmlrbnR3OEZ6eF9CZUw0WWJBbmRyNkFIc2RncGF0RkNpZyIsICJDRkxHe - mVudEdOUkZuZ25MVlZRVmNvQUZpMDVyNlJKVVgtcmRiTGRFZmV3IiwgIkpVX3NUYUhDb - mdTMzJYLTBhakhyZDEtSENMQ2twVDVZcWdjZlFtZTE2OHciLCAiVlFJLVMxbVQxS3hmc - TJvOEo5aW83eE1NWDJNSXhhRzlNOVBlSlZxck1jQSIsICJ6VmRnaGNtQ2xNVldsVWdHc - 0dwU2tDUGtFSFo0dTlvV2oxU2xJQmxDYzFvIl19fSwgIl9zZF9hbGciOiAic2hhLTI1N - iJ9.gsvYGCpWbnx8Dkd5ofKq-MtZplFFV49uY42Yf9S3rZe_SPTjg_AWdpm4bvSOhNbe - P0aMzFGtftSk3-3sufXBdw~WyIyR0xDNDJzS1F2ZUNmR2ZyeU5STjl3IiwgImV2aWRlb - mNlIiwgW3sidHlwZSI6ICJlbGVjdHJvbmljX3JlY29yZCIsICJyZWNvcmQiOiB7InR5c - GUiOiAiZWlkYXMuaXQuY2llIiwgInNvdXJjZSI6IHsib3JnYW5pemF0aW9uX25hbWUiO - iAiTWluaXN0ZXJvIGRlbGwnSW50ZXJubyIsICJvcmdhbml6YXRpb25faWQiOiAibV9pd - CIsICJjb3VudHJ5X2NvZGUiOiAiSVQifX19XV0~WyJlbHVWNU9nM2dTTklJOEVZbnN4Q - V9BIiwgInVuaXF1ZV9pZCIsICJ4eHh4eHh4eC14eHh4LXh4eHgteHh4eC14eHh4eHh4e - Hh4eHgiXQ~WyI2SWo3dE0tYTVpVlBHYm9TNXRtdlZBIiwgImdpdmVuX25hbWUiLCAiTW - FyaW8iXQ~WyJlSThaV205UW5LUHBOUGVOZW5IZGhRIiwgImZhbWlseV9uYW1lIiwgIlJ - vc3NpIl0~WyJRZ19PNjR6cUF4ZTQxMmExMDhpcm9BIiwgImJpcnRoZGF0ZSIsICIxOTg - wLTAxLTEwIl0~WyJBSngtMDk1VlBycFR0TjRRTU9xUk9BIiwgInBsYWNlX29mX2JpcnR - oIiwgeyJjb3VudHJ5IjogIklUIiwgImxvY2FsaXR5IjogIlJvbWUifV0~WyJQYzMzSk0 - yTGNoY1VfbEhnZ3ZfdWZRIiwgInRheF9pZF9jb2RlIiwgIlRJTklULVhYWFhYWFhYWFh - YWFhYWFgiXQ - - - -MDOC-CBOR -========= - -[TODO] - - diff --git a/en/_sources/pid-eaa-data-model.rst.txt b/en/_sources/pid-eaa-data-model.rst.txt index 1ff53b0e4..25888685e 100644 --- a/en/_sources/pid-eaa-data-model.rst.txt +++ b/en/_sources/pid-eaa-data-model.rst.txt @@ -19,16 +19,16 @@ The User attributes carried in the Italian PID are: The italian PID is extended according to the `OpenID Identity Assurance Profile [OIDC.IDA] `_, that enables the binding of the PID to a national trust framework, giving all the evidence of the identity proofing procedures underlying the PID issuing in both remote and proximity flows. -The (Q)EAAs are issued by the (Q)EAA Issuers to a Wallet Instance and MUST be provided in SD-JWT-VC or mDOC CBOR data format. They MAY contain any (qualified) attributes, entitlement or any elettronic attestations. +The (Q)EAAs are issued by (Q)EAA Issuers to a Wallet Instance and MUST be provided in SD-JWT-VC or mDOC CBOR data format. -The (Q)EAAs are extended according to the `OpenID Identity Assurance Profile [OIDC.IDA] `_, that allows the recipients to know the Authentic Sources where where the data comes from. +The (Q)EAAs are extended according to the `OpenID Identity Assurance Profile [OIDC.IDA] `_, that allows the recipients to know the Authentic Sources where the data comes from. The PID/(Q)EAA data format and the mechanism through which a digital credential is issued to the Wallet Instance and presented to an RP is described in the following sections. SD-JWT ====== -The PID/(Q)EAA is given as a Verifiable Credential with JSON payload based on the `Selective Disclosure JWT format `_ as specified in `[draft-terbu-sd-jwt-vc-latest] `__. +The PID/(Q)EAA is issued in the form of a digital credential. The digital credential format is `Selective Disclosure JWT format `_ as specified in `[draft-terbu-sd-jwt-vc-latest] `__. An SD-JWT is a JWT that MUST be signed using the Issuer's private key. The SD-JWT payload of the MUST contain the **_sd_alg** claim described in `[SD-JWT]. Section 5.1.2. `_ and other claims specified in this section, some of them may be selectively disclosable claims. @@ -50,6 +50,7 @@ The Disclosures are sent to the Holder together with the SD-JWT in the *Combined See `[draft-terbu-sd-jwt-vc-latest] `_ and `[SD-JWT] `__ for more details. + PID/(Q)EAA SD-JWT parameters ---------------------------- @@ -133,13 +134,13 @@ The ``verification`` claim is a JSON structure with all the following mandatory - **Description** - **Reference** * - **trust_framework** - - [NSD]. For PID credential it MUST be set to ``eidas``. For (Q)EAA it MUST be set to ``eidas2``. + - [NSD]. It MUST be set to ``eidas``. - `[OID.IDA. Section 5.1] `_ * - **assurance_level** - [NSD]. MUST be set according to the LoA required. For PID credential it MUST be set to ``high``. - `[OID.IDA. Section 5.1] `_ * - **evidence** - - [SD]. JSON Array. Each element is the electronic evidence of the User identification during the PID issuance or, in the case of (Q)EAA, it represents the evidence of the Authentic Source that ensures the authenticity of the data conveyed by the (Q)EAA. It MUST contain at least the following claims: + - [SD]. JSON Array. Each element is the electronic evidence of the User identification during the PID issuance or, in the case of (Q)EAA, with this evidence the Authentic Source assures the authenticity of the data conveyed in the (Q)EAA. It MUST contain at least the following claims: - **type**: MUST be set to ``electronic_record`` - **record**: JSON object (see the table below) @@ -156,25 +157,24 @@ The ``record`` MUST have at least the following sub parameters: - **Description** - **Reference** * - **type** - - Identification of the trust framework used for obtaining the verified claims. For example, in case of PID, ``eidas.it.cie`` means that the CIE id identification scheme is used by the User. + - It uniquely identifies the trust framework used for the provisioning of the credential. For example, in case of PID, the value ``https://eudi.wallet.cie.gov.it`` means that the CIE id identification scheme is used. - `[OID.IDA. Section 5.1.1.2] `_ * - **source** - JSON Object cointaining the follwoing mandatory claims: - - **organization_name**: Name of the Organization. In case of PID, it is the Organization handling the eID used by the User. For the (Q)EAA it is the Authentic Source. - - **organization_id**: Identification code for the Organization. For public Organization, it MUST be set to the *IPA Code*. + - **organization_name**: Name of the Organization acting as Authentic Source. + - **organization_id**: Identification code for the Organization. For public Organization, it MUST be set to the *IPA Code*, following the URN namespace ``urn:eudi:it:organization_id:ipa_code:``. - **country_code**: String representing country in `[ISO3166-1] Alpha-2 (e.g., IT) or [ISO3166-3] syntax `_. - `[OID.IDA. Section 5.1.1.2] `_ .. warning:: - Note that the sub-claims of the **evidence** parameter are not selectively disclosable separately, thus, for example, the User cannot give only the *record type* without disclosure the *record source* (organization name, identifier and country). + Note that the sub-claims of the **evidence** parameter are not selectively disclosable separately, thus, for example, the User cannot give only the *record type* without the disclosure of the *record source* value (organization name, identifier and country). PID Claims field ---------------- The ``claims`` parameter contains the User attributes with the following mandatory fields: - .. list-table:: :widths: 20 60 20 :header-rows: 1 @@ -206,10 +206,10 @@ The ``claims`` parameter contains the User attributes with the following mandato -PID Non-normative examples +PID Non-normative Examples -------------------------- -In the following, the non-normative example of a PID digital credential. +In the following, the non-normative example of a PID. .. code-block:: JSON @@ -222,7 +222,7 @@ In the following, the non-normative example of a PID digital credential. { "type": "electronic_record", "record": { - "type": "eidas.it.cie", + "type": "https://eudi.wallet.cie.gov.it", "source": { "organization_name": "Ministero dell'Interno", "organization_id": "m_it", @@ -315,7 +315,7 @@ Claim **evidence**: ``OiAiTWluaXN0ZXJvIGRlbGwnSW50ZXJubyIsICJvcmdhbml6YXRpb25faWQi`` ``OiAibV9pdCIsICJjb3VudHJ5X2NvZGUiOiAiSVQifX19XV0`` - Contents: ``["2GLC42sKQveCfGfryNRN9w", "evidence", [{"type":`` - ``"electronic_record", "record": {"type": "eidas.it.cie",`` + ``"electronic_record", "record": {"type": "https://eudi.wallet.cie.gov.it",`` ``"source": {"organization_name": "Ministero dell'Interno",`` ``"organization_id": "m_it", "country_code": "IT"}}}]]`` @@ -380,23 +380,23 @@ The combined format for the PID issuance is given by (Q)EAA Non-normative examples ----------------------------- -In the following, we provide a non-normative example of (Q)EAA VC in JSON. +In the following, we provide a non-normative example of (Q)EAA in JSON. .. code-block:: JSON { "verified_claims": { "verification": { - "trust_framework": "eidas2", + "trust_framework": "eidas", "assurance_level": "high", "evidence": [ { "type": "electronic_record", "record": { - "type": "eidas.it.pdnd", + "type": "https://eudi.wallet.pdnd.gov.it", "source": { "organization_name": "Ragioneria Generale dello Stato", - "organization_id": "QLHCFC", + "organization_id": "urn:eudi:it:organization_id:ipa_code:QLHCFC", "country_code": "IT" } } @@ -416,14 +416,14 @@ In the following, we provide a non-normative example of (Q)EAA VC in JSON. } } -The corresponding SD-JWT for the preivous data is represented as follow, as decoded JSON for both header and payload. +The corresponding SD-JWT for the previous data is represented as follow, as decoded JSON for both header and payload. .. code-block:: JSON { "typ":"vc+sd-jwt", "alg":"RS512", - "kid":"dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw", + "kid":"d126a6a856f7724560484fa9dc59d195", "trust_chain" : [ "NEhRdERpYnlHY3M5WldWTWZ2aUhm ...", "eyJhbGciOiJSUzI1NiIsImtpZCI6 ...", @@ -443,10 +443,11 @@ The corresponding SD-JWT for the preivous data is represented as follow, as deco "cnf": { "jwk": { "kty": "RSA", - "use": "sig", - "n": "1Ta-sE …", "e": "AQAB", - "kid": "YhNFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs" + "use": "sig", + "kid": "d126a6a856f7724560484fa9dc59d195", + "alg": "RS256", + "n": "oians5wYCWk4wFtEStVYcn_xOw9edKMNGH33_q6_pBI0XaTY7P3apUgjO0ivk5c1NQAVY6PZmcPQ8P1Y0cBAC9STRmzvTvDQcOocLhVy2ZlcXTu39oOGLNra8_LQsaMA386lO_qMW4-uY6DbGZY4vHkScvAC9FIZYDPafqWBEQUNV2QOFMH5VPoihCTKHwMGXnZBatYObg57xSOUX-bvhO_sFMm3k4RvsXcr3MFojAhLfwutu_jK9k7N9KR_mNc5IpiOyhZw_sUmF6SamRqsSPp42KD10hPMW0YJTDMYxBdHrMFeSMHYIMY4oBBT43__a55zILI_CnIk4241wOvGvw" } }, "type": "HealthInsuranceData", @@ -455,7 +456,7 @@ The corresponding SD-JWT for the preivous data is represented as follow, as deco "_sd": [ "2jIR18gfeASHYGB27s7sS3S_iQ4xxFIxCRyiohrBfns" ], - "trust_framework": "eidas2", + "trust_framework": "eidas", "assurance_level": "high" }, "claims": { @@ -471,7 +472,7 @@ The corresponding SD-JWT for the preivous data is represented as follow, as deco "_sd_alg": "sha-256" } -In the following the disclosure list is given +In the following the disclosure list is given: Claim **evidence**: @@ -484,7 +485,7 @@ Claim **evidence**: ``emF0aW9uX2lkIjogIlFMSENGQyIsICJjb3VudHJ5X2NvZGUiOiAiSVQifX19`` ``XV0`` - Contents: ``["2GLC42sKQveCfGfryNRN9w", "evidence", [{"type":`` - ``"electronic_record", "record": {"type": "eidas.it.pdnd",`` + ``"electronic_record", "record": {"type": "https://eudi.wallet.pdnd.gov.it",`` ``"source": {"organization_name": "Ragioneria Generale dello Stato",`` ``"organization_id": "QLHCFC", "country_code":"IT"}}}]]`` @@ -528,11 +529,11 @@ Claim **tax_id_code**: - Contents: ``["AJx-095VPrpTtN4QMOqROA", "tax_id_code",`` ``"TINIT-XXXXXXXXXXXXXXXX"]`` -The combined format for the PID issuance is given by +The combined format for the PID issuance is represented below: .. code-block:: - eyJ0eXAiOiJ2YytzZC1qd3QiLCJhbGciOiJSUzUxMiIsImtpZCI6ImQxMjZhNmE4NTZmNzcyNDU2MDQ4NGZhOWRjNTlkMTk1IiwidHJ1c3RfY2hhaW4iOlsiTkVoUmRFUnBZbmxIWTNNNVdsZFdUV1oyYVVobSAuLi4iLCJleUpoYkdjaU9pSlNVekkxTmlJc0ltdHBaQ0k2IC4uLiIsIklrSllkbVp5Ykc1b1FVMTFTRkl3TjJGcVZXMUIgLi4uIl19.eyJpc3MiOiJodHRwczovL2lzc3Vlci5leGFtcGxlLm9yZyIsInN1YiI6Ik56YkxzWGg4dURDY2Q3bm9XWEZaQWZIa3hac1JHQzlYcy4uLiIsImp0aSI6InVybjp1dWlkOjZjNWMwYTQ5LWI1ODktNDMxZC1iYWU3LTIxOTEyMmE5ZWMyYyIsImlhdCI6MTU0MTQ5MzcyNCwiZXhwIjoxNTQxNDkzNzI0LCJzdGF0dXMiOiJodHRwczovL2lzc3Vlci5leGFtcGxlLm9yZy9zdGF0dXMiLCJjbmYiOnsiandrIjp7Imt0eSI6IlJTQSIsInVzZSI6InNpZyIsIm4iOiIxVGEtc0Ug4oCmIiwiZSI6IkFRQUIiLCJraWQiOiJZaE5GUzNZbkM5dGppQ2FpdmhXTFZVSjNBeHdHR3pfOTh1UkZhcU1FRXMifX0sInR5cGUiOiJIZWFsdGhJbnN1cmFuY2VEYXRhIiwidmVyaWZpZWRfY2xhaW1zIjp7InZlcmlmaWNhdGlvbiI6eyJfc2QiOlsiMmpJUjE4Z2ZlQVNIWUdCMjdzN3NTM1NfaVE0eHhGSXhDUnlpb2hyQmZucyJdLCJ0cnVzdF9mcmFtZXdvcmsiOiJlaWRhczIiLCJhc3N1cmFuY2VfbGV2ZWwiOiJoaWdoIn0sImNsYWltcyI6eyJfc2QiOlsiMWl6dHE3Ym92NjR4VFliRGtXRmM0NF9WaldlMDI5aFpxWGVVSWxvcVVONCIsIkVOTm8zMWpmekZwOFkyRFcwUi1mSU1lV3dlN0VMR3ZHb0hNd01CcHUxNEUiLCJGVjJDRE5XdVRxVGdPSGFmdHZWYXVtQkYwT2xtbnl4TXN3eWY0dUl4cmhZIiwiZFpXanE3bUpTU1gtWFRJX0hXdUU4QjJ4NklkTTVsRS1kb0RfeUJwS0phbyIsImdIWWkxOWZyYkRfaTRCb2FXRU5PamMzbENuTWo0cGJHTlFjc0JqX1FNNFEiXX19LCJfc2RfYWxnIjoic2hhLTI1NiJ9.Dy8IdMBmzL5QSxAHiYTv9Fg0HhiI-AFIwL2slNEVI5iTxcne0reX2w-Bo78bY0UkOF5LHBLjGV_l5wbX6pvDY0v193ifp7KzJIpj2jUuQ-XR7RHng9RFdjKSj7urVYaseQxKA97vWcJxNX7bYKLQ6jKOdxl0CXmFdg00HTA1MnO7OPWdRiT7BlDyl0HfwQ-X08Yk23zX2Po90p1pBIWMlqnkfeZwQIWyz6LvFcK7OClEYlmzhtLR5QmYHbIbu9oGhn00hv0Q94TcheGpSm8WmfUjE-dV6YvfWtkcsTg7bjmawt6B4W_YMwV9pSmoC1euwO1svoyAdqxjGbInmLT4hA + eyJ0eXAiOiJ2YytzZC1qd3QiLCJhbGciOiJSUzUxMiIsImtpZCI6ImQxMjZhNmE4NTZmNzcyNDU2MDQ4NGZhOWRjNTlkMTk1IiwidHJ1c3RfY2hhaW4iOlsiTkVoUmRFUnBZbmxIWTNNNVdsZFdUV1oyYVVobSAuLi4iLCJleUpoYkdjaU9pSlNVekkxTmlJc0ltdHBaQ0k2IC4uLiIsIklrSllkbVp5Ykc1b1FVMTFTRkl3TjJGcVZXMUIgLi4uIl19.eyJpc3MiOiJodHRwczovL2lzc3Vlci5leGFtcGxlLm9yZyIsInN1YiI6Ik56YkxzWGg4dURDY2Q3bm9XWEZaQWZIa3hac1JHQzlYcy4uLiIsImp0aSI6InVybjp1dWlkOjZjNWMwYTQ5LWI1ODktNDMxZC1iYWU3LTIxOTEyMmE5ZWMyYyIsImlhdCI6MTU0MTQ5MzcyNCwiZXhwIjoxNTQxNDkzNzI0LCJzdGF0dXMiOiJodHRwczovL2lzc3Vlci5leGFtcGxlLm9yZy9zdGF0dXMiLCJjbmYiOnsiandrIjp7Imt0eSI6IlJTQSIsImUiOiJBUUFCIiwidXNlIjoic2lnIiwia2lkIjoiZDEyNmE2YTg1NmY3NzI0NTYwNDg0ZmE5ZGM1OWQxOTUiLCJhbGciOiJSUzI1NiIsIm4iOiJvaWFuczV3WUNXazR3RnRFU3RWWWNuX3hPdzllZEtNTkdIMzNfcTZfcEJJMFhhVFk3UDNhcFVnak8waXZrNWMxTlFBVlk2UFptY1BROFAxWTBjQkFDOVNUUm16dlR2RFFjT29jTGhWeTJabGNYVHUzOW9PR0xOcmE4X0xRc2FNQTM4NmxPX3FNVzQtdVk2RGJHWlk0dkhrU2N2QUM5RklaWURQYWZxV0JFUVVOVjJRT0ZNSDVWUG9paENUS0h3TUdYblpCYXRZT2JnNTd4U09VWC1idmhPX3NGTW0zazRSdnNYY3IzTUZvakFoTGZ3dXR1X2pLOWs3TjlLUl9tTmM1SXBpT3loWndfc1VtRjZTYW1ScXNTUHA0MktEMTBoUE1XMFlKVERNWXhCZEhyTUZlU01IWUlNWTRvQkJUNDNfX2E1NXpJTElfQ25JazQyNDF3T3ZHdncifX0sInR5cGUiOiJIZWFsdGhJbnN1cmFuY2VEYXRhIiwidmVyaWZpZWRfY2xhaW1zIjp7InZlcmlmaWNhdGlvbiI6eyJfc2QiOlsiMmpJUjE4Z2ZlQVNIWUdCMjdzN3NTM1NfaVE0eHhGSXhDUnlpb2hyQmZucyJdLCJ0cnVzdF9mcmFtZXdvcmsiOiJlaWRhcyIsImFzc3VyYW5jZV9sZXZlbCI6ImhpZ2gifSwiY2xhaW1zIjp7Il9zZCI6WyIxaXp0cTdib3Y2NHhUWWJEa1dGYzQ0X1ZqV2UwMjloWnFYZVVJbG9xVU40IiwiRU5ObzMxamZ6RnA4WTJEVzBSLWZJTWVXd2U3RUxHdkdvSE13TUJwdTE0RSIsIkZWMkNETld1VHFUZ09IYWZ0dlZhdW1CRjBPbG1ueXhNc3d5ZjR1SXhyaFkiLCJkWldqcTdtSlNTWC1YVElfSFd1RThCMng2SWRNNWxFLWRvRF95QnBLSmFvIiwiZ0hZaTE5ZnJiRF9pNEJvYVdFTk9qYzNsQ25NajRwYkdOUWNzQmpfUU00USJdfX0sIl9zZF9hbGciOiJzaGEtMjU2In0.PrVt9qpf1WmfoRKncGXw6loKRANomsL-foXMqMUIyK2AO0tWM5laveqRet9Bb5A0fPq7rxNQLU57ngV3o8VzKLhFkbKm1_wtA5XuZXBfz0qGCmIP6tZQu9yAvXy162h6_i4FOINyHoL8i5mNPFTHFY0nBYTyVkCScfBC2Ccv4i7RSALbpbpviTpoYVBzFWtdOKuuMED5XwKpW9-VF_JK11yaJJ880walzu5tZ3XAOb0KkfUS3sCmSkKO5wMm1SeaS7xL5iiPSnAMTMrlmKE6qcwAkdDX-hNeGzncwBjHASTWb2udayK8Cal-wFGDWrRWGq3mU0rfuxMIFkjv4gdi8Q MDOC-CBOR ========= diff --git a/en/_sources/pid-eaa-data.rst.txt b/en/_sources/pid-eaa-data.rst.txt deleted file mode 100644 index 8ab0305c9..000000000 --- a/en/_sources/pid-eaa-data.rst.txt +++ /dev/null @@ -1,57 +0,0 @@ -.. include:: ../common/common_definitions.rst - -.. _pid-eaa-data.rst: - -pid-eaa-data.rst -+++++++++++++++++++++++++++ - -[What is it] - -[What it is usefull for] - -[Example] - -General Properties ------------------- - -[TODO] - - -Requirements ------------- - - - req 1 - - req 2 - - -Attributes ----------- - -[Table with parameters/attributes] - -.. list-table:: - :widths: 20 60 - :header-rows: 1 - - * - **Claim** - - **Description** - * - key - - value - - -Implementation considerations ------------------------------ - -TODO - - -Libraries and code snippets ---------------------------- - -TODO - - -External references -------------------- - -TODO diff --git a/en/_sources/pid-eaa-issuance.rst.txt b/en/_sources/pid-eaa-issuance.rst.txt index 5732c2e5a..9cfca1822 100644 --- a/en/_sources/pid-eaa-issuance.rst.txt +++ b/en/_sources/pid-eaa-issuance.rst.txt @@ -5,7 +5,7 @@ PID/(Q)EAA Issuance +++++++++++++++++++ -This section describes the issuance flow for the PID and (Q)EAAs that require a high security implementation profile. +This section describes the PID and (Q)EAAs issuance flow with an high level of security. The relevant entities and interfaces involved in the issuance flow are: - *Wallet Provider*: It represents an organization (public or private) that is responsible for the release of an eIDAS-compliant EUDI Wallet Solution. It also issues thes Wallet Instance Attestation to its Wallet Instances by means of an Attestation Service. The Wallet Attestation certifies the genuinity and authenticity of the Wallet Instance and its compliance with a Trust Framework in compliance to the security and privacy requirements. @@ -16,7 +16,7 @@ The relevant entities and interfaces involved in the issuance flow are: - OpenID4VCI Component: based on the “OpenID for Verifiable Credential Issuance” specification `[OIDC4VCI. Draft 13] `_ to release PID credentials. - National eID Relying Party (OpenID Connect or SAML2): It represents the component to authenticate the End-User with the national Digital Identity Providers. - National IdP: It represents preexisting identity systems based on SAML2 or OpenID Connect, already in production in each Member State (for Italy SPID and CIE id authentication schemed notified eIDAS with *LoA* **High**, see `SPID/CIE OpenID Connect Specifications `_). - - *(Q)EAA Issuer*: It represents the issuer of (Q)EAAs. It is composed of: + - *(Q)EAA Issuer*: It represents the Issuer of (Q)EAAs. It is composed of: - OpenID4VCI Component: based on the “OpenID for Verifiable Credential Issuance” specification `[OIDC4VCI. Draft 13] `_ to release (Q)EAAs. - Relying Party: It represents the component to authenticate the User with the PID. The (Q)EAA Issuer acts as a verifier and it sends a presentation request to the Wallet Instance according to [`OpenID4VP`_]. The Wallet Instance MUST have a valid PID obtained prior to starting a transaction with the (Q)EAA Issuer. @@ -39,7 +39,7 @@ Below a detailed description for each step represented in the previous picture: 0. **Wallet Instance Setup**: the first time the Wallet Instance is started a preliminary setup phase MUST be carried out. It consists of the release of a verifiable proof issued by the Attestation Service provided by the Wallet Provider that asserts the genuineness, the authenticity and the compliance with a trust framework of the Wallet Instance. The verifiable proof binds a public key corresponding to a local private key generated by the Wallet Instance. 1. **Obtaining the trusted PID Provider**: the Wallet Instance queries the Trust Anchor to fetch the trusted PID Provider. 2. **Obtaining of PID Provider metadata**: the Wallet Instance establishes the trust to the PID Provider according to the Trust Model, obtaining the Metadata that discloses the formats of the PID, the algorithms supported, and any other parameter required for interoperability needs. - 3. **PID request**: following the Authorization Code Flow in `[OIDC4VCI. Draft 13] `_ the Wallet Instance requests a PID to the PID Provider. A fresh key pairs is generated by the Wallet Instance, the public key is used by PID Provider for the key binding of the PID. The PID Provider checks the Wallet Instance by means of the Wallet Attestation and the Trust Chain related to the Wallet Provider + 3. **PID request**: following the Authorization Code Flow in `[OIDC4VCI. Draft 13] `_ the Wallet Instance requests a PID to the PID Provider. A fresh key pairs is generated by the Wallet Instance, the public key is used by PID Provider for the key binding of the PID. The PID Provider checks the Wallet Instance by means of the Wallet Attestation and the Trust Chain related to the Wallet Provider. 4. **End-user authentication**: the PID Provider authenticates the End-User with LoA High, acting as an IAM Proxy to the National eID system. 5. **PID issuance**: once the User authentication with LoA High happens, the User gives their consent, and the PID Provider releases a PID bound to the key material held by the requesting Wallet Instance. @@ -48,9 +48,9 @@ The Wallet Instance Setup phase is described in Section [...]. In the following High-Level (Q)EAA flow ---------------------- -The :numref:`fig_High-Level-Flow-ITWallet-QEAA-Issuance` shows a general architecture and highlights the main operations involved in the issuance of a (Q)EAA, under the main following assumptions: +The :numref:`fig_High-Level-Flow-ITWallet-QEAA-Issuance` shows a general architecture and highlights the main operations involved in the issuance of a (Q)EAA, following the assumptions listed below: - - the User has a valid PID stored in its own Wallet Instance; + - the User has a valid PID stored in their own Wallet Instance; - the (Q)EAA requires a high security implementation profile. .. _fig_High-Level-Flow-ITWallet-QEAA-Issuance: @@ -64,9 +64,9 @@ Below the description of the most relevant operations involved in the (Q)EAA iss 1. **Obtaining the trusted (Q)EAA Issuer**: the Wallet Instance queries the Trust Anchor to fetch the trusted (Q)EAA Issuer. 2. **Obtaining of (Q)EAA Issuer metadata**: the Wallet Instance establishes the trust to the (Q)EAA Issuer according to the Trust Model, obtaining the Metadata that discloses the formats of the (Q)EAA, the algorithms supported, and any other parameter required for interoperability needs. - 3. **(Q)EAA request**: following the Authorization Code Flow in `[OIDC4VCI. Draft 13] `_ the Wallet Instance requests a (Q)EAA to the (Q)EAA Issuer. A fresh key pairs is generated by the Wallet Instance, the public key is used by (Q)EAA Issuer for the key binding of the (Q)EAA. The (Q)EAA Issuer checks the Wallet Instance by means of the Wallet Attestation and the Trust Chain related to the Wallet Provider - 4. **End-user authentication**: the (Q)EAA Issuer authenticates the User with the PID owned by the User, acting as a verifier (Relying Party). - 5. **(Q)EAA issuance**: once the User authentication with a valid PID happens, the User gives their consent, and the (Q)EAA Issuer releases a (Q)EAA bound to the key material held by the requesting Wallet Instance. + 3. **(Q)EAA request**: following the Authorization Code Flow in `[OIDC4VCI. Draft 13] `_ the Wallet Instance requests a (Q)EAA to the (Q)EAA Issuer. A fresh key pairs is generated by the Wallet Instance, the public key is used by (Q)EAA Issuer for the key binding of the (Q)EAA. The (Q)EAA Issuer checks the Wallet Instance by means of the Wallet Attestation and the Trust Chain related to the Wallet Provider. + 4. **End-user authentication**: the (Q)EAA Issuer, acting as a verifier (Relying Party), authenticates the User with the PID. + 5. **(Q)EAA issuance**: once the User has been authenticated with a valid PID, the User gives their consent, then the (Q)EAA Issuer releases a (Q)EAA bound to the key material held by the requesting Wallet Instance. @@ -91,10 +91,10 @@ The PID/(Q)EAA Issuance phase is based on the **Authorization Code Flow** with * .. note:: - **Federation Check:** The Wallet Instance needs to check if the PID/(Q)EAA Issuer is part of Federation, obtaining then its protocol specific metadata. A non-normative example of a response from the endpoint **.well-known/openid-federation** with the **Entity Configuration** and the **Metadata** of the PID/(Q)EAA Issuer is represented within the section `Entity Configuration Credential Issuer`_. + **Federation Check:** The Wallet Instance needs to check if the PID/(Q)EAA Issuer is part of the Federation, obtaining then its protocol specific metadata. A non-normative example of a response from the endpoint **.well-known/openid-federation** with the **Entity Configuration** and the **Metadata** of the PID/(Q)EAA Issuer is represented within the section `Entity Configuration Credential Issuer`_. -**Steps 5-6 (PAR Request):** The Wallet Instance creates a PKCE code verifier that sends in a *pushed authorization request*, using the request parameter (see :rfc:`9126` Section 3) to the PID/(Q)EAA Issuer PAR endpoint. The Wallet Instance signs the request using its private key. A OAuth2 client authentication method MUST be involved, since in this flow the pushed authorization endpoint is a protected endpoint. The client authentication is based on the model defined in [:rfc:`7521`] using the Wallet Instance Attestation JWS inside the **client_assertion** parameter. The authorization_details [RAR :rfc:`9396`] parameter is extended to allow Wallet Instance to specify the types of the credentials when requesting authorization for the PID/(Q)EAA issuance. +**Steps 5-6 (PAR Request):** The Wallet Instance creates a PKCE code verifier that sends in a *pushed authorization request*, using the request parameter (see :rfc:`9126` Section 3) to the PID/(Q)EAA Issuer PAR endpoint. The Wallet Instance signs the request using its private key. A OAuth2 client authentication method is involved, since in this flow the pushed authorization endpoint is a protected endpoint. The client authentication is based on the model defined in [:rfc:`7521`] using the Wallet Instance Attestation JWS inside the **client_assertion** parameter. The authorization_details [RAR :rfc:`9396`] parameter is extended to allow Wallet Instance to specify the types of the credentials when requesting authorization for the PID/(Q)EAA issuance. Below a non-normative example of the PAR. @@ -177,7 +177,7 @@ The JWS payload of the request object is represented below: .. note:: **User Authentication and Consent:** The PID Provider performs the User authentication based on the requirements of eIDAS LoA High by means of national notified eIDAS scheme and requires the User consent for the PID issuance. - The (Q)EAA Issuer performs the User authentication requesting a valid PID to the Wallet Instance. The (Q)EAA Issuer MUST use [`OpenID4VP`_] to dynamically request presentation of the PID. From a protocol perspective, the (Q)EAA Issuer then acts as a verifier and sends a presentation request to the Wallet Instance. The Wallet Instance MUST have a valid PID obtained prior to starting a transaction with the (Q)EAA Issuer. + The (Q)EAA Issuer performs the User authentication requesting a valid PID to the Wallet Instance. The (Q)EAA Issuer MUST use [`OpenID4VP`_] to dynamically request the presentation of the PID. From a protocol perspective, the (Q)EAA Issuer then acts as a verifier and sends a presentation request to the Wallet Instance. The Wallet Instance MUST have a valid PID obtained prior to starting a transaction with the (Q)EAA Issuer. **Steps 10-11 (Authorization Response):** The PID/(Q)EAA Issuer sends an authorization code to the Wallet Instance. @@ -190,7 +190,7 @@ The JWS payload of the request object is represented below: HTTP/1.1 302 Found Location: eudiw://start.wallet.example.org?code=SplxlOBeZQQYbYS6WxSbIA&state=fyZiOL9Lf2CeKuNT2JzxiLRDink0uPcd&iss=https%3A%2F%2Fpid-provider.example.org -**Steps 12-13 (DPoP Proof for Token Endpoint)**: The Wallet Instance creates a key for DPoP and a fresh DPoP proof for the token request to the PID/(Q)EAA Issuer. DPoP provides a way to bind the access token to a certain sender (Wallet Instance) `[DPoP-draft16] `_. This mitigates the misuse of leaked or stolen Access Tokens at the Credential Endpoint of PID/(Q)EAA Issuer as the attacker needs to present a valid DPoP proof. +**Steps 12-13 (DPoP Proof for Token Endpoint)**: The Wallet Instance creates a key for DPoP and a fresh DPoP proof for the token request to the PID/(Q)EAA Issuer. DPoP provides a way to bind the Access Token to a certain sender (Wallet Instance) `[DPoP-draft16] `_. This mitigates the misuse of leaked or stolen Access Tokens at the Credential Endpoint of PID/(Q)EAA Issuer as the attacker needs to present a valid DPoP proof. **Step 14 (Token Request):** The Wallet Instance sends a token request to the PID/(Q)EAA Issuer token endpoint using the authorization *code*, *code_verifier*, *DPoP proof* and *private_key_jwt*. @@ -216,7 +216,7 @@ The JWS payload of the request object is represented below: &client_assertion=eyJhbGciOiJIUzI1NiI -**Step 15 (Token Response):** The PID/(Q)EAA Issuer validates the request and if it is successful, it issues an *access token* (bound to the DPoP key) and a fresh *c_nonce*. +**Step 15 (Token Response):** The PID/(Q)EAA Issuer validates the request and if it is successful, it issues an *Access Token* (bound to the DPoP key) and a fresh *c_nonce*. .. code-block:: http @@ -233,9 +233,9 @@ The JWS payload of the request object is represented below: } -**Steps 16-18 (DPoP Proof for Credential Endpoint):** The Wallet Instance creates a new key pair to which the new credential SHALL be bound. Then, it creates a proof of possession with the new key and the *c_nonce* obtained in **Step 15** and it creates a DPoP proof for the request to the PID/(Q)EAA credential issuance endpoint. +**Steps 16-18 (DPoP Proof for Credential Endpoint):** The Wallet Instance SHOULD create a new key pair to which the new credential SHALL be bound. Then, it creates a proof of possession with the new key and the *c_nonce* obtained in **Step 15** and it creates a DPoP proof for the request to the PID/(Q)EAA credential issuance endpoint. -**Step 19 (Credential Request):** The Wallet Instance sends a PID/(Q)EAA issuance request to the PID/(Q)EAA credential endpoint. It contains the *access token*, the *DPoP proof*, the *credential type*, the *proof* (proof of possession of the key) and the *format*. +**Step 19 (Credential Request):** The Wallet Instance sends a PID/(Q)EAA issuance request to the PID/(Q)EAA credential endpoint. It contains the *Access Token*, the *DPoP proof*, the *credential type*, the *proof* (proof of possession of the key) and the *format*. .. note:: @@ -293,7 +293,7 @@ Where the decoded content of the JWT is represented below: -**Steps 20-22 (Credential Response):** The PID/(Q)EAA Issuer checks the *DPoP proof* and whether the *access token* is valid and suitable for the requested PID/(Q)EAA. It also checks the proof of possession for the key material the new credential SHALL be bound to. If all checks succeed, the PID/(Q)EAA Issuer creates a new credential bound to the key material and sends it to the Wallet Instance. The Wallet Instance MUST perform the PID/(Q)EAA integrity and authenticity checks before proceeding with the secure storage of the credential. +**Steps 20-22 (Credential Response):** The PID/(Q)EAA Issuer checks the *DPoP proof* and whether the *Access Token* is valid and suitable for the requested PID/(Q)EAA. It also checks the proof of possession for the key material the new credential SHALL be bound to. If all checks succeed, the PID/(Q)EAA Issuer creates a new credential bound to the key material and sends it to the Wallet Instance. The Wallet Instance MUST perform the PID/(Q)EAA integrity and authenticity checks before proceeding with the secure storage of the credential. .. code-block:: http @@ -502,7 +502,7 @@ Token endpoint -------------- The token endpoint is used by the Wallet Instance -to obtain an access token by presenting its authorization grant, as +to obtain an Access Token by presenting its authorization grant, as defined in :rfc:`6749`. Token Request @@ -510,7 +510,7 @@ Token Request The request to the PID/(Q)EAA Token endpoint MUST be an HTTP request with method POST, where its body message is encoded in ``application/x-www-form-urlencoded`` format. The Wallet Instance sends the Token endpoint request with *private_key_jwt* authentication and a *DPoP proof* containing the mandatory parameters, defined in the table below. -The Token endpoint MUST accept and validate the DPoP proof sent in the DPoP HTTP header. The Token endpoint MUST validate the DPoP proof according to Section 4.3 of the DPoP specifications `[DPoP-draft16] `_. Thus, this mitigates the misuse of leaked or stolen access tokens at the credential endpoint. If the DPoP proof is invalid, the Token endpoint returns an error response, according to Section 5.2 of [:rfc:`6749`] with ``invalid_dpop_proof`` as the value of the error parameter. +The Token endpoint MUST accept and validate the DPoP proof sent in the DPoP HTTP header. The Token endpoint MUST validate the DPoP proof according to Section 4.3 of the DPoP specifications `[DPoP-draft16] `_. Thus, this mitigates the misuse of leaked or stolen Access Tokens at the credential endpoint. If the DPoP proof is invalid, the Token endpoint returns an error response, according to Section 5.2 of [:rfc:`6749`] with ``invalid_dpop_proof`` as the value of the error parameter. .. list-table:: @@ -641,7 +641,7 @@ A DPoP-bound Access Token is provided by the PID/(Q)EAA Token endpoint as a resu - It identifies the principal that is the subject of the JWT. It MUST be set to the value of the ``sub`` field in the PID/(Q)EAA SD-JWT-VC. - [:rfc:`9068`], [:rfc:`7519`] and [`OpenID.Core#SubjectIDTypes `_]. * - **client_id** - - MUST be set to the *jwk* value in the *cnf* parameter inside the Wallet Instance Attestation. + - It MUST be set to the *jwk* value in the *cnf* parameter, as taken in the Wallet Instance Attestation. - [:rfc:`9068`]. * - **aud** - It MUST match the value *client_id*. The RP MUST verify that this value matches its client ID. @@ -656,7 +656,7 @@ A DPoP-bound Access Token is provided by the PID/(Q)EAA Token endpoint as a resu - It MUST be a String in *uuid4* format. Unique Token ID identifier that the RP MAY use to prevent reuse by rejecting the Token ID if already processed. - [:rfc:`9068`], [:rfc:`7519`]. * - **jkt** - - JWK SHA-256 Thumbprint Confirmation Method. The value of the jkt member MUST be the base64url encoding (as defined in [RFC7515]) of the JWK SHA-256 Thumbprint of the DPoP public key (in JWK format) to which the access token is bound. + - JWK SHA-256 Thumbprint Confirmation Method. The value of the jkt member MUST be the base64url encoding (as defined in [RFC7515]) of the JWK SHA-256 Thumbprint of the DPoP public key (in JWK format) to which the Access Token is bound. - [`DPoP-draft16 `_. Section 6.1] and [:rfc:`7638`]. @@ -669,7 +669,7 @@ The Credential Endpoint issues a Credential as approved by the End-User upon pre Credential Request ^^^^^^^^^^^^^^^^^^^ -A Wallet Instance makes a PID/(Q)EAA Request to the PID/(Q)EAA Credential endpoint by sending the following mandatory parameters in the entity-body of an HTTP POST request using the `application/json` media type. +The Wallet Instance when requests the PID/(Q)EAA to the PID/(Q)EAA Credential endpoint, MUST use the following parameters in the entity-body of the HTTP POST request, using the `application/json` media type. The Credential endpoint MUST accept and validate the *DPoP proof* sent in the DPoP field of the Header based on the steps defined in Section 4.3 of [DPoP-draft16]. The *DPoP proof* in addition to the values that are defined in the Token Endpoint section MUST contain the following claim: - **ath**: hash of the Access Token. The value MUST be the result of a base64url encoding (as defined in Section 2 of :rfc:`7515`) the SHA-256 hash of the ASCII encoding of the associated Access Token's value. @@ -702,7 +702,7 @@ If the *DPoP proof* is invalid, the Credential endpoint returns an error respons .. note:: - If the **format** value is `mso_mdoc`, the credential request MUST contain the doctype claim which is a JSON string identifying the credential type according to `EIDAS-ARF`_ . See Appendix E.2. of `[OIDC4VCI. Draft 13] `_ for more details. + If the **format** value is `mso_mdoc`, the credential request MUST contain the ``doctype`` claim which is a JSON string identifying the credential type according to `EIDAS-ARF`_ . See Appendix E.2. of `[OIDC4VCI. Draft 13] `_ for more details. The JWT proof type MUST contain the following parameters for the JOSE header and the JWT body: @@ -821,7 +821,7 @@ Below a non-normative example of an Entity Configuration containing an `openid_c "credentials_supported": [ { "format": "vc+sd-jwt", - "id": "eu.eudiw.pid.it", + "id": "eudiw.pid.it", "cryptographic_binding_methods_supported": ["jwk"], "cryptographic_suites_supported": ["RS256", "RS512", "ES256", "ES512"], "display": [{ diff --git a/en/_sources/pid-eaa-mdoc-cbor.rst.txt b/en/_sources/pid-eaa-mdoc-cbor.rst.txt deleted file mode 100644 index d96df2fff..000000000 --- a/en/_sources/pid-eaa-mdoc-cbor.rst.txt +++ /dev/null @@ -1,57 +0,0 @@ -.. include:: ../common/common_definitions.rst - -.. _pid-eaa-mdoc-cbor.rst: - -pid-eaa-mdoc-cbor.rst -+++++++++++++++++++++++++++ - -[What is it] - -[What it is usefull for] - -[Example] - -General Properties ------------------- - -[TODO] - - -Requirements ------------- - - - req 1 - - req 2 - - -Attributes ----------- - -[Table with parameters/attributes] - -.. list-table:: - :widths: 20 60 - :header-rows: 1 - - * - **Claim** - - **Description** - * - key - - value - - -Implementation considerations ------------------------------ - -TODO - - -Libraries and code snippets ---------------------------- - -TODO - - -External references -------------------- - -TODO diff --git a/en/_sources/pid-eaa-sd-jwt.rst.txt b/en/_sources/pid-eaa-sd-jwt.rst.txt deleted file mode 100644 index b4daf4770..000000000 --- a/en/_sources/pid-eaa-sd-jwt.rst.txt +++ /dev/null @@ -1,57 +0,0 @@ -.. include:: ../common/common_definitions.rst - -.. _pid-eaa-sd-jwt.rst: - -pid-eaa-sd-jwt.rst -+++++++++++++++++++++++++++ - -[What is it] - -[What it is usefull for] - -[Example] - -General Properties ------------------- - -[TODO] - - -Requirements ------------- - - - req 1 - - req 2 - - -Attributes ----------- - -[Table with parameters/attributes] - -.. list-table:: - :widths: 20 60 - :header-rows: 1 - - * - **Claim** - - **Description** - * - key - - value - - -Implementation considerations ------------------------------ - -TODO - - -Libraries and code snippets ---------------------------- - -TODO - - -External references -------------------- - -TODO diff --git a/en/_sources/pid-issuance.rst.txt b/en/_sources/pid-issuance.rst.txt deleted file mode 100644 index 25f58de87..000000000 --- a/en/_sources/pid-issuance.rst.txt +++ /dev/null @@ -1,887 +0,0 @@ -.. include:: ../common/common_definitions.rst - -.. _pid_issuance.rst: - -PID Issuance -+++++++++++++ - -The relevant entities and interfaces involved in the issuance flow are: - - - *Wallet Provider*: It represents an organization (public or private) that is responsible for the release of an eIDAS-compliant EUDI Wallet Solution. It also issues thes Wallet Instance Attestation to its Wallet Instances by means of an Attestation Service. The Wallet Attestation certifies the genuinity and authenticity of the Wallet Instance and its compliance with a Trust Framework in compliance to the security and privacy requirements. - - *Wallet Solution*: It represents the entire product and service owned by a Wallet Provider, offered to all Users of that solution. A Wallet Solution must be certified as being EUDI-compliant by a Conformity Assessment Body (CAB). - - *Wallet Instance*: instance of a Wallet Solution, installed on User's device. It provides interfaces for User interaction with the Wallet Provider, Relying Parties, PID and (Q)EAA Providers. - - *PID Provider*: It represents the issuer of eIDAS Person Identification Data (PID). It is composed of: - - - OpenID4VCI Component: based on the “OpenID for Verifiable Credential Issuance” specification `[OIDC4VCI. Draft 13] `_ to release PID credentials. - - National eID Relying Party (OpenID Connect or SAML2): It represents the component to authenticate the End-User with the national Digital Identity Providers. - - National IdP: It represents preexisting identity systems based on SAML2 or OpenID Connect, already in production in each Member State (for Italy SPID and CIE id authentication schemed notified eIDAS with *LoA* **High**, see `SPID/CIE OpenID Connect Specifications `_). - -.. _fig_High-Level-Flow-EUDIW-PID-Issuing: -.. figure:: ../../images/High-Level-Flow-EUDIW-PID-Issuing.svg - :figwidth: 100% - :align: center - - PID Issuance - General architecture and high level flow - -The :numref:`fig_High-Level-Flow-EUDIW-PID-Issuing` shows a general architecture and highlights the main operations involved in the issuance of a PID, in particular: - - 0. **Wallet Instance Setup**: the first time the Wallet Instance is started a preliminary setup phase MUST be carried out. It consists of the release of a verifiable proof issued by the Attestation Service provided by the Wallet Provider that asserts the genuineness, the authenticity and the compliance with a trust framework of the Wallet Instance. The verifiable proof binds a public key corresponding to a local private key generated by the Wallet Instance. - 1. **Obtaining the trusted PID Provider**: the Wallet Instance queries the Trust Anchor to fetch the trusted PID Provider. - 2. **Obtaining of PID Provider metadata**: the Wallet Instance establishes the trust to the PID Provider according to the Trust Model, obtaining the Metadata that discloses the formats of the PID, the algorithms supported, and any other parameter required for interoperability needs. - 3. **PID request**: following the Authorization Code Flow in `[OIDC4VCI. Draft 13] `_ the Wallet Instance requests a PID to the PID Provider. A fresh key pairs is generated by the Wallet Instance, the public key is used by PID Provider for the key binding of the PID. - 4. **End-user authentication**: the PID Provider authenticates the End-User with LoA High, acting as an IAM Proxy to the National eID system. - 5. **PID issuance**: once the User authentication with LoA High happens, the User gives their consent, the PID Provider checks the Wallet Instance by means of the Wallet Attestation and the Trust Chain related to the Wallet Provider. Finally, the PID Provider releases a PID bound to the key material held by the requesting Wallet instance. - -The Wallet Instance Setup phase is described in Section [...]. In the following Section the steps from 1 to 5 are further expanded into more technical detailed steps. - -Detailed Flow -------------- - -The PID Issuance phase is based on the **Authorization Code Flow** with **Pushed Authorization Requests** (PAR) [:rfc:`9126`] and **PKCE** (Proof Key for Code Exchange, :rfc:`7636`) as recommended in `[OIDC4VCI. Draft 13. Section 3.4] `_. A *Wallet Initiated Flow* is considered and the User receives the PID directly in response to the Credential Request (*Immediate Flow*). - -.. _fig_Low-Level-Flow-EUDIW-PID-Issuing: -.. figure:: ../../images/Low-Level-Flow-EUDIW-PID-Issuing.svg - :figwidth: 100% - :align: center - :target: https://www.plantuml.com/plantuml/svg/bLHTJ-iu47tthnW1qb8frRuZBQ905wf5gwfRn6Fa9jDcrDJE-gEbzzVVSQm4ft1HB-AXySoSENEEntVMIUFyhXRIEwtyReL6Y8RFgA16AWSNhnRD1KWBNeYLVey7VrYmEyvgAgtm0YvVQ5Ev-zhZiFRUw4DVBeUnDrdNw62cc88giCqv25GbS1VnPUxSw3sL4GzM9pdpsUCmWGJ_7M1y2_u6zCf9Kd3KtW1d2WzZ3Xnku8XM2AEqGz1xD720oxVdsN8gOWL8gCawq6jO6cyTbf0s2dpROkuqlkK-XLPhCZjm5OB56Wj7Md7ri4fuxixDzNROEoEMSlRql7nQJAV_YXE9eAYms5h6bgvja682MGXwSAyszZVoeMoxIrLsyvEpi4CdI-baoXs26C3q3Kh7mFyyJ7cK4e5fqPhGn1mWpfbF5h30_psoBDS6RQELnTmT6yoWg0cLowdCslAygC88QeEdtpcpg3IdcOZKbqfhqGJQAM9o_DTLLAKJPU8SbxU3NeqWLPEorK3DLArFKaRGSzJy7iVIHadd3N9b2fpGX618wyHUrbIIEq9YXQ1uCtkXexwiT1GgzuOomFU6MFgSr2XUSYxnyWOcdbKrz2CswbrAR4bWHiBBjf9-kr0CXVRTqdZBtvAnk8gA27OWLm7E7YV_mJC_4-tqHPX9kMHkWZW3d71950WtA8EW8lRK3sVc9tTyWofuYV0urtFOul6NiSPeTd6jpN3JdDwY0gRUQE8PajLOSgHNBmwU0ALgRenKhhlYkkpserktizSX-5AImQ8pXk8eaKkgXYmAj3PloMTnXeYPN2R6pvLM1VO_ye_WbngkELO54LkP2YOJd9VrvpSbQi3_ZMRorWQlhcENQ4-I_xq3QP_UXiI5XpxwXHM93F5b71ZKL-ObhabHb9ZxxwJBOjOelVhTUtt_yZeL2zoGTNmgwphiVa9pRB3ceKeGf28Q0xTpHSVZglnfSA_ZJqZUXDxJPBB4s8xTHxUpRMHH-qSeYD4kYxVnLKlohDC6KtVlc9pVrJy1 - - PID Issuance - Detailed flow - -**Steps 1-4:** The User has selected a PID Provider, and the Wallet Instance obtains the metadata for the selected PID Provider. - -.. note:: - - **Federation Check:** The Wallet Instance needs to check if the PID Provider is part of Federation and then it can consume its Metadata. A non-normative example of a response from the endpoint **.well-known/openid-federation** with the **Entity Configuration** and the **Metadata** of the PID Provider is represented within the section `Entity Configuration Credential Issuer`_. - - -**Steps 5-6:** The Wallet Instance creates a PKCE code verifier that sends in a *pushed authorization request*, using the request parameter (see :rfc:`9126` Section 3) to the PID Provider authorization endpoint. The Wallet Instance signs the request using its private key. A OAuth2 client authentication method must be involved, since in this flow the pushed authorization endpoint is a protected endpoint. The client authentication should be based on the model defined in [:rfc:`7521`] using the Wallet Instance Attestation JWS inside the **client_assertion** parameter. The authorization_details [RAR :rfc:`9396`] parameter is extended to allow Wallet Instance to specify the types of the credentials when requesting authorization for the PID issuance. - -Below a non-normative example of the PAR. - -.. code-block:: http - - POST /as/par HTTP/1.1 - Host: pid-provider.example.org - Content-Type: application/x-www-form-urlencoded - - response_type=code - &client_id=$thumprint-of-the-jwk-in-the-cnf-wallet-attestation$ - &code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM - &code_challenge_method=S256 - &request=eyJhbGciOiJSUzI1NiIsImtpZCI6ImsyYmRjIn0.ew0KIC Jpc3MiOiAiczZCaGRSa3F0MyIsDQogImF1ZCI6ICJodHRwczovL3NlcnZlci5leGFtcGxlLmNvbSIsDQo gInJlc3BvbnNlX3R5cGUiOiAiY29kZSBpZF90b2tlbiIsDQogImNsaWVudF9pZCI6ICJzNkJoZFJrcXQz IiwNCiAicmVkaXJlY3RfdXJpIjogImh0dHBzOi8vY2xpZW50LmV4YW1... - &client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation - &client_assertion=$WalletInstanceAttestation$ - -The JWS header of request object is represented below: - -.. code-block:: JSON - - { - "alg": "ES256", - "kid": "FifYx03bnosD8m6gYQIfNHNP9cM_Sam9Tc5nLloIIrc", - } - - -The JWS payload of the request object is represented below: - -.. code-block:: JSON - - { - "response_type":"code", - "client_id":"$thumprint-of-the-jwk-in-the-cnf-wallet-attestation$", - "state":"fyZiOL9Lf2CeKuNT2JzxiLRDink0uPcd", - "code_challenge":"E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM", - "code_challenge_method":"S256", - "authorization_details":[ - { - "type":"openid_credential", - "format": "vc+sd-jwt", - "credential_definition": { - "type": ["eu.eudiw.pid.it"] - } - } - ], - "redirect_uri":"eudiw://start.wallet.example.org", - "client_assertion_type":"urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation", - -**Step 7:** The PID Provider creates a new request URI representing this new authorization request to be returned to the Wallet Instance. - } - - -.. note:: - - **Federation Check:** PID Provider MUST check that the Wallet Provider is part of the federation and in addition it MUST verify the Wallet Instance Attestation validity by checking its signature and data. - -**Step 7:** The PID Provider creates a new request URI representing a new authorization request and returns it to the Wallet Instance. A non-normative example of the authorization request is represented below: - -.. code-block:: http - - HTTP/1.1 201 Created - Cache-Control: no-cache, no-store - Content-Type: application/json - - { - "request_uri":"urn:ietf:params:oauth:request_uri:bwc4JK-ESC0w8acc191e-Y1LTC2", - "expires_in": 60 - } - - - -**Steps 8-9:** The Wallet Instance sends an authorization request to the PID Provider authorization endpoint. - -.. code-block:: http - - GET /authorize?client_id=$thumprint-of-the-jwk-in-the-cnf-wallet-attestation$&request_uri=urn%3Aietf%3Aparams%3Aoauth%3Arequest_uri%3Abwc4JK-ESC0w8acc191e-Y1LTC2 HTTP/1.1 - Host: pid-provider.example.org - - -.. note:: - - **User Authentication and Consent:** The PID Provider performs the User authentication based on the requirements of eIDAS LoA High and asks the User consent for the PID issuance. - -**Steps 10-11:** The PID Provider sends an authorization code to the Wallet Instance. - -.. note:: - - The Wallet Instance redirect URI is a universal or app link registered with the local operating system, so this latter will resolve it and pass the response to the Wallet Instance. - -.. code-block:: http - - HTTP/1.1 302 Found - Location: eudiw://start.wallet.example.org?code=SplxlOBeZQQYbYS6WxSbIA&state=fyZiOL9Lf2CeKuNT2JzxiLRDink0uPcd&iss=https%3A%2F%2Fpid-provider.example.org - - -**Step 14:** The Wallet Instance sends a token request to the PID Provider token endpoint using the authorization *code*, *code_verifier*, *DPoP proof* and *private_key_jwt*. - -.. code-block:: http - - POST /token HTTP/1.1 - Host: pid-provider.example.org - Content-Type: application/x-www-form-urlencoded - DPoP: eyJ0eXAiOiJkcG9wK2p3dCIsImFsZyI6IkVTMjU2IiwiandrIjp7Imt0eSI6Ik - VDIiwieCI6Imw4dEZyaHgtMzR0VjNoUklDUkRZOXpDa0RscEJoRjQyVVFVZldWQVdCR - nMiLCJ5IjoiOVZFNGpmX09rX282NHpiVFRsY3VOSmFqSG10NnY5VERWclUwQ2R2R1JE - QSIsImNydiI6IlAtMjU2In19.eyJqdGkiOiItQndDM0VTYzZhY2MybFRjIiwiaHRtIj - oiUE9TVCIsImh0dSI6Imh0dHBzOi8vc2VydmVyLmV4YW1wbGUuY29tL3Rva2VuIiwia - WF0IjoxNTYyMjYyNjE2fQ.2-GxA6T8lP4vfrg8v-FdWP0A0zdrj8igiMLvqRMUvwnQg - 4PtFLbdLXiOSsX0x7NVY-FNyJK70nfbV37xRZT3Lg - - client_id=$thumprint-of-the-jwk-in-the-cnf-wallet-attestation$ - &grant_type=authorization_code - &code=SplxlOBeZQQYbYS6WxSbIA - &redirect_uri=eudiw://start.wallet.example.org - &code_verifier=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk - &client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer - &client_assertion=eyJhbGciOiJIUzI1NiI - - -**Step 15:** The PID Provider validates the request and if it is successful, it issues an *access token* (bound to the DPoP key) and a fresh *c_nonce*. - -.. code-block:: http - - HTTP/1.1 200 OK - Content-Type: application/json - Cache-Control: no-store - - { - "access_token": "Kz~8mXK1EalYznwH-LC-1fBAo.4Ljp~zsPE_NeO.gxU", - "token_type": "DPoP", - "expires_in": 2677, - "c_nonce": "tZign[...]snFbp", - "c_nonce_expires_in": 86400 - } - - -**Steps 16-18:** The Wallet Instance creates a new key pair to which the new credential shall be bound. Then, it creates a proof of possession with the new key and the *c_nonce* obtained in **Step 15** and it creates a DPoP proof for the request to the PID credential issuance endpoint. - -**Step 19:** The Wallet Instance sends a PID issuance request to the PID Provider credential endpoint. It contains the *access token*, the *DPoP proof*, the *credential type*, the *proof* (proof of possession of the key) and the *format*. - -.. note:: - - **PID Credential Schema and Status registration:** The PID Provider MUST register all the issued PIDs for their later revocation, if needed. - -.. code-block:: http - - POST /credential HTTP/1.1 - Host: pid-provider.example.org - Content-Type: application/x-www-form-urlencoded - Authorization: DPoP Kz~8mXK1EalYznwH-LC-1fBAo.4Ljp~zsPE_NeO.gxU - DPoP: eyJ0eXAiOiJkcG9wK2p3dCIsImFsZyI6IkVTMjU2IiwiandrIjp7Imt0eSI6Ik - VDIiwieCI6Imw4dEZyaHgtMzR0VjNoUklDUkRZOXpDa0RscEJoRjQyVVFVZldWQVdCR - nMiLCJ5IjoiOVZFNGpmX09rX282NHpiVFRsY3VOSmFqSG10NnY5VERWclUwQ2R2R - 1JEQSIsImNydiI6IlAtMjU2In19.eyJqdGkiOiJlMWozVl9iS2ljOC1MQUVCIiwiaHRtIj - oiR0VUIiwiaHR1IjoiaHR0cHM6Ly9yZXNvdXJjZS5leGFtcGxlLm9yZy9wcm90ZWN0Z - WRyZXNvdXJjZSIsImlhdCI6MTU2MjI2MjYxOCwiYXRoIjoiZlVIeU8ycjJaM0RaNTNF - c05yV0JiMHhXWG9hTnk1OUlpS0NBcWtzbVFFbyJ9.2oW9RP35yRqzhrtNP86L-Ey71E - OptxRimPPToA1plemAgR6pxHF8y6-yqyVnmcw6Fy1dqd-jfxSYoMxhAJpLjA - - credential_definition=%7B%22type%22:%5B%22eu.eudiw.pid.it%22%5D%7D - &format=vc+sd-jwt - &proof=%7B%22proof_type%22:%22...-ace0-9c5210e16c32%22%7D - - - -A non-normative example of proof parameter is given below: - -.. code-block:: JSON - - { - "proof_type": "jwt", - "jwt": "eyJraWQiOiJkaWQ6ZXhhbXBsZTplYm …" - } - - -Where the decoded content of the JWT is represented below: - -.. code-block:: JSON - - { - "alg": "ES256", - "typ": "openid4vci-proof+jwt", - "kid": "dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw" - } - -.. code-block:: JSON - - { - "iss": "0b434530-e151-4c40-98b7-74c75a5ef760", - "aud": "https://pid-provider.example.org", - "iat": 1504699136, - "nonce": "tZign...snFbp" - } - - - -**Steps 20-22:** The PID Provider checks the *DPoP proof* and whether the *access token* is valid and suitable for the requested PID. It also checks the proof of possession for the key material the new credential shall be bound to. If all checks succeed, the PID Provider creates a new credential bound to the key material and sends it to the Wallet Instance. The Wallet Instance MUST perform the PID integrity and authenticity checks and if it is successful can proceed with secure storage of the PID credential. - -.. code-block:: http - - HTTP/1.1 200 OK - Content-Type: application/json - Cache-Control: no-store - Pragma: no-cache - - { - "format": "vc+sd-jwt" - "credential" : "LUpixVCWJk0eOt4CXQe1NXK[...]WZwmhmn9OQp6YxX0a2L", - "c_nonce": "fGFF7[...]UkhLa", - "c_nonce_expires_in": 86400 - } - -Pushed Authorization Request Endpoint -------------------------------------- - -Pushed Authorization Request (PAR) Request -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -The requests to the PID Provider authorization endpoint MUST be HTTP with method POST, with the following mandatory parameters in the HTTP request message body, encoded in ``application/x-www-form-urlencoded`` format. - -.. _table_http_request_claim: -.. list-table:: PAR http request parameters - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **response_type** - - MUST be set to ``code``. - - :rfc:`6749` - * - **client_id** - - MUST be set to the thumbprint of the ``jwk`` value in the ``cnf`` parameter inside the Wallet Instance Attestation. - - :rfc:`6749` - * - **code_challenge** - - A challenge derived from the **code verifier** that is sent in the authorization request - - :rfc:`7636#section-4.2`. - * - **code_challenge_method** - - A method that was used to derive **code challenge**. It MUST be set to ``S256``. - - :rfc:`7636#section-4.3`. - * - **request** - - It MUST be a signed JWT. The private key corresponding to the public one in the ``cnf`` parameter inside the Wallet Instance Attestation MUST be used for signing the request object. - - `OpenID Connect Core. Section 6 `_ - * - **client_assertion_type** - - It MUST be set to ``urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation``. - - `Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants `_ - * - **client_assertion** - - It MUST be the Wallet Instance Attestation signed JWT. - - `Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants `_ - -The JWT Request Object has the following JOSE header parameters: - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **JOSE header** - - **Description** - - **Reference** - * - **alg** - - A digital signature algorithm identifier such as per IANA "JSON Web Signature and Encryption Algorithms" registry. It MUST be one of the supported algorithms in Section `Cryptographic Algorithms `_ and MUST NOT be none or an identifier for a symmetric algorithm (MAC). - - :rfc:`7516#section-4.1.1`. - * - **kid** - - Unique identifier of the JWK as base64url-encoded JWK Thumbprint value. - - :rfc:`7638#section_3`. - -.. note:: - The parameter **typ**, if omitted, assumes the implicit value **JWT**. - - -The JWT payload is given by the following parameters: - -.. _table_jwt_request: -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **response_type** - - It MUST be set as in the :ref:`Table of the HTTP parameters `. - - See :ref:`Table of the HTTP parameters `. - * - **client_id** - - It MUST be set as in the :ref:`Table of the HTTP parameters `. - - See :ref:`Table of the HTTP parameters `. - * - **state** - - Unique session identifier at the client side. This value will be returned to the client in the response, at the end of the authentication. It MUST be a random string with at least 32 alphanumeric characters. - - See `OpenID.Core#AuthRequest `_. - * - **code_challenge** - - It MUST be set as in the :ref:`Table of the HTTP parameters `. - - See :ref:`Table of the HTTP parameters `. - * - **code_challenge_method** - - It MUST be set as in the :ref:`Table of the HTTP parameters `. - - See :ref:`Table of the HTTP parameters `. - * - **authorization_details** - - JSON Object. It MUST include the following claims: - - - **type**: it MUST be set to ``openid_credential``, - - **format**: it MUST be set to ``vc+sd-jwt``, - - **credential_definition**: JSON Object. It MUST have the **type** claim which MUST be set to ``eu.eudiw.pid.it`` - - See [RAR :rfc:`9396`] and `[OIDC4VCI. Draft 13] `_. - * - **redirect_uri** - - Redirection URI to which the response will be sent. It MUST be an universal or app link registered with the local operating system, so this latter will resolve it and pass the response to the Wallet Instance. - - See `OpenID.Core#AuthRequest `_. - * - **client_assertion_type** - - It MUST be set as in the :ref:`Table of the HTTP parameters `. - - See :ref:`Table of the HTTP parameters `. - * - **client_assertion** - - It MUST be set as in the :ref:`Table of the HTTP parameters `. - - See :ref:`Table of the HTTP parameters `. - - -Pushed Authorization Request (PAR) Response -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -If the verification is successful, the PID Provider MUST provide the response with a *201 HTTP status code*. The following parameters are included as top-level members in the HTTP response message body, using the ``application/json`` media type as defined in [:rfc:`8259`]. - -.. _table_http_response_claim: -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **request_uri** - - The request URI corresponding to the authorization request posted. This URI MUST be a single-use reference to the respective authorization request. It MUST contain some part generated using a cryptographically strong pseudorandom algorithm. The value format MUST be ``urn:ietf:params:oauth:request_uri:`` with ```` as the random part of the URI that references the respective authorization request data. - - [:rfc:`9126`]. - * - **expires_in** - - A JSON number that represents the lifetime of the request URI in seconds as a positive integer. - - [:rfc:`9126`]. - - -Authorization endpoint ----------------------- - -The authorization endpoint is used to interact with the Credential Issuer and obtain an authorization grant. -The authorization server MUST first verify the identity of the resource owner (the User that own it's credentials) -as defined in the :rfc:`6749`. - -Authorization Request -^^^^^^^^^^^^^^^^^^^^^^^ - -The Authorization request is issued by the Wallet Instance Browser, HTTP **POST** or **GET** methods MAY be used. When the method **POST** is used, the parameters MUST be sent using the *Form Serialization*. When the method **GET** is used, the parameters MUST be sent using the *Query String Serialization*. For more details see `OpenID.Core#Serializations `_. - -The mandatory parameters in the HTTP authentication request are specified in the following table. - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **client_id** - - It MUST be set as in the :ref:`Table of the HTTP parameters `. - - See :ref:`Table of the HTTP parameters `. - * - **request_uri** - - It MUST be set to the same value as obtained by PAR Response. See :ref:`Table of the HTTP PAR Response parameters `. - - [:rfc:`9126`]. - - -Authorization Response -^^^^^^^^^^^^^^^^^^^^^^^ - -The authentication response is returned by the PID Provider authorization endpoint at the end of the authentication flow. - -If the authentication is successful the PID Provider redirects the User by adding the following query parameters as required to the *redirect_uri*. The redirect URI MUST be an universal or app link registered with the local operating system, so this latter is able to resolve its value and delegates the Wallet Instance for the processing. - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **code** - - Unique *Authorization Code* that the client submits to the Token Endpoint. - - [:rfc:`6749#section-4.1.2`], `Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants `_ - * - **state** - - The client MUST check the correspondence with the state value in the request object. It is defined as in the :ref:`Table of the JWT Request parameters `. - - [:rfc:`6749#section-4.1.2`]. - * - **iss** - - Unique identifier of the PID PRovider who created the Authentication Response. The Wallet Instance MUST validate this parameter. - - `OAuth 2.0 Authorization Server Issuer Identifier in Authorization Response `_, `[RFC7519, Section 4.1.1] `_. - - - -Token endpoint --------------- - -The token endpoint is used by the Wallet Instance -to obtain an access token by presenting its authorization grant, as -defined in :rfc:`6749`. - -Token Request -^^^^^^^^^^^^^^^ - -The request to the PID Provider Token endpoint MUST be an HTTP request with method POST, where its body message is encoded in ``application/x-www-form-urlencoded`` format. The Wallet Instance sends the Token endpoint request with *private_key_jwt* authentication and a *DPoP proof* containing the mandatory parameters, defined in the table below. - -The Token endpoint MUST accept and validate the DPoP proof sent in the DPoP HTTP header. The Token endpoint MUST validate the DPoP proof based on the steps defined in Section 4.3 of the DPoP specifications `[DPoP-draft16] `_. Thus, this mitigates the misuse of leaked or stolen access tokens at the credential endpoint. If the DPoP proof is invalid, the Token endpoint returns an error response, according to Section 5.2 of [:rfc:`6749`] with ``invalid_dpop_proof`` as the value of the error parameter. - - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **client_id** - - It MUST be set as in the :ref:`Table of the HTTP parameters `. - - See :ref:`Table of the HTTP parameters `. - * - **grant_type** - - It MUST be set to ``authorization_code``. - - `Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants `_. - * - **code** - - Authorization code returned in the Authentication Response. - - `Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants `_. - * - **redirect_uri** - - It MUST be set as in the request object :ref:`Table of the JWT Request parameters `. - - `Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants `_. - * - **code_verifier** - - Verification code of the **code_challenge**. - - `Proof Key for Code Exchange by OAuth Public Clients `_. - * - **client_assertion_type** - - It MUST be set to ``urn:ietf:params:oauth:client-assertion-type:jwt-bearer``. - - `Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants `_. - * - **client_assertion** - - JWT signed with the Wallet Instance private key containing the following parameters: - - - **iss**: This MUST contain the client_id. - - **sub**: This MUST contain the iss. - - **aud**: URL of the PID Provider Token Endpoint. - - **iat**: UNIX Timestamp with the time of the JWT issuance, coded as NumericDate as indicated in RFC 7519. - - **exp**: UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in RFC 7519. - - **jti**: Unique Identifier for this authentication request, generated by the client. E.g., uuid4 format. - - `Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants `_. - -A **DPoP proof** is included in an HTTP request using the ``DPoP`` header parameter containing a DPoP JWS. - -The JOSE header of a **DPoP JWT** MUST contain at least the following parameters: - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **JOSE header** - - **Description** - - **Reference** - * - **typ** - - It MUST be equal to ``dpop+jwt``. - - [:rfc:`7515`] and [:rfc:`8725`. Section 3.11]. - * - **alg** - - A digital signature algorithm identifier such as per IANA "JSON Web Signature and Encryption Algorithms" registry. It MUST be one of the supported algorithms in Section :ref:`Cryptographic Algorithms ` and MUST NOT be none or an identifier for a symmetric algorithm (MAC). - - [:rfc:`7515`]. - * - **jwk** - - representing the public key chosen by the client, in JSON Web Key (JWK) [RFC7517] format, as defined in Section 4.1.3 of [RFC7515]. It MUST NOT contain a private key. - - [:rfc:`7517`] and [:rfc:`7515`]. - - -The payload of a **DPoP proof** MUST contain at least the following claims: - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **jti** - - Unique identifier for the DPoP proof JWT. The value MUST be assigned in a *UUID v4* string format according to [:rfc:`4122`]. - - [:rfc:`7519`. Section 4.1.7]. - * - **htm** - - The value of the HTTP method of the request to which the JWT is attached. - - [:rfc:`9110`. Section 9.1]. - * - **htu** - - The HTTP target URI, without query and fragment parts, of the request to which the JWT is attached. - - [:rfc:`9110`. Section 7.1]. - * - **iat** - - UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in :rfc:`7519`. - - [:rfc:`7519`. Section 4.1.6]. - - -Token Response -^^^^^^^^^^^^^^^ - -Token endpoint response MUST contain the following mandatory claims. - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **access_token** - - The *DPoP-bound Access Token*, in signed JWT format, allows accessing the Credential Endpoint for obtaining the PID. - - :rfc:`6749`. - * - **token_type** - - Type of *Access Token* returned. It MUST be equal to ``DPoP``. - - :rfc:`6749`. - * - **expires_in** - - Expiry time of the *Access Token* in seconds. - - :rfc:`6749`. - * - **c_nonce** - - JSON string containing a nonce to be used to create a *proof of possession* of key material when requesting a Credential. - - `[OIDC4VCI. Draft 13] `_. - * - **c_nonce_expires_in** - - JSON integer, it represents the lifetime in seconds of the **c_nonce**. - - `[OIDC4VCI. Draft 13] `_. - -Access Token -^^^^^^^^^^^^ - -A DPoP-bound Access Token is provided by the PID Provider Token endpoint as a result of a successful token request. The Access Token is encoded in JWT format, according to [:rfc:`7519`]. The Access Token MUST have at least the following mandatory claims and it MUST be bound to the public key that is provided by the DPoP proof. This binding can be accomplished based on the methodology defined in Section 6 of `[DPoP-draft16] `_. - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **iss** - - It MUST be an HTTPS URL that uniquely identifies the PID Provider. The client MUST verify that this value matches the PID Provider where it has requested the credential. - - [:rfc:`9068`], `[RFC7519, Section 4.1.1] `_. - * - **sub** - - It identifies the subject of the JWT. It MUST be of type *pairwise*. - - [:rfc:`9068`], [:rfc:`7519`] and [`OpenID.Core#SubjectIDTypes `_]. - * - **client_id** - - It MUST contain a HTTPS URL that uniquely identifies the RP. - - [:rfc:`9068`]. - * - **aud** - - It MUST match the value *client_id*. The RP MUST verify that this value matches its client ID. - - [:rfc:`9068`]. - * - **iat** - - UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in :rfc:`7519`. - - [:rfc:`9068`], [:rfc:`7519`. Section 4.1.6]. - * - **exp** - - UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in :rfc:`7519`. - - [:rfc:`9068`], [:rfc:`7519`]. - * - **jti** - - It MUST be a String in *uuid4* format. Unique Token ID identifier that the RP MAY use to prevent reuse by rejecting the Token ID if already processed. - - [:rfc:`9068`], [:rfc:`7519`]. - * - **nonce** - - It MUST be a random string of at least 32 alphanumeric characters. The value type of this claim MUST be a string, where the value is a **c_nonce** provided by the PID Provider. - - [`OpenID.Core#AuthRequest `_]. - * - **jkt** - - JWK SHA-256 Thumbprint Confirmation Method. The value of the jkt member MUST be the base64url encoding (as defined in [RFC7515]) of the JWK SHA-256 Thumbprint of the DPoP public key (in JWK format) to which the access token is bound. - - [`DPoP-draft16 `_. Section 6.1] and [:rfc:`7638`]. - - - -Credential endpoint -------------------- - -The Credential Endpoint issues a Credential as approved by the End-User upon presentation of a valid Access Token representing this approval, as defined in `OPENID4VCI`_. - -Credential Request -^^^^^^^^^^^^^^^^^^^ - -The Wallet Instance may request a PID to the PID Provider Credential endpoint with a HTTP POST request encoded in *application/json* format, where the following parameters in the message body MUST be present. - -The Credential endpoint MUST accept and validate the DPoP proof sent in the DPoP HTTP header based on the steps defined in Section 4.3 of `[DPoP-draft16] `_. If the DPoP proof is invalid, the Credential endpoint returns an error response per Section 5.2 of [:rfc:`6749`] with `invalid_dpop_proof` as the value of the error parameter. - -.. warning:: - The Wallet Instance MUST create a **new DPoP proof** for the Credential request and MUST NOT use the previously created proof for the Token Endpoint. - - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **credential_definition** - - JSON object containing the detailed description of the credential type. It MUST have at least the **type** sub claims which is a JSON array containing the type values the Wallet shall request in the subsequent Credential Request. It MUST be `eu.eudiw.pid.it`. - - `[OIDC4VCI. Draft 13] `_. - * - **format** - - Format of the Credential to be issued. This MUST be `vc+sd-jwt`. - - `[OIDC4VCI. Draft 13] `_. - * - **proof** - - JSON object containing proof of possession of the key material the issued Credential shall be bound to. The proof object MUST contain the following mandatory claims: - - - **proof_type**: JSON string denoting the proof type. It MUST be `jwt`. - - **jwt**: the JWT used as proof of possession. - - `[OIDC4VCI. Draft 13] `_. - -.. note:: - - If the **format** value is `mso_mdoc`, the credential request MUST contain the doctype claim which is a JSON string identifying the PID type according to `EIDAS-ARF`_ . See Appendix E.2. of `[OIDC4VCI. Draft 13] `_ for more details. - - -The JWT proof type MUST contain the following parameters for the JOSE header and the JWT body: - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **JOSE Header** - - **Description** - - **Reference** - * - **alg** - - A digital signature algorithm identifier such as per IANA "JSON Web Signature and Encryption Algorithms" registry. It MUST be one of the supported algorithms in Section :ref:`Cryptographic Algorithms ` and MUST NOT be ``none`` or an identifier for a symmetric algorithm (MAC). - - `[OIDC4VCI. Draft 13] `_, [:rfc:`7515`], [:rfc:`7517`]. - * - **typ** - - MUST be `openid4vci-proof+jwt`. - - `[OIDC4VCI. Draft 13] `_, [:rfc:`7515`], [:rfc:`7517`]. - * - **kid** - - It MUST contain the identifier of the key material the PID shall be bound to. - - `[OIDC4VCI. Draft 13] `_, [:rfc:`7515`], [:rfc:`7517`]. - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **iss** - - The value of this claim MUST be the **client_id** of the Wallet Instance. - - `[OIDC4VCI. Draft 13] `_, `[RFC7519, Section 4.1.1] `_. - * - **aud** - - The value of this claim MUST be the identifier URL of the PID Provider. - - `[OIDC4VCI. Draft 13] `_. - * - **iat** - - UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in :rfc:`7519`. - - `[OIDC4VCI. Draft 13] `_, [:rfc:`7519`. Section 4.1.6]. - * - **nonce** - - The value type of this claim MUST be a string, where the value is a **c_nonce** provided by the PID Provider in the Token response. - - `[OIDC4VCI. Draft 13] `_. - - - -Credential Response -^^^^^^^^^^^^^^^^^^^^ - -Credential Response to the Wallet Instance MUST be sent using `application/json` media type. The response MUST contain the following mandatory claims: - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **format** - - Format of the Credential to be issued. This MUST be `vc+sd-jwt`. - - `[OIDC4VCI. Draft 13] `_. - * - **credential** - - Contains the issued PID. It MUST be an SD-JWT JSON Object (see Section :ref:`PID Data Model `). - - Appendix E in `[OIDC4VCI. Draft 13] `_. - * - **c_nonce** - - JSON string containing a nonce to be used to create a *proof of possession* of key material when requesting a further credential or for renewal credential. - - `[OIDC4VCI. Draft 13] `_. - * - **c_nonce_expires_in** - - JSON integer corresponding to the **c_nonce** lifetime in seconds. - - `[OIDC4VCI. Draft 13] `_. - -.. note:: - - If the **format** value is `mso_mdoc`, the **credential** value MUST be a base64url-encoded JSON string according to Appendix E of `[OIDC4VCI. Draft 13] `_. - - -.. _Entity Configuration Credential Issuer: - -Entity Configuration Credential Issuer -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -Below a non-normative example of an Entity Configuration containing an `openid_credential_issuer` metadata. - -.. code-block:: http - - HTTP/1.1 200 OK - Content-Type: application/entity-statement+jwt - - { - - "alg": "RS256", - "kid": "FANFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs", - "typ": "entity-statement+jwt" - - } - . - { - "exp": "1649610249", - "iat": "1649437449", - "iss": "https://pid-provider.example.org", - "sub": "https://pid-provider.example.org", - "jwks": { - "keys": [{ - "kty": "RSA", - "use": "sig", - "n": "1Ta-sE …", - "e": "AQAB", - "kid": "FANFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs" - }] - }, - "metadata": { - "openid_credential_issuer": { - "credential_issuer": "https://pid-provider.example.org", - "authorization_endpoint": "https://pid-provider.example.org/connect/authorize", - "token_endpoint": "https://pid-provider.example.org/connect/token", - "pushed_authorization_request_endpoint": "https://pid-provider.example.org/connect/par", - "dpop_signing_alg_values_supported": ["RS256", "RS512", "ES256", "ES512"], - "credential_endpoint": "https://pid-provider.example.org/credential", - "credentials_supported": { - "eu.eudiw.pid.it": { - "format": "vc+sd-jwt", - "cryptographic_binding_methods_supported": ["jwk"], - "cryptographic_suites_supported": ["RS256", "RS512", "ES256", "ES512"], - "display": [{ - "name": "PID Provider Italiano di esempio", - "locale": "it-IT", - "logo": { - "url": "https://pid-provider example.org/public/logo.svg", - "alt_text": "logo di questo PID Provider" - }, - "background_color": "#12107c", - "text_color": "#FFFFFF" - }, - { - "name": "Example Italian PID Provider", - "locale": "en-US", - "logo": { - "url": "https://pid-provider.example.org/public/logo.svg", - "alt_text": "The logo of this PID Provider" - }, - "background_color": "#12107c", - "text_color": "#FFFFFF" - } - ], - "credential_definition": { - "type": ["PIDCredential"], - "credentialSubject": { - "given_name": { - "mandatory": true, - "display": [{ - "name": "Current First Name", - "locale": "en-US" - }, - { - "name": "Nome", - "locale": "it-IT" - } - ] - }, - "family_name": { - "mandatory": true, - "display": [{ - "name": "Current Family Name", - "locale": "en-US" - }, - { - "name": "Cognome", - "locale": "it-IT" - } - ] - }, - "birthdate": { - "mandatory": true, - "display": [{ - "name": "Date of Birth", - "locale": "en-US" - }, - { - "name": "Data di Nascita", - "locale": "it-IT" - } - ] - }, - "place_of_birth": { - "mandatory": true, - "display": [{ - "name": "Place of Birth", - "locale": "en-US" - }, - { - "name": "Luogo di Nascita", - "locale": "it-IT" - } - ] - }, - "unique_id": { - "mandatory": true, - "display": [{ - "name": "Unique Identifier", - "locale": "en-US" - }, - { - "name": "Identificativo univoco", - "locale": "it-IT" - } - ] - }, - "tax_id_number": { - "mandatory": true, - "display": [{ - "name": "Tax Id Number", - "locale": "en-US" - }, - { - "name": "Codice Fiscale", - "locale": "it-IT" - } - ] - } - } - } - } - } - }, - - "federation_entity": { - "organization_name": "Pid Provider Organization Example", - "homepage_uri": "https://pid-provider.example.org", - "policy_uri": "https://pid-provider.example.org/privacy_policy", - "tos_uri": "https://pid-provider.example.org/info_policy", - "logo_uri": "https://pid-provider.example.org/logo.svg" - }, - - "openid_relying_party": { - - } - } - } diff --git a/en/_sources/pid-issuing.rst.txt b/en/_sources/pid-issuing.rst.txt deleted file mode 100644 index b48cb4a1b..000000000 --- a/en/_sources/pid-issuing.rst.txt +++ /dev/null @@ -1,877 +0,0 @@ -.. include:: ../common/common_definitions.rst - -.. _pid_issuing.rst: - -PID Issuing -+++++++++++ - -The relevant entities and interfaces involved in the issuing flows are: - - - *Wallet Provider*: It represents an organization (public or private) that is responsible for the release of an eIDAS-compliant EUDI Wallet Solution. It also issues thes Wallet Instance Attestation to its Wallet Instances by means of an Attestation Service. The Wallet Attestation certifies the genuinity and authenticity of the Wallet Instance and its compliance with a Trust Framework in compliance to the security and privacy requirements. - - *Wallet Solution*: It represents the entire product and service owned by a Wallet Provider, offered to all Users of that solution. A Wallet Solution must be certified as being EUDI-compliant by a Conformity Assessment Body (CAB). - - *Wallet Instance*: instance of a Wallet Solution, installed on User's device. It provides interfaces for User interaction with the Wallet Provider, Relying Parties, PID and (Q)EAA Providers. - - *PID Provider*: It represents the issuer of eIDAS Person Identification Data (PID). It is composed of: - - - OpenID4VCI Component: based on the “OpenID for Verifiable Credential Issuance” specification `[OIDC4VCI. Draft 13] `_ to release PID credentials. - - National eID Relying Party (OpenID Connect or SAML2): It represents the component to authenticate the End-User with the national Digital Identity Providers. - - National IdP: It represents preexisting identity systems based on SAML2 or OpenID Connect, already in production in each Member State (for Italy SPID and CIE id authentication schemed notified eIDAS with *LoA* **High**, see `SPID/CIE OpenID Connect Specifications `_). - -.. _fig_High-Level-Flow-EUDIW-PID-Issuing: -.. figure:: ../../images/High-Level-Flow-EUDIW-PID-Issuing.svg - :figwidth: 100% - :align: center - - PID Issuing - General architecture and high level flow - -The :numref:`fig_High-Level-Flow-EUDIW-PID-Issuing` shows a general architecture and highlights the main operations involved in the issuing of a PID, in particular: - - 0. **Wallet Instance Setup**: the first time the Wallet Instance is started a preliminary setup phase MUST be carried out. It consists of the release of a verifiable proof issued by the Attestation Service provided by the Wallet Provider that asserts the genuineness, the authenticity and the compliance with a trust framework of the Wallet Instance. The verifiable proof binds a public key corresponding to a local private key generated by the Wallet Instance. - 1. **Obtaining the trusted PID Provider**: the Wallet Instance queries the Trust Anchor to fetch the trusted PID Provider. - 2. **Obtaining of PID Provider metadata**: the Wallet Instance establishes the trust to the PID Provider according to the Trust Model, obtaining the Metadata that discloses the formats of the PID, the algorithms supported, and any other parameter required for interoperability needs. - 3. **PID request**: following the Authorization Code Flow in `[OIDC4VCI. Draft 13] `_ the Wallet Instance requests a PID to the PID Provider. A fresh key pairs is generated by the Wallet Instance, the public key is used by PID Provider for the key binding of the PID. - 4. **End-user authentication**: the PID Provider authenticates the End-User with LoA High, acting as an IAM Proxy to the National eID system. - 5. **PID issuance**: once the User authentication with LoA High happens, the User gives their consent, the PID Provider checks the Wallet Instance by means of the Wallet Attestation and the Trust Chain related to the Wallet Provider. Finally, the PID Provider releases a PID bound to the key material held by the requesting Wallet instance. - -The Wallet Instance Setup phase is described in Section [...]. In the following Section the steps from 1 to 5 are further expanded into more technical detailed steps. - -Detailed Flow -------------- - -The PID Issuing phase is based on the **Authorization Code Flow** with **Pushed Authorization Requests** (PAR) [:rfc:`9126`] and **PKCE** (Proof Key for Code Exchange, :rfc:`7636`) as recommended in `[OIDC4VCI. Draft 13. Section 3.4] `_. A *Wallet Initiated Flow* is considered and the User receives the PID directly in response to the Credential Request (*Immediate Flow*). - -.. _fig_Low-Level-Flow-EUDIW-PID-Issuing: -.. figure:: ../../images/Low-Level-Flow-EUDIW-PID-Issuing.svg - :figwidth: 100% - :align: center - :target: https://www.plantuml.com/plantuml/svg/bLHTJ-iu47tthnW1qb8frRuZBQ905wf5gwfRn6Fa9jDcrDJE-gEbzzVVSQm4ft1HB-AXySoSENEEntVMIUFyhXRIEwtyReL6Y8RFgA16AWSNhnRD1KWBNeYLVey7VrYmEyvgAgtm0YvVQ5Ev-zhZiFRUw4DVBeUnDrdNw62cc88giCqv25GbS1VnPUxSw3sL4GzM9pdpsUCmWGJ_7M1y2_u6zCf9Kd3KtW1d2WzZ3Xnku8XM2AEqGz1xD720oxVdsN8gOWL8gCawq6jO6cyTbf0s2dpROkuqlkK-XLPhCZjm5OB56Wj7Md7ri4fuxixDzNROEoEMSlRql7nQJAV_YXE9eAYms5h6bgvja682MGXwSAyszZVoeMoxIrLsyvEpi4CdI-baoXs26C3q3Kh7mFyyJ7cK4e5fqPhGn1mWpfbF5h30_psoBDS6RQELnTmT6yoWg0cLowdCslAygC88QeEdtpcpg3IdcOZKbqfhqGJQAM9o_DTLLAKJPU8SbxU3NeqWLPEorK3DLArFKaRGSzJy7iVIHadd3N9b2fpGX618wyHUrbIIEq9YXQ1uCtkXexwiT1GgzuOomFU6MFgSr2XUSYxnyWOcdbKrz2CswbrAR4bWHiBBjf9-kr0CXVRTqdZBtvAnk8gA27OWLm7E7YV_mJC_4-tqHPX9kMHkWZW3d71950WtA8EW8lRK3sVc9tTyWofuYV0urtFOul6NiSPeTd6jpN3JdDwY0gRUQE8PajLOSgHNBmwU0ALgRenKhhlYkkpserktizSX-5AImQ8pXk8eaKkgXYmAj3PloMTnXeYPN2R6pvLM1VO_ye_WbngkELO54LkP2YOJd9VrvpSbQi3_ZMRorWQlhcENQ4-I_xq3QP_UXiI5XpxwXHM93F5b71ZKL-ObhabHb9ZxxwJBOjOelVhTUtt_yZeL2zoGTNmgwphiVa9pRB3ceKeGf28Q0xTpHSVZglnfSA_ZJqZUXDxJPBB4s8xTHxUpRMHH-qSeYD4kYxVnLKlohDC6KtVlc9pVrJy1 - - PID Issuing - Detailed flow - -**Steps 1-4:** The User has selected a PID Provider, and the Wallet Instance obtains the metadata for the selected PID Provider. - -.. note:: - - **Federation Check:** The Wallet Instance needs to check if the PID Provider is part of Federation and then it can consume its Metadata. A non-normative example of a response from the endpoint **.well-known/openid-federation** with the **Entity Configuration** and the **Metadata** of the PID Provider is represented withing the section `Entity Configuration Credential Issuer `_. - - -**Steps 5-6:** The Wallet Instance creates a fresh PKCE code verifier that sends in a *pushed authorization request*, using the request parameter (see :rfc:`9126` Section 3) to the PID Provider authorization endpoint. The Wallet Instance signs its request using its attested private key. A standard OAuth2 client authentication method must be involved, since in this flow the pushed authorization endpoint is a protected endpoint. The client authentication can be based on the model defined in [:rfc:`7521`] using the Wallet Instance Attestation JWS inside the **client_assertion** parameter. The authorization_details [RAR :rfc:`9396`] parameter is extended to allow Wallet Instance to specify types of the credentials when requesting authorization for the PID issuance. - -Below a non-normative example of the PAR. - -.. code-block:: http - - POST /as/par HTTP/1.1 - Host: pid-provider.example.org - Content-Type: application/x-www-form-urlencoded - - response_type=code - &client_id=$thumprint-of-the-jwk-in-the-cnf-wallet-attestation$ - &code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM - &code_challenge_method=S256 - &request=eyJhbGciOiJSUzI1NiIsImtpZCI6ImsyYmRjIn0.ew0KIC Jpc3MiOiAiczZCaGRSa3F0MyIsDQogImF1ZCI6ICJodHRwczovL3NlcnZlci5leGFtcGxlLmNvbSIsDQo gInJlc3BvbnNlX3R5cGUiOiAiY29kZSBpZF90b2tlbiIsDQogImNsaWVudF9pZCI6ICJzNkJoZFJrcXQz IiwNCiAicmVkaXJlY3RfdXJpIjogImh0dHBzOi8vY2xpZW50LmV4YW1... - &client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation - &client_assertion=$WalletInstanceAttestation$ - -The JWS header of request object is represented below: - -.. code-block:: JSON - - { - "alg": "ES256", - "kid": "FifYx03bnosD8m6gYQIfNHNP9cM_Sam9Tc5nLloIIrc", - } - - -The JWS payload of the request object is represented below: - -.. code-block:: JSON - - { - "response_type":"code", - "client_id":"$thumprint-of-the-jwk-in-the-cnf-wallet-attestation$", - "state":"fyZiOL9Lf2CeKuNT2JzxiLRDink0uPcd", - "code_challenge":"E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM", - "code_challenge_method":"S256", - "authorization_details":[ - { - "type":"openid_credential", - "format": "vc+sd-jwt", - "credential_definition": { - "type": ["eu.eudiw.pid.it"] - } - } - ], - "redirect_uri":"eudiw://start.wallet.example.org", - "client_assertion_type":"urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation", - -**Step 7:** The PID Provider creates a new request URI representing this new authorization request to be returned to the Wallet Instance. - } - - -.. note:: - **Federation Check:** PID Provider MUST check that the Wallet Provider is part of the federation and in addition it MUST verify Wallet Instance Attestation validity by checking its signature and the claims inside it. - -**Step 7:** The PID Provider creates a new request URI representing a new authorization request and returns it to the Wallet Instance. A non-normative example of the authorization request is represented below: - -.. code-block:: http - - HTTP/1.1 201 Created - Cache-Control: no-cache, no-store - Content-Type: application/json - - { - "request_uri":"urn:ietf:params:oauth:request_uri:bwc4JK-ESC0w8acc191e-Y1LTC2", - "expires_in": 60 - } - - - -**Steps 8-9:** The Wallet Instance sends an authorization request to the PID Provider authorization endpoint. - -.. code-block:: http - - GET /authorize?client_id=$thumprint-of-the-jwk-in-the-cnf-wallet-attestation$&request_uri=urn%3Aietf%3Aparams%3Aoauth%3Arequest_uri%3Abwc4JK-ESC0w8acc191e-Y1LTC2 HTTP/1.1 - Host: pid-provider.example.org - - -.. note:: - - **User Authentication and Consent:** The PID Provider performs the User authentication based on the requirements of eIDAS LoA High and asks the User for consent for the PID issuance. - -**Steps 10-11:** The PID Provider sends an authorization code to the Wallet Instance. - -.. note:: - - The Wallet Instance redirect URI is a universal or app link registered with the local operating system, so this latter will resolve it and pass the response to the Wallet Instance. - -.. code-block:: http - - HTTP/1.1 302 Found - Location: eudiw://start.wallet.example.org?code=SplxlOBeZQQYbYS6WxSbIA&state=fyZiOL9Lf2CeKuNT2JzxiLRDink0uPcd&iss=https%3A%2F%2Fpid-provider.example.org - - -**Step 14:** The Wallet Instance sends a token request to the PID Provider's token endpoint using the authorization *code*, *code_verifier* and *DPoP proof*, and *private_key_jwt*. - -.. code-block:: http - - POST /token HTTP/1.1 - Host: pid-provider.example.org - Content-Type: application/x-www-form-urlencoded - DPoP: eyJ0eXAiOiJkcG9wK2p3dCIsImFsZyI6IkVTMjU2IiwiandrIjp7Imt0eSI6Ik - VDIiwieCI6Imw4dEZyaHgtMzR0VjNoUklDUkRZOXpDa0RscEJoRjQyVVFVZldWQVdCR - nMiLCJ5IjoiOVZFNGpmX09rX282NHpiVFRsY3VOSmFqSG10NnY5VERWclUwQ2R2R1JE - QSIsImNydiI6IlAtMjU2In19.eyJqdGkiOiItQndDM0VTYzZhY2MybFRjIiwiaHRtIj - oiUE9TVCIsImh0dSI6Imh0dHBzOi8vc2VydmVyLmV4YW1wbGUuY29tL3Rva2VuIiwia - WF0IjoxNTYyMjYyNjE2fQ.2-GxA6T8lP4vfrg8v-FdWP0A0zdrj8igiMLvqRMUvwnQg - 4PtFLbdLXiOSsX0x7NVY-FNyJK70nfbV37xRZT3Lg - - client_id=$thumprint-of-the-jwk-in-the-cnf-wallet-attestation$ - &grant_type=authorization_code - &code=SplxlOBeZQQYbYS6WxSbIA - &redirect_uri=eudiw://start.wallet.example.org - &code_verifier=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk - &client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer - &client_assertion=eyJhbGciOiJIUzI1NiI - - -**Step 15:** The PID Provider validates the request and if it is successful, it issues an *access token* (bound to the DPoP key) and a fresh *c_nonce*. - -.. code-block:: http - - HTTP/1.1 200 OK - Content-Type: application/json - Cache-Control: no-store - - { - "access_token": "Kz~8mXK1EalYznwH-LC-1fBAo.4Ljp~zsPE_NeO.gxU", - "token_type": "DPoP", - "expires_in": 2677, - "c_nonce": "tZign[...]snFbp", - "c_nonce_expires_in": 86400 - } - - -**Steps 16-18:** The Wallet Instance creates a new key pair to which the new credential shall be bound. Then, it creates a proof of possession with the new key and the *c_nonce* obtained in **Step 15** and it creates a DPoP proof for the request to the PID credential issuance endpoint. - -**Step 19:** The Wallet Instance sends a PID issuance request to the PID Provider credential endpoint. It contains the *access token*, the *DPoP proof*, the *credential type*, the *proof* (proof of possession of the key) and the *format*. - -.. note:: - - **PID Credential Schema and Status registration:** The PID Provider MUST register all the issued PIDs for their later revocation, if needed. - -.. code-block:: http - - POST /credential HTTP/1.1 - Host: pid-provider.example.org - Content-Type: application/x-www-form-urlencoded - Authorization: DPoP Kz~8mXK1EalYznwH-LC-1fBAo.4Ljp~zsPE_NeO.gxU - DPoP: eyJ0eXAiOiJkcG9wK2p3dCIsImFsZyI6IkVTMjU2IiwiandrIjp7Imt0eSI6Ik - VDIiwieCI6Imw4dEZyaHgtMzR0VjNoUklDUkRZOXpDa0RscEJoRjQyVVFVZldWQVdCR - nMiLCJ5IjoiOVZFNGpmX09rX282NHpiVFRsY3VOSmFqSG10NnY5VERWclUwQ2R2R - 1JEQSIsImNydiI6IlAtMjU2In19.eyJqdGkiOiJlMWozVl9iS2ljOC1MQUVCIiwiaHRtIj - oiR0VUIiwiaHR1IjoiaHR0cHM6Ly9yZXNvdXJjZS5leGFtcGxlLm9yZy9wcm90ZWN0Z - WRyZXNvdXJjZSIsImlhdCI6MTU2MjI2MjYxOCwiYXRoIjoiZlVIeU8ycjJaM0RaNTNF - c05yV0JiMHhXWG9hTnk1OUlpS0NBcWtzbVFFbyJ9.2oW9RP35yRqzhrtNP86L-Ey71E - OptxRimPPToA1plemAgR6pxHF8y6-yqyVnmcw6Fy1dqd-jfxSYoMxhAJpLjA - - credential_definition=%7B%22type%22:%5B%22eu.eudiw.pid.it%22%5D%7D - &format=vc+sd-jwt - &proof=%7B%22proof_type%22:%22...-ace0-9c5210e16c32%22%7D - - - -A non-normative example of proof parameter is given below: - -.. code-block:: JSON - - { - "proof_type": "jwt", - "jwt": "eyJraWQiOiJkaWQ6ZXhhbXBsZTplYm …" - } - - -Where the JWT looks like this: - -.. code-block:: JSON - - { - "alg": "ES256", - "typ": "openid4vci-proof+jwt", - "kid": "dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw" - } - -.. code-block:: JSON - - { - "iss": "0b434530-e151-4c40-98b7-74c75a5ef760", - "aud": "https://pid-provider.example.org", - "iat": 1504699136, - "nonce": "tZign...snFbp" - } - - - -**Steps 20-22:** The PID Provider checks the *DPoP proof* and whether the *access token* is valid and suitable for the requested PID. It also checks the proof of possession for the key material the new credential shall be bound to. If all checks succeed, the PID Provider creates a new credential bound to the key material and sends it to the Wallet Instance. The Wallet Instance MUST perform the PID integrity and authenticity checks and if it is successful can proceed with secure storage of the PID credential. - -.. code-block:: http - - HTTP/1.1 200 OK - Content-Type: application/json - Cache-Control: no-store - Pragma: no-cache - - { - "format": "vc+sd-jwt" - "credential" : "LUpixVCWJk0eOt4CXQe1NXK[...]WZwmhmn9OQp6YxX0a2L", - "c_nonce": "fGFF7[...]UkhLa", - "c_nonce_expires_in": 86400 - } - -PAR endpoint ------------- - -Request -^^^^^^^ - -The requests to the PID Provider authorization endpoint MUST be HTTP with method POST, with the following mandatory parameters in the HTTP request message body, encoded in ``application/x-www-form-urlencoded`` format. - -.. _table_http_request_claim: -.. list-table:: PAR http request parameters - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **response_type** - - MUST be set to ``code``. - - `The OAuth 2.0 Authorization Framework `_ - * - **client_id** - - MUST be set to the thumbprint of the ``jwk`` value in the ``cnf`` parameter inside the Wallet Instance Attestation. - - `The OAuth 2.0 Authorization Framework `_ - * - **code_challenge** - - A challenge derived from the **code verifier** that is sent in the authorization request - - :rfc:`7636#section-4.2`. - * - **code_challenge_method** - - A method that was used to derive **code challenge**. It MUST be set to ``S256``. - - :rfc:`7636#section-4.3`. - * - **request** - - It MUST be a signed JWT. The private key corresponding to the public one in the ``cnf`` parameter inside the Wallet Instance Attestation MUST be used for signing the request object. - - `OpenID Connect Core. Section 6 `_ - * - **client_assertion_type** - - It MUST be set to ``urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation``. - - `Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants `_ - * - **client_assertion** - - It MUST be the Wallet Instance Attestation signed JWT. - - `Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants `_ - -The JWT Request Object has the following JOSE header parameters: - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **JOSE header** - - **Description** - - **Reference** - * - **alg** - - A digital signature algorithm identifier such as per IANA "JSON Web Signature and Encryption Algorithms" registry. It MUST be one of the supported algorithms in Section `Cryptographic Algorithms `_ and MUST NOT be none or an identifier for a symmetric algorithm (MAC). - - :rfc:`7516#section-4.1.1`. - * - **kid** - - Unique identifier of the JWK as base64url-encoded JWK Thumbprint value. - - :rfc:`7638#section_3`. - -.. note:: - The parameter **typ**, if omitted, assumes the implicit value **JWT**. - - -The JWT payload is given by the following parameters: - -.. _table_jwt_request: -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **response_type** - - It MUST be set as in the :ref:`Table of the HTTP parameters `. - - See :ref:`Table of the HTTP parameters `. - * - **client_id** - - It MUST be set as in the :ref:`Table of the HTTP parameters `. - - See :ref:`Table of the HTTP parameters `. - * - **state** - - Unique session identifier at the client side. This value will be returned to the client in the response, at the end of the authentication. It MUST be a random string with at least 32 alphanumeric characters. - - See `OpenID.Core#AuthRequest `_. - * - **code_challenge** - - It MUST be set as in the :ref:`Table of the HTTP parameters `. - - See :ref:`Table of the HTTP parameters `. - * - **code_challenge_method** - - It MUST be set as in the :ref:`Table of the HTTP parameters `. - - See :ref:`Table of the HTTP parameters `. - * - **authorization_details** - - JSON Object. It MUST include the following claims: - - - **type**: it MUST be set to ``openid_credential``, - - **format**: it MUST be set to ``vc+sd-jwt``, - - **credential_definition**: JSON Object. It MUST have the **type** claim which MUST be set to ``eu.eudiw.pid.it`` - - See [RAR :rfc:`9396`] and `[OIDC4VCI. Draft 13] `_. - * - **redirect_uri** - - Redirection URI to which the response will be sent. It MUST be an universal or app link registered with the local operating system, so this latter will resolve it and pass the response to the Wallet Instance. - - See `OpenID.Core#AuthRequest `_. - * - **client_assertion_type** - - It MUST be set as in the :ref:`Table of the HTTP parameters `. - - See :ref:`Table of the HTTP parameters `. - * - **client_assertion** - - It MUST be set as in the :ref:`Table of the HTTP parameters `. - - See :ref:`Table of the HTTP parameters `. - - -Response -^^^^^^^^ - -If the verification is successful, the PID Provider MUST provide the response with a *201 HTTP status code*. The following parameters are included as top-level members in the message body of the HTTP response using the ``application/json`` media type as defined by [:rfc:`8259`]. - -.. _table_http_response_claim: -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **request_uri** - - The request URI corresponding to the authorization request posted. This URI MUST be a single-use reference to the respective authorization request. It MUST contain some part generated using a cryptographically strong pseudorandom algorithm. The value format MUST be ``urn:ietf:params:oauth:request_uri:`` with ```` as the random part of the URI that references the respective authorization request data. - - [:rfc:`9126`]. - * - **expires_in** - - A JSON number that represents the lifetime of the request URI in seconds as a positive integer. - - [:rfc:`9126`]. - - -Authorization endpoint ----------------------- - -Request -^^^^^^^ - -The Authorization request passes through the Browser of the Wallet Instance and both **HTTP POST** and **GET** method MAY be used. With the method **POST** the parameters MUST be sent using the *Form Serialization*. With the method **GET** the parameters MUST be sent using the *Query String Serialization*. For more details see `OpenID.Core#Serializations `_. - -The mandatory parameters in the HTTP authentication request are specified in the following table. - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **client_id** - - It MUST be set as in the :ref:`Table of the HTTP parameters `. - - See :ref:`Table of the HTTP parameters `. - * - **request_uri** - - It MUST be set to the same value as obtained by PAR Response. See :ref:`Table of the HTTP PAR Response parameters `. - - [:rfc:`9126`]. - - -Response -^^^^^^^^ - -The authentication response is returned by the PID Provider authorization endpoint at the end of the authentication flow. - -If the authentication is successful the PID Provider redirects the User by adding the following query parameters as required to the *redirect_uri*. The redirect URI MUST be an universal or app link registered with the local operating system, so this latter is able to resolve its value and delegates the Wallet Instance for the processing. - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **code** - - Unique *Authorization Code* that the client submits to the Token Endpoint. - - [:rfc:`6749#section-4.1.2`], `Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants `_ - * - **state** - - The client MUST check the correspondence with the state value in the request object. It is defined as in the :ref:`Table of the JWT Request parameters `. - - [:rfc:`6749#section-4.1.2`]. - * - **iss** - - Unique identifier of the PID PRovider who created the Authentication Response. The Wallet Instance MUST validate this parameter. - - `OAuth 2.0 Authorization Server Issuer Identifier in Authorization Response `_, `[RFC7519, Section 4.1.1] `_. - - - -Token endpoint --------------- - -Request -^^^^^^^ - -The request to the PID Provider Token endpoint MUST be an HTTP request with method POST, where its body message is encoded in ``application/x-www-form-urlencoded`` format. The Wallet Instance sends the Token endpoint request with *private_key_jwt* authentication and a *DPoP proof* containing the mandatory parameters, defined in the table below. - -The Token endpoint MUST accept and validate the DPoP proof sent in the DPoP HTTP header. The Token endpoint MUST validate the DPoP proof based on the steps defined in Section 4.3 of the DPoP specifications `[DPoP-draft16] `_. Thus, this mitigates the misuse of leaked or stolen access tokens at the credential endpoint. If the DPoP proof is invalid, the Token endpoint returns an error response, according to Section 5.2 of [:rfc:`6749`] with ``invalid_dpop_proof`` as the value of the error parameter. - - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **client_id** - - It MUST be set as in the :ref:`Table of the HTTP parameters `. - - See :ref:`Table of the HTTP parameters `. - * - **grant_type** - - It MUST be set to ``authorization_code``. - - `Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants `_. - * - **code** - - Authorization code returned in the Authentication Response. - - `Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants `_. - * - **redirect_uri** - - It MUST be set as in the request object :ref:`Table of the JWT Request parameters `. - - `Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants `_. - * - **code_verifier** - - Verification code of the **code_challenge**. - - `Proof Key for Code Exchange by OAuth Public Clients `_. - * - **client_assertion_type** - - It MUST be set to ``urn:ietf:params:oauth:client-assertion-type:jwt-bearer``. - - `Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants `_. - * - **client_assertion** - - JWT signed with the Wallet Instance's private key containing the following parameters: - - - **iss**: This MUST contain the client_id. - - **sub**: This MUST contain the iss. - - **aud**: URL of the PID Provider Token Endpoint. - - **iat**: UNIX Timestamp with the time of the JWT issuance, coded as NumericDate as indicated in RFC 7519. - - **exp**: UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in RFC 7519. - - **jti**: Unique Identifier for this authentication request, generated by the client. E.g., uuid4 format. - - `Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants `_. - -A **DPoP proof** is included in an HTTP request using the ``DPoP`` header parameter containing a DPoP JWS. - -The JOSE header of a **DPoP JWT** MUST contain at least the following parameters: - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **JOSE header** - - **Description** - - **Reference** - * - **typ** - - It MUST be equal to ``dpop+jwt``. - - [:rfc:`7515`] and [:rfc:`8725`. Section 3.11]. - * - **alg** - - A digital signature algorithm identifier such as per IANA "JSON Web Signature and Encryption Algorithms" registry. It MUST be one of the supported algorithms in Section :ref:`Cryptographic Algorithms ` and MUST NOT be none or an identifier for a symmetric algorithm (MAC). - - [:rfc:`7515`]. - * - **jwk** - - representing the public key chosen by the client, in JSON Web Key (JWK) [RFC7517] format, as defined in Section 4.1.3 of [RFC7515]. It MUST NOT contain a private key. - - [:rfc:`7517`] and [:rfc:`7515`]. - - -The payload of a **DPoP proof** MUST contain at least the following claims: - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **jti** - - Unique identifier for the DPoP proof JWT. The value MUST be assigned in a *UUID v4* string format according to [:rfc:`4122`]. - - [:rfc:`7519`. Section 4.1.7]. - * - **htm** - - The value of the HTTP method of the request to which the JWT is attached. - - [:rfc:`9110`. Section 9.1]. - * - **htu** - - The HTTP target URI, without query and fragment parts, of the request to which the JWT is attached. - - [:rfc:`9110`. Section 7.1]. - * - **iat** - - UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in :rfc:`7519`. - - [:rfc:`7519`. Section 4.1.6]. - - -Response -^^^^^^^^ - -Token endpoint response MUST contain the following mandatory claims. - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **access_token** - - The *DPoP-bound Access Token*, in signed JWT format, allows accessing the Credential Endpoint for obtaining the PID. - - `The OAuth 2.0 Authorization Framework `_. - * - **token_type** - - Type of *Access Token* returned. It MUST be equal to ``DPoP``. - - `The OAuth 2.0 Authorization Framework `_. - * - **expires_in** - - Expiry time of the *Access Token* in seconds. - - `The OAuth 2.0 Authorization Framework `_. - * - **c_nonce** - - JSON string containing a nonce to be used to create a *proof of possession* of key material when requesting a Credential. - - `[OIDC4VCI. Draft 13] `_. - * - **c_nonce_expires_in** - - JSON integer denoting the lifetime in seconds of the **c_nonce**. - - `[OIDC4VCI. Draft 13] `_. - -Access Token -^^^^^^^^^^^^ - -A DPoP-bound Access Token is provided by the PID Provider Token endpoint as a result of a successful token request. The Access Token is represented as JWT according to [:rfc:`7519`]. The Access Token MUST have at least the following mandatory claims and it MUST be bound to the public key that is provided by the DPoP proof. This binding can be accomplished based on the methodology defined in Section 6 of `[DPoP-draft16] `_. - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **iss** - - It MUST be an HTTPS URL that uniquely identifies the PID Provider. The client MUST verify that this value matches the PID Provider where it has requested the credential. - - [:rfc:`9068`], `[RFC7519, Section 4.1.1] `_. - * - **sub** - - It identifies the subject of the JWT. It MUST be of type *pairwise*. - - [:rfc:`9068`], [:rfc:`7519`] and [`OpenID.Core#SubjectIDTypes `_]. - * - **client_id** - - It MUST contain a HTTPS URL that uniquely identifies the RP. - - [:rfc:`9068`]. - * - **aud** - - It MUST match the value *client_id*. The RP MUST verify that this value matches its client ID. - - [:rfc:`9068`]. - * - **iat** - - UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in :rfc:`7519`. - - [:rfc:`9068`], [:rfc:`7519`. Section 4.1.6]. - * - **exp** - - UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in :rfc:`7519`. - - [:rfc:`9068`], [:rfc:`7519`]. - * - **jti** - - It MUST be a String in *uuid4* format. Unique Token ID identifier that the RP MAY use to prevent reuse by rejecting the Token ID if already processed. - - [:rfc:`9068`], [:rfc:`7519`]. - * - **nonce** - - It MUST be a random string of at least 32 alphanumeric characters. The value type of this claim MUST be a string, where the value is a **c_nonce** provided by the PID Provider. - - [`OpenID.Core#AuthRequest `_]. - * - **jkt** - - JWK SHA-256 Thumbprint Confirmation Method. The value of the jkt member MUST be the base64url encoding (as defined in [RFC7515]) of the JWK SHA-256 Thumbprint of the DPoP public key (in JWK format) to which the access token is bound. - - [`DPoP-draft16 `_. Section 6.1] and [:rfc:`7638`]. - - - -Credential endpoint -------------------- - -Request -^^^^^^^ - -A Wallet Instance makes a PID Request to the PID Provider Credential endpoint by sending the following mandatory parameters in the entity-body of an HTTP POST request using the *application/json* media type. - -The Credential endpoint MUST accept and validate the DPoP proof sent in the DPoP HTTP header based on the steps defined in Section 4.3 of `[DPoP-draft16] `_. If the DPoP proof is invalid, the Credential endpoint returns an error response per Section 5.2 of [:rfc:`6749`] with `invalid_dpop_proof` as the value of the error parameter. - -.. warning:: - The Wallet Instance MUST create a **new DPoP proof** for the Credential request and MUST NOT use the previously created proof for the Token Endpoint. - - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **credential_definition** - - JSON object containing the detailed description of the credential type. It MUST have at least the **type** sub claims which is a JSON array containing the type values the Wallet shall request in the subsequent Credential Request. It MUST be `eu.eudiw.pid.it`. - - `[OIDC4VCI. Draft 13] `_. - * - **format** - - Format of the Credential to be issued. This MUST be `vc+sd-jwt`. - - `[OIDC4VCI. Draft 13] `_. - * - **proof** - - JSON object containing proof of possession of the key material the issued Credential shall be bound to. The proof object MUST contain the following mandatory claims: - - - **proof_type**: JSON string denoting the proof type. It MUST be `jwt`. - - **jwt**: the JWT used as proof of possession. - - `[OIDC4VCI. Draft 13] `_. - -.. note:: - - If the **format** value is `mso_mdoc`, the credential request MUST contain the doctype claim which is a JSON string identifying the PID type according to `EIDAS-ARF`_ . See Appendix E.2. of `[OIDC4VCI. Draft 13] `_ for more details. - - -The JWT proof type MUST contain the following parameters for the JOSE header and the JWT body: - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **JOSE Header** - - **Description** - - **Reference** - * - **alg** - - A digital signature algorithm identifier such as per IANA "JSON Web Signature and Encryption Algorithms" registry. It MUST be one of the supported algorithms in Section :ref:`Cryptographic Algorithms ` and MUST NOT be ``none`` or an identifier for a symmetric algorithm (MAC). - - `[OIDC4VCI. Draft 13] `_, [:rfc:`7515`], [:rfc:`7517`]. - * - **typ** - - MUST be `openid4vci-proof+jwt`. - - `[OIDC4VCI. Draft 13] `_, [:rfc:`7515`], [:rfc:`7517`]. - * - **kid** - - It MUST contain the identifier of the key material the PID shall be bound to. - - `[OIDC4VCI. Draft 13] `_, [:rfc:`7515`], [:rfc:`7517`]. - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **iss** - - The value of this claim MUST be the **client_id** of the Wallet Instance. - - `[OIDC4VCI. Draft 13] `_, `[RFC7519, Section 4.1.1] `_. - * - **aud** - - The value of this claim MUST be the identifier URL of the PID Provider. - - `[OIDC4VCI. Draft 13] `_. - * - **iat** - - UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in :rfc:`7519`. - - `[OIDC4VCI. Draft 13] `_, [:rfc:`7519`. Section 4.1.6]. - * - **nonce** - - The value type of this claim MUST be a string, where the value is a **c_nonce** provided by the PID Provider in the Token response. - - `[OIDC4VCI. Draft 13] `_. - - - -Response -^^^^^^^^ - -Credential Response to the Wallet Instance MUST be sent using `application/json` media type. The response MUST contain the following mandatory claims: - -.. list-table:: - :widths: 20 60 20 - :header-rows: 1 - - * - **Claim** - - **Description** - - **Reference** - * - **format** - - Format of the Credential to be issued. This MUST be `vc+sd-jwt`. - - `[OIDC4VCI. Draft 13] `_. - * - **credential** - - Contains the issued PID. It MUST be an SD-JWT JSON Object (see Section :ref:`PID Data Model `). - - Appendix E in `[OIDC4VCI. Draft 13] `_. - * - **c_nonce** - - JSON string containing a nonce to be used to create a *proof of possession* of key material when requesting a further credential or for renewal credential. - - `[OIDC4VCI. Draft 13] `_. - * - **c_nonce_expires_in** - - JSON integer corresponding to the **c_nonce** lifetime in seconds. - - `[OIDC4VCI. Draft 13] `_. - -.. note:: - - If the **format** value is `mso_mdoc`, the **credential** value MUST be a base64url-encoded JSON string according to Appendix E of `[OIDC4VCI. Draft 13] `_. - - -.. _Entity Configuration Credential Issuer: - -Entity Configuration Credential Issuer -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -Below a non-normative example of an Entity Configuration containing an `openid_credential_issuer` metadata. - -.. code-block:: http - - HTTP/1.1 200 OK - Content-Type: application/entity-statement+jwt - - { - - "alg": "RS256", - "kid": "FANFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs", - "typ": "entity-statement+jwt" - - } - . - { - "exp": "1649610249", - "iat": "1649437449", - "iss": "https://pid-provider.example.org", - "sub": "https://pid-provider.example.org", - "jwks": { - "keys": [{ - "kty": "RSA", - "use": "sig", - "n": "1Ta-sE …", - "e": "AQAB", - "kid": "FANFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs" - }] - }, - "metadata": { - "openid_credential_issuer": { - "credential_issuer": "https://pid-provider.example.org", - "authorization_endpoint": "https://pid-provider.example.org/connect/authorize", - "token_endpoint": "https://pid-provider.example.org/connect/token", - "pushed_authorization_request_endpoint": "https://pid-provider.example.org/connect/par", - "dpop_signing_alg_values_supported": ["RS256", "RS512", "ES256", "ES512"], - "credential_endpoint": "https://pid-provider.example.org/credential", - "credentials_supported": { - "eu.eudiw.pid.it": { - "format": "vc+sd-jwt", - "cryptographic_binding_methods_supported": ["jwk"], - "cryptographic_suites_supported": ["RS256", "RS512", "ES256", "ES512"], - "display": [{ - "name": "PID Provider Italiano di esempio", - "locale": "it-IT", - "logo": { - "url": "https://pid-provider example.org/public/logo.svg", - "alt_text": "logo di questo PID Provider" - }, - "background_color": "#12107c", - "text_color": "#FFFFFF" - }, - { - "name": "Example Italian PID Provider", - "locale": "en-US", - "logo": { - "url": "https://pid-provider.example.org/public/logo.svg", - "alt_text": "The logo of this PID Provider" - }, - "background_color": "#12107c", - "text_color": "#FFFFFF" - } - ], - "credential_definition": { - "type": ["PIDCredential"], - "credentialSubject": { - "given_name": { - "mandatory": true, - "display": [{ - "name": "Current First Name", - "locale": "en-US" - }, - { - "name": "Nome", - "locale": "it-IT" - } - ] - }, - "family_name": { - "mandatory": true, - "display": [{ - "name": "Current Family Name", - "locale": "en-US" - }, - { - "name": "Cognome", - "locale": "it-IT" - } - ] - }, - "birthdate": { - "mandatory": true, - "display": [{ - "name": "Date of Birth", - "locale": "en-US" - }, - { - "name": "Data di Nascita", - "locale": "it-IT" - } - ] - }, - "place_of_birth": { - "mandatory": true, - "display": [{ - "name": "Place of Birth", - "locale": "en-US" - }, - { - "name": "Luogo di Nascita", - "locale": "it-IT" - } - ] - }, - "unique_id": { - "mandatory": true, - "display": [{ - "name": "Unique Identifier", - "locale": "en-US" - }, - { - "name": "Identificativo univoco", - "locale": "it-IT" - } - ] - }, - "tax_id_number": { - "mandatory": true, - "display": [{ - "name": "Tax Id Number", - "locale": "en-US" - }, - { - "name": "Codice Fiscale", - "locale": "it-IT" - } - ] - } - } - } - } - } - }, - - "federation_entity": { - "organization_name": "Pid Provider Organization Example", - "homepage_uri": "https://pid-provider.example.org", - "policy_uri": "https://pid-provider.example.org/privacy_policy", - "tos_uri": "https://pid-provider.example.org/info_policy", - "logo_uri": "https://pid-provider.example.org/logo.svg" - }, - - "openid_relying_party": { - - } - } - } - diff --git a/en/_sources/presentation.rst.txt b/en/_sources/presentation.rst.txt deleted file mode 100644 index 5ada80406..000000000 --- a/en/_sources/presentation.rst.txt +++ /dev/null @@ -1,57 +0,0 @@ -.. include:: ../common/common_definitions.rst - -.. _presentation.rst: - -presentation.rst -+++++++++++++++++++++++++++ - -[What is it] - -[What it is usefull for] - -[Example] - -General Properties ------------------- - -[TODO] - - -Requirements ------------- - - - req 1 - - req 2 - - -Attributes ----------- - -[Table with parameters/attributes] - -.. list-table:: - :widths: 20 60 - :header-rows: 1 - - * - **Claim** - - **Description** - * - key - - value - - -Implementation considerations ------------------------------ - -TODO - - -Libraries and code snippets ---------------------------- - -TODO - - -External references -------------------- - -TODO diff --git a/en/_sources/relying-party-solution.rst.txt b/en/_sources/relying-party-solution.rst.txt index 42d398975..a35bf3e4a 100644 --- a/en/_sources/relying-party-solution.rst.txt +++ b/en/_sources/relying-party-solution.rst.txt @@ -10,8 +10,8 @@ Relying Party Solution This section describes how a Relying Party may ask to a Wallet Instance the presentation of the PID and the (Q)EAAs, according the following specifications: -- `OpenID for Verifiable Presentations - draft 19 `_. -- `Draft: OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP) `_. +- `OpenID for Verifiable Presentations - draft 19 `_. +- `Draft: OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP) `_. In this section the following flows are described: @@ -340,10 +340,10 @@ Here a non-normative example of ``presentation_definition``: { "presentation_definition": { - "id": "pid-sd-jwt:unique_id+given_name+family_name", + "id": "presentation definitions", "input_descriptors": [ { - "id": "eu.europa.ec.eudiw.pid.it.1", + "id": "pid-sd-jwt:unique_id+given_name+family_name", "name": "Person Identification Data", "purpose": "User authentication", "format": "vc+sd-jwt", @@ -384,8 +384,7 @@ After getting the User authorization and consent for the presentation of the cre .. note:: **Why the response is encrypted?** - The response sent from the Wallet Instance to the Relying Party is encrypted - to prevent a technique called `SSL split attack `_, that could be enabled by malicious app installed locally by Users,that intecepts the network traffic, or be present by-design in network environments where a next-generation firewalls or other security devices may reduce the privacy of the Users. + The response sent from the Wallet Instance to the Relying Party is encrypted to prevent a malicious agent from gaining access to the plaintext information transmitted within the verifier's network. This is only possible if the network environment of the verifier employs `TLS termination `_. Such technique employs a termination proxy that acts as an intermediary between the client and the webserver and handles all TLS-related operations. In this manner, the proxy deciphers the transmission's content and either forwards it in plaintext or by negotiates an internal TLS session with the actual webserver's intended target. In the first scenario, any malicious actor within the network segment could intercept the transmitted data and obtain sensitive information, such as an unencrypted response, by sniffing the transmitted data. Below a non-normative example of the request: @@ -410,14 +409,9 @@ Below is a non-normative example of the decrypted JSON ``response`` content: "id": "04a98be3-7fb0-4cf5-af9a-31579c8b0e7d", "descriptor_map": [ { - "id": "eu.europa.ec.eudiw.pid.it.1:unique_id", + "id": "pid-sd-jwt:unique_id+given_name+family_name", "path": "$.vp_token.verified_claims.claims._sd[0]", "format": "vc+sd-jwt" - }, - { - "id": "eu.europa.ec.eudiw.pid.it.1:given_name", - "path": "$.vp_token.verified_claims.claims._sd[1]", - "format": "vc+sd-jwt" } ] } diff --git a/en/_sources/trust.rst.txt b/en/_sources/trust.rst.txt index 8fa149c8c..3e3898615 100644 --- a/en/_sources/trust.rst.txt +++ b/en/_sources/trust.rst.txt @@ -254,7 +254,10 @@ Below is a non-normative example of a Trust Anchor Entity Configuration, where e Entity Configuration -------------------- -The Entity Configuration is the verifiable document that each Federation Entity must publish on its own behalf. +The Entity Configuration is the verifiable document that each Federation Entity must publish on its own behalf in the web path **.well-known/openid-federation**. + +The Entity Configuration HTTP response MUST set the media type `application/entity-statement+jwt`. + The Entity Configuration must be cryptographically signed. The public part of this key must be present in the Entity Configuration and within the Entity Statement issued by a immediate superior concerning the Federation Entity. diff --git a/en/_sources/wallet-instance-attestation.rst.txt b/en/_sources/wallet-instance-attestation.rst.txt index 899b1bf62..7ce4641fd 100644 --- a/en/_sources/wallet-instance-attestation.rst.txt +++ b/en/_sources/wallet-instance-attestation.rst.txt @@ -43,222 +43,40 @@ The following requirements are assumed for the Wallet Instance Attestation: .. attention:: ⚠️ Implementation of points no. 5 and 9 is still under discussion. This version assumes the authenticity and non-revocability of the Wallet Instance. -High-end design ---------------- +High-level Design +----------------- -Static view of the components -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +Static Component View +~~~~~~~~~~~~~~~~~~~~~ .. figure:: ../../images/static_view_wallet_instance_attestation.svg - :name: Wallet Solution schema - :alt: The image shows how the Wallet Provider and the Wallet Instances are contained within the Wallet Solution, which is managed by the Wallet Provider. + :name: Wallet Solution Schema + :alt: The image illustrates the containment of Wallet Provider and Wallet Instances within the Wallet Solution, managed by the Wallet Provider. :target: https://www.plantuml.com/plantuml/uml/XP4nJuSm44VtVehBdxbnPp2iRYx6qTHIjR7SaVQ0-EqzaICDgN4ZBxpqzTUXiCkyJCaupvJXzbH2le4hiCW7A7rsAGM6ETCQn-E7RMSloi0OJzDC691FeL1QE1BMWZBeraW2Mbv4wK8VQayPT5yX9TgCQPclpdy676lnGF0ZN93DyVs3xVsrhOU70hCi0_JshwHXFJp-Rg4dIuECo96moD7xeBQbUKBEbE0EPEwuEWx6N2zj_uXqU8wbhVMhD3tjbAX1BYIl_mq0 -Dynamic view of the components -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +Dynamic Component View +~~~~~~~~~~~~~~~~~~~~~~ -This section describes the format of the Wallet Instance Attestation and how it is issued by the Wallet Provider. +This section describes the Wallet Instance Attestation format and how the Wallet Provider issues it. .. figure:: ../../images/dynamic_view_sequence_wallet_instance_attestation.svg - :name: sequence diagram for Wallet Instance Attestation request - :alt: The figure shows the sequence diagram for issuing a Wallet Instance Attestation. The steps will be described below. + :name: Sequence Diagram for Wallet Instance Attestation Request + :alt: The figure illustrates the sequence diagram for issuing a Wallet Instance Attestation, with the steps explained below. :target: https://www.plantuml.com/plantuml/uml/XPB1RzKm3CRl-IlCJY3nn7s7QOZ3118IGi0kkxYDLLcqJd2SLMz_FLvV6r7AnDN-_Fi-ExajXcfr6iEhh3XC24Rf2Kmh1QoMf4uTQGZPLTnpHZ6u-bv8hm0Br7tz7iUH33wAGwMdHJBpFpLVD3roN35p5qA5qusBhtsQZN7a9uBvekMLzo19GUbNfMBlib8X1_PAaUHveeIPJpTpTmrtPDjiNdrW8iE8Xc7kJgvoeyzh1VeaXYmimnyqi7EcyXP-qddnPAN9EruXYJcnsEhdf1yUrqbqC3MjnM3aOgxT5hmZ8NNrWix8MhQcH_zwMGyaIK-U5KwNgRNGB3yeFIF-kZYyBuNKE4a3VRh_5h0tVbpoTRiROLE__Y_eZOTP9W_RyZOpa5GM4YhbA2uy25fLQgrXkmDANDe7OClN7ktbXO-FyJ8jqluYpguDtVJSFc9y42MCPx04gJDa0Q5vz_LkIMATnjy0 -- - - **Message 1**: The User initializes the Wallet Instance. In particular, this process happens after the Wallet Instance installation and after the expiration of the Wallet Instance Attestation is launched and every time the User wants to request or present a credential. -- **Message 2-3**: The Wallet Instance obtains metadata about its Wallet Provider. Among these, we also find the list of supported algorithms, public keys, endpoints. -- **Message 4**: The Wallet Instance verifies that the Wallet Provider is trustworthy by resolving the provider's trust chain up to the Trust Anchor. -- **Message 5-7**: The Wallet Instance creates a new key pair and requests a ``nonce`` from the Wallet Provider (as a measure against replay attacks). -- **Message 8**: The Wallet Instance generates a Wallet Instance Attestation Request, in JWS format, signed with the private key associated with the public key for which it wants to obtain the attestation. -- **Message 9-13**: The Wallet Instance sends the Wallet Instance Attestation Request to the Wallet Provider which verifies its validity and issues the signed attestation. -- **Message 13-14**:The Wallet Instance receives the Wallet Instance Attestation signed by the Wallet Provider and proceeds with a formal verification. -- **Message 15**:The Wallet Instance Attestation is ready to be consumed. +- **Message 1**: The User starts the Wallet Instance mobile app, a new Wallet Instance Attestation is automatically obtained if the previous one results expired. +- **Message 2-3**: The Wallet Instance retrieves metadata about its Wallet Provider, including the list of supported algorithms, public keys, and endpoints. +- **Message 4**: The Wallet Instance verifies the Wallet Provider's trustworthiness by resolving the provider's trust chain to the Trust Anchor. +- **Message 5-7**: The Wallet Instance generates a new key pair and requests a ``nonce`` from the Wallet Provider to guard against replay attacks. +- **Message 8**: The Wallet Instance creates a Wallet Instance Attestation Request in JWS format, signed with the private key associated with the public key for which it seeks attestation. +- **Message 9-13**: The Wallet Instance sends the Wallet Instance Attestation Request to the Wallet Provider, which validates it and issues a signed attestation in return. +- **Message 13-14**: The Wallet Instance receives the Wallet Instance Attestation signed by the Wallet Provider and performs formal verification. +- **Message 15**: The Wallet Instance Attestation is now ready for use. -Detail design +Detailed Design --------------- -We will go into the detail design below. - -Format of the Wallet Provider Entity Configuration -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -The Wallet Provider Entity Configuration is a JWS containing the public keys and the supported algorithms within the Wallet Provider metadata definition. It is defined according to `OpenID Connect Federation `_ and Section Trust Model of this specification. - -Header -^^^^^^ -+---------+-----------------------------------------------------------------+ -| **key** | **value** | -+---------+-----------------------------------------------------------------+ -| alg | Algorithm to verify the token signature (es. ES256). | -+---------+-----------------------------------------------------------------+ -| kid | Thumbprint of the public key used for signing. | -+---------+-----------------------------------------------------------------+ -| typ | Media type, in this case, we use the entity-statement+jwt value.| -+---------+-----------------------------------------------------------------+ - -Payload -^^^^^^^ -+-----------------------------------+-----------------------------------+ -| **key** | **value** | -+-----------------------------------+-----------------------------------+ -| iss | The public url of the Wallet | -| | Provider. | -+-----------------------------------+-----------------------------------+ -| sub | The public url of the Wallet | -| | Provider. | -+-----------------------------------+-----------------------------------+ -| iat | Configuration release timestamp. | -+-----------------------------------+-----------------------------------+ -| exp | Configuration expiration | -| | timestamp. | -+-----------------------------------+-----------------------------------+ -| jwks | Containing the keys attribute | -| | which is an array of all the | -| | public keys associated with the | -| | domain (they could also match | -| | those of the Wallet Provider). | -+-----------------------------------+-----------------------------------+ -| metadata | This attribute will contain for | -| | each entity its own | -| | metadata. In this case we | -| | will have the Wallet | -| | Provider metadata contained within| -| | the ``eudi_wallet_provider`` | -| | attribute and the more generic | -| | entity ``federation_entity``. | -+-----------------------------------+-----------------------------------+ - -Payload `eudi_wallet_provider` -'''''''''''''''''''''''''''''' -+------------------------------------+------------------------------------+ -| **key** | **value** | -+------------------------------------+------------------------------------+ -|| jwks || Containing the keys attribute | -|| || which is an array of all the | -|| || Wallet Provider's public keys. | -+------------------------------------+------------------------------------+ -|| token_endpoint || Endpoint for obtaining the Wallet | -|| || Instance Attestation. | -+------------------------------------+------------------------------------+ -|| asc_values_supported || List of supported values for | -|| || the certified security context. | -|| || These values define a level of | -|| || assurance about the security of | -|| || the app. In particular we will | -|| || mainly have 3 values associated | -|| || with low, medium and high | -|| || security. An attested security | -|| || context is defined according to | -|| || the proof that the Wallet | -|| || Instance is able to send to the | -|| || Wallet Provider. | -|| || ⚠️ This parameter is not standard | -|| || and is still under discussion. | -+------------------------------------+------------------------------------+ -|| grant_types_supported || The type of grants supported by | -|| || the endpoint token. Therefore, | -|| || for the Wallet Provider the token | -|| || is equivalent only to the Wallet | -|| || Instance attestation, therefore | -|| || this attribute will contain an | -|| || array with only one element. | -+------------------------------------+------------------------------------+ -|| token_endpoint_auth_methods_suppo || Supported authentication method | -|| rted || for the endpoint token. | -|| || | -+------------------------------------+------------------------------------+ -|| token_endpoint_auth_signing_alg_v || List of supported signature | -|| alues_supported || algorithms. | -+------------------------------------+------------------------------------+ - -.. note:: - The parameter `asc_values_supported` is experimental and still - under discussion. - -Payload `federation_entity` -''''''''''''''''''''''''''' -+-------------------+----------------------------------------+ -| **key** | **value** | -+-------------------+----------------------------------------+ -| organization_name | Organization name. | -+-------------------+----------------------------------------+ -| homepage_uri | Organization website. | -+-------------------+----------------------------------------+ -| tos_uri | Url to the terms of use. | -+-------------------+----------------------------------------+ -| policy_uri | Url to the privacy policy. | -+-------------------+----------------------------------------+ -| logo_uri | URL of the organization logo. | -+-------------------+----------------------------------------+ - -Below a non-normative example of the Entity Configuration. - -.. code-block:: javascript - - { - "alg": "ES256", - "kid": "5t5YYpBhN-EgIEEI5iUzr6r0MR02LnVQ0OmekmNKcjY", - "typ": "entity-statement+jwt" - } - . - { - "iss": "https://wallet-provider.example.org", - "sub": "https://wallet-provider.example.org", - "jwks": { - "keys": [ - { - "crv": "P-256", - "kty": "EC", - "x": "qrJrj3Af_B57sbOIRrcBM7br7wOc8ynj7lHFPTeffUk", - "y": "1H0cWDyGgvU8w-kPKU_xycOCUNT2o0bwslIQtnPU6iM", - "kid": "5t5YYpBhN-EgIEEI5iUzr6r0MR02LnVQ0OmekmNKcjY" - } - ] - }, - "metadata": { - "eudi_wallet_provider": { - "jwks": { - "keys": [ - { - "crv": "P-256", - "kty": "EC", - "x": "qrJrj3Af_B57sbOIRrcBM7br7wOc8ynj7lHFPTeffUk", - "y": "1H0cWDyGgvU8w-kPKU_xycOCUNT2o0bwslIQtnPU6iM", - "kid": "5t5YYpBhN-EgIEEI5iUzr6r0MR02LnVQ0OmekmNKcjY" - } - ] - }, - "token_endpoint": "https://wallet-provider.example.org/token", - "asc_values_supported": [ - "https://wallet-provider.example.org/LoA/basic", - "https://wallet-provider.example.org/LoA/medium", - "https://wallet-provider.example.org/LoA/high" - ], - "grant_types_supported": [ - "urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation" - ], - "token_endpoint_auth_methods_supported": [ - "private_key_jwt" - ], - "token_endpoint_auth_signing_alg_values_supported": [ - "ES256", - "ES384", - "ES512" - ] - }, - "federation_entity": { - "organization_name": "PagoPa S.p.A.", - "homepage_uri": "https://wallet-provider.example.org", - "policy_uri": "https://wallet-provider.example.org/privacy_policy", - "tos_uri": "https://wallet-provider.example.org/info_policy", - "logo_uri": "https://wallet-provider.example.org/logo.svg" - } - }, - "iat": 1687171759, - "exp": 1709290159 - } - +The detailed design is explained below. Format of the Wallet Instance Attestation Request ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -284,38 +102,38 @@ Header Payload ^^^^^^^ -+---------+---------------------------------------+ -| **key** | **value** | -+---------+---------------------------------------+ -|| iss || The thumbprint | -|| || of the JWK of the Wallet Instance | -|| || for which the attestation is | -|| || being requested. | -+---------+---------------------------------------+ -|| sub || The public url of the Wallet | -|| || Provider | -+---------+---------------------------------------+ -|| jti || Unique identifier of the request. | -|| || This parameter will be used to | -|| || avoid replay attacks. | -+---------+---------------------------------------+ -|| type || String. It must be set to | -|| || ``WalletInstanceAttestationRequest`` | -+---------+---------------------------------------+ -|| nonce || The nonce obtained from the | -|| || Wallet Porvider. | -+---------+---------------------------------------+ -|| cnf || This parameter will contain the | -|| || configuration of the Wallet | -|| || Instance in JSON format. Among | -|| || the mandatory attributes there | -|| || will be the jwk parameter | -|| || containing the public key of the | -|| || Wallet Instance. It will also | -|| || contain all the information | -|| || useful for the Wallet Provider | -|| || to verify that the app is genuine. | -+---------+---------------------------------------+ ++--------+----------------------------------------+ +| **key**| **value** | ++--------+----------------------------------------+ +|| iss || The thumbprint | +|| || of the JWK of the Wallet Instance | +|| || for which the attestation is | +|| || being requested. | ++--------+----------------------------------------+ +|| aud || The public url of the Wallet | +|| || Provider. | ++--------+----------------------------------------+ +|| jti || Unique identifier of the request. | +|| || This parameter will be used to | +|| || avoid replay attacks. | ++--------+----------------------------------------+ +|| type || String. It must be set to | +|| || ``WalletInstanceAttestationRequest``. | ++--------+----------------------------------------+ +|| nonce || The nonce obtained from the | +|| || Wallet Porvider. | ++--------+----------------------------------------+ +|| cnf || This parameter will contain the | +|| || configuration of the Wallet | +|| || Instance in JSON format. Among | +|| || the mandatory attributes there | +|| || will be the jwk parameter | +|| || containing the public key of the | +|| || Wallet Instance. It will also | +|| || contain all the information | +|| || useful for the Wallet Provider | +|| || to verify that the app is genuine. | ++--------+----------------------------------------+ Below a non-normative example of the Wallet Instance Attestation request where the decoded JWS headers and payload are separated by a comma: @@ -330,7 +148,7 @@ request where the decoded JWS headers and payload are separated by a comma: . { "iss": "vbeXJksM45xphtANnCiG6mCyuU4jfGNzopGuKvogg9c", - "sub": "https://wallet-provider.example.org", + "aud": "https://wallet-provider.example.org", "jti": "6ec69324-60a8-4e5b-a697-a766d85790ea", "type": "WalletInstanceAttestationRequest", "nonce" : "....." @@ -369,15 +187,10 @@ Header | kid | Key id used by the Wallet | | | Provider to sign the attestation. | +-----------------------------------+-----------------------------------+ -| typ | Media type, in this case we use | -| | the value va+jwt (Verifiable | -| | Assertion JWT). | -| | This parameter is currently | -| | non-standard as it is not yet | -| | registered as `IANA Media | -| | Types `__. | +| typ | Media type, set to | +| | `wallet-attestation+jwt`, | +| | according to | +| | [`OPENID4VC-HAIP`_] | +-----------------------------------+-----------------------------------+ | x5c | Array containing the X.509 | | | certificate (and the entire chain | @@ -392,79 +205,77 @@ Header Payload ^^^^^^^ -+---------------------------+-------------------------------------------+ -| **key** | **value** | -+---------------------------+-------------------------------------------+ -|| iss || The public url of the Wallet | -|| || Instance attestation issuer. See | -|| || the example below in this section. | -+---------------------------+-------------------------------------------+ -|| sub || Thumbprint value | -|| || of the JWK of the Wallet Instance | -|| || for which the attestation is | -|| || being issued. | -+---------------------------+-------------------------------------------+ -|| iat || Unix timestamp of attestation | -|| || issuance time. | -+---------------------------+-------------------------------------------+ -|| exp || Unix timestamp regarding the | -|| || expiration date time. | -|| || A good practice to avoid security | -|| || problems is to have a limited | -|| || duration of the attestation. | -+---------------------------+-------------------------------------------+ -|| type || String: | -|| || "WalletInstanceAttestation". | -+---------------------------+-------------------------------------------+ -|| policy_uri || Url to the privacy policy | -|| || of the wallet. | -+---------------------------+-------------------------------------------+ -|| tos_uri || Url to the terms | -|| || of use of the Wallet Provider. | -+---------------------------+-------------------------------------------+ -|| logo_uri || Logo url of the Wallet Provider. | -+---------------------------+-------------------------------------------+ -|| asc || Attested security context: | -|| || Represents a level of "trust" of | -|| || the service containing a Level Of | -|| || Agreement defined in the metadata | -|| || of the Wallet Provider. | -+---------------------------+-------------------------------------------+ -|| cnf || This parameter contains the ``jwk`` | -|| || parameter | -|| || with the public key of the Wallet | -|| || necessary for the holder binding. | -+---------------------------+-------------------------------------------+ -|| authorization_endpoint || URL of the OP's OAuth 2.0 | -|| || Authorization Endpoint. | -+---------------------------+-------------------------------------------+ -|| response_types_supported || JSON array containing a list of | -|| || the OAuth 2.0 response_type values | -|| || that this OP supports. | -+---------------------------+-------------------------------------------+ -|| vp_formats_supported || JSON object containing | -|| || ``jwt_vp_json`` and ``jwt_vc_json`` | -|| || supported algorithms array. | -+---------------------------+-------------------------------------------+ -|| request_object_signing || JSON array containing a list of the | -|| _alg_values_supported || JWS signing algorithms (alg values) | -|| || supported by the OP for Request Objects. | -+---------------------------+-------------------------------------------+ -|| presentation_definition || Boolean value specifying whether the | -|| _uri_supported || Wallet Instance supports the transfer of | -|| || presentation_definition by | -|| || reference, with true indicating support. | -+---------------------------+-------------------------------------------+ ++---------------------------+------------------------------------------------+ +| **key** | **value** | ++---------------------------+------------------------------------------------+ +|| iss || The public url of the Wallet | +|| || Instance attestation issuer. See | +|| || the example below in this section. | ++---------------------------+------------------------------------------------+ +|| sub || Thumbprint value | +|| || of the JWK of the Wallet Instance | +|| || for which the attestation is | +|| || being issued. | ++---------------------------+------------------------------------------------+ +|| iat || Unix timestamp of attestation | +|| || issuance time. | ++---------------------------+------------------------------------------------+ +|| exp || Unix timestamp regarding the | +|| || expiration date time. | +|| || A good practice to avoid security | +|| || problems is to have a limited | +|| || duration of the attestation. | ++---------------------------+------------------------------------------------+ +|| type || String: | +|| || "WalletInstanceAttestation". | ++---------------------------+------------------------------------------------+ +|| policy_uri || URL to the privacy policy | +|| || of the wallet. | ++---------------------------+------------------------------------------------+ +|| tos_uri || URL to the terms | +|| || of use of the Wallet Provider. | ++---------------------------+------------------------------------------------+ +|| logo_uri || URL of the Wallet Provider logo in SVG format | ++---------------------------+------------------------------------------------+ +|| attested_security_context|| Attested security context: | +|| || Represents a level of "trust" of | +|| || the service containing a Level Of | +|| || Agreement defined in the metadata | +|| || of the Wallet Provider. | ++---------------------------+------------------------------------------------+ +|| cnf || This parameter contains the ``jwk`` | +|| || parameter | +|| || with the public key of the Wallet | +|| || necessary for the holder binding. | ++---------------------------+------------------------------------------------+ +|| authorization_endpoint || URL of the OP's OAuth 2.0 | +|| || Authorization Endpoint. | ++---------------------------+------------------------------------------------+ +|| response_types_supported || JSON array containing a list of | +|| || the OAuth 2.0 response_type values | +|| || that this OP supports. | ++---------------------------+------------------------------------------------+ +|| vp_formats_supported || JSON object containing | +|| || ``jwt_vp_json`` and ``jwt_vc_json`` | +|| || supported algorithms array. | ++---------------------------+------------------------------------------------+ +|| request_object_signing || JSON array containing a list of the | +|| _alg_values_supported || JWS signing algorithms (alg values) | +|| || supported by the OP for Request Objects. | ++---------------------------+------------------------------------------------+ +|| presentation_definition || Boolean value specifying whether the | +|| _uri_supported || Wallet Instance supports the transfer of | +|| || presentation_definition by | +|| || reference, with true indicating support. | ++---------------------------+------------------------------------------------+ .. note:: - The claim ``asc`` (Attested Security Context) is under discussion + The claim ``attested_security_context`` (Attested Security Context) is under discussion and must be intended as experimental. -Signature -^^^^^^^^^ +.. note:: -The Wallet Instance Attestation JWS is signed using the -private key of the Wallet Provider. + The Wallet Instance Attestation JWS is signed using the private key of the Wallet Provider. Below is an example of Wallet Instance Attestation: @@ -478,7 +289,7 @@ Below is an example of Wallet Instance Attestation: "eyJhbGciOiJFUz...jJLA", "eyJhbGciOiJFUz...H9gw", ], - "typ": "va+jwt", + "typ": "wallet-attestation+jwt", "x5c": ["MIIBjDCC ... XFehgKQA=="] } . @@ -489,7 +300,7 @@ Below is an example of Wallet Instance Attestation: "policy_uri": "https://wallet-provider.example.org/privacy_policy", "tos_uri": "https://wallet-provider.example.org/info_policy", "logo_uri": "https://wallet-provider.example.org/logo.svg", - "asc": "https://wallet-provider.example.org/LoA/basic", + "attested_security_context": "https://wallet-provider.example.org/LoA/basic", "cnf": { "jwk": @@ -520,28 +331,3 @@ Below is an example of Wallet Instance Attestation: "iat": 1687281195, "exp": 1687288395 } - - -Endpoints -~~~~~~~~~ -The Wallet Provider that issues the Wallet Instance Attestations must -make available a series of APIs in REST format that follow the OpenID -Federation standard. - -Metadata -^^^^^^^^ -A **GET /.well-known/openid-federation endpoint** for retrieving the Wallet -Provider Entity Configuration. - -Wallet Instance Attestation -^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -A second **POST /token** endpoint that takes two parameters as input: - -``grant_type`` which in our case is a string: -``urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation`` - -``assertion`` which contains the signed JWT of the Wallet Instance Attestation -Request. - -The response will then contain the Wallet Instance Attestation. diff --git a/en/_sources/wallet-solution.rst.txt b/en/_sources/wallet-solution.rst.txt index 328cf07be..119eb441d 100644 --- a/en/_sources/wallet-solution.rst.txt +++ b/en/_sources/wallet-solution.rst.txt @@ -62,6 +62,200 @@ Deactivation ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Users have the ability to deactivate the Wallet Instance voluntarily. This action removes the operational capabilities of the Wallet Instance and sets it to the deactivated state. Deactivation provides Users with control over access and usage according to their preferences. + +Wallet Provider Endpoints +^^^^^^^^^^^^^^^^^^^^^^^^^ + +The Wallet Provider that issues the Wallet Instance Attestations must +make available a series of APIs in REST format that follow the OpenID +Federation standard. + +Wallet Provider Metadata +~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +A **GET /.well-known/openid-federation endpoint** for retrieving the Wallet +Provider Entity Configuration. + +The Wallet Provider Entity Configuration is a JWS containing the public keys and supported algorithms of the Wallet Provider metadata definition. It is structured in accordance with the `OpenID Connect Federation `_ and the Trust Model section outlined in this specification. + +Header +^^^^^^ ++---------+-----------------------------------------------------------------+ +| **Key** | **Value** | ++---------+-----------------------------------------------------------------+ +| alg | Algorithm employed to verify the token signature (e.g., ES256). | ++---------+-----------------------------------------------------------------+ +| kid | Thumbprint of the public key used for signing. | ++---------+-----------------------------------------------------------------+ +| typ | Media type, here we use the entity-statement+jwt value. | ++---------+-----------------------------------------------------------------+ + +Payload +^^^^^^^ ++-----------------------------------+-----------------------------------+ +| **Key** | **Value** | ++-----------------------------------+-----------------------------------+ +| iss | Public URL of the Wallet | +| | Provider. | ++-----------------------------------+-----------------------------------+ +| sub | Public URL of the Wallet | +| | Provider. | ++-----------------------------------+-----------------------------------+ +| iat | Issuance datetime in | +| | Unix Timestamp format. | ++-----------------------------------+-----------------------------------+ +| exp | Expiration datetime | +| | in Unix Timestamp format. | ++-----------------------------------+-----------------------------------+ +| jwks | Contains an array of all public | +| | keys associated with the domain. | +| | These could match the Wallet | +| | Provider's keys. | ++-----------------------------------+-----------------------------------+ +| metadata | For each entity, this attribute | +| | houses its metadata. In this case,| +| | it contains the Wallet Provider's | +| | metadata within the | +| | ``wallet_provider`` attribute | +| | and the generic entity | +| | ``federation_entity``. | ++-----------------------------------+-----------------------------------+ + +Payload `wallet_provider` +~~~~~~~~~~~~~~~~~~~~~~~~~ + ++---------------------------------------------+---------------------------------------------------------------------+ +| **Key** | **Value** | ++---------------------------------------------+---------------------------------------------------------------------+ +| jwks | Contains an array of all the Wallet | +| | Provider's public keys. | ++---------------------------------------------+---------------------------------------------------------------------+ +| token_endpoint | Endpoint for obtaining the Wallet | +| | Instance Attestation. | ++---------------------------------------------+---------------------------------------------------------------------+ +| attested_security_context_values_supported | List of supported values for the | +| | certified security context. These | +| | values specify the security level | +| | of the app—low, medium, or high. | +| | An attested security context is | +| | defined by the proof that the | +| | Wallet Instance can send to the | +| | Wallet Provider. Note: this | +| | parameter is defined in this | +| | specification | ++---------------------------------------------+---------------------------------------------------------------------+ +| grant_types_supported | The types of grants supported by | +| | the endpoint token. It MUST be set to | +| | ``urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation`` | ++---------------------------------------------+---------------------------------------------------------------------+ +| token_endpoint_auth_methods_suppor | Supported authentication method for | +| ted | the endpoint token. | ++---------------------------------------------+---------------------------------------------------------------------+ +| token_endpoint_auth_signing_alg_va | List of supported signature | +| lues_supported | algorithms. | ++---------------------------------------------+---------------------------------------------------------------------+ + +.. note:: + The `asc_values_supported` parameter is experimental and under review. + +Payload `federation_entity` +~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + ++-------------------+----------------------------------------------+ +| **Key** | **Value** | ++-------------------+----------------------------------------------+ +| organization_name | Organization name. | ++-------------------+----------------------------------------------+ +| homepage_uri | Organization's website URL. | ++-------------------+----------------------------------------------+ +| tos_uri | URL to the terms of service. | ++-------------------+----------------------------------------------+ +| policy_uri | URL to the privacy policy. | ++-------------------+----------------------------------------------+ +| logo_uri | URL of the organization's logo in SVG format.| ++-------------------+----------------------------------------------+ + +Below a non-normative example of the Entity Configuration. + +.. code-block:: javascript + + { + "alg": "ES256", + "kid": "5t5YYpBhN-EgIEEI5iUzr6r0MR02LnVQ0OmekmNKcjY", + "typ": "entity-statement+jwt" + } + . + { + "iss": "https://wallet-provider.example.org", + "sub": "https://wallet-provider.example.org", + "jwks": { + "keys": [ + { + "crv": "P-256", + "kty": "EC", + "x": "qrJrj3Af_B57sbOIRrcBM7br7wOc8ynj7lHFPTeffUk", + "y": "1H0cWDyGgvU8w-kPKU_xycOCUNT2o0bwslIQtnPU6iM", + "kid": "5t5YYpBhN-EgIEEI5iUzr6r0MR02LnVQ0OmekmNKcjY" + } + ] + }, + "metadata": { + "wallet_provider": { + "jwks": { + "keys": [ + { + "crv": "P-256", + "kty": "EC", + "x": "qrJrj3Af_B57sbOIRrcBM7br7wOc8ynj7lHFPTeffUk", + "y": "1H0cWDyGgvU8w-kPKU_xycOCUNT2o0bwslIQtnPU6iM", + "kid": "5t5YYpBhN-EgIEEI5iUzr6r0MR02LnVQ0OmekmNKcjY" + } + ] + }, + "token_endpoint": "https://wallet-provider.example.org/token", + "attested_security_context_values_supported": [ + "https://wallet-provider.example.org/LoA/basic", + "https://wallet-provider.example.org/LoA/medium", + "https://wallet-provider.example.org/LoA/high" + ], + "grant_types_supported": [ + "urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation" + ], + "token_endpoint_auth_methods_supported": [ + "private_key_jwt" + ], + "token_endpoint_auth_signing_alg_values_supported": [ + "ES256", + "ES384", + "ES512" + ] + }, + "federation_entity": { + "organization_name": "PagoPa S.p.A.", + "homepage_uri": "https://wallet-provider.example.org", + "policy_uri": "https://wallet-provider.example.org/privacy_policy", + "tos_uri": "https://wallet-provider.example.org/info_policy", + "logo_uri": "https://wallet-provider.example.org/logo.svg" + } + }, + "iat": 1687171759, + "exp": 1709290159 + } + + +Wallet Instance Attestation +~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The **token** endpoint requires two parameters as input, in HTTP Post method: + +``grant_type`` which in our case is a string: +``urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation`` + +``assertion`` which contains the signed JWT of the Wallet Instance Attestation +Request. + +The response will then contain the Wallet Instance Attestation. + + External references ^^^^^^^^^^^^^^^^^^^^ ¹ Definitions are inherited from the EUDI Wallet Architecture and Reference Framework, version 1.1.0 at the time of writing. Please refer to `this page `_ for extended definitions and details. diff --git a/en/algorithms.html b/en/algorithms.html index 3be69e847..056c73244 100644 --- a/en/algorithms.html +++ b/en/algorithms.html @@ -579,7 +579,8 @@

{{ item.title }}

  • Introduction to SSI
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -606,31 +629,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -782,31 +874,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -606,31 +629,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -782,31 +874,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -606,31 +629,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -782,31 +874,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -606,31 +629,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -782,31 +874,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -604,31 +627,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -780,31 +872,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -605,31 +628,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -781,31 +873,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -956,31 +1117,77 @@

    Index of contentHigh-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • Same Device Flow
    • Remote Cross Device Flow
    • Authorization Request Details
      • -
    • Request Object Details
      • +
    • Request Object Details +
    • Request URI response
    • Authorization Response Details
    • Relying Party Entity Configuration
      • diff --git a/en/issuance.html b/en/issuance.html deleted file mode 100644 index 83ad2b479..000000000 --- a/en/issuance.html +++ /dev/null @@ -1,1305 +0,0 @@ - - - - - - - - Italian eIDAS Wallet Technical Specifications version: latest documentation | issuance.rst - - - - - - - - - - - - - - - - - - - - - -
      - - -
      -
      -
      - -
      -
      -

      - - Docs Italia - - beta - - -

      -

      Public documents, made digital.

      -
      -
      -
      -
      - - - Italian eIDAS Wallet Technical Specifications version: latest documentation - -
      -
      - -
      - - Project: - - Progetto demo - -
      - - -
      - - Administration: - - Organizzazione demo - -
      - -
      -
      -
      -
      -
      -
      -
      - -
      -
      - - -
      -
      - - - - About this document - - -
      -
      -
      - -
      -
      -
      -
      -
      - -
      -
      -
        - -
      -
      -
      -
      - - - -
      - - - Source - -
      -
      -
      - -
      - - - Actions - -
      -
      -
      -
      -
      -
      -
      -
      - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      -
      -
      - -
      - - - - - -
      -

      issuance.rst

      -

      [What is it]

      -

      [What it is usefull for]

      -

      [Example]

      -
      -

      General Properties

      -

      [TODO]

      -
      -
      -

      Requirements

      -
      -
        -

      • req 1

        • -

      • req 2

        • -
      -
      -
      -
      -

      Attributes

      -

      [Table with parameters/attributes]

      - ---- - - - - - - - - - - -

      Claim

      Description

      key

      value

      -
      -
      -

      Implementation considerations

      -

      TODO

      -
      -
      -

      Libraries and code snippets

      -

      TODO

      -
      -
      -

      External references

      -

      TODO

      -
      -
      - - - - - -
      - -
      -
      -
      - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/en/objects.inv b/en/objects.inv index 7b366d21a4c0401d850b06aa6627d6bf7d0a5676..658dd8239328a969b2ee7669810f58ac64d29412 100644 GIT binary patch delta 933 zcmV;W16usL2+0VLvVZ3*G-DR95DZ&(nWh7o0VcF%Sb7xe##T`*SCUim_vqz^WIGLI zW$Ql9Il7XrM0hDA)74QSrRgUs3WPr*(p%qG`pD6ZJU3dDk~9@7M&8w)6u;XBOHf)! z7(>J!50luW(yOV-fpD@1z5tWOHf(e7st~o7Y~Sig#bEUczJG{kq{YZQ%A1lW+1W65 zq*E{o2UY{c8f0A1$l;}Y7xG9nI|2Gi>aryzAW~CwBkB{>nu%J)a8r3x&@3`Jkyp^z zuRhy(99Y>(Vy&o^?;_-AExRzpb6tZy~Gk~R#W&B zvv*d1mbUhHHH3vzH;&MRGg715pPMcE<@BHjD5{zjrhiWN4HWEPe*J+s3OYmCoN?#y znBN3#IRx^q9F%Bc<4n#-$<*s1Mg`aymxTnrN=rM36qS9hkQOC3k-6o}J?Er_Ea=Ln zcGpZ6PtBq+Y2fl zCe(3iHh+x6r8L?yFYKk=Sy!eBMq5e(KeM{T4Uwj)D#2UVC`a1oBRt}r_o1Ejq5I&w z1lp^+0Gqv820jUYfG}rDt5|33^9mORZrA6xbdZ19+R)aPR#)b1$0M zrxxsSql}oh&Ji7iM80>KR-&{!ibQMk?(kQZw0{YyywL2r1UyRcN;?`HXt1Hd7qW0i zV`ih63DMH*k|Ny;sjr(KKbSQ-fdp38XiNPSJwck5c@{5At**?ABxWv@NE+>h-WUXS z!y$S`OO%uKL(e`Sv`r(V2AZ2Es)`|!CvDcpVi&vk!qsHYP2&?-S6f1;8gn1PD;a%qpu_?A@mc4y`}Pu`NgC}!E!&VB zmed*iaz0eHdmSWE#^~Q2;(#7(fX|yQ?vS0iU$>~2aKe!sdRI}wk^JK+3;`Vo4j_1S zA#*(Emk7E?#mlG0$Fx4zPG!D#7#_4Ml+0Z&i7T2_-}Td=CH3(ok`{lYvPb?4 H=8aqd8XCl3 delta 918 zcmV;H18Mxp2)YQ6vVZ$4G-DR95DZ&(nWh6-FcaD`EIq1q9jhpoE6EM{d-U={vYm#q zv+v`aqpPbc5q=Po>H4UU()0@zCBmN(8LS^`edOpyo?9&rlC(7|C*JIll)t+cOHf)! zm_o!J50luW(%IbPKsb2>z5ETE4Kglh{kDbAcLndj$`$?1s^q0vmAt-6XGI!QDW4Jsv2>mVF4 zr8!snCTPY z95l89dh%{E69nt3M$-`xIWnU_!MJY^VVL1!WIhz(My7IZ*&5c#Lj%bjyN)z`= zYE3Dkl{^UrMGb_mO`@eG*d!d1aMmj5sA$gdz#Xl=l#_pZ?Zm$cb)1@y|KX~cw9G5L zv_I?G41d9>r6lk(YYw<2(hOB4c;^P?MEi1tN4)bsw6{KVAAFZU2Xz-<^LOjOFTx)n z%$d?E)*1V}!kN|9d&!upTL8;bYuEt=b_T`(-sUyjd;gvsz{EaxV2>MR#JpgRs1g$S z*=0tF((Wh{t<7t~Us=*7r1HYB>l5%K!7J@)aDSk|h6Z2A!aa>yjbbK5OVcG~+6$?# zUmvf`9=(7Bc4*L!`YU>dG%xcaUY=TAnO8~7S}2h;>V?4=1oppU^n#WsCm()2`-srB zt&kdMVIH0;hDaW&`4Ed;?CQH!lSgg_kJfDw_Ms>_VaIC*oXf>Fx8FnTbN8D&WX(ed znSYZ;j$j^W388AueFSf0^vQt|2jHiZE*AUt5}-+%bfK1ANDf=-41PNwYCF9uNt7}A zcZaCZgAMR`^UWQzbNA^s^%71vlH=?uYdDgBJcS{k2f+aZXBRT3YkrNOe`M_X!Lb - - - - - - - Italian eIDAS Wallet Technical Specifications version: latest documentation | PID Data Model - - - - - - - - - - - - - - - - - - - - - -
      - - -
      -
      -
      - -
      -
      -

      - - Docs Italia - - beta - - -

      -

      Public documents, made digital.

      -
      -
      -
      -
      - - - Italian eIDAS Wallet Technical Specifications version: latest documentation - -
      -
      - -
      - - Project: - - Progetto demo - -
      - - -
      - - Administration: - - Organizzazione demo - -
      - -
      -
      -
      -
      -
      -
      -
      - -
      -
      - - -
      -
      - - - - About this document - - -
      -
      -
      - -
      -
      -
      -
      -
      - -
      -
      -
        - -
      -
      -
      -
      - - - -
      - - - Source - -
      -
      -
      - -
      - - - Actions - -
      -
      -
      -
      -
      -
      -
      -
      - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      -
      -
      - -
      - - - - - -
      -

      PID Data Model

      -

      The Person Identification Data (PID) is issued by the PID Provider following national laws and allows a natural person to be authenitcated and identified.

      -

      The User attributes carried in the Italian PID are:

      -
      -
        -

      • Current Family Name

        • -

      • Current First Name

        • -

      • Date of Birth

        • -

      • Place of Birth

        • -

      • Unique Identifier

        • -

      • Taxpayer identification number

        • -
      -
      -

      The italian PID is extended according to the OpenID Identity Assurance Profile [OIDC.IDA], that enables the binding of the PID to a national trust framework, giving all the evidence of the identity proofing procedures underlying the PID issuing in both remote and proximity flows.

      -

      The PID data format and the mechanism through which it is issued into the Wallet Instance and presented to a RP will be detailed in the next sections.

      -
      -

      SD-JWT

      -

      The PID is given as a Verifiable Credential with JSON payload based on the Selective Disclosure JWT format as specified in [draft-terbu-sd-jwt-vc-latest].

      -

      An SD-JWT is a JWT that MUST be signed using the Issuer's private key. The SD-JWT payload of the MUST contain the _sd_alg claim described in [SD-JWT]. Section 5.1.2. and other claims specified in this section, some of them may be selectively disclosable claims.

      -

      The claim _sd_alg indicates the hash algorithm used by the Issuer to generate the digests over the salts and the claim values. The _sd_alg claim MUST be set to one of the specified algorithms in Section Cryptographic Algorithms.

      -

      Selectively disclosable claims are omitted from the SD-JWT. Instead, the digests of the respective disclosures and decoy digests are contained as an array in a new JWT claim, _sd.

      -

      Each digest value ensures the integrity of, and maps to, the respective Disclosure. Digest values are calculated using a hash function over the disclosures, each of which contains

      -
      -
        -

      • a random salt,

        • -

      • the claim name (only when the claim is an object property),

        • -

      • the claim value.

        • -
      -
      -

      The Disclosures are sent to the Holder together with the SD-JWT in the Combined Format for Issuance that MUST be an ordered series of base64url-encoded values, each separated from the next by a single tilde ('~') character as follows:

      -
      <SD-JWT>~<Disclosure 1>~<Disclosure 2>~...~<Disclosure N>
-
      -
      -

      See [draft-terbu-sd-jwt-vc-latest] and [SD-JWT] for more details.

      -

      The JOSE header contains the following mandatory parameters:

      - ----- - - - - - - - - - - - - - - - - - - - - - - - - -

      Claim

      Description

      Reference

      typ

      MUST be set to vc+sd-jwt as defined in [draft-terbu-sd-jwt-vc-latest].

      [RFC7515, Section 4.1.9].

      alg

      Signature Algorithm.

      [RFC7515, Section 4.1.1].

      kid

      Unique identifier of the public key.

      [RFC7515, Section 4.1.8].

      trust_chain

      JSON array containing the trust chain that proves the reliability of the issuer of the JWT.

      [OIDC-FED, Section 3.2.1].

      -

      The following claims MUST be in the JWT payload and MUST NOT be included in the disclosures, i.e. cannot be selectively disclosed.

      - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

      Claim

      Description

      Reference

      iss

      The PID Provider identifier as URL string (the issuer of this JWT)

      [RFC7519, Section 4.1.1].

      sub

      Thumbprint of the JWK in the cnf parameter

      [RFC7519, Section 4.1.2].

      jti

      Unique Token ID identifier of this JWT. It SHOULD be a String in uuid4 format.

      [RFC7519, Section 4.1.7].

      iat

      UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in RFC 7519.

      [RFC7519, Section 4.1.6].

      exp

      UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in RFC 7519.

      [RFC7519, Section 4.1.4].

      status

      HTTPS URL where the credential validity status is available

      [SD-JWT-VC. Section 4.2.2.2].

      cnf

      JSON object containing the proof-of-possession key materials. By including a cnf (confirmation) claim in a JWT, the issuer of the JWT declares that the presenter is in control of the private key related to the public one defined in the cnf parameter. The recipient MUST cryptographically verify that the presenter is in control of that key.

      [RFC7800, Section 3.1].

      type

      Credential type as a string, MUST be set to eu.eudiw.pid.it.

      [draft-terbu-sd-jwt-vc-latest. Section 4.2.2.2].

      verified_claims

      JSON object containing the following sub-elements:

      -
      -
        -

      • verification;

        • -

      • claims.

        • -
      -
      -

      [OIDC.IDA. Section 5].

      -

      The verification claim contain the information as sub claims regarding the identity proofing evidence during the issuing phase of the PID. The claims parameter contains the user attributes claims. Some of these additional claims MAY be included in the Disclosures and MAY be selectively disclosed and they are given in the following tables that also specify whether a claim is selectively disclosable (SD) or not (NSD).

      -

      The verification claim is a JSON structure with all the following mandatory sub-claims.

      - ----- - - - - - - - - - - - - - - - - - - - - -

      Claim

      Description

      Reference

      trust_framework

      [NSD]. MUST be set to eidas

      [OID.IDA. Section 5.1]

      assurance_level

      [NSD]. MUST be set to high

      [OID.IDA. Section 5.1]

      evidence

      [SD]. JSON Array. Each element is the electronic evidence of the user identification during the PID issuing phase. It MUST contain at least the following claims:

      -
      -
        -

      • type: MUST be set to electronic_record

        • -

      • record: JSON object (see the table below)

        • -
      -
      -

      [OID.IDA. Section 5.1]

      -

      The record MUST have at least the following sub parameters:

      - ----- - - - - - - - - - - - - - - - - -

      Claim

      Description

      Reference

      type

      identification of the national eID framework used by the User. For example eidas.it.cie means that the CIE id identification scheme is used by the User.

      [OID.IDA. Section 5.1.1.2]

      source

      JSON Object cointaining the follwoing mandatory claims:

      -
        -

      • organization_name: Name of the Organization handling the eID used by the User

        • -

      • organization_id: Identification code for the Organization. It MUST be set to the IPA Code of the Organization

        • -

      • country_code: String representing country in [ISO3166-1] Alpha-2 (e.g., IT) or [ISO3166-3] syntax.

        • -
      -

      [OID.IDA. Section 5.1.1.2]

      -
      -

      Warning

      -

      Note that the sub-claims of the evidence parameter are not selectively disclosable separately, thus, for example, the User cannot give only the record type without disclosure the record source (organization name, identifier and country that hendles the User identity proofing).

      -
      -

      Finally, the claims parameter contains the following mandatory claims:

      - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

      Claim

      Description

      Reference

      given_name

      [SD]. Current First Name

      [OpenID Connect Core 1.0, Section 5.1]

      family_name

      [SD]. Current Family Name

      [OpenID Connect Core 1.0, Section 5.1]

      birthdate

      [SD]. Date of Birth

      [OpenID Connect Core 1.0, Section 5.1]

      place_of_birth

      [SD]. Place of Birth. JSON Object with the following subclaims:

      -
        -

      • country

        • -

      • locality

        • -
      -

      [OpenID Connect for Identity Assurance 1.0, Section 4]

      unique_id

      [SD]. Unique citizen identifier (ID ANPR) given by the National Register of the Resident Population (ANPR). It MUST be set according to ANPR rules

      This specification

      tax_id_number

      [SD]. National tax identification code of natural person as a String format. It MUST be set according to ETSI EN 319 412-1. For example TINIT-<ItalianTaxIdentificationNumber>

      This specification

      -
      -

      Non-normative examples

      -

      In the following, we provide a non-normative example of PID VC in JSON.

      -
      {
-"verified_claims": {
-    "verification": {
-      "trust_framework": "eidas",
-      "assurance_level": "high",
-      "evidence": [
-        {
-          "type": "electronic_record",
-          "record": {
-            "type": "eidas.it.cie",
-            "source": {
-              "organization_name": "Ministero dell'Interno",
-              "organization_id": "m_it",
-              "country_code": "IT"
-            }
-          }
-        }
-      ]
-    },
-    "claims": {
-      "unique_id":
-        "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
-      "given_name": "Mario",
-      "family_name": "Rossi",
-      "birthdate": "1980-01-10",
-      "place_of_birth": {
-        "country": "IT",
-        "locality": "Rome"
-      },
-      "tax_id_number": "TINIT-XXXXXXXXXXXXXXXX"
-    }
-  }
-}
-
      -
      -

      The corresponding SD-JWT verson for PID is given by

      -
      {
-   "typ":"vc+sd-jwt",
-   "alg":"RS512",
-   "kid":"dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw",
-   "trust_chain" : [
-    "NEhRdERpYnlHY3M5WldWTWZ2aUhm ...",
-    "eyJhbGciOiJSUzI1NiIsImtpZCI6 ...",
-    "IkJYdmZybG5oQU11SFIwN2FqVW1B ..."
-   ]
-}
-
      -
      -
      {
-  "iss": "https://pidprovider.example.org",
-  "sub": "NzbLsXh8uDCcd7noWXFZAfHkxZsRGC9Xs...",
-  "jti": "urn:uuid:6c5c0a49-b589-431d-bae7-219122a9ec2c",
-  "iat": 1541493724,
-  "exp": 1541493724,
-  "status": "https://pidprovider.example.org/status",
-  "cnf": {
-    "jwk": {
-      "kty": "RSA",
-      "use": "sig",
-      "n": "1Ta-sE …",
-      "e": "AQAB",
-      "kid": "YhNFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
-    }
-  },
-  "type": "PersonIdentificationData",
-  "verified_claims": {
-    "verification": {
-      "_sd": [
-        "OGm7ryXgt5Xzlevp-Hu-UTk0a-TxAaPAobqv1pIWMfw"
-      ],
-      "trust_framework": "eidas",
-      "assurance_level": "high"
-    },
-    "claims": {
-      "_sd": [
-        "8JjozBfovMNvQ3HflmPWy4O19Gpxs61FWHjZebU589E",
-        "BoMGktW1rbikntw8Fzx_BeL4YbAndr6AHsdgpatFCig",
-        "CFLGzentGNRFngnLVVQVcoAFi05r6RJUX-rdbLdEfew",
-        "JU_sTaHCngS32X-0ajHrd1-HCLCkpT5YqgcfQme168w",
-        "VQI-S1mT1Kxfq2o8J9io7xMMX2MIxaG9M9PeJVqrMcA",
-        "zVdghcmClMVWlUgGsGpSkCPkEHZ4u9oWj1SlIBlCc1o"
-      ]
-    }
-  },
-  "_sd_alg": "sha-256"
-}
-
      -
      -

      In the following the disclosure list is given

      -

      Claim evidence:

      -
        -

      • SHA-256 Hash: OGm7ryXgt5Xzlevp-Hu-UTk0a-TxAaPAobqv1pIWMfw

        • -

      • Disclosure: -WyIyR0xDNDJzS1F2ZUNmR2ZyeU5STjl3IiwgImV2aWRlbmNlIiwgW3sidHlw -ZSI6ICJlbGVjdHJvbmljX3JlY29yZCIsICJyZWNvcmQiOiB7InR5cGUiOiAi -ZWlkYXMuaXQuY2llIiwgInNvdXJjZSI6IHsib3JnYW5pemF0aW9uX25hbWUi -OiAiTWluaXN0ZXJvIGRlbGwnSW50ZXJubyIsICJvcmdhbml6YXRpb25faWQi -OiAibV9pdCIsICJjb3VudHJ5X2NvZGUiOiAiSVQifX19XV0

        • -

      • Contents: ["2GLC42sKQveCfGfryNRN9w", "evidence", [{"type": -"electronic_record", "record": {"type": "eidas.it.cie", -"source": {"organization_name": "Ministero dell'Interno", -"organization_id": "m_it", "country_code": "IT"}}}]]

        • -
      -

      Claim unique_id:

      -
        -

      • SHA-256 Hash: BoMGktW1rbikntw8Fzx_BeL4YbAndr6AHsdgpatFCig

        • -

      • Disclosure: -WyJlbHVWNU9nM2dTTklJOEVZbnN4QV9BIiwgInVuaXF1ZV9pZCIsICJ4eHh4 -eHh4eC14eHh4LXh4eHgteHh4eC14eHh4eHh4eHh4eHgiXQ

        • -

      • Contents: ["eluV5Og3gSNII8EYnsxA_A", "unique_id", -"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"]

        • -
      -

      Claim given_name:

      -
        -

      • SHA-256 Hash: zVdghcmClMVWlUgGsGpSkCPkEHZ4u9oWj1SlIBlCc1o

        • -

      • Disclosure: -WyI2SWo3dE0tYTVpVlBHYm9TNXRtdlZBIiwgImdpdmVuX25hbWUiLCAiTWFy -aW8iXQ

        • -

      • Contents: ["6Ij7tM-a5iVPGboS5tmvVA", "given_name", "Mario"]

        • -
      -

      Claim family_name:

      -
        -

      • SHA-256 Hash: VQI-S1mT1Kxfq2o8J9io7xMMX2MIxaG9M9PeJVqrMcA

        • -

      • Disclosure: -WyJlSThaV205UW5LUHBOUGVOZW5IZGhRIiwgImZhbWlseV9uYW1lIiwgIlJv -c3NpIl0

        • -

      • Contents: ["eI8ZWm9QnKPpNPeNenHdhQ", "family_name", "Rossi"]

        • -
      -

      Claim birthdate:

      -
        -

      • SHA-256 Hash: CFLGzentGNRFngnLVVQVcoAFi05r6RJUX-rdbLdEfew

        • -

      • Disclosure: -WyJRZ19PNjR6cUF4ZTQxMmExMDhpcm9BIiwgImJpcnRoZGF0ZSIsICIxOTgw -LTAxLTEwIl0

        • -

      • Contents: ["Qg_O64zqAxe412a108iroA", "birthdate", "1980-01-10"]

        • -
      -

      Claim place_of_birth:

      -
        -

      • SHA-256 Hash: JU_sTaHCngS32X-0ajHrd1-HCLCkpT5YqgcfQme168w

        • -

      • Disclosure: -WyJBSngtMDk1VlBycFR0TjRRTU9xUk9BIiwgInBsYWNlX29mX2JpcnRoIiwg -eyJjb3VudHJ5IjogIklUIiwgImxvY2FsaXR5IjogIlJvbWUifV0

        • -

      • Contents: -["AJx-095VPrpTtN4QMOqROA", "place_of_birth", {"country": -"IT", "locality": "Rome"}]

        • -
      -

      Claim tax_id_code:

      -
        -

      • SHA-256 Hash: 8JjozBfovMNvQ3HflmPWy4O19Gpxs61FWHjZebU589E

        • -

      • Disclosure: -WyJQYzMzSk0yTGNoY1VfbEhnZ3ZfdWZRIiwgInRheF9pZF9jb2RlIiwgIlRJ -TklULVhYWFhYWFhYWFhYWFhYWFgiXQ

        • -

      • Contents: ["Pc33JM2LchcU_lHggv_ufQ", "tax_id_code", -"TINIT-XXXXXXXXXXXXXXXX"]

        • -
      -

      The combined format for the PID issuance is given by

      -
      eyJhbGciOiAiRVMyNTYifQ.eyJpc3MiOiAiaHR0cHM6Ly9waWRwcm92aWRlci5pdCIsI
-CJpYXQiOiAxNjgzMDAwMDAwLCAiZXhwIjogMTg4MzAwMDAwMCwgInZlcmlmaWVkX2NsY
-WltcyI6IHsidmVyaWZpY2F0aW9uIjogeyJfc2QiOiBbIk9HbTdyeVhndDVYemxldnAtS
-HUtVVRrMGEtVHhBYVBBb2JxdjFwSVdNZnciXSwgInRydXN0X2ZyYW1ld29yayI6ICJla
-WRhcyIsICJhc3N1cmFuY2VfbGV2ZWwiOiAiaGlnaCJ9LCAiY2xhaW1zIjogeyJfc2QiO
-iBbIjhKam96QmZvdk1OdlEzSGZsbVBXeTRPMTlHcHhzNjFGV0hqWmViVTU4OUUiLCAiQ
-m9NR2t0VzFyYmlrbnR3OEZ6eF9CZUw0WWJBbmRyNkFIc2RncGF0RkNpZyIsICJDRkxHe
-mVudEdOUkZuZ25MVlZRVmNvQUZpMDVyNlJKVVgtcmRiTGRFZmV3IiwgIkpVX3NUYUhDb
-mdTMzJYLTBhakhyZDEtSENMQ2twVDVZcWdjZlFtZTE2OHciLCAiVlFJLVMxbVQxS3hmc
-TJvOEo5aW83eE1NWDJNSXhhRzlNOVBlSlZxck1jQSIsICJ6VmRnaGNtQ2xNVldsVWdHc
-0dwU2tDUGtFSFo0dTlvV2oxU2xJQmxDYzFvIl19fSwgIl9zZF9hbGciOiAic2hhLTI1N
-iJ9.gsvYGCpWbnx8Dkd5ofKq-MtZplFFV49uY42Yf9S3rZe_SPTjg_AWdpm4bvSOhNbe
-P0aMzFGtftSk3-3sufXBdw~WyIyR0xDNDJzS1F2ZUNmR2ZyeU5STjl3IiwgImV2aWRlb
-mNlIiwgW3sidHlwZSI6ICJlbGVjdHJvbmljX3JlY29yZCIsICJyZWNvcmQiOiB7InR5c
-GUiOiAiZWlkYXMuaXQuY2llIiwgInNvdXJjZSI6IHsib3JnYW5pemF0aW9uX25hbWUiO
-iAiTWluaXN0ZXJvIGRlbGwnSW50ZXJubyIsICJvcmdhbml6YXRpb25faWQiOiAibV9pd
-CIsICJjb3VudHJ5X2NvZGUiOiAiSVQifX19XV0~WyJlbHVWNU9nM2dTTklJOEVZbnN4Q
-V9BIiwgInVuaXF1ZV9pZCIsICJ4eHh4eHh4eC14eHh4LXh4eHgteHh4eC14eHh4eHh4e
-Hh4eHgiXQ~WyI2SWo3dE0tYTVpVlBHYm9TNXRtdlZBIiwgImdpdmVuX25hbWUiLCAiTW
-FyaW8iXQ~WyJlSThaV205UW5LUHBOUGVOZW5IZGhRIiwgImZhbWlseV9uYW1lIiwgIlJ
-vc3NpIl0~WyJRZ19PNjR6cUF4ZTQxMmExMDhpcm9BIiwgImJpcnRoZGF0ZSIsICIxOTg
-wLTAxLTEwIl0~WyJBSngtMDk1VlBycFR0TjRRTU9xUk9BIiwgInBsYWNlX29mX2JpcnR
-oIiwgeyJjb3VudHJ5IjogIklUIiwgImxvY2FsaXR5IjogIlJvbWUifV0~WyJQYzMzSk0
-yTGNoY1VfbEhnZ3ZfdWZRIiwgInRheF9pZF9jb2RlIiwgIlRJTklULVhYWFhYWFhYWFh
-YWFhYWFgiXQ
-
      -
      -
      -
      -
      -

      MDOC-CBOR

      -

      [TODO]

      -
      -
      - - - - - -
      - -
      -
      -
      - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/en/pid-eaa-data-model.html b/en/pid-eaa-data-model.html index c19d326dc..c72deffcb 100644 --- a/en/pid-eaa-data-model.html +++ b/en/pid-eaa-data-model.html @@ -579,7 +579,8 @@

      {{ item.title }}

    • Introduction to SSI
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -606,31 +629,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -782,31 +874,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution

    The italian PID is extended according to the OpenID Identity Assurance Profile [OIDC.IDA], that enables the binding of the PID to a national trust framework, giving all the evidence of the identity proofing procedures underlying the PID issuing in both remote and proximity flows.

    -

    The (Q)EAAs are issued by the (Q)EAA Issuers to a Wallet Instance and MUST be provided in SD-JWT-VC or mDOC CBOR data format. They MAY contain any (qualified) attributes, entitlement or any elettronic attestations.

    -

    The (Q)EAAs are extended according to the OpenID Identity Assurance Profile [OIDC.IDA], that allows the recipients to know the Authentic Sources where where the data comes from.

    +

    The (Q)EAAs are issued by (Q)EAA Issuers to a Wallet Instance and MUST be provided in SD-JWT-VC or mDOC CBOR data format.

    +

    The (Q)EAAs are extended according to the OpenID Identity Assurance Profile [OIDC.IDA], that allows the recipients to know the Authentic Sources where the data comes from.

    The PID/(Q)EAA data format and the mechanism through which a digital credential is issued to the Wallet Instance and presented to an RP is described in the following sections.

    SD-JWT

    -

    The PID/(Q)EAA is given as a Verifiable Credential with JSON payload based on the Selective Disclosure JWT format as specified in [draft-terbu-sd-jwt-vc-latest].

    +

    The PID/(Q)EAA is issued in the form of a digital credential. The digital credential format is Selective Disclosure JWT format as specified in [draft-terbu-sd-jwt-vc-latest].

    An SD-JWT is a JWT that MUST be signed using the Issuer's private key. The SD-JWT payload of the MUST contain the _sd_alg claim described in [SD-JWT]. Section 5.1.2. and other claims specified in this section, some of them may be selectively disclosable claims.

    The claim _sd_alg indicates the hash algorithm used by the Issuer to generate the digests over the salts and the claim values. The _sd_alg claim MUST be set to one of the specified algorithms in Section Cryptographic Algorithms.

    Selectively disclosable claims are omitted from the SD-JWT. Instead, the digests of the respective disclosures and decoy digests are contained as an array in a new JWT claim, _sd.

    @@ -1025,7 +1163,7 @@

    PID/(Q)EAA Verification field

    trust_framework

    -

    [NSD]. For PID credential it MUST be set to eidas. For (Q)EAA it MUST be set to eidas2.

    +

    [NSD]. It MUST be set to eidas.

    [OID.IDA. Section 5.1]

    assurance_level

    @@ -1033,7 +1171,7 @@

    PID/(Q)EAA Verification field[OID.IDA. Section 5.1]

    evidence

    -

    [SD]. JSON Array. Each element is the electronic evidence of the User identification during the PID issuance or, in the case of (Q)EAA, it represents the evidence of the Authentic Source that ensures the authenticity of the data conveyed by the (Q)EAA. It MUST contain at least the following claims:

    +

    [SD]. JSON Array. Each element is the electronic evidence of the User identification during the PID issuance or, in the case of (Q)EAA, with this evidence the Authentic Source assures the authenticity of the data conveyed in the (Q)EAA. It MUST contain at least the following claims:

    @@ -1129,8 +1267,8 @@

    PID Claims field -

    PID Non-normative examples

    -

    In the following, the non-normative example of a PID digital credential.

    +

    PID Non-normative Examples

    +

    In the following, the non-normative example of a PID.

    {
 "verified_claims": {
     "verification": {
@@ -1140,7 +1278,7 @@ 
    PID Non-normative examples        {
           "type": "electronic_record",
           "record": {
-            "type": "eidas.it.cie",
+            "type": "https://eudi.wallet.cie.gov.it",
             "source": {
               "organization_name": "Ministero dell'Interno",
               "organization_id": "m_it",
@@ -1230,7 +1368,7 @@ 
    PID Non-normative examplesOiAiTWluaXN0ZXJvIGRlbGwnSW50ZXJubyIsICJvcmdhbml6YXRpb25faWQi
 OiAibV9pdCIsICJjb3VudHJ5X2NvZGUiOiAiSVQifX19XV0

  • Contents: ["2GLC42sKQveCfGfryNRN9w", "evidence", [{"type": -"electronic_record", "record": {"type": "eidas.it.cie", +"electronic_record", "record": {"type": "https://eudi.wallet.cie.gov.it", "source": {"organization_name": "Ministero dell'Interno", "organization_id": "m_it", "country_code": "IT"}}}]]

    • @@ -1293,20 +1431,20 @@

    PID Non-normative examples

    (Q)EAA Non-normative examples

    -

    In the following, we provide a non-normative example of (Q)EAA VC in JSON.

    +

    In the following, we provide a non-normative example of (Q)EAA in JSON.

    {
 "verified_claims": {
     "verification": {
-      "trust_framework": "eidas2",
+      "trust_framework": "eidas",
       "assurance_level": "high",
       "evidence": [
         {
           "type": "electronic_record",
           "record": {
-            "type": "eidas.it.pdnd",
+            "type": "https://eudi.wallet.pdnd.gov.it",
             "source": {
               "organization_name": "Ragioneria Generale dello Stato",
-              "organization_id": "QLHCFC",
+              "organization_id": "urn:eudi:it:organization_id:ipa_code:QLHCFC",
               "country_code": "IT"
             }
           }
@@ -1327,11 +1465,11 @@ 
    (Q)EAA Non-normative examples}
    -

    The corresponding SD-JWT for the preivous data is represented as follow, as decoded JSON for both header and payload.

    +

    The corresponding SD-JWT for the previous data is represented as follow, as decoded JSON for both header and payload.

    {
    "typ":"vc+sd-jwt",
    "alg":"RS512",
-   "kid":"dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw",
+   "kid":"d126a6a856f7724560484fa9dc59d195",
    "trust_chain" : [
     "NEhRdERpYnlHY3M5WldWTWZ2aUhm ...",
     "eyJhbGciOiJSUzI1NiIsImtpZCI6 ...",
@@ -1350,10 +1488,11 @@ 
    (Q)EAA Non-normative examples  "cnf": {
     "jwk": {
       "kty": "RSA",
-      "use": "sig",
-      "n": "1Ta-sE …",
       "e": "AQAB",
-      "kid": "YhNFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
+      "use": "sig",
+      "kid": "d126a6a856f7724560484fa9dc59d195",
+      "alg": "RS256",
+      "n": "oians5wYCWk4wFtEStVYcn_xOw9edKMNGH33_q6_pBI0XaTY7P3apUgjO0ivk5c1NQAVY6PZmcPQ8P1Y0cBAC9STRmzvTvDQcOocLhVy2ZlcXTu39oOGLNra8_LQsaMA386lO_qMW4-uY6DbGZY4vHkScvAC9FIZYDPafqWBEQUNV2QOFMH5VPoihCTKHwMGXnZBatYObg57xSOUX-bvhO_sFMm3k4RvsXcr3MFojAhLfwutu_jK9k7N9KR_mNc5IpiOyhZw_sUmF6SamRqsSPp42KD10hPMW0YJTDMYxBdHrMFeSMHYIMY4oBBT43__a55zILI_CnIk4241wOvGvw"
     }
   },
   "type": "HealthInsuranceData",
@@ -1362,7 +1501,7 @@ 
    (Q)EAA Non-normative examples      "_sd": [
         "2jIR18gfeASHYGB27s7sS3S_iQ4xxFIxCRyiohrBfns"
       ],
-      "trust_framework": "eidas2",
+      "trust_framework": "eidas",
       "assurance_level": "high"
     },
     "claims": {
@@ -1379,7 +1518,7 @@ 
    (Q)EAA Non-normative examples}
    -

    In the following the disclosure list is given

    +

    In the following the disclosure list is given:

    Claim evidence:

     @@ -1435,8 +1574,8 @@

    (Q)EAA Non-normative examples["AJx-095VPrpTtN4QMOqROA", "tax_id_code", "TINIT-XXXXXXXXXXXXXXXX"]

    -

    The combined format for the PID issuance is given by

    -
    eyJ0eXAiOiJ2YytzZC1qd3QiLCJhbGciOiJSUzUxMiIsImtpZCI6ImQxMjZhNmE4NTZmNzcyNDU2MDQ4NGZhOWRjNTlkMTk1IiwidHJ1c3RfY2hhaW4iOlsiTkVoUmRFUnBZbmxIWTNNNVdsZFdUV1oyYVVobSAuLi4iLCJleUpoYkdjaU9pSlNVekkxTmlJc0ltdHBaQ0k2IC4uLiIsIklrSllkbVp5Ykc1b1FVMTFTRkl3TjJGcVZXMUIgLi4uIl19.eyJpc3MiOiJodHRwczovL2lzc3Vlci5leGFtcGxlLm9yZyIsInN1YiI6Ik56YkxzWGg4dURDY2Q3bm9XWEZaQWZIa3hac1JHQzlYcy4uLiIsImp0aSI6InVybjp1dWlkOjZjNWMwYTQ5LWI1ODktNDMxZC1iYWU3LTIxOTEyMmE5ZWMyYyIsImlhdCI6MTU0MTQ5MzcyNCwiZXhwIjoxNTQxNDkzNzI0LCJzdGF0dXMiOiJodHRwczovL2lzc3Vlci5leGFtcGxlLm9yZy9zdGF0dXMiLCJjbmYiOnsiandrIjp7Imt0eSI6IlJTQSIsInVzZSI6InNpZyIsIm4iOiIxVGEtc0Ug4oCmIiwiZSI6IkFRQUIiLCJraWQiOiJZaE5GUzNZbkM5dGppQ2FpdmhXTFZVSjNBeHdHR3pfOTh1UkZhcU1FRXMifX0sInR5cGUiOiJIZWFsdGhJbnN1cmFuY2VEYXRhIiwidmVyaWZpZWRfY2xhaW1zIjp7InZlcmlmaWNhdGlvbiI6eyJfc2QiOlsiMmpJUjE4Z2ZlQVNIWUdCMjdzN3NTM1NfaVE0eHhGSXhDUnlpb2hyQmZucyJdLCJ0cnVzdF9mcmFtZXdvcmsiOiJlaWRhczIiLCJhc3N1cmFuY2VfbGV2ZWwiOiJoaWdoIn0sImNsYWltcyI6eyJfc2QiOlsiMWl6dHE3Ym92NjR4VFliRGtXRmM0NF9WaldlMDI5aFpxWGVVSWxvcVVONCIsIkVOTm8zMWpmekZwOFkyRFcwUi1mSU1lV3dlN0VMR3ZHb0hNd01CcHUxNEUiLCJGVjJDRE5XdVRxVGdPSGFmdHZWYXVtQkYwT2xtbnl4TXN3eWY0dUl4cmhZIiwiZFpXanE3bUpTU1gtWFRJX0hXdUU4QjJ4NklkTTVsRS1kb0RfeUJwS0phbyIsImdIWWkxOWZyYkRfaTRCb2FXRU5PamMzbENuTWo0cGJHTlFjc0JqX1FNNFEiXX19LCJfc2RfYWxnIjoic2hhLTI1NiJ9.Dy8IdMBmzL5QSxAHiYTv9Fg0HhiI-AFIwL2slNEVI5iTxcne0reX2w-Bo78bY0UkOF5LHBLjGV_l5wbX6pvDY0v193ifp7KzJIpj2jUuQ-XR7RHng9RFdjKSj7urVYaseQxKA97vWcJxNX7bYKLQ6jKOdxl0CXmFdg00HTA1MnO7OPWdRiT7BlDyl0HfwQ-X08Yk23zX2Po90p1pBIWMlqnkfeZwQIWyz6LvFcK7OClEYlmzhtLR5QmYHbIbu9oGhn00hv0Q94TcheGpSm8WmfUjE-dV6YvfWtkcsTg7bjmawt6B4W_YMwV9pSmoC1euwO1svoyAdqxjGbInmLT4hA
+
    The combined format for the PID issuance is represented below:
    
+
    eyJ0eXAiOiJ2YytzZC1qd3QiLCJhbGciOiJSUzUxMiIsImtpZCI6ImQxMjZhNmE4NTZmNzcyNDU2MDQ4NGZhOWRjNTlkMTk1IiwidHJ1c3RfY2hhaW4iOlsiTkVoUmRFUnBZbmxIWTNNNVdsZFdUV1oyYVVobSAuLi4iLCJleUpoYkdjaU9pSlNVekkxTmlJc0ltdHBaQ0k2IC4uLiIsIklrSllkbVp5Ykc1b1FVMTFTRkl3TjJGcVZXMUIgLi4uIl19.eyJpc3MiOiJodHRwczovL2lzc3Vlci5leGFtcGxlLm9yZyIsInN1YiI6Ik56YkxzWGg4dURDY2Q3bm9XWEZaQWZIa3hac1JHQzlYcy4uLiIsImp0aSI6InVybjp1dWlkOjZjNWMwYTQ5LWI1ODktNDMxZC1iYWU3LTIxOTEyMmE5ZWMyYyIsImlhdCI6MTU0MTQ5MzcyNCwiZXhwIjoxNTQxNDkzNzI0LCJzdGF0dXMiOiJodHRwczovL2lzc3Vlci5leGFtcGxlLm9yZy9zdGF0dXMiLCJjbmYiOnsiandrIjp7Imt0eSI6IlJTQSIsImUiOiJBUUFCIiwidXNlIjoic2lnIiwia2lkIjoiZDEyNmE2YTg1NmY3NzI0NTYwNDg0ZmE5ZGM1OWQxOTUiLCJhbGciOiJSUzI1NiIsIm4iOiJvaWFuczV3WUNXazR3RnRFU3RWWWNuX3hPdzllZEtNTkdIMzNfcTZfcEJJMFhhVFk3UDNhcFVnak8waXZrNWMxTlFBVlk2UFptY1BROFAxWTBjQkFDOVNUUm16dlR2RFFjT29jTGhWeTJabGNYVHUzOW9PR0xOcmE4X0xRc2FNQTM4NmxPX3FNVzQtdVk2RGJHWlk0dkhrU2N2QUM5RklaWURQYWZxV0JFUVVOVjJRT0ZNSDVWUG9paENUS0h3TUdYblpCYXRZT2JnNTd4U09VWC1idmhPX3NGTW0zazRSdnNYY3IzTUZvakFoTGZ3dXR1X2pLOWs3TjlLUl9tTmM1SXBpT3loWndfc1VtRjZTYW1ScXNTUHA0MktEMTBoUE1XMFlKVERNWXhCZEhyTUZlU01IWUlNWTRvQkJUNDNfX2E1NXpJTElfQ25JazQyNDF3T3ZHdncifX0sInR5cGUiOiJIZWFsdGhJbnN1cmFuY2VEYXRhIiwidmVyaWZpZWRfY2xhaW1zIjp7InZlcmlmaWNhdGlvbiI6eyJfc2QiOlsiMmpJUjE4Z2ZlQVNIWUdCMjdzN3NTM1NfaVE0eHhGSXhDUnlpb2hyQmZucyJdLCJ0cnVzdF9mcmFtZXdvcmsiOiJlaWRhcyIsImFzc3VyYW5jZV9sZXZlbCI6ImhpZ2gifSwiY2xhaW1zIjp7Il9zZCI6WyIxaXp0cTdib3Y2NHhUWWJEa1dGYzQ0X1ZqV2UwMjloWnFYZVVJbG9xVU40IiwiRU5ObzMxamZ6RnA4WTJEVzBSLWZJTWVXd2U3RUxHdkdvSE13TUJwdTE0RSIsIkZWMkNETld1VHFUZ09IYWZ0dlZhdW1CRjBPbG1ueXhNc3d5ZjR1SXhyaFkiLCJkWldqcTdtSlNTWC1YVElfSFd1RThCMng2SWRNNWxFLWRvRF95QnBLSmFvIiwiZ0hZaTE5ZnJiRF9pNEJvYVdFTk9qYzNsQ25NajRwYkdOUWNzQmpfUU00USJdfX0sIl9zZF9hbGciOiJzaGEtMjU2In0.PrVt9qpf1WmfoRKncGXw6loKRANomsL-foXMqMUIyK2AO0tWM5laveqRet9Bb5A0fPq7rxNQLU57ngV3o8VzKLhFkbKm1_wtA5XuZXBfz0qGCmIP6tZQu9yAvXy162h6_i4FOINyHoL8i5mNPFTHFY0nBYTyVkCScfBC2Ccv4i7RSALbpbpviTpoYVBzFWtdOKuuMED5XwKpW9-VF_JK11yaJJ880walzu5tZ3XAOb0KkfUS3sCmSkKO5wMm1SeaS7xL5iiPSnAMTMrlmKE6qcwAkdDX-hNeGzncwBjHASTWb2udayK8Cal-wFGDWrRWGq3mU0rfuxMIFkjv4gdi8Q
 
    
 
    
 
diff --git a/en/pid-eaa-data.html b/en/pid-eaa-data.html
deleted file mode 100644
index 8adcaa9e0..000000000
--- a/en/pid-eaa-data.html
+++ /dev/null
@@ -1,1318 +0,0 @@
-
-
-
-
-  
-  
-  
-  Italian eIDAS Wallet Technical Specifications version: latest documentation | pid-eaa-data.rst
-
-  
-  
-  
-
-  
-  
-  
-  
-  
-
-  
-  
-  
-  
-  
-  
-
-
-
-  
-  
    
-  
-
-  
    
-    
    
-      
    
-        
-      
    
-      
    
-        
    
-          
-            Docs Italia
-            
-              beta
-            
-          
-        
    
-        
    Public documents, made digital.
    
-      
    
-    
    
-    
    
-      
    
-        
-        
-          Italian eIDAS Wallet Technical Specifications version: latest documentation
-        
-      
    
-      
    
-        
-        
    
-          
-          Project:
-          
-            Progetto demo
-          
-        
    
-        
-        
-        
    
-          
-          Administration:
-          
-            Organizzazione demo
-          
-        
    
-        
-      
    
-    
    
-  
    
-
    
-
    
-  
    
-    
    
-      
-    
    
-    
    
-      
-  
-    
    
-    
    
-      
-      
-        
-        About this document
-      
-      
-    
    
-    
    
-      
    
-        
-      
    
-    
    
-    
    
-      
    
-  
    
-    
-    
    
-      
    
-        
      
-          
-        
    
-      
    
-    
    
-  
    
-  
-  
-  
-  
    
-    
-        
-        Source
-    
-  
    
-
    
-    
    
-    
-    
    
-      
-        
-        Actions
-      
-    
    
-  
    
-  
    
-    
    
-      
    
-    
    
-  
    
-
    
-
-	
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-  
    
-    
    
-      
    
-        
-        
    
-          
-          
-            
-          
-          
-  
    
-
    pid-eaa-data.rst
    
-
    [What is it]
    
-
    [What it is usefull for]
    
-
    [Example]
    
-
    
-
    General Properties
    
-
    [TODO]
    
-
    
-
    
-
    Requirements
    
-
    
-
      
-
    • req 1
      • 
-
    • req 2
      • 
-
    
-
    
-
    
-
    
-
    Attributes
    
-
    [Table with parameters/attributes]
    
-
----
-
-
-
-
-
-
-
-
-
-
-
    



    Claim
    Description
    key
    value
    
-
    
-
    
-
    Implementation considerations
    
-
    TODO
    
-
    
-
    
-
    Libraries and code snippets
    
-
    TODO
    
-
    
-
    
-
    External references
    
-
    TODO
    
-
    
-
    
-
-
-          
-            
-            
-          
    
-
-        
    
-      
    
-  
    
-  
-  
-  
-  
-  
-
-
-
-
-
-  
-  
-  
-    
-  
-  
-  
-
-
-  
-
-
\ No newline at end of file
diff --git a/en/pid-eaa-issuance.html b/en/pid-eaa-issuance.html
index dffd272d0..61d28a65e 100644
--- a/en/pid-eaa-issuance.html
+++ b/en/pid-eaa-issuance.html
@@ -579,7 +579,8 @@ 
    {{ item.title }}
    
 
  • Introduction to SSI
    • 
 
 
-
  • Defined Terms
 
    • 
 
  • PID/(Q)EAA Data Model
 
    • 
@@ -606,31 +629,77 @@ 
    {{ item.title }}
    
 
  • High-Level PID flow
    • 
 
  • High-Level (Q)EAA flow
    • 
 
  • Detailed Flow
    • 
-
  • Pushed Authorization Request Endpoint
    • 
-
  • Authorization endpoint
    • 
-
  • Token endpoint
    • 
-
  • Credential endpoint
    • 
+
  • Pushed Authorization Request Endpoint
+
    • 
+
  • Authorization endpoint
+
    • 
+
  • Token endpoint
+
    • 
+
  • Credential endpoint
+
    • 
 
 
 
  • Wallet Solution
 
    • 
 
  • Wallet Instance Attestation
 
    • 
 
  • Relying Party Solution
 
    • 
-
  • Defined Terms
 
    • 
 
  • PID/(Q)EAA Data Model
 
    • 
@@ -782,31 +874,77 @@ 
    {{ item.title }}
    
 
  • High-Level PID flow
    • 
 
  • High-Level (Q)EAA flow
    • 
 
  • Detailed Flow
    • 
-
  • Pushed Authorization Request Endpoint
    • 
-
  • Authorization endpoint
    • 
-
  • Token endpoint
    • 
-
  • Credential endpoint
    • 
+
  • Pushed Authorization Request Endpoint
+
    • 
+
  • Authorization endpoint
+
    • 
+
  • Token endpoint
+
    • 
+
  • Credential endpoint
+
    • 
 
 
 
  • Wallet Solution
 
    • 
 
  • Wallet Instance Attestation
 
    • 
 
  • Relying Party Solution
      
 
    • Same Device Flow
      • 
 
    • Remote Cross Device Flow
      • 
 
    • Authorization Request Details
      • 
-
    • Request Object Details
      • 
+
    • Request Object Details
+
      • 
 
    • Request URI response
      • 
 
    • Authorization Response Details
      • 
 
    • Relying Party Entity Configuration
      • 
@@ -878,7 +1016,7 @@ 
      {{ item.title }}
      
           
   
      
 
      PID/(Q)EAA Issuance
      
-
      This section describes the issuance flow for the PID and (Q)EAAs that require a high security implementation profile.
+
      This section describes the PID and (Q)EAAs issuance flow with an high level of security.
 The relevant entities and interfaces involved in the issuance flow are:
      
 
      
 
        
@@ -894,7 +1032,7 @@ 
        {{ item.title }}
        
 
      
 
 
    • National IdP: It represents preexisting identity systems based on SAML2 or OpenID Connect, already in production in each Member State (for Italy SPID and CIE id authentication schemed notified eIDAS with LoA High, see SPID/CIE OpenID Connect Specifications).
      • 
-
    • (Q)EAA Issuer: It represents the issuer of (Q)EAAs. It is composed of:
      
+
    • (Q)EAA Issuer: It represents the Issuer of (Q)EAAs. It is composed of:
      
 
        
 
      • OpenID4VCI Component: based on the “OpenID for Verifiable Credential Issuance” specification  [OIDC4VCI. Draft 13] to release (Q)EAAs.
        • 
 
      • Relying Party: It represents the component to authenticate the User with the PID. The (Q)EAA Issuer acts as a verifier and it sends a presentation request to the Wallet Instance according to [OpenID4VP]. The Wallet Instance MUST have a valid PID obtained prior to starting a transaction with the (Q)EAA Issuer.
        • 
@@ -916,7 +1054,7 @@ 
        High-Level PID flow[OIDC4VCI. Draft 13] the Wallet Instance requests a PID to the PID Provider. A fresh key pairs is generated by the Wallet Instance, the public key is used by PID Provider for the key binding of the PID. The PID Provider checks the Wallet Instance by means of the Wallet Attestation and the Trust Chain related to the Wallet Provider
        
+
      • PID request: following the Authorization Code Flow in [OIDC4VCI. Draft 13] the Wallet Instance requests a PID to the PID Provider. A fresh key pairs is generated by the Wallet Instance, the public key is used by PID Provider for the key binding of the PID. The PID Provider checks the Wallet Instance by means of the Wallet Attestation and the Trust Chain related to the Wallet Provider.
        • 
 
      • End-user authentication: the PID Provider authenticates the End-User with LoA High, acting as an IAM Proxy to the National eID system.
        • 
 
      • PID issuance: once the User authentication with LoA High happens, the User gives their consent, and the PID Provider releases a PID bound to the key material held by the requesting Wallet Instance.
        • 
 
@@ -925,10 +1063,10 @@ 
        High-Level PID flow
 
        High-Level (Q)EAA flow
        
-
        The Fig. 3 shows a general architecture and highlights the main operations involved in the issuance of a (Q)EAA, under the main following assumptions:
        
+
        The Fig. 3 shows a general architecture and highlights the main operations involved in the issuance of a (Q)EAA, following the assumptions listed below:
        
 
        
 
          
-
        • the User has a valid PID stored in its own Wallet Instance;
          • 
+
        • the User has a valid PID stored in their own Wallet Instance;
          • 
 
        • the (Q)EAA requires a high security implementation profile.
          • 
 
        
 
        
@@ -942,9 +1080,9 @@ 
        High-Level (Q)EAA flow
          
 
        1. Obtaining the trusted (Q)EAA Issuer: the Wallet Instance queries the Trust Anchor to fetch the trusted (Q)EAA Issuer.
          2. 
 
        2. Obtaining of (Q)EAA Issuer metadata: the Wallet Instance establishes the trust to the (Q)EAA Issuer according to the Trust Model, obtaining the Metadata that discloses the formats of the (Q)EAA, the algorithms supported, and any other parameter required for interoperability needs.
          3. 
-
        3. (Q)EAA request: following the Authorization Code Flow in [OIDC4VCI. Draft 13] the Wallet Instance requests a (Q)EAA to the (Q)EAA Issuer. A fresh key pairs is generated by the Wallet Instance, the public key is used by (Q)EAA Issuer for the key binding of the (Q)EAA. The (Q)EAA Issuer checks the Wallet Instance by means of the Wallet Attestation and the Trust Chain related to the Wallet Provider
          4. 
-
        4. End-user authentication: the (Q)EAA Issuer authenticates the User with the PID owned by the User, acting as a verifier (Relying Party).
          5. 
-
        5. (Q)EAA issuance: once the User authentication with a valid PID happens, the User gives their consent, and the (Q)EAA Issuer releases a (Q)EAA bound to the key material held by the requesting Wallet Instance.
          6. 
+
        6. (Q)EAA request: following the Authorization Code Flow in [OIDC4VCI. Draft 13] the Wallet Instance requests a (Q)EAA to the (Q)EAA Issuer. A fresh key pairs is generated by the Wallet Instance, the public key is used by (Q)EAA Issuer for the key binding of the (Q)EAA. The (Q)EAA Issuer checks the Wallet Instance by means of the Wallet Attestation and the Trust Chain related to the Wallet Provider.
          7. 
+
        7. End-user authentication: the (Q)EAA Issuer, acting as a verifier (Relying Party), authenticates the User with the PID.
          8. 
+
        8. (Q)EAA issuance: once the User has been authenticated with a valid PID, the User gives their consent, then the (Q)EAA Issuer releases a (Q)EAA bound to the key material held by the requesting Wallet Instance.
          9.
    • @@ -964,9 +1102,9 @@

    Detailed Flow

    Note

    -

    Federation Check: The Wallet Instance needs to check if the PID/(Q)EAA Issuer is part of Federation, obtaining then its protocol specific metadata. A non-normative example of a response from the endpoint .well-known/openid-federation with the Entity Configuration and the Metadata of the PID/(Q)EAA Issuer is represented within the section Entity Configuration Credential Issuer.

    +

    Federation Check: The Wallet Instance needs to check if the PID/(Q)EAA Issuer is part of the Federation, obtaining then its protocol specific metadata. A non-normative example of a response from the endpoint .well-known/openid-federation with the Entity Configuration and the Metadata of the PID/(Q)EAA Issuer is represented within the section Entity Configuration Credential Issuer.

    -

    Steps 5-6 (PAR Request): The Wallet Instance creates a PKCE code verifier that sends in a pushed authorization request, using the request parameter (see RFC 9126 Section 3) to the PID/(Q)EAA Issuer PAR endpoint. The Wallet Instance signs the request using its private key. A OAuth2 client authentication method MUST be involved, since in this flow the pushed authorization endpoint is a protected endpoint. The client authentication is based on the model defined in [RFC 7521] using the Wallet Instance Attestation JWS inside the client_assertion parameter. The authorization_details [RAR RFC 9396] parameter is extended to allow Wallet Instance to specify the types of the credentials when requesting authorization for the PID/(Q)EAA issuance.

    +

    Steps 5-6 (PAR Request): The Wallet Instance creates a PKCE code verifier that sends in a pushed authorization request, using the request parameter (see RFC 9126 Section 3) to the PID/(Q)EAA Issuer PAR endpoint. The Wallet Instance signs the request using its private key. A OAuth2 client authentication method is involved, since in this flow the pushed authorization endpoint is a protected endpoint. The client authentication is based on the model defined in [RFC 7521] using the Wallet Instance Attestation JWS inside the client_assertion parameter. The authorization_details [RAR RFC 9396] parameter is extended to allow Wallet Instance to specify the types of the credentials when requesting authorization for the PID/(Q)EAA issuance.

    Below a non-normative example of the PAR.

    POST /as/par HTTP/1.1
 Host: pid-provider.example.org
@@ -1032,7 +1170,7 @@ 
    Detailed Flow
 
    Note
    
 
    User Authentication and Consent: The PID Provider performs the User authentication based on the requirements of eIDAS LoA High by means of national notified eIDAS scheme and requires the User consent for the PID issuance.
-The (Q)EAA Issuer performs the User authentication requesting a valid PID to the Wallet Instance. The (Q)EAA Issuer MUST use [OpenID4VP] to dynamically request presentation of the PID. From a protocol perspective, the (Q)EAA Issuer then acts as a verifier and sends a presentation request to the Wallet Instance. The Wallet Instance MUST have a valid PID obtained prior to starting a transaction with the (Q)EAA Issuer.
    
+The (Q)EAA Issuer performs the User authentication requesting a valid PID to the Wallet Instance. The (Q)EAA Issuer MUST use [OpenID4VP] to dynamically request the presentation of the PID. From a protocol perspective, the (Q)EAA Issuer then acts as a verifier and sends a presentation request to the Wallet Instance. The Wallet Instance MUST have a valid PID obtained prior to starting a transaction with the (Q)EAA Issuer.

    Steps 10-11 (Authorization Response): The PID/(Q)EAA Issuer sends an authorization code to the Wallet Instance.

    @@ -1043,7 +1181,7 @@

    Detailed FlowLocation: eudiw://start.wallet.example.org?code=SplxlOBeZQQYbYS6WxSbIA&state=fyZiOL9Lf2CeKuNT2JzxiLRDink0uPcd&iss=https%3A%2F%2Fpid-provider.example.org

    -

    Steps 12-13 (DPoP Proof for Token Endpoint): The Wallet Instance creates a key for DPoP and a fresh DPoP proof for the token request to the PID/(Q)EAA Issuer. DPoP provides a way to bind the access token to a certain sender (Wallet Instance) [DPoP-draft16]. This mitigates the misuse of leaked or stolen Access Tokens at the Credential Endpoint of PID/(Q)EAA Issuer as the attacker needs to present a valid DPoP proof.

    +

    Steps 12-13 (DPoP Proof for Token Endpoint): The Wallet Instance creates a key for DPoP and a fresh DPoP proof for the token request to the PID/(Q)EAA Issuer. DPoP provides a way to bind the Access Token to a certain sender (Wallet Instance) [DPoP-draft16]. This mitigates the misuse of leaked or stolen Access Tokens at the Credential Endpoint of PID/(Q)EAA Issuer as the attacker needs to present a valid DPoP proof.

    Step 14 (Token Request): The Wallet Instance sends a token request to the PID/(Q)EAA Issuer token endpoint using the authorization code, code_verifier, DPoP proof and private_key_jwt.

    POST /token HTTP/1.1
 Host: pid-provider.example.org
@@ -1065,7 +1203,7 @@ 
    Detailed Flow
    HTTP/1.1 200 OK
 Content-Type: application/json
 Cache-Control: no-store
@@ -1079,8 +1217,8 @@ 
    Detailed Flow}
    -

    Steps 16-18 (DPoP Proof for Credential Endpoint): The Wallet Instance creates a new key pair to which the new credential SHALL be bound. Then, it creates a proof of possession with the new key and the c_nonce obtained in Step 15 and it creates a DPoP proof for the request to the PID/(Q)EAA credential issuance endpoint.

    -

    Step 19 (Credential Request): The Wallet Instance sends a PID/(Q)EAA issuance request to the PID/(Q)EAA credential endpoint. It contains the access token, the DPoP proof, the credential type, the proof (proof of possession of the key) and the format.

    +

    Steps 16-18 (DPoP Proof for Credential Endpoint): The Wallet Instance SHOULD create a new key pair to which the new credential SHALL be bound. Then, it creates a proof of possession with the new key and the c_nonce obtained in Step 15 and it creates a DPoP proof for the request to the PID/(Q)EAA credential issuance endpoint.

    +

    Step 19 (Credential Request): The Wallet Instance sends a PID/(Q)EAA issuance request to the PID/(Q)EAA credential endpoint. It contains the Access Token, the DPoP proof, the credential type, the proof (proof of possession of the key) and the format.

    Note

    PID Credential Schema and Status registration: The PID/(Q)EAA Issuer MUST register all the issued credentials for their later revocation, if needed.

    @@ -1126,7 +1264,7 @@

    Detailed Flow}

    -

    Steps 20-22 (Credential Response): The PID/(Q)EAA Issuer checks the DPoP proof and whether the access token is valid and suitable for the requested PID/(Q)EAA. It also checks the proof of possession for the key material the new credential SHALL be bound to. If all checks succeed, the PID/(Q)EAA Issuer creates a new credential bound to the key material and sends it to the Wallet Instance. The Wallet Instance MUST perform the PID/(Q)EAA integrity and authenticity checks before proceeding with the secure storage of the credential.

    +

    Steps 20-22 (Credential Response): The PID/(Q)EAA Issuer checks the DPoP proof and whether the Access Token is valid and suitable for the requested PID/(Q)EAA. It also checks the proof of possession for the key material the new credential SHALL be bound to. If all checks succeed, the PID/(Q)EAA Issuer creates a new credential bound to the key material and sends it to the Wallet Instance. The Wallet Instance MUST perform the PID/(Q)EAA integrity and authenticity checks before proceeding with the secure storage of the credential.

    HTTP/1.1 200 OK
 Content-Type: application/json
 Cache-Control: no-store
@@ -1392,12 +1530,12 @@ 
    Authorization Response
 
    Token endpoint
    
 
    The token endpoint is used by the Wallet Instance
-to obtain an access token by presenting its authorization grant, as
+to obtain an Access Token by presenting its authorization grant, as
 defined in RFC 6749.
    
 
    
 
    Token Request
    
 
    The request to the PID/(Q)EAA Token endpoint MUST be an HTTP request with method POST, where its body message is encoded in application/x-www-form-urlencoded format. The Wallet Instance sends the Token endpoint request with private_key_jwt authentication and a DPoP proof containing the mandatory parameters, defined in the table below.
    
-
    The Token endpoint MUST accept and validate the DPoP proof sent in the DPoP HTTP header. The Token endpoint MUST validate the DPoP proof according to Section 4.3 of the DPoP specifications [DPoP-draft16]. Thus, this mitigates the misuse of leaked or stolen access tokens at the credential endpoint. If the DPoP proof is invalid, the Token endpoint returns an error response, according to Section 5.2 of [RFC 6749] with invalid_dpop_proof as the value of the error parameter.
    
+
    The Token endpoint MUST accept and validate the DPoP proof sent in the DPoP HTTP header. The Token endpoint MUST validate the DPoP proof according to Section 4.3 of the DPoP specifications [DPoP-draft16]. Thus, this mitigates the misuse of leaked or stolen Access Tokens at the credential endpoint. If the DPoP proof is invalid, the Token endpoint returns an error response, according to Section 5.2 of [RFC 6749] with invalid_dpop_proof as the value of the error parameter.
    
 @@ -1576,7 +1714,7 @@ 
    Access TokenRFC 9068], [RFC 7519] and [OpenID.Core#SubjectIDTypes].
    
 
 
    
-
+
@@ -1596,7 +1734,7 @@ 
    Access TokenRFC 9068], [RFC 7519].
    
 
    
-
+
@@ -1608,7 +1746,7 @@ 
    Credential endpointOPENID4VCI.
    
 
    
 
    Credential Request
    
-
    A Wallet Instance makes a PID/(Q)EAA Request to the PID/(Q)EAA Credential endpoint by sending the following mandatory parameters in the entity-body of an HTTP POST request using the application/json media type.
+
    The Wallet Instance when requests the PID/(Q)EAA to the PID/(Q)EAA Credential endpoint, MUST use the following parameters in the entity-body of the HTTP POST request, using the application/json media type.
 The Credential endpoint MUST accept and validate the DPoP proof sent in the DPoP field of the Header based on the steps defined in Section 4.3 of [DPoP-draft16]. The DPoP proof in addition to the values that are defined in the Token Endpoint section MUST contain the following claim:
    
 
    
 
    
 
    The JWT proof type MUST contain the following parameters for the JOSE header and the JWT body:
    
 
    
 
 

    client_id
    MUST be set to the jwk value in the cnf parameter inside the Wallet Instance Attestation.
    It MUST be set to the jwk value in the cnf parameter, as taken in the Wallet Instance Attestation.
    		
 
    [RFC 9068].
    		
 
    
 
    aud
    
 
    jkt
    JWK SHA-256 Thumbprint Confirmation Method. The value of the jkt member MUST be the base64url encoding (as defined in [RFC7515]) of the JWK SHA-256 Thumbprint of the DPoP public key (in JWK format) to which the access token is bound.
    JWK SHA-256 Thumbprint Confirmation Method. The value of the jkt member MUST be the base64url encoding (as defined in [RFC7515]) of the JWK SHA-256 Thumbprint of the DPoP public key (in JWK format) to which the Access Token is bound.
    		
 
    [DPoP-draft16. Section 6.1] and [RFC 7638].
    		
 
    
 
    
@@ -1794,7 +1932,7 @@ 
    Credential Response
-
-
-  
-  
-  
-  Italian eIDAS Wallet Technical Specifications version: latest documentation | pid-eaa-mdoc-cbor.rst
-
-  
-  
-  
-
-  
-  
-  
-  
-  
-
-  
-  
-  
-  
-  
-  
-
-
-
-  
-  
    
-  
-
-  
    
-    
    
-      
    
-        
-      
    
-      
    
-        
    
-          
-            Docs Italia
-            
-              beta
-            
-          
-        
    
-        
    Public documents, made digital.
    
-      
    
-    
    
-    
    
-      
    
-        
-        
-          Italian eIDAS Wallet Technical Specifications version: latest documentation
-        
-      
    
-      
    
-        
-        
    
-          
-          Project:
-          
-            Progetto demo
-          
-        
    
-        
-        
-        
    
-          
-          Administration:
-          
-            Organizzazione demo
-          
-        
    
-        
-      
    
-    
    
-  
    
-
    
-
    
-  
    
-    
    
-      
-    
    
-    
    
-      
-  
-    
    
-    
    
-      
-      
-        
-        About this document
-      
-      
-    
    
-    
    
-      
    
-        
-      
    
-    
    
-    
    
-      
    
-  
    
-    
-    
    
-      
    
-        
      
-          
-        
    
-      
    
-    
    
-  
    
-  
-  
-  
-  
    
-    
-        
-        Source
-    
-  
    
-
    
-    
    
-    
-    
    
-      
-        
-        Actions
-      
-    
    
-  
    
-  
    
-    
    
-      
    
-    
    
-  
    
-
    
-
-	
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-  
    
-    
    
-      
    
-        
-        
    
-          
-          
-            
-          
-          
-  
    
-
    pid-eaa-mdoc-cbor.rst
    
-
    [What is it]
    
-
    [What it is usefull for]
    
-
    [Example]
    
-
    
-
    General Properties
    
-
    [TODO]
    
-
    
-
    
-
    Requirements
    
-
    
-
      
-
    • req 1
      • 
-
    • req 2
      • 
-
    
-
    
-
    
-
    
-
    Attributes
    
-
    [Table with parameters/attributes]
    
-
    
----
-
-
-
-
-
-
-
-
-
-
-
    



    Claim
    Description
    key
    value
    
-
    
-
    
-
    Implementation considerations
    
-
    TODO
    
-
    
-
    
-
    Libraries and code snippets
    
-
    TODO
    
-
    
-
    
-
    External references
    
-
    TODO
    
-
    
-
-
-
-          
-            
-            
-
    - -
    - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/en/pid-eaa-sd-jwt.html b/en/pid-eaa-sd-jwt.html deleted file mode 100644 index 9ee7a2e96..000000000 --- a/en/pid-eaa-sd-jwt.html +++ /dev/null @@ -1,1318 +0,0 @@ - - - - - - - - Italian eIDAS Wallet Technical Specifications version: latest documentation | pid-eaa-sd-jwt.rst - - - - - - - - - - - - - - - - - - - - - -
    - - -
    -
    -
    - -
    -
    -

    - - Docs Italia - - beta - - -

    -

    Public documents, made digital.

    -
    -
    -
    -
    - - - Italian eIDAS Wallet Technical Specifications version: latest documentation - -
    -
    - -
    - - Project: - - Progetto demo - -
    - - -
    - - Administration: - - Organizzazione demo - -
    - -
    -
    -
    -
    -
    -
    -
    - -
    -
    - - -
    -
    - - - - About this document - - -
    -
    -
    - -
    -
    -
    -
    -
    - -
    -
    -
      - -
    -
    -
    -
    - - - -
    - - - Source - -
    -
    -
    - -
    - - - Actions - -
    -
    -
    -
    -
    -
    -
    -
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    -
    -
    - -
    - - - - - -
    -

    pid-eaa-sd-jwt.rst

    -

    [What is it]

    -

    [What it is usefull for]

    -

    [Example]

    -
    -

    General Properties

    -

    [TODO]

    -
    -
    -

    Requirements

    -
    -
      -

    • req 1

      • -

    • req 2

      • -
    -
    -
    -
    -

    Attributes

    -

    [Table with parameters/attributes]

    - ---- - - - - - - - - - - -

    Claim

    Description

    key

    value

    -
    -
    -

    Implementation considerations

    -

    TODO

    -
    -
    -

    Libraries and code snippets

    -

    TODO

    -
    -
    -

    External references

    -

    TODO

    -
    -
    - - - - - -
    - -
    -
    -
    - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/en/pid-issuance.html b/en/pid-issuance.html deleted file mode 100644 index dc50ed783..000000000 --- a/en/pid-issuance.html +++ /dev/null @@ -1,2209 +0,0 @@ - - - - - - - - Italian eIDAS Wallet Technical Specifications version: latest documentation | PID Issuance - - - - - - - - - - - - - - - - - - - - - -
    - - -
    -
    -
    - -
    -
    -

    - - Docs Italia - - beta - - -

    -

    Public documents, made digital.

    -
    -
    -
    -
    - - - Italian eIDAS Wallet Technical Specifications version: latest documentation - -
    -
    - -
    - - Project: - - Progetto demo - -
    - - -
    - - Administration: - - Organizzazione demo - -
    - -
    -
    -
    -
    -
    -
    -
    - -
    -
    - - -
    -
    - - - - About this document - - -
    -
    -
    - -
    -
    -
    -
    -
    - -
    -
    -
      - -
    -
    -
    -
    - - - -
    - - - Source - -
    -
    -
    - -
    - - - Actions - -
    -
    -
    -
    -
    -
    -
    -
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    -
    -
    - -
    - - - - - -
    -

    PID Issuance

    -

    The relevant entities and interfaces involved in the issuance flow are:

    -
    -
      -

    • Wallet Provider: It represents an organization (public or private) that is responsible for the release of an eIDAS-compliant EUDI Wallet Solution. It also issues thes Wallet Instance Attestation to its Wallet Instances by means of an Attestation Service. The Wallet Attestation certifies the genuinity and authenticity of the Wallet Instance and its compliance with a Trust Framework in compliance to the security and privacy requirements.

      • -

    • Wallet Solution: It represents the entire product and service owned by a Wallet Provider, offered to all Users of that solution. A Wallet Solution must be certified as being EUDI-compliant by a Conformity Assessment Body (CAB).

      • -

    • Wallet Instance: instance of a Wallet Solution, installed on User's device. It provides interfaces for User interaction with the Wallet Provider, Relying Parties, PID and (Q)EAA Providers.

      • -

    • PID Provider: It represents the issuer of eIDAS Person Identification Data (PID). It is composed of:

      -
      -
        -

      • OpenID4VCI Component: based on the “OpenID for Verifiable Credential Issuance” specification [OIDC4VCI. Draft 13] to release PID credentials.

        • -

      • National eID Relying Party (OpenID Connect or SAML2): It represents the component to authenticate the End-User with the national Digital Identity Providers.

        • -
      -
      -
      • -

    • National IdP: It represents preexisting identity systems based on SAML2 or OpenID Connect, already in production in each Member State (for Italy SPID and CIE id authentication schemed notified eIDAS with LoA High, see SPID/CIE OpenID Connect Specifications).

      • -
    -
    -
    -_images/High-Level-Flow-EUDIW-PID-Issuing.svg
    -

    Fig. 2 PID Issuance - General architecture and high level flow

    -
    -
    -

    The Fig. 2 shows a general architecture and highlights the main operations involved in the issuance of a PID, in particular:

    -
    -
      -

    1. Wallet Instance Setup: the first time the Wallet Instance is started a preliminary setup phase MUST be carried out. It consists of the release of a verifiable proof issued by the Attestation Service provided by the Wallet Provider that asserts the genuineness, the authenticity and the compliance with a trust framework of the Wallet Instance. The verifiable proof binds a public key corresponding to a local private key generated by the Wallet Instance.

      2. -

    2. Obtaining the trusted PID Provider: the Wallet Instance queries the Trust Anchor to fetch the trusted PID Provider.

      3. -

    3. Obtaining of PID Provider metadata: the Wallet Instance establishes the trust to the PID Provider according to the Trust Model, obtaining the Metadata that discloses the formats of the PID, the algorithms supported, and any other parameter required for interoperability needs.

      4. -

    4. PID request: following the Authorization Code Flow in [OIDC4VCI. Draft 13] the Wallet Instance requests a PID to the PID Provider. A fresh key pairs is generated by the Wallet Instance, the public key is used by PID Provider for the key binding of the PID.

      5. -

    5. End-user authentication: the PID Provider authenticates the End-User with LoA High, acting as an IAM Proxy to the National eID system.

      6. -

    6. PID issuance: once the User authentication with LoA High happens, the User gives their consent, the PID Provider checks the Wallet Instance by means of the Wallet Attestation and the Trust Chain related to the Wallet Provider. Finally, the PID Provider releases a PID bound to the key material held by the requesting Wallet instance.

      7. -
    -
    -

    The Wallet Instance Setup phase is described in Section [...]. In the following Section the steps from 1 to 5 are further expanded into more technical detailed steps.

    -
    -

    Detailed Flow

    -

    The PID Issuance phase is based on the Authorization Code Flow with Pushed Authorization Requests (PAR) [RFC 9126] and PKCE (Proof Key for Code Exchange, RFC 7636) as recommended in [OIDC4VCI. Draft 13. Section 3.4]. A Wallet Initiated Flow is considered and the User receives the PID directly in response to the Credential Request (Immediate Flow).

    -
    -_images/Low-Level-Flow-EUDIW-PID-Issuing.svg -
    -

    Fig. 3 PID Issuance - Detailed flow

    -
    -
    -

    Steps 1-4: The User has selected a PID Provider, and the Wallet Instance obtains the metadata for the selected PID Provider.

    -
    -

    Note

    -

    Federation Check: The Wallet Instance needs to check if the PID Provider is part of Federation and then it can consume its Metadata. A non-normative example of a response from the endpoint .well-known/openid-federation with the Entity Configuration and the Metadata of the PID Provider is represented within the section Entity Configuration Credential Issuer.

    -
    -

    Steps 5-6: The Wallet Instance creates a PKCE code verifier that sends in a pushed authorization request, using the request parameter (see RFC 9126 Section 3) to the PID Provider authorization endpoint. The Wallet Instance signs the request using its private key. A OAuth2 client authentication method must be involved, since in this flow the pushed authorization endpoint is a protected endpoint. The client authentication should be based on the model defined in [RFC 7521] using the Wallet Instance Attestation JWS inside the client_assertion parameter. The authorization_details [RAR RFC 9396] parameter is extended to allow Wallet Instance to specify the types of the credentials when requesting authorization for the PID issuance.

    -

    Below a non-normative example of the PAR.

    -
    POST /as/par HTTP/1.1
-Host: pid-provider.example.org
-Content-Type: application/x-www-form-urlencoded
-
-response_type=code
-&client_id=$thumprint-of-the-jwk-in-the-cnf-wallet-attestation$
-&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
-&code_challenge_method=S256
-&request=eyJhbGciOiJSUzI1NiIsImtpZCI6ImsyYmRjIn0.ew0KIC Jpc3MiOiAiczZCaGRSa3F0MyIsDQogImF1ZCI6ICJodHRwczovL3NlcnZlci5leGFtcGxlLmNvbSIsDQo gInJlc3BvbnNlX3R5cGUiOiAiY29kZSBpZF90b2tlbiIsDQogImNsaWVudF9pZCI6ICJzNkJoZFJrcXQz IiwNCiAicmVkaXJlY3RfdXJpIjogImh0dHBzOi8vY2xpZW50LmV4YW1...
-&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation
-&client_assertion=$WalletInstanceAttestation$
-
    -
    -

    The JWS header of request object is represented below:

    -
    {
-  "alg": "ES256",
-  "kid": "FifYx03bnosD8m6gYQIfNHNP9cM_Sam9Tc5nLloIIrc",
-}
-
    -
    -

    The JWS payload of the request object is represented below:

    -
    {
-"response_type":"code",
-"client_id":"$thumprint-of-the-jwk-in-the-cnf-wallet-attestation$",
-"state":"fyZiOL9Lf2CeKuNT2JzxiLRDink0uPcd",
-"code_challenge":"E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
-"code_challenge_method":"S256",
-"authorization_details":[
-{
-    "type":"openid_credential",
-    "format": "vc+sd-jwt",
-    "credential_definition": {
-        "type": ["eu.eudiw.pid.it"]
-    }
-}
-],
-"redirect_uri":"eudiw://start.wallet.example.org",
-"client_assertion_type":"urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation",
-
    -
    -
    -
    Step 7: The PID Provider creates a new request URI representing this new authorization request to be returned to the Wallet Instance.

    }

    -
    -
    -
    -

    Note

    -

    Federation Check: PID Provider MUST check that the Wallet Provider is part of the federation and in addition it MUST verify the Wallet Instance Attestation validity by checking its signature and data.

    -
    -

    Step 7: The PID Provider creates a new request URI representing a new authorization request and returns it to the Wallet Instance. A non-normative example of the authorization request is represented below:

    -
    HTTP/1.1 201 Created
-Cache-Control: no-cache, no-store
-Content-Type: application/json
-
-{
-    "request_uri":"urn:ietf:params:oauth:request_uri:bwc4JK-ESC0w8acc191e-Y1LTC2",
-    "expires_in": 60
-}
-
    -
    -

    Steps 8-9: The Wallet Instance sends an authorization request to the PID Provider authorization endpoint.

    -
    GET /authorize?client_id=$thumprint-of-the-jwk-in-the-cnf-wallet-attestation$&request_uri=urn%3Aietf%3Aparams%3Aoauth%3Arequest_uri%3Abwc4JK-ESC0w8acc191e-Y1LTC2 HTTP/1.1
-Host: pid-provider.example.org
-
    -
    -
    -

    Note

    -

    User Authentication and Consent: The PID Provider performs the User authentication based on the requirements of eIDAS LoA High and asks the User consent for the PID issuance.

    -
    -

    Steps 10-11: The PID Provider sends an authorization code to the Wallet Instance.

    -
    -

    Note

    -

    The Wallet Instance redirect URI is a universal or app link registered with the local operating system, so this latter will resolve it and pass the response to the Wallet Instance.

    -
    -
    HTTP/1.1 302 Found
-Location: eudiw://start.wallet.example.org?code=SplxlOBeZQQYbYS6WxSbIA&state=fyZiOL9Lf2CeKuNT2JzxiLRDink0uPcd&iss=https%3A%2F%2Fpid-provider.example.org
-
    -
    -

    Step 14: The Wallet Instance sends a token request to the PID Provider token endpoint using the authorization code, code_verifier, DPoP proof and private_key_jwt.

    -
    POST /token HTTP/1.1
-Host: pid-provider.example.org
-Content-Type: application/x-www-form-urlencoded
-DPoP: eyJ0eXAiOiJkcG9wK2p3dCIsImFsZyI6IkVTMjU2IiwiandrIjp7Imt0eSI6Ik
-    VDIiwieCI6Imw4dEZyaHgtMzR0VjNoUklDUkRZOXpDa0RscEJoRjQyVVFVZldWQVdCR
-    nMiLCJ5IjoiOVZFNGpmX09rX282NHpiVFRsY3VOSmFqSG10NnY5VERWclUwQ2R2R1JE
-    QSIsImNydiI6IlAtMjU2In19.eyJqdGkiOiItQndDM0VTYzZhY2MybFRjIiwiaHRtIj
-    oiUE9TVCIsImh0dSI6Imh0dHBzOi8vc2VydmVyLmV4YW1wbGUuY29tL3Rva2VuIiwia
-    WF0IjoxNTYyMjYyNjE2fQ.2-GxA6T8lP4vfrg8v-FdWP0A0zdrj8igiMLvqRMUvwnQg
-    4PtFLbdLXiOSsX0x7NVY-FNyJK70nfbV37xRZT3Lg
-
-client_id=$thumprint-of-the-jwk-in-the-cnf-wallet-attestation$
-&grant_type=authorization_code
-&code=SplxlOBeZQQYbYS6WxSbIA
-&redirect_uri=eudiw://start.wallet.example.org
-&code_verifier=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk
-&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
-&client_assertion=eyJhbGciOiJIUzI1NiI
-
    -
    -

    Step 15: The PID Provider validates the request and if it is successful, it issues an access token (bound to the DPoP key) and a fresh c_nonce.

    -
    HTTP/1.1 200 OK
-Content-Type: application/json
-Cache-Control: no-store
-
-{
-"access_token": "Kz~8mXK1EalYznwH-LC-1fBAo.4Ljp~zsPE_NeO.gxU",
-"token_type": "DPoP",
-"expires_in": 2677,
-"c_nonce": "tZign[...]snFbp",
-"c_nonce_expires_in": 86400
-}
-
    -
    -

    Steps 16-18: The Wallet Instance creates a new key pair to which the new credential shall be bound. Then, it creates a proof of possession with the new key and the c_nonce obtained in Step 15 and it creates a DPoP proof for the request to the PID credential issuance endpoint.

    -

    Step 19: The Wallet Instance sends a PID issuance request to the PID Provider credential endpoint. It contains the access token, the DPoP proof, the credential type, the proof (proof of possession of the key) and the format.

    -
    -

    Note

    -

    PID Credential Schema and Status registration: The PID Provider MUST register all the issued PIDs for their later revocation, if needed.

    -
    -
    POST /credential HTTP/1.1
-Host: pid-provider.example.org
-Content-Type: application/x-www-form-urlencoded
-Authorization: DPoP Kz~8mXK1EalYznwH-LC-1fBAo.4Ljp~zsPE_NeO.gxU
-DPoP: eyJ0eXAiOiJkcG9wK2p3dCIsImFsZyI6IkVTMjU2IiwiandrIjp7Imt0eSI6Ik
-    VDIiwieCI6Imw4dEZyaHgtMzR0VjNoUklDUkRZOXpDa0RscEJoRjQyVVFVZldWQVdCR
-    nMiLCJ5IjoiOVZFNGpmX09rX282NHpiVFRsY3VOSmFqSG10NnY5VERWclUwQ2R2R
-    1JEQSIsImNydiI6IlAtMjU2In19.eyJqdGkiOiJlMWozVl9iS2ljOC1MQUVCIiwiaHRtIj
-    oiR0VUIiwiaHR1IjoiaHR0cHM6Ly9yZXNvdXJjZS5leGFtcGxlLm9yZy9wcm90ZWN0Z
-    WRyZXNvdXJjZSIsImlhdCI6MTU2MjI2MjYxOCwiYXRoIjoiZlVIeU8ycjJaM0RaNTNF
-    c05yV0JiMHhXWG9hTnk1OUlpS0NBcWtzbVFFbyJ9.2oW9RP35yRqzhrtNP86L-Ey71E
-    OptxRimPPToA1plemAgR6pxHF8y6-yqyVnmcw6Fy1dqd-jfxSYoMxhAJpLjA
-
-credential_definition=%7B%22type%22:%5B%22eu.eudiw.pid.it%22%5D%7D
-&format=vc+sd-jwt
-&proof=%7B%22proof_type%22:%22...-ace0-9c5210e16c32%22%7D
-
    -
    -

    A non-normative example of proof parameter is given below:

    -
    {
-"proof_type": "jwt",
-"jwt": "eyJraWQiOiJkaWQ6ZXhhbXBsZTplYm …"
-}
-
    -
    -

    Where the decoded content of the JWT is represented below:

    -
    {
-  "alg": "ES256",
-  "typ": "openid4vci-proof+jwt",
-  "kid": "dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw"
-}
-
    -
    -
    {
-"iss": "0b434530-e151-4c40-98b7-74c75a5ef760",
-"aud": "https://pid-provider.example.org",
-"iat": 1504699136,
-"nonce": "tZign...snFbp"
-}
-
    -
    -

    Steps 20-22: The PID Provider checks the DPoP proof and whether the access token is valid and suitable for the requested PID. It also checks the proof of possession for the key material the new credential shall be bound to. If all checks succeed, the PID Provider creates a new credential bound to the key material and sends it to the Wallet Instance. The Wallet Instance MUST perform the PID integrity and authenticity checks and if it is successful can proceed with secure storage of the PID credential.

    -
    HTTP/1.1 200 OK
-Content-Type: application/json
-Cache-Control: no-store
-Pragma: no-cache
-
-{
-"format": "vc+sd-jwt"
-"credential" : "LUpixVCWJk0eOt4CXQe1NXK[...]WZwmhmn9OQp6YxX0a2L",
-"c_nonce": "fGFF7[...]UkhLa",
-"c_nonce_expires_in": 86400
-}
-
    -
    -
    -
    -

    Pushed Authorization Request Endpoint

    -
    -

    Pushed Authorization Request (PAR) Request

    -

    The requests to the PID Provider authorization endpoint MUST be HTTP with method POST, with the following mandatory parameters in the HTTP request message body, encoded in application/x-www-form-urlencoded format.

    - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Table 1 PAR http request parameters

    Claim

    Description

    Reference

    response_type

    MUST be set to code.

    RFC 6749

    client_id

    MUST be set to the thumbprint of the jwk value in the cnf parameter inside the Wallet Instance Attestation.

    RFC 6749

    code_challenge

    A challenge derived from the code verifier that is sent in the authorization request

    RFC 7636#section-4.2.

    code_challenge_method

    A method that was used to derive code challenge. It MUST be set to S256.

    RFC 7636#section-4.3.

    request

    It MUST be a signed JWT. The private key corresponding to the public one in the cnf parameter inside the Wallet Instance Attestation MUST be used for signing the request object.

    OpenID Connect Core. Section 6

    client_assertion_type

    It MUST be set to urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation.

    Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants

    client_assertion

    It MUST be the Wallet Instance Attestation signed JWT.

    Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants

    -

    The JWT Request Object has the following JOSE header parameters:

    - ----- - - - - - - - - - - - - - - - - -

    JOSE header

    Description

    Reference

    alg

    A digital signature algorithm identifier such as per IANA "JSON Web Signature and Encryption Algorithms" registry. It MUST be one of the supported algorithms in Section Cryptographic Algorithms and MUST NOT be none or an identifier for a symmetric algorithm (MAC).

    RFC 7516#section-4.1.1.

    kid

    Unique identifier of the JWK as base64url-encoded JWK Thumbprint value.

    RFC 7638#section_3.

    -
    -

    Note

    -

    The parameter typ, if omitted, assumes the implicit value JWT.

    -
    -

    The JWT payload is given by the following parameters:

    - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    response_type

    It MUST be set as in the Table of the HTTP parameters.

    See Table of the HTTP parameters.

    client_id

    It MUST be set as in the Table of the HTTP parameters.

    See Table of the HTTP parameters.

    state

    Unique session identifier at the client side. This value will be returned to the client in the response, at the end of the authentication. It MUST be a random string with at least 32 alphanumeric characters.

    See OpenID.Core#AuthRequest.

    code_challenge

    It MUST be set as in the Table of the HTTP parameters.

    See Table of the HTTP parameters.

    code_challenge_method

    It MUST be set as in the Table of the HTTP parameters.

    See Table of the HTTP parameters.

    authorization_details

    JSON Object. It MUST include the following claims:

    -
    -
      -

    • type: it MUST be set to openid_credential,

      • -

    • format: it MUST be set to vc+sd-jwt,

      • -

    • credential_definition: JSON Object. It MUST have the type claim which MUST be set to eu.eudiw.pid.it

      • -
    -
    -

    See [RAR RFC 9396] and [OIDC4VCI. Draft 13].

    redirect_uri

    Redirection URI to which the response will be sent. It MUST be an universal or app link registered with the local operating system, so this latter will resolve it and pass the response to the Wallet Instance.

    See OpenID.Core#AuthRequest.

    client_assertion_type

    It MUST be set as in the Table of the HTTP parameters.

    See Table of the HTTP parameters.

    client_assertion

    It MUST be set as in the Table of the HTTP parameters.

    See Table of the HTTP parameters.

    -
    -
    -

    Pushed Authorization Request (PAR) Response

    -

    If the verification is successful, the PID Provider MUST provide the response with a 201 HTTP status code. The following parameters are included as top-level members in the HTTP response message body, using the application/json media type as defined in [RFC 8259].

    - ----- - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    request_uri

    The request URI corresponding to the authorization request posted. This URI MUST be a single-use reference to the respective authorization request. It MUST contain some part generated using a cryptographically strong pseudorandom algorithm. The value format MUST be urn:ietf:params:oauth:request_uri:<reference-value> with <reference-value> as the random part of the URI that references the respective authorization request data.

    [RFC 9126].

    expires_in

    A JSON number that represents the lifetime of the request URI in seconds as a positive integer.

    [RFC 9126].

    -
    -
    -
    -

    Authorization endpoint

    -

    The authorization endpoint is used to interact with the Credential Issuer and obtain an authorization grant. -The authorization server MUST first verify the identity of the resource owner (the User that own it's credentials) -as defined in the RFC 6749.

    -
    -

    Authorization Request

    -

    The Authorization request is issued by the Wallet Instance Browser, HTTP POST or GET methods MAY be used. When the method POST is used, the parameters MUST be sent using the Form Serialization. When the method GET is used, the parameters MUST be sent using the Query String Serialization. For more details see OpenID.Core#Serializations.

    -

    The mandatory parameters in the HTTP authentication request are specified in the following table.

    - ----- - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    client_id

    It MUST be set as in the Table of the HTTP parameters.

    See Table of the HTTP parameters.

    request_uri

    It MUST be set to the same value as obtained by PAR Response. See Table of the HTTP PAR Response parameters.

    [RFC 9126].

    -
    -
    -

    Authorization Response

    -

    The authentication response is returned by the PID Provider authorization endpoint at the end of the authentication flow.

    -

    If the authentication is successful the PID Provider redirects the User by adding the following query parameters as required to the redirect_uri. The redirect URI MUST be an universal or app link registered with the local operating system, so this latter is able to resolve its value and delegates the Wallet Instance for the processing.

    - ----- - - - - - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    code

    Unique Authorization Code that the client submits to the Token Endpoint.

    [RFC 6749#section-4.1.2], Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants

    state

    The client MUST check the correspondence with the state value in the request object. It is defined as in the Table of the JWT Request parameters.

    [RFC 6749#section-4.1.2].

    iss

    Unique identifier of the PID PRovider who created the Authentication Response. The Wallet Instance MUST validate this parameter.

    OAuth 2.0 Authorization Server Issuer Identifier in Authorization Response, [RFC7519, Section 4.1.1].

    -
    -
    -
    -

    Token endpoint

    -

    The token endpoint is used by the Wallet Instance -to obtain an access token by presenting its authorization grant, as -defined in RFC 6749.

    -
    -

    Token Request

    -

    The request to the PID Provider Token endpoint MUST be an HTTP request with method POST, where its body message is encoded in application/x-www-form-urlencoded format. The Wallet Instance sends the Token endpoint request with private_key_jwt authentication and a DPoP proof containing the mandatory parameters, defined in the table below.

    -

    The Token endpoint MUST accept and validate the DPoP proof sent in the DPoP HTTP header. The Token endpoint MUST validate the DPoP proof based on the steps defined in Section 4.3 of the DPoP specifications [DPoP-draft16]. Thus, this mitigates the misuse of leaked or stolen access tokens at the credential endpoint. If the DPoP proof is invalid, the Token endpoint returns an error response, according to Section 5.2 of [RFC 6749] with invalid_dpop_proof as the value of the error parameter.

    - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    client_id

    It MUST be set as in the Table of the HTTP parameters.

    See Table of the HTTP parameters.

    grant_type

    It MUST be set to authorization_code.

    Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants.

    code

    Authorization code returned in the Authentication Response.

    Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants.

    redirect_uri

    It MUST be set as in the request object Table of the JWT Request parameters.

    Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants.

    code_verifier

    Verification code of the code_challenge.

    Proof Key for Code Exchange by OAuth Public Clients.

    client_assertion_type

    It MUST be set to urn:ietf:params:oauth:client-assertion-type:jwt-bearer.

    Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants.

    client_assertion

    JWT signed with the Wallet Instance private key containing the following parameters:

    -
      -

    • iss: This MUST contain the client_id.

      • -

    • sub: This MUST contain the iss.

      • -

    • aud: URL of the PID Provider Token Endpoint.

      • -

    • iat: UNIX Timestamp with the time of the JWT issuance, coded as NumericDate as indicated in RFC 7519.

      • -

    • exp: UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in RFC 7519.

      • -

    • jti: Unique Identifier for this authentication request, generated by the client. E.g., uuid4 format.

      • -
    -

    Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants.

    -

    A DPoP proof is included in an HTTP request using the DPoP header parameter containing a DPoP JWS.

    -

    The JOSE header of a DPoP JWT MUST contain at least the following parameters:

    - ----- - - - - - - - - - - - - - - - - - - - - -

    JOSE header

    Description

    Reference

    typ

    It MUST be equal to dpop+jwt.

    [RFC 7515] and [RFC 8725. Section 3.11].

    alg

    A digital signature algorithm identifier such as per IANA "JSON Web Signature and Encryption Algorithms" registry. It MUST be one of the supported algorithms in Section Cryptographic Algorithms and MUST NOT be none or an identifier for a symmetric algorithm (MAC).

    [RFC 7515].

    jwk

    representing the public key chosen by the client, in JSON Web Key (JWK) [RFC7517] format, as defined in Section 4.1.3 of [RFC7515]. It MUST NOT contain a private key.

    [RFC 7517] and [RFC 7515].

    -

    The payload of a DPoP proof MUST contain at least the following claims:

    - ----- - - - - - - - - - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    jti

    Unique identifier for the DPoP proof JWT. The value MUST be assigned in a UUID v4 string format according to [RFC 4122].

    [RFC 7519. Section 4.1.7].

    htm

    The value of the HTTP method of the request to which the JWT is attached.

    [RFC 9110. Section 9.1].

    htu

    The HTTP target URI, without query and fragment parts, of the request to which the JWT is attached.

    [RFC 9110. Section 7.1].

    iat

    UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in RFC 7519.

    [RFC 7519. Section 4.1.6].

    -
    -
    -

    Token Response

    -

    Token endpoint response MUST contain the following mandatory claims.

    - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    access_token

    The DPoP-bound Access Token, in signed JWT format, allows accessing the Credential Endpoint for obtaining the PID.

    RFC 6749.

    token_type

    Type of Access Token returned. It MUST be equal to DPoP.

    RFC 6749.

    expires_in

    Expiry time of the Access Token in seconds.

    RFC 6749.

    c_nonce

    JSON string containing a nonce to be used to create a proof of possession of key material when requesting a Credential.

    [OIDC4VCI. Draft 13].

    c_nonce_expires_in

    JSON integer, it represents the lifetime in seconds of the c_nonce.

    [OIDC4VCI. Draft 13].

    -
    -
    -

    Access Token

    -

    A DPoP-bound Access Token is provided by the PID Provider Token endpoint as a result of a successful token request. The Access Token is encoded in JWT format, according to [RFC 7519]. The Access Token MUST have at least the following mandatory claims and it MUST be bound to the public key that is provided by the DPoP proof. This binding can be accomplished based on the methodology defined in Section 6 of [DPoP-draft16].

    - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    iss

    It MUST be an HTTPS URL that uniquely identifies the PID Provider. The client MUST verify that this value matches the PID Provider where it has requested the credential.

    [RFC 9068], [RFC7519, Section 4.1.1].

    sub

    It identifies the subject of the JWT. It MUST be of type pairwise.

    [RFC 9068], [RFC 7519] and [OpenID.Core#SubjectIDTypes].

    client_id

    It MUST contain a HTTPS URL that uniquely identifies the RP.

    [RFC 9068].

    aud

    It MUST match the value client_id. The RP MUST verify that this value matches its client ID.

    [RFC 9068].

    iat

    UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in RFC 7519.

    [RFC 9068], [RFC 7519. Section 4.1.6].

    exp

    UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in RFC 7519.

    [RFC 9068], [RFC 7519].

    jti

    It MUST be a String in uuid4 format. Unique Token ID identifier that the RP MAY use to prevent reuse by rejecting the Token ID if already processed.

    [RFC 9068], [RFC 7519].

    nonce

    It MUST be a random string of at least 32 alphanumeric characters. The value type of this claim MUST be a string, where the value is a c_nonce provided by the PID Provider.

    [OpenID.Core#AuthRequest].

    jkt

    JWK SHA-256 Thumbprint Confirmation Method. The value of the jkt member MUST be the base64url encoding (as defined in [RFC7515]) of the JWK SHA-256 Thumbprint of the DPoP public key (in JWK format) to which the access token is bound.

    [DPoP-draft16. Section 6.1] and [RFC 7638].

    -
    -
    -
    -

    Credential endpoint

    -

    The Credential Endpoint issues a Credential as approved by the End-User upon presentation of a valid Access Token representing this approval, as defined in OPENID4VCI.

    -
    -

    Credential Request

    -

    The Wallet Instance may request a PID to the PID Provider Credential endpoint with a HTTP POST request encoded in application/json format, where the following parameters in the message body MUST be present.

    -

    The Credential endpoint MUST accept and validate the DPoP proof sent in the DPoP HTTP header based on the steps defined in Section 4.3 of [DPoP-draft16]. If the DPoP proof is invalid, the Credential endpoint returns an error response per Section 5.2 of [RFC 6749] with invalid_dpop_proof as the value of the error parameter.

    -
    -

    Warning

    -

    The Wallet Instance MUST create a new DPoP proof for the Credential request and MUST NOT use the previously created proof for the Token Endpoint.

    -
    - ----- - - - - - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    credential_definition

    JSON object containing the detailed description of the credential type. It MUST have at least the type sub claims which is a JSON array containing the type values the Wallet shall request in the subsequent Credential Request. It MUST be eu.eudiw.pid.it.

    [OIDC4VCI. Draft 13].

    format

    Format of the Credential to be issued. This MUST be vc+sd-jwt.

    [OIDC4VCI. Draft 13].

    proof

    JSON object containing proof of possession of the key material the issued Credential shall be bound to. The proof object MUST contain the following mandatory claims:

    -
      -

    • proof_type: JSON string denoting the proof type. It MUST be jwt.

      • -

    • jwt: the JWT used as proof of possession.

      • -
    -

    [OIDC4VCI. Draft 13].

    -
    -

    Note

    -

    If the format value is mso_mdoc, the credential request MUST contain the doctype claim which is a JSON string identifying the PID type according to EIDAS-ARF . See Appendix E.2. of [OIDC4VCI. Draft 13] for more details.

    -
    -

    The JWT proof type MUST contain the following parameters for the JOSE header and the JWT body:

    - ----- - - - - - - - - - - - - - - - - - - - - -

    JOSE Header

    Description

    Reference

    alg

    A digital signature algorithm identifier such as per IANA "JSON Web Signature and Encryption Algorithms" registry. It MUST be one of the supported algorithms in Section Cryptographic Algorithms and MUST NOT be none or an identifier for a symmetric algorithm (MAC).

    [OIDC4VCI. Draft 13], [RFC 7515], [RFC 7517].

    typ

    MUST be openid4vci-proof+jwt.

    [OIDC4VCI. Draft 13], [RFC 7515], [RFC 7517].

    kid

    It MUST contain the identifier of the key material the PID shall be bound to.

    [OIDC4VCI. Draft 13], [RFC 7515], [RFC 7517].

    - ----- - - - - - - - - - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    iss

    The value of this claim MUST be the client_id of the Wallet Instance.

    [OIDC4VCI. Draft 13], [RFC7519, Section 4.1.1].

    aud

    The value of this claim MUST be the identifier URL of the PID Provider.

    [OIDC4VCI. Draft 13].

    iat

    UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in RFC 7519.

    [OIDC4VCI. Draft 13], [RFC 7519. Section 4.1.6].

    nonce

    The value type of this claim MUST be a string, where the value is a c_nonce provided by the PID Provider in the Token response.

    [OIDC4VCI. Draft 13].

    -
    -
    -

    Credential Response

    -

    Credential Response to the Wallet Instance MUST be sent using application/json media type. The response MUST contain the following mandatory claims:

    - ----- - - - - - - - - - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    format

    Format of the Credential to be issued. This MUST be vc+sd-jwt.

    [OIDC4VCI. Draft 13].

    credential

    Contains the issued PID. It MUST be an SD-JWT JSON Object (see Section PID Data Model).

    Appendix E in [OIDC4VCI. Draft 13].

    c_nonce

    JSON string containing a nonce to be used to create a proof of possession of key material when requesting a further credential or for renewal credential.

    [OIDC4VCI. Draft 13].

    c_nonce_expires_in

    JSON integer corresponding to the c_nonce lifetime in seconds.

    [OIDC4VCI. Draft 13].

    -
    -

    Note

    -

    If the format value is mso_mdoc, the credential value MUST be a base64url-encoded JSON string according to Appendix E of [OIDC4VCI. Draft 13].

    -
    -
    -
    -

    Entity Configuration Credential Issuer

    -

    Below a non-normative example of an Entity Configuration containing an openid_credential_issuer metadata.

    -
    HTTP/1.1 200 OK
-Content-Type: application/entity-statement+jwt
-
-{
-
-  "alg": "RS256",
-  "kid": "FANFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs",
-  "typ": "entity-statement+jwt"
-
-}
-.
-{
-  "exp": "1649610249",
-  "iat": "1649437449",
-  "iss": "https://pid-provider.example.org",
-  "sub": "https://pid-provider.example.org",
-  "jwks": {
-    "keys": [{
-      "kty": "RSA",
-      "use": "sig",
-      "n": "1Ta-sE …",
-      "e": "AQAB",
-      "kid": "FANFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
-    }]
-  },
-  "metadata": {
-    "openid_credential_issuer": {
-      "credential_issuer": "https://pid-provider.example.org",
-      "authorization_endpoint": "https://pid-provider.example.org/connect/authorize",
-      "token_endpoint": "https://pid-provider.example.org/connect/token",
-      "pushed_authorization_request_endpoint": "https://pid-provider.example.org/connect/par",
-      "dpop_signing_alg_values_supported": ["RS256", "RS512", "ES256", "ES512"],
-      "credential_endpoint": "https://pid-provider.example.org/credential",
-      "credentials_supported": {
-        "eu.eudiw.pid.it": {
-          "format": "vc+sd-jwt",
-          "cryptographic_binding_methods_supported": ["jwk"],
-          "cryptographic_suites_supported": ["RS256", "RS512", "ES256", "ES512"],
-          "display": [{
-              "name": "PID Provider Italiano di esempio",
-              "locale": "it-IT",
-              "logo": {
-                "url": "https://pid-provider example.org/public/logo.svg",
-                "alt_text": "logo di questo PID Provider"
-              },
-              "background_color": "#12107c",
-              "text_color": "#FFFFFF"
-            },
-            {
-              "name": "Example Italian PID Provider",
-              "locale": "en-US",
-              "logo": {
-                "url": "https://pid-provider.example.org/public/logo.svg",
-                "alt_text": "The logo of this PID Provider"
-              },
-              "background_color": "#12107c",
-              "text_color": "#FFFFFF"
-            }
-          ],
-          "credential_definition": {
-            "type": ["PIDCredential"],
-            "credentialSubject": {
-              "given_name": {
-                "mandatory": true,
-                "display": [{
-                    "name": "Current First Name",
-                    "locale": "en-US"
-                  },
-                  {
-                    "name": "Nome",
-                    "locale": "it-IT"
-                  }
-                ]
-              },
-              "family_name": {
-                "mandatory": true,
-                "display": [{
-                    "name": "Current Family Name",
-                    "locale": "en-US"
-                  },
-                  {
-                    "name": "Cognome",
-                    "locale": "it-IT"
-                  }
-                ]
-              },
-              "birthdate": {
-                "mandatory": true,
-                "display": [{
-                    "name": "Date of Birth",
-                    "locale": "en-US"
-                  },
-                  {
-                    "name": "Data di Nascita",
-                    "locale": "it-IT"
-                  }
-                ]
-              },
-              "place_of_birth": {
-                "mandatory": true,
-                "display": [{
-                    "name": "Place of Birth",
-                    "locale": "en-US"
-                  },
-                  {
-                    "name": "Luogo di Nascita",
-                    "locale": "it-IT"
-                  }
-                ]
-              },
-              "unique_id": {
-                "mandatory": true,
-                "display": [{
-                    "name": "Unique Identifier",
-                    "locale": "en-US"
-                  },
-                  {
-                    "name": "Identificativo univoco",
-                    "locale": "it-IT"
-                  }
-                ]
-              },
-              "tax_id_number": {
-                "mandatory": true,
-                "display": [{
-                    "name": "Tax Id Number",
-                    "locale": "en-US"
-                  },
-                  {
-                    "name": "Codice Fiscale",
-                    "locale": "it-IT"
-                  }
-                ]
-              }
-            }
-          }
-        }
-      }
-    },
-
-    "federation_entity": {
-      "organization_name": "Pid Provider Organization Example",
-      "homepage_uri": "https://pid-provider.example.org",
-      "policy_uri": "https://pid-provider.example.org/privacy_policy",
-      "tos_uri": "https://pid-provider.example.org/info_policy",
-      "logo_uri": "https://pid-provider.example.org/logo.svg"
-    },
-
-    "openid_relying_party": {
-      <This is the metadata of the PID Provider acting as a Relying Party in the national digital identity framework (CIE/SPID). See spid-cie-oidc-docs for details.>
-    }
-  }
-}
-
    -
    -
    -
    -
    - - - - - -
    - -
    -
    -
    - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/en/pid-issuing.html b/en/pid-issuing.html deleted file mode 100644 index e261649c7..000000000 --- a/en/pid-issuing.html +++ /dev/null @@ -1,2230 +0,0 @@ - - - - - - - - Italian eIDAS Wallet Technical Specifications version: latest documentation | PID Issuing - - - - - - - - - - - - - - - - - - - - - -
    - - -
    -
    -
    - -
    -
    -

    - - Docs Italia - - beta - - -

    -

    Public documents, made digital.

    -
    -
    -
    -
    - - - Italian eIDAS Wallet Technical Specifications version: latest documentation - -
    -
    - -
    - - Project: - - Progetto demo - -
    - - -
    - - Administration: - - Organizzazione demo - -
    - -
    -
    -
    -
    -
    -
    -
    - -
    -
    - - -
    -
    - - - - About this document - - -
    -
    -
    - -
    -
    -
    -
    -
    - -
    -
    -
      - -
    -
    -
    -
    - - - -
    - - - Source - -
    -
    -
    - -
    - - - Actions - -
    -
    -
    -
    -
    -
    -
    -
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    -
    -
    - -
    - - - - - -
    -

    PID Issuing

    -

    The relevant entities and interfaces involved in the issuing flows are:

    -
    -
      -

    • Wallet Provider: It represents an organization (public or private) that is responsible for the release of an eIDAS-compliant EUDI Wallet Solution. It also issues thes Wallet Instance Attestation to its Wallet Instances by means of an Attestation Service. The Wallet Attestation certifies the genuinity and authenticity of the Wallet Instance and its compliance with a Trust Framework in compliance to the security and privacy requirements.

      • -

    • Wallet Solution: It represents the entire product and service owned by a Wallet Provider, offered to all Users of that solution. A Wallet Solution must be certified as being EUDI-compliant by a Conformity Assessment Body (CAB).

      • -

    • Wallet Instance: instance of a Wallet Solution, installed on User's device. It provides interfaces for User interaction with the Wallet Provider, Relying Parties, PID and (Q)EAA Providers.

      • -

    • PID Provider: It represents the issuer of eIDAS Person Identification Data (PID). It is composed of:

      -
      -
        -

      • OpenID4VCI Component: based on the “OpenID for Verifiable Credential Issuance” specification [OIDC4VCI. Draft 13] to release PID credentials.

        • -

      • National eID Relying Party (OpenID Connect or SAML2): It represents the component to authenticate the End-User with the national Digital Identity Providers.

        • -
      -
      -
      • -

    • National IdP: It represents preexisting identity systems based on SAML2 or OpenID Connect, already in production in each Member State (for Italy SPID and CIE id authentication schemed notified eIDAS with LoA High, see SPID/CIE OpenID Connect Specifications).

      • -
    -
    -
    -_images/High-Level-Flow-EUDIW-PID-Issuing.svg
    -

    Fig. 2 PID Issuing - General architecture and high level flow

    -
    -
    -

    The Fig. 2 shows a general architecture and highlights the main operations involved in the issuing of a PID, in particular:

    -
    -
      -

    1. Wallet Instance Setup: the first time the Wallet Instance is started a preliminary setup phase MUST be carried out. It consists of the release of a verifiable proof issued by the Attestation Service provided by the Wallet Provider that asserts the genuineness, the authenticity and the compliance with a trust framework of the Wallet Instance. The verifiable proof binds a public key corresponding to a local private key generated by the Wallet Instance.

      2. -

    2. Obtaining the trusted PID Provider: the Wallet Instance queries the Trust Anchor to fetch the trusted PID Provider.

      3. -

    3. Obtaining of PID Provider metadata: the Wallet Instance establishes the trust to the PID Provider according to the Trust Model, obtaining the Metadata that discloses the formats of the PID, the algorithms supported, and any other parameter required for interoperability needs.

      4. -

    4. PID request: following the Authorization Code Flow in [OIDC4VCI. Draft 13] the Wallet Instance requests a PID to the PID Provider. A fresh key pairs is generated by the Wallet Instance, the public key is used by PID Provider for the key binding of the PID.

      5. -

    5. End-user authentication: the PID Provider authenticates the End-User with LoA High, acting as an IAM Proxy to the National eID system.

      6. -

    6. PID issuance: once the User authentication with LoA High happens, the User gives their consent, the PID Provider checks the Wallet Instance by means of the Wallet Attestation and the Trust Chain related to the Wallet Provider. Finally, the PID Provider releases a PID bound to the key material held by the requesting Wallet instance.

      7. -
    -
    -

    The Wallet Instance Setup phase is described in Section [...]. In the following Section the steps from 1 to 5 are further expanded into more technical detailed steps.

    -
    -

    Detailed Flow

    -

    The PID Issuing phase is based on the Authorization Code Flow with Pushed Authorization Requests (PAR) [RFC 9126] and PKCE (Proof Key for Code Exchange, RFC 7636) as recommended in [OIDC4VCI. Draft 13. Section 3.4]. A Wallet Initiated Flow is considered and the User receives the PID directly in response to the Credential Request (Immediate Flow).

    -
    -_images/Low-Level-Flow-EUDIW-PID-Issuing.svg -
    -

    Fig. 3 PID Issuing - Detailed flow

    -
    -
    -

    Steps 1-4: The User has selected a PID Provider, and the Wallet Instance obtains the metadata for the selected PID Provider.

    -
    -

    Note

    -

    Federation Check: The Wallet Instance needs to check if the PID Provider is part of Federation and then it can consume its Metadata. A non-normative example of a response from the endpoint .well-known/openid-federation with the Entity Configuration and the Metadata of the PID Provider is represented withing the section Entity Configuration Credential Issuer.

    -
    -

    Steps 5-6: The Wallet Instance creates a fresh PKCE code verifier that sends in a pushed authorization request, using the request parameter (see RFC 9126 Section 3) to the PID Provider authorization endpoint. The Wallet Instance signs its request using its attested private key. A standard OAuth2 client authentication method must be involved, since in this flow the pushed authorization endpoint is a protected endpoint. The client authentication can be based on the model defined in [RFC 7521] using the Wallet Instance Attestation JWS inside the client_assertion parameter. The authorization_details [RAR RFC 9396] parameter is extended to allow Wallet Instance to specify types of the credentials when requesting authorization for the PID issuance.

    -

    Below a non-normative example of the PAR.

    -
    POST /as/par HTTP/1.1
-Host: pid-provider.example.org
-Content-Type: application/x-www-form-urlencoded
-
-response_type=code
-&client_id=$thumprint-of-the-jwk-in-the-cnf-wallet-attestation$
-&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
-&code_challenge_method=S256
-&request=eyJhbGciOiJSUzI1NiIsImtpZCI6ImsyYmRjIn0.ew0KIC Jpc3MiOiAiczZCaGRSa3F0MyIsDQogImF1ZCI6ICJodHRwczovL3NlcnZlci5leGFtcGxlLmNvbSIsDQo gInJlc3BvbnNlX3R5cGUiOiAiY29kZSBpZF90b2tlbiIsDQogImNsaWVudF9pZCI6ICJzNkJoZFJrcXQz IiwNCiAicmVkaXJlY3RfdXJpIjogImh0dHBzOi8vY2xpZW50LmV4YW1...
-&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation
-&client_assertion=$WalletInstanceAttestation$
-
    -
    -

    The JWS header of request object is represented below:

    -
    {
-  "alg": "ES256",
-  "kid": "FifYx03bnosD8m6gYQIfNHNP9cM_Sam9Tc5nLloIIrc",
-}
-
    -
    -

    The JWS payload of the request object is represented below:

    -
    {
-"response_type":"code",
-"client_id":"$thumprint-of-the-jwk-in-the-cnf-wallet-attestation$",
-"state":"fyZiOL9Lf2CeKuNT2JzxiLRDink0uPcd",
-"code_challenge":"E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
-"code_challenge_method":"S256",
-"authorization_details":[
-{
-    "type":"openid_credential",
-    "format": "vc+sd-jwt",
-    "credential_definition": {
-        "type": ["eu.eudiw.pid.it"]
-    }
-}
-],
-"redirect_uri":"eudiw://start.wallet.example.org",
-"client_assertion_type":"urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation",
-
    -
    -
    -
    Step 7: The PID Provider creates a new request URI representing this new authorization request to be returned to the Wallet Instance.

    }

    -
    -
    -
    -

    Note

    -

    Federation Check: PID Provider MUST check that the Wallet Provider is part of the federation and in addition it MUST verify Wallet Instance Attestation validity by checking its signature and the claims inside it.

    -
    -

    Step 7: The PID Provider creates a new request URI representing a new authorization request and returns it to the Wallet Instance. A non-normative example of the authorization request is represented below:

    -
    HTTP/1.1 201 Created
-Cache-Control: no-cache, no-store
-Content-Type: application/json
-
-{
-    "request_uri":"urn:ietf:params:oauth:request_uri:bwc4JK-ESC0w8acc191e-Y1LTC2",
-    "expires_in": 60
-}
-
    -
    -

    Steps 8-9: The Wallet Instance sends an authorization request to the PID Provider authorization endpoint.

    -
    GET /authorize?client_id=$thumprint-of-the-jwk-in-the-cnf-wallet-attestation$&request_uri=urn%3Aietf%3Aparams%3Aoauth%3Arequest_uri%3Abwc4JK-ESC0w8acc191e-Y1LTC2 HTTP/1.1
-Host: pid-provider.example.org
-
    -
    -
    -

    Note

    -

    User Authentication and Consent: The PID Provider performs the User authentication based on the requirements of eIDAS LoA High and asks the User for consent for the PID issuance.

    -
    -

    Steps 10-11: The PID Provider sends an authorization code to the Wallet Instance.

    -
    -

    Note

    -

    The Wallet Instance redirect URI is a universal or app link registered with the local operating system, so this latter will resolve it and pass the response to the Wallet Instance.

    -
    -
    HTTP/1.1 302 Found
-Location: eudiw://start.wallet.example.org?code=SplxlOBeZQQYbYS6WxSbIA&state=fyZiOL9Lf2CeKuNT2JzxiLRDink0uPcd&iss=https%3A%2F%2Fpid-provider.example.org
-
    -
    -

    Step 14: The Wallet Instance sends a token request to the PID Provider's token endpoint using the authorization code, code_verifier and DPoP proof, and private_key_jwt.

    -
    POST /token HTTP/1.1
-Host: pid-provider.example.org
-Content-Type: application/x-www-form-urlencoded
-DPoP: eyJ0eXAiOiJkcG9wK2p3dCIsImFsZyI6IkVTMjU2IiwiandrIjp7Imt0eSI6Ik
-    VDIiwieCI6Imw4dEZyaHgtMzR0VjNoUklDUkRZOXpDa0RscEJoRjQyVVFVZldWQVdCR
-    nMiLCJ5IjoiOVZFNGpmX09rX282NHpiVFRsY3VOSmFqSG10NnY5VERWclUwQ2R2R1JE
-    QSIsImNydiI6IlAtMjU2In19.eyJqdGkiOiItQndDM0VTYzZhY2MybFRjIiwiaHRtIj
-    oiUE9TVCIsImh0dSI6Imh0dHBzOi8vc2VydmVyLmV4YW1wbGUuY29tL3Rva2VuIiwia
-    WF0IjoxNTYyMjYyNjE2fQ.2-GxA6T8lP4vfrg8v-FdWP0A0zdrj8igiMLvqRMUvwnQg
-    4PtFLbdLXiOSsX0x7NVY-FNyJK70nfbV37xRZT3Lg
-
-client_id=$thumprint-of-the-jwk-in-the-cnf-wallet-attestation$
-&grant_type=authorization_code
-&code=SplxlOBeZQQYbYS6WxSbIA
-&redirect_uri=eudiw://start.wallet.example.org
-&code_verifier=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk
-&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
-&client_assertion=eyJhbGciOiJIUzI1NiI
-
    -
    -

    Step 15: The PID Provider validates the request and if it is successful, it issues an access token (bound to the DPoP key) and a fresh c_nonce.

    -
    HTTP/1.1 200 OK
-Content-Type: application/json
-Cache-Control: no-store
-
-{
-"access_token": "Kz~8mXK1EalYznwH-LC-1fBAo.4Ljp~zsPE_NeO.gxU",
-"token_type": "DPoP",
-"expires_in": 2677,
-"c_nonce": "tZign[...]snFbp",
-"c_nonce_expires_in": 86400
-}
-
    -
    -

    Steps 16-18: The Wallet Instance creates a new key pair to which the new credential shall be bound. Then, it creates a proof of possession with the new key and the c_nonce obtained in Step 15 and it creates a DPoP proof for the request to the PID credential issuance endpoint.

    -

    Step 19: The Wallet Instance sends a PID issuance request to the PID Provider credential endpoint. It contains the access token, the DPoP proof, the credential type, the proof (proof of possession of the key) and the format.

    -
    -

    Note

    -

    PID Credential Schema and Status registration: The PID Provider MUST register all the issued PIDs for their later revocation, if needed.

    -
    -
    POST /credential HTTP/1.1
-Host: pid-provider.example.org
-Content-Type: application/x-www-form-urlencoded
-Authorization: DPoP Kz~8mXK1EalYznwH-LC-1fBAo.4Ljp~zsPE_NeO.gxU
-DPoP: eyJ0eXAiOiJkcG9wK2p3dCIsImFsZyI6IkVTMjU2IiwiandrIjp7Imt0eSI6Ik
-    VDIiwieCI6Imw4dEZyaHgtMzR0VjNoUklDUkRZOXpDa0RscEJoRjQyVVFVZldWQVdCR
-    nMiLCJ5IjoiOVZFNGpmX09rX282NHpiVFRsY3VOSmFqSG10NnY5VERWclUwQ2R2R
-    1JEQSIsImNydiI6IlAtMjU2In19.eyJqdGkiOiJlMWozVl9iS2ljOC1MQUVCIiwiaHRtIj
-    oiR0VUIiwiaHR1IjoiaHR0cHM6Ly9yZXNvdXJjZS5leGFtcGxlLm9yZy9wcm90ZWN0Z
-    WRyZXNvdXJjZSIsImlhdCI6MTU2MjI2MjYxOCwiYXRoIjoiZlVIeU8ycjJaM0RaNTNF
-    c05yV0JiMHhXWG9hTnk1OUlpS0NBcWtzbVFFbyJ9.2oW9RP35yRqzhrtNP86L-Ey71E
-    OptxRimPPToA1plemAgR6pxHF8y6-yqyVnmcw6Fy1dqd-jfxSYoMxhAJpLjA
-
-credential_definition=%7B%22type%22:%5B%22eu.eudiw.pid.it%22%5D%7D
-&format=vc+sd-jwt
-&proof=%7B%22proof_type%22:%22...-ace0-9c5210e16c32%22%7D
-
    -
    -

    A non-normative example of proof parameter is given below:

    -
    {
-"proof_type": "jwt",
-"jwt": "eyJraWQiOiJkaWQ6ZXhhbXBsZTplYm …"
-}
-
    -
    -

    Where the JWT looks like this:

    -
    {
-  "alg": "ES256",
-  "typ": "openid4vci-proof+jwt",
-  "kid": "dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw"
-}
-
    -
    -
    {
-"iss": "0b434530-e151-4c40-98b7-74c75a5ef760",
-"aud": "https://pid-provider.example.org",
-"iat": 1504699136,
-"nonce": "tZign...snFbp"
-}
-
    -
    -

    Steps 20-22: The PID Provider checks the DPoP proof and whether the access token is valid and suitable for the requested PID. It also checks the proof of possession for the key material the new credential shall be bound to. If all checks succeed, the PID Provider creates a new credential bound to the key material and sends it to the Wallet Instance. The Wallet Instance MUST perform the PID integrity and authenticity checks and if it is successful can proceed with secure storage of the PID credential.

    -
    HTTP/1.1 200 OK
-Content-Type: application/json
-Cache-Control: no-store
-Pragma: no-cache
-
-{
-"format": "vc+sd-jwt"
-"credential" : "LUpixVCWJk0eOt4CXQe1NXK[...]WZwmhmn9OQp6YxX0a2L",
-"c_nonce": "fGFF7[...]UkhLa",
-"c_nonce_expires_in": 86400
-}
-
    -
    -
    -
    -

    PAR endpoint

    -
    -

    Request

    -

    The requests to the PID Provider authorization endpoint MUST be HTTP with method POST, with the following mandatory parameters in the HTTP request message body, encoded in application/x-www-form-urlencoded format.

    - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Table 1 PAR http request parameters

    Claim

    Description

    Reference

    response_type

    MUST be set to code.

    The OAuth 2.0 Authorization Framework

    client_id

    MUST be set to the thumbprint of the jwk value in the cnf parameter inside the Wallet Instance Attestation.

    The OAuth 2.0 Authorization Framework

    code_challenge

    A challenge derived from the code verifier that is sent in the authorization request

    RFC 7636#section-4.2.

    code_challenge_method

    A method that was used to derive code challenge. It MUST be set to S256.

    RFC 7636#section-4.3.

    request

    It MUST be a signed JWT. The private key corresponding to the public one in the cnf parameter inside the Wallet Instance Attestation MUST be used for signing the request object.

    OpenID Connect Core. Section 6

    client_assertion_type

    It MUST be set to urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation.

    Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants

    client_assertion

    It MUST be the Wallet Instance Attestation signed JWT.

    Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants

    -

    The JWT Request Object has the following JOSE header parameters:

    - ----- - - - - - - - - - - - - - - - - -

    JOSE header

    Description

    Reference

    alg

    A digital signature algorithm identifier such as per IANA "JSON Web Signature and Encryption Algorithms" registry. It MUST be one of the supported algorithms in Section Cryptographic Algorithms and MUST NOT be none or an identifier for a symmetric algorithm (MAC).

    RFC 7516#section-4.1.1.

    kid

    Unique identifier of the JWK as base64url-encoded JWK Thumbprint value.

    RFC 7638#section_3.

    -
    -

    Note

    -

    The parameter typ, if omitted, assumes the implicit value JWT.

    -
    -

    The JWT payload is given by the following parameters:

    - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    response_type

    It MUST be set as in the Table of the HTTP parameters.

    See Table of the HTTP parameters.

    client_id

    It MUST be set as in the Table of the HTTP parameters.

    See Table of the HTTP parameters.

    state

    Unique session identifier at the client side. This value will be returned to the client in the response, at the end of the authentication. It MUST be a random string with at least 32 alphanumeric characters.

    See OpenID.Core#AuthRequest.

    code_challenge

    It MUST be set as in the Table of the HTTP parameters.

    See Table of the HTTP parameters.

    code_challenge_method

    It MUST be set as in the Table of the HTTP parameters.

    See Table of the HTTP parameters.

    authorization_details

    JSON Object. It MUST include the following claims:

    -
    -
      -

    • type: it MUST be set to openid_credential,

      • -

    • format: it MUST be set to vc+sd-jwt,

      • -

    • credential_definition: JSON Object. It MUST have the type claim which MUST be set to eu.eudiw.pid.it

      • -
    -
    -

    See [RAR RFC 9396] and [OIDC4VCI. Draft 13].

    redirect_uri

    Redirection URI to which the response will be sent. It MUST be an universal or app link registered with the local operating system, so this latter will resolve it and pass the response to the Wallet Instance.

    See OpenID.Core#AuthRequest.

    client_assertion_type

    It MUST be set as in the Table of the HTTP parameters.

    See Table of the HTTP parameters.

    client_assertion

    It MUST be set as in the Table of the HTTP parameters.

    See Table of the HTTP parameters.

    -
    -
    -

    Response

    -

    If the verification is successful, the PID Provider MUST provide the response with a 201 HTTP status code. The following parameters are included as top-level members in the message body of the HTTP response using the application/json media type as defined by [RFC 8259].

    - ----- - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    request_uri

    The request URI corresponding to the authorization request posted. This URI MUST be a single-use reference to the respective authorization request. It MUST contain some part generated using a cryptographically strong pseudorandom algorithm. The value format MUST be urn:ietf:params:oauth:request_uri:<reference-value> with <reference-value> as the random part of the URI that references the respective authorization request data.

    [RFC 9126].

    expires_in

    A JSON number that represents the lifetime of the request URI in seconds as a positive integer.

    [RFC 9126].

    -
    -
    -
    -

    Authorization endpoint

    -
    -

    Request

    -

    The Authorization request passes through the Browser of the Wallet Instance and both HTTP POST and GET method MAY be used. With the method POST the parameters MUST be sent using the Form Serialization. With the method GET the parameters MUST be sent using the Query String Serialization. For more details see OpenID.Core#Serializations.

    -

    The mandatory parameters in the HTTP authentication request are specified in the following table.

    - ----- - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    client_id

    It MUST be set as in the Table of the HTTP parameters.

    See Table of the HTTP parameters.

    request_uri

    It MUST be set to the same value as obtained by PAR Response. See Table of the HTTP PAR Response parameters.

    [RFC 9126].

    -
    -
    -

    Response

    -

    The authentication response is returned by the PID Provider authorization endpoint at the end of the authentication flow.

    -

    If the authentication is successful the PID Provider redirects the User by adding the following query parameters as required to the redirect_uri. The redirect URI MUST be an universal or app link registered with the local operating system, so this latter is able to resolve its value and delegates the Wallet Instance for the processing.

    - ----- - - - - - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    code

    Unique Authorization Code that the client submits to the Token Endpoint.

    [RFC 6749#section-4.1.2], Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants

    state

    The client MUST check the correspondence with the state value in the request object. It is defined as in the Table of the JWT Request parameters.

    [RFC 6749#section-4.1.2].

    iss

    Unique identifier of the PID PRovider who created the Authentication Response. The Wallet Instance MUST validate this parameter.

    OAuth 2.0 Authorization Server Issuer Identifier in Authorization Response, [RFC7519, Section 4.1.1].

    -
    -
    -
    -

    Token endpoint

    -
    -

    Request

    -

    The request to the PID Provider Token endpoint MUST be an HTTP request with method POST, where its body message is encoded in application/x-www-form-urlencoded format. The Wallet Instance sends the Token endpoint request with private_key_jwt authentication and a DPoP proof containing the mandatory parameters, defined in the table below.

    -

    The Token endpoint MUST accept and validate the DPoP proof sent in the DPoP HTTP header. The Token endpoint MUST validate the DPoP proof based on the steps defined in Section 4.3 of the DPoP specifications [DPoP-draft16]. Thus, this mitigates the misuse of leaked or stolen access tokens at the credential endpoint. If the DPoP proof is invalid, the Token endpoint returns an error response, according to Section 5.2 of [RFC 6749] with invalid_dpop_proof as the value of the error parameter.

    - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    client_id

    It MUST be set as in the Table of the HTTP parameters.

    See Table of the HTTP parameters.

    grant_type

    It MUST be set to authorization_code.

    Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants.

    code

    Authorization code returned in the Authentication Response.

    Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants.

    redirect_uri

    It MUST be set as in the request object Table of the JWT Request parameters.

    Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants.

    code_verifier

    Verification code of the code_challenge.

    Proof Key for Code Exchange by OAuth Public Clients.

    client_assertion_type

    It MUST be set to urn:ietf:params:oauth:client-assertion-type:jwt-bearer.

    Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants.

    client_assertion

    JWT signed with the Wallet Instance's private key containing the following parameters:

    -
      -

    • iss: This MUST contain the client_id.

      • -

    • sub: This MUST contain the iss.

      • -

    • aud: URL of the PID Provider Token Endpoint.

      • -

    • iat: UNIX Timestamp with the time of the JWT issuance, coded as NumericDate as indicated in RFC 7519.

      • -

    • exp: UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in RFC 7519.

      • -

    • jti: Unique Identifier for this authentication request, generated by the client. E.g., uuid4 format.

      • -
    -

    Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants.

    -

    A DPoP proof is included in an HTTP request using the DPoP header parameter containing a DPoP JWS.

    -

    The JOSE header of a DPoP JWT MUST contain at least the following parameters:

    - ----- - - - - - - - - - - - - - - - - - - - - -

    JOSE header

    Description

    Reference

    typ

    It MUST be equal to dpop+jwt.

    [RFC 7515] and [RFC 8725. Section 3.11].

    alg

    A digital signature algorithm identifier such as per IANA "JSON Web Signature and Encryption Algorithms" registry. It MUST be one of the supported algorithms in Section Cryptographic Algorithms and MUST NOT be none or an identifier for a symmetric algorithm (MAC).

    [RFC 7515].

    jwk

    representing the public key chosen by the client, in JSON Web Key (JWK) [RFC7517] format, as defined in Section 4.1.3 of [RFC7515]. It MUST NOT contain a private key.

    [RFC 7517] and [RFC 7515].

    -

    The payload of a DPoP proof MUST contain at least the following claims:

    - ----- - - - - - - - - - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    jti

    Unique identifier for the DPoP proof JWT. The value MUST be assigned in a UUID v4 string format according to [RFC 4122].

    [RFC 7519. Section 4.1.7].

    htm

    The value of the HTTP method of the request to which the JWT is attached.

    [RFC 9110. Section 9.1].

    htu

    The HTTP target URI, without query and fragment parts, of the request to which the JWT is attached.

    [RFC 9110. Section 7.1].

    iat

    UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in RFC 7519.

    [RFC 7519. Section 4.1.6].

    -
    -
    -

    Response

    -

    Token endpoint response MUST contain the following mandatory claims.

    - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    access_token

    The DPoP-bound Access Token, in signed JWT format, allows accessing the Credential Endpoint for obtaining the PID.

    The OAuth 2.0 Authorization Framework.

    token_type

    Type of Access Token returned. It MUST be equal to DPoP.

    The OAuth 2.0 Authorization Framework.

    expires_in

    Expiry time of the Access Token in seconds.

    The OAuth 2.0 Authorization Framework.

    c_nonce

    JSON string containing a nonce to be used to create a proof of possession of key material when requesting a Credential.

    [OIDC4VCI. Draft 13].

    c_nonce_expires_in

    JSON integer denoting the lifetime in seconds of the c_nonce.

    [OIDC4VCI. Draft 13].

    -
    -
    -

    Access Token

    -

    A DPoP-bound Access Token is provided by the PID Provider Token endpoint as a result of a successful token request. The Access Token is represented as JWT according to [RFC 7519]. The Access Token MUST have at least the following mandatory claims and it MUST be bound to the public key that is provided by the DPoP proof. This binding can be accomplished based on the methodology defined in Section 6 of [DPoP-draft16].

    - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    iss

    It MUST be an HTTPS URL that uniquely identifies the PID Provider. The client MUST verify that this value matches the PID Provider where it has requested the credential.

    [RFC 9068], [RFC7519, Section 4.1.1].

    sub

    It identifies the subject of the JWT. It MUST be of type pairwise.

    [RFC 9068], [RFC 7519] and [OpenID.Core#SubjectIDTypes].

    client_id

    It MUST contain a HTTPS URL that uniquely identifies the RP.

    [RFC 9068].

    aud

    It MUST match the value client_id. The RP MUST verify that this value matches its client ID.

    [RFC 9068].

    iat

    UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in RFC 7519.

    [RFC 9068], [RFC 7519. Section 4.1.6].

    exp

    UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in RFC 7519.

    [RFC 9068], [RFC 7519].

    jti

    It MUST be a String in uuid4 format. Unique Token ID identifier that the RP MAY use to prevent reuse by rejecting the Token ID if already processed.

    [RFC 9068], [RFC 7519].

    nonce

    It MUST be a random string of at least 32 alphanumeric characters. The value type of this claim MUST be a string, where the value is a c_nonce provided by the PID Provider.

    [OpenID.Core#AuthRequest].

    jkt

    JWK SHA-256 Thumbprint Confirmation Method. The value of the jkt member MUST be the base64url encoding (as defined in [RFC7515]) of the JWK SHA-256 Thumbprint of the DPoP public key (in JWK format) to which the access token is bound.

    [DPoP-draft16. Section 6.1] and [RFC 7638].

    -
    -
    -
    -

    Credential endpoint

    -
    -

    Request

    -

    A Wallet Instance makes a PID Request to the PID Provider Credential endpoint by sending the following mandatory parameters in the entity-body of an HTTP POST request using the application/json media type.

    -

    The Credential endpoint MUST accept and validate the DPoP proof sent in the DPoP HTTP header based on the steps defined in Section 4.3 of [DPoP-draft16]. If the DPoP proof is invalid, the Credential endpoint returns an error response per Section 5.2 of [RFC 6749] with invalid_dpop_proof as the value of the error parameter.

    -
    -

    Warning

    -

    The Wallet Instance MUST create a new DPoP proof for the Credential request and MUST NOT use the previously created proof for the Token Endpoint.

    -
    - ----- - - - - - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    credential_definition

    JSON object containing the detailed description of the credential type. It MUST have at least the type sub claims which is a JSON array containing the type values the Wallet shall request in the subsequent Credential Request. It MUST be eu.eudiw.pid.it.

    [OIDC4VCI. Draft 13].

    format

    Format of the Credential to be issued. This MUST be vc+sd-jwt.

    [OIDC4VCI. Draft 13].

    proof

    JSON object containing proof of possession of the key material the issued Credential shall be bound to. The proof object MUST contain the following mandatory claims:

    -
      -

    • proof_type: JSON string denoting the proof type. It MUST be jwt.

      • -

    • jwt: the JWT used as proof of possession.

      • -
    -

    [OIDC4VCI. Draft 13].

    -
    -

    Note

    -

    If the format value is mso_mdoc, the credential request MUST contain the doctype claim which is a JSON string identifying the PID type according to EIDAS-ARF . See Appendix E.2. of [OIDC4VCI. Draft 13] for more details.

    -
    -

    The JWT proof type MUST contain the following parameters for the JOSE header and the JWT body:

    - ----- - - - - - - - - - - - - - - - - - - - - -

    JOSE Header

    Description

    Reference

    alg

    A digital signature algorithm identifier such as per IANA "JSON Web Signature and Encryption Algorithms" registry. It MUST be one of the supported algorithms in Section Cryptographic Algorithms and MUST NOT be none or an identifier for a symmetric algorithm (MAC).

    [OIDC4VCI. Draft 13], [RFC 7515], [RFC 7517].

    typ

    MUST be openid4vci-proof+jwt.

    [OIDC4VCI. Draft 13], [RFC 7515], [RFC 7517].

    kid

    It MUST contain the identifier of the key material the PID shall be bound to.

    [OIDC4VCI. Draft 13], [RFC 7515], [RFC 7517].

    - ----- - - - - - - - - - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    iss

    The value of this claim MUST be the client_id of the Wallet Instance.

    [OIDC4VCI. Draft 13], [RFC7519, Section 4.1.1].

    aud

    The value of this claim MUST be the identifier URL of the PID Provider.

    [OIDC4VCI. Draft 13].

    iat

    UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in RFC 7519.

    [OIDC4VCI. Draft 13], [RFC 7519. Section 4.1.6].

    nonce

    The value type of this claim MUST be a string, where the value is a c_nonce provided by the PID Provider in the Token response.

    [OIDC4VCI. Draft 13].

    -
    -
    -

    Response

    -

    Credential Response to the Wallet Instance MUST be sent using application/json media type. The response MUST contain the following mandatory claims:

    - ----- - - - - - - - - - - - - - - - - - - - - - - - - -

    Claim

    Description

    Reference

    format

    Format of the Credential to be issued. This MUST be vc+sd-jwt.

    [OIDC4VCI. Draft 13].

    credential

    Contains the issued PID. It MUST be an SD-JWT JSON Object (see Section PID Data Model).

    Appendix E in [OIDC4VCI. Draft 13].

    c_nonce

    JSON string containing a nonce to be used to create a proof of possession of key material when requesting a further credential or for renewal credential.

    [OIDC4VCI. Draft 13].

    c_nonce_expires_in

    JSON integer corresponding to the c_nonce lifetime in seconds.

    [OIDC4VCI. Draft 13].

    -
    -

    Note

    -

    If the format value is mso_mdoc, the credential value MUST be a base64url-encoded JSON string according to Appendix E of [OIDC4VCI. Draft 13].

    -
    -
    -
    -

    Entity Configuration Credential Issuer

    -

    Below a non-normative example of an Entity Configuration containing an openid_credential_issuer metadata.

    -
    HTTP/1.1 200 OK
-Content-Type: application/entity-statement+jwt
-
-{
-
-  "alg": "RS256",
-  "kid": "FANFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs",
-  "typ": "entity-statement+jwt"
-
-}
-.
-{
-  "exp": "1649610249",
-  "iat": "1649437449",
-  "iss": "https://pid-provider.example.org",
-  "sub": "https://pid-provider.example.org",
-  "jwks": {
-    "keys": [{
-      "kty": "RSA",
-      "use": "sig",
-      "n": "1Ta-sE …",
-      "e": "AQAB",
-      "kid": "FANFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
-    }]
-  },
-  "metadata": {
-    "openid_credential_issuer": {
-      "credential_issuer": "https://pid-provider.example.org",
-      "authorization_endpoint": "https://pid-provider.example.org/connect/authorize",
-      "token_endpoint": "https://pid-provider.example.org/connect/token",
-      "pushed_authorization_request_endpoint": "https://pid-provider.example.org/connect/par",
-      "dpop_signing_alg_values_supported": ["RS256", "RS512", "ES256", "ES512"],
-      "credential_endpoint": "https://pid-provider.example.org/credential",
-      "credentials_supported": {
-        "eu.eudiw.pid.it": {
-          "format": "vc+sd-jwt",
-          "cryptographic_binding_methods_supported": ["jwk"],
-          "cryptographic_suites_supported": ["RS256", "RS512", "ES256", "ES512"],
-          "display": [{
-              "name": "PID Provider Italiano di esempio",
-              "locale": "it-IT",
-              "logo": {
-                "url": "https://pid-provider example.org/public/logo.svg",
-                "alt_text": "logo di questo PID Provider"
-              },
-              "background_color": "#12107c",
-              "text_color": "#FFFFFF"
-            },
-            {
-              "name": "Example Italian PID Provider",
-              "locale": "en-US",
-              "logo": {
-                "url": "https://pid-provider.example.org/public/logo.svg",
-                "alt_text": "The logo of this PID Provider"
-              },
-              "background_color": "#12107c",
-              "text_color": "#FFFFFF"
-            }
-          ],
-          "credential_definition": {
-            "type": ["PIDCredential"],
-            "credentialSubject": {
-              "given_name": {
-                "mandatory": true,
-                "display": [{
-                    "name": "Current First Name",
-                    "locale": "en-US"
-                  },
-                  {
-                    "name": "Nome",
-                    "locale": "it-IT"
-                  }
-                ]
-              },
-              "family_name": {
-                "mandatory": true,
-                "display": [{
-                    "name": "Current Family Name",
-                    "locale": "en-US"
-                  },
-                  {
-                    "name": "Cognome",
-                    "locale": "it-IT"
-                  }
-                ]
-              },
-              "birthdate": {
-                "mandatory": true,
-                "display": [{
-                    "name": "Date of Birth",
-                    "locale": "en-US"
-                  },
-                  {
-                    "name": "Data di Nascita",
-                    "locale": "it-IT"
-                  }
-                ]
-              },
-              "place_of_birth": {
-                "mandatory": true,
-                "display": [{
-                    "name": "Place of Birth",
-                    "locale": "en-US"
-                  },
-                  {
-                    "name": "Luogo di Nascita",
-                    "locale": "it-IT"
-                  }
-                ]
-              },
-              "unique_id": {
-                "mandatory": true,
-                "display": [{
-                    "name": "Unique Identifier",
-                    "locale": "en-US"
-                  },
-                  {
-                    "name": "Identificativo univoco",
-                    "locale": "it-IT"
-                  }
-                ]
-              },
-              "tax_id_number": {
-                "mandatory": true,
-                "display": [{
-                    "name": "Tax Id Number",
-                    "locale": "en-US"
-                  },
-                  {
-                    "name": "Codice Fiscale",
-                    "locale": "it-IT"
-                  }
-                ]
-              }
-            }
-          }
-        }
-      }
-    },
-
-    "federation_entity": {
-      "organization_name": "Pid Provider Organization Example",
-      "homepage_uri": "https://pid-provider.example.org",
-      "policy_uri": "https://pid-provider.example.org/privacy_policy",
-      "tos_uri": "https://pid-provider.example.org/info_policy",
-      "logo_uri": "https://pid-provider.example.org/logo.svg"
-    },
-
-    "openid_relying_party": {
-      <This is the metadata of the PID Provider acting as a Relying Party in the national digital identity framework (CIE/SPID). See spid-cie-oidc-docs for details.>
-    }
-  }
-}
-
    -
    -
    -
    -
    - - - - - -
    - -
    -
    -
    - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/en/presentation.html b/en/presentation.html deleted file mode 100644 index 79415fd5d..000000000 --- a/en/presentation.html +++ /dev/null @@ -1,1311 +0,0 @@ - - - - - - - - Italian eIDAS Wallet Technical Specifications version: latest documentation | presentation.rst - - - - - - - - - - - - - - - - - - - - - -
    - - -
    -
    -
    - -
    -
    -

    - - Docs Italia - - beta - - -

    -

    Public documents, made digital.

    -
    -
    -
    -
    - - - Italian eIDAS Wallet Technical Specifications version: latest documentation - -
    -
    - -
    - - Project: - - Progetto demo - -
    - - -
    - - Administration: - - Organizzazione demo - -
    - -
    -
    -
    -
    -
    -
    -
    - -
    -
    - - -
    -
    - - - - About this document - - -
    -
    -
    - -
    -
    -
    -
    -
    - -
    -
    -
      - -
    -
    -
    -
    - - - -
    - - - Source - -
    -
    -
    - -
    - - - Actions - -
    -
    -
    -
    -
    -
    -
    -
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    -
    -
    - -
    - - - - - -
    -

    presentation.rst

    -

    [What is it]

    -

    [What it is usefull for]

    -

    [Example]

    -
    -

    General Properties

    -

    [TODO]

    -
    -
    -

    Requirements

    -
    -
      -

    • req 1

      • -

    • req 2

      • -
    -
    -
    -
    -

    Attributes

    -

    [Table with parameters/attributes]

    - ---- - - - - - - - - - - -

    Claim

    Description

    key

    value

    -
    -
    -

    Implementation considerations

    -

    TODO

    -
    -
    -

    Libraries and code snippets

    -

    TODO

    -
    -
    -

    External references

    -

    TODO

    -
    -
    - - - - - -
    - -
    -
    -
    - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/en/pseudonyms.html b/en/pseudonyms.html index af3362a02..7bee1c080 100644 --- a/en/pseudonyms.html +++ b/en/pseudonyms.html @@ -579,7 +579,8 @@

    {{ item.title }}

  • Introduction to SSI
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -606,31 +629,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -782,31 +874,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -606,31 +629,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -782,31 +874,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -782,31 +874,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -604,31 +627,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -780,31 +872,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • Same Device Flow
    • Remote Cross Device Flow
    • Authorization Request Details
      • -
    • Request Object Details
      • +
    • Request Object Details +
    • Request URI response
    • Authorization Response Details
    • Relying Party Entity Configuration
      • diff --git a/en/searchindex.js b/en/searchindex.js index ec3d7a5ca..5ef55c05b 100644 --- a/en/searchindex.js +++ b/en/searchindex.js @@ -1 +1 @@ -Search.setIndex({"docnames": ["algorithms", "backup-restore", "contribute", "defined-terms", "index", "pid-eaa-data-model", "pid-eaa-issuance", "pseudonyms", "relying-party-solution", "revocation-lists", "ssi-introduction", "standards", "trust", "wallet-instance-attestation", "wallet-solution"], "filenames": ["algorithms.rst", "backup-restore.rst", "contribute.rst", "defined-terms.rst", "index.rst", "pid-eaa-data-model.rst", "pid-eaa-issuance.rst", "pseudonyms.rst", "relying-party-solution.rst", "revocation-lists.rst", "ssi-introduction.rst", "standards.rst", "trust.rst", "wallet-instance-attestation.rst", "wallet-solution.rst"], "titles": ["Cryptographic algorithms", "backup-restore.rst", "How to contribute", "Defined Terms", "Italian EUDI Wallet Technical Specifications", "PID/(Q)EAA Data Model", "PID/(Q)EAA Issuance", "pseudonyms.rst", "Relying Party Solution", "revocation-lists.rst", "Self Sovereign Identity", "Standards", "The Infrastructure of Trust", "Wallet Instance Attestation", "Wallet Solution"], "terms": {"tutti": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "gli": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "esempi": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "contenuti": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "questa": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "documentazion": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "sono": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "da": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "intendersi": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "come": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "non": [0, 1, 2, 3, 4, 6, 7, 8, 9, 10, 11, 13, 14], "normativi": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "all": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "exampl": [0, 1, 2, 3, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14], "contain": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "thi": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "document": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "ar": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "meant": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "norm": [0, 1, 2, 3, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14], "The": [0, 2, 3, 4, 5, 6, 8, 10, 13, 14], "follow": [0, 2, 4, 5, 6, 8, 10, 12, 13], "must": [0, 4, 5, 6, 8, 12, 13, 14], "support": [0, 6, 8, 12, 13, 14], "oper": [0, 6, 8, 12], "refer": [0, 3, 4, 5, 6, 8, 10, 12, 13], "rs256": [0, 6, 8, 12], "signatur": [0, 3, 4, 5, 6, 8, 12], "rfc": [0, 5, 6, 8, 12], "7518": 0, "rs512": [0, 5, 6, 12], "rsa": [0, 5, 6, 8, 12], "oaep": [0, 8], "kei": [0, 1, 5, 6, 7, 8, 9, 10, 12, 13, 14], "encrypt": [0, 6, 8, 12], "256": [0, 5, 6, 8, 12, 13], "7516": [0, 6, 8], "a128cbc": [0, 8], "hs256": [0, 8], "content": [0, 5, 6, 8], "a256cbc": [0, 8], "hs512": [0, 8], "recommend": [0, 6, 12], "es256": [0, 6, 8, 12, 13], "es512": [0, 6, 12, 13], "ps256": [0, 12], "ps512": [0, 12], "ecdh": 0, "es": [0, 13], "a128kw": 0, "a256kw": 0, "NOT": [0, 5, 6, 8], "none": [0, 6, 8], "rsa_1_5": 0, "hs384": [0, 8], "length": [0, 8], "equal": [0, 6, 8], "greater": 0, "than": [0, 12], "2048": 0, "bit": 0, "A": [0, 3, 6, 8, 10, 12, 13, 14], "4096": 0, "what": [1, 4, 7, 9, 10, 12], "useful": [1, 7, 9], "todo": [1, 5, 7, 9, 11], "req": [1, 7, 8, 9], "1": [1, 5, 6, 7, 8, 9, 12, 13, 14], "2": [1, 5, 6, 7, 8, 9, 13], "tabl": [1, 5, 6, 7, 9, 12], "paramet": [1, 7, 8, 9, 13], "claim": [1, 3, 6, 7, 8, 9, 12, 13], "descript": [1, 3, 5, 6, 7, 8, 9, 12], "valu": [1, 5, 6, 7, 8, 9, 12, 13], "IT": [2, 3, 4, 5, 6], "wallet": [2, 3, 5, 6, 8, 10], "project": [2, 4], "includ": [2, 5, 6, 8, 10, 12, 13, 14], "an": [2, 3, 5, 6, 8, 10, 12, 13, 14], "open": [2, 14], "develop": [2, 4, 12], "process": [2, 3, 6, 8, 10, 12, 13], "approach": [2, 10], "ensur": [2, 4, 5, 10, 12, 13, 14], "access": [2, 4, 8, 10, 12, 14], "invit": 2, "interest": 2, "parti": [2, 3, 4, 6, 10, 13, 14], "particip": [2, 3, 4, 12], "consequ": 2, "stakehold": 2, "nation": [2, 3, 4, 5, 6, 10, 14], "intern": [2, 4], "commun": [2, 4], "member": [2, 4, 6, 10, 12], "onli": [2, 5, 10, 12, 13, 14], "encourag": 2, "also": [2, 3, 6, 10, 12, 13, 14], "heartili": 2, "welcom": 2, "refin": [2, 8], "technic": [2, 3, 6, 8, 12], "rule": [2, 3, 4, 5, 12], "below": [2, 3, 5, 6, 8, 12, 13], "sever": [2, 13], "method": [2, 6, 8, 13, 14], "avail": [2, 5, 8, 12, 13, 14], "github": 2, "issu": [2, 3, 5, 6, 8, 10, 12, 13, 14], "By": [2, 5], "you": [2, 4], "can": [2, 4, 6, 8, 10, 12, 14], "seek": 2, "clarif": 2, "propos": [2, 4], "enhanc": [2, 4, 10, 13], "report": 2, "editori": 2, "typo": 2, "If": [2, 6, 8, 12, 13], "work": 2, "we": [2, 5, 12, 13, 14], "draft": [2, 5, 6, 8, 12], "pull": 2, "request": [2, 4, 10, 12], "link": [2, 6, 13], "repres": [2, 5, 6, 8, 12, 13, 14], "activ": [2, 4, 10, 12, 14], "typic": [2, 10], "alwai": [2, 3, 10, 12], "base": [2, 5, 6, 8, 10, 13], "discuss": [2, 8, 13], "onc": [2, 6, 8, 14], "initi": [2, 6, 13], "facilit": [2, 12], "review": 2, "chang": [2, 8, 12], "befor": [2, 6, 12], "thei": [2, 5, 10, 12, 13], "merg": [2, 13], "main": [2, 6, 10, 12], "branch": 2, "version": [2, 13, 14], "corrent": 2, "italia": 2, "slack": 2, "channel": 2, "messag": [2, 6, 13], "applic": [2, 3, 6, 8, 10, 12, 14], "design": [2, 4, 8, 10, 14], "busi": [2, 4], "connect": [2, 5, 6, 12, 13], "peopl": [2, 10], "inform": [2, 5, 8, 10, 12, 13, 14], "need": [2, 6, 8, 10, 12, 13, 14], "from": [2, 4, 5, 6, 8, 12, 13, 14], "public": [2, 3, 4, 5, 6, 8, 10, 12, 13], "administr": [2, 4, 10, 12], "technician": 2, "student": 2, "citizen": [2, 3, 4, 5, 10], "ha": [2, 6, 8, 12], "everyon": 2, "join": 2, "free": 2, "http": [2, 5, 12, 13], "where": [2, 5, 6, 8, 10, 12, 13], "learn": 2, "about": [2, 4, 8, 10, 13, 14], "partak": 2, "user": [3, 4, 5, 6, 8, 10, 12, 13, 14], "trust": [3, 4, 5, 6, 8, 10, 13, 14], "servic": [3, 4, 6, 10, 12, 13, 14], "model": [3, 4, 6, 8, 10, 13, 14], "list": [3, 4, 5, 10, 12, 13], "framework": [3, 4, 5, 6, 12, 14], "attribut": [3, 4, 5, 8, 10, 12, 13, 14], "electron": [3, 4, 5, 12, 13, 14], "attest": [3, 4, 5, 6, 8, 10, 14], "provid": [3, 4, 5, 6, 8, 10, 12, 14], "tsp": [3, 12], "person": [3, 5, 6, 8, 10, 12, 13, 14], "identif": [3, 4, 5, 6, 8, 10, 12, 14], "data": [3, 4, 6, 8, 10, 12, 13, 14], "pid": [3, 4, 8, 12, 14], "revoc": [3, 4, 6, 8, 12, 13, 14], "qualifi": [3, 5, 12, 14], "qtsp": [3, 12], "eaa": [3, 4, 8, 12, 14], "eida": [3, 4, 5, 6, 10, 12], "arf": [3, 4, 6, 12], "definit": [3, 8, 10, 13, 14], "which": [3, 5, 6, 8, 10, 12, 13, 14], "us": [3, 4, 5, 6, 8, 10, 12, 13], "further": [3, 6, 12, 14], "insight": 3, "topic": 3, "complement": 3, "interact": [3, 6, 8, 10, 12, 13, 14], "compon": [3, 4, 6, 12], "accredit": [3, 12, 13], "bodi": [3, 6, 12], "entiti": [3, 4], "feder": [3, 4, 6, 8, 13], "author": [3, 4, 10, 12, 13, 14], "respons": [3, 4, 12, 13, 14], "manag": [3, 10, 13, 14], "verif": [3, 6, 10, 12, 13, 14], "certif": [3, 10, 12, 13], "requir": [3, 4, 5, 6, 8], "ecosystem": [3, 4, 10, 12, 14], "role": [3, 4, 10, 14], "digit": [3, 4, 5, 6, 8, 10, 12, 14], "ident": [3, 4, 5, 6, 14], "recogn": [3, 10], "state": [3, 4, 6, 8, 10, 12], "identifi": [3, 5, 6, 8, 12, 13, 14], "issuanc": [3, 4, 5, 8, 12, 13, 14], "master": 3, "alreadi": [3, 4, 6], "present": [3, 4, 5, 6, 8, 10, 12, 13, 14], "italian": [3, 5, 6, 12], "system": [3, 4, 6, 10, 12, 14], "govern": [3, 4, 10], "guidelin": [3, 4], "administ": 3, "directli": [3, 6], "through": [3, 5, 12, 13], "its": [3, 6, 8, 12, 13, 14], "intermediari": [3, 12], "statu": [3, 5, 6, 8, 12, 14], "elig": [3, 4], "evalu": [3, 4], "It": [3, 5, 6, 8, 10, 12, 13, 14], "perform": [3, 6, 8], "oversight": 3, "function": [3, 4, 5, 14], "instanc": [3, 4, 5, 6, 8], "solut": [3, 4, 6, 12, 13], "instal": [3, 6, 8, 13, 14], "mobil": [3, 10, 12, 14], "devic": [3, 4, 6, 10, 12, 13, 14], "control": [3, 5, 6, 10, 14], "specif": [3, 5, 6, 8, 10, 12, 13, 14], "who": [3, 4, 6, 10, 12], "sole": 3, "owner": [3, 6, 10, 12], "enabl": [3, 5, 8, 10, 12, 14], "fulli": [3, 12], "autonom": [3, 12], "privat": [3, 4, 5, 6, 8, 12, 13], "conform": [3, 6, 13], "profil": [3, 5, 6], "verifi": [3, 5, 6, 8, 10, 12, 13, 14], "prove": [3, 5, 10, 12], "secur": [3, 6, 8, 10, 12, 13, 14], "compliac": [3, 12], "qeaa": [3, 14], "form": [3, 6, 8, 10, 12, 14], "substanti": 3, "s": [3, 5, 6, 8, 10, 12, 13, 14], "possess": [3, 5, 6, 8, 10, 12, 14], "reli": [3, 4, 6, 10, 14], "natur": [3, 5, 14], "legal": [3, 10, 12, 14], "implement": [3, 4, 6, 12, 13], "authent": [3, 4, 5, 6, 8, 10, 12, 13, 14], "submiss": 3, "mechan": [3, 4, 5, 8, 14], "complianc": [3, 4, 6, 12, 13, 14], "regulatori": 3, "cryptograph": [3, 4, 5, 6, 8, 10, 12, 14], "cannot": [3, 5, 12], "repudi": [3, 4], "over": [3, 5, 10, 12, 13, 14], "time": [3, 5, 6, 8, 12, 13, 14], "relat": [3, 4, 5, 6, 8, 12, 13], "particular": [3, 12, 13], "layer": [3, 8], "architectur": [3, 4, 6, 12, 13, 14], "establish": [3, 4, 6, 10, 14], "reliabl": [3, 5, 12, 13, 14], "oid4vp": [3, 8], "openid": [3, 5, 6, 8, 12, 13], "vc": [3, 5, 6, 8], "credenti": [3, 4, 5, 8, 10, 12, 13], "vp": [3, 8], "api": [3, 4, 13], "program": 3, "interfac": [3, 6, 14], "stand": 4, "commonli": 4, "name": [4, 5, 6, 8, 12, 13], "eu": [4, 6, 8, 12, 14], "regul": [4, 10], "910": 4, "2014": 4, "transact": [4, 6, 14], "market": 4, "repeal": 4, "old": 4, "direct": [4, 13], "1999": 4, "93": 4, "ec": [4, 8, 12, 13], "new": [4, 5, 6, 10, 13], "european": [4, 10], "overcom": 4, "dissimilar": 4, "both": [4, 5, 10, 12, 14], "technolog": 4, "experi": [4, 10, 14], "term": [4, 12, 13], "exist": [4, 14], "among": [4, 12, 13, 14], "21": 4, "eid": [4, 5, 6, 14], "current": [4, 5, 6, 13], "within": [4, 6, 8, 12, 13, 14], "mani": 4, "16": [4, 6, 8], "wa": [4, 6, 8, 13], "creat": [4, 6, 8, 12, 13], "improv": [4, 10], "respond": 4, "input": [4, 13], "receiv": [4, 6, 13], "area": 4, "innov": 4, "decentr": 4, "awar": 4, "To": [4, 8, 13, 14], "date": [4, 5, 6, 12, 13], "three": [4, 14], "coexist": 4, "itali": [4, 6], "web": [4, 6, 8, 12, 13, 14], "card": 4, "cie": [4, 5, 6], "spid": [4, 6, 8, 12], "health": 4, "ts": 4, "cn": 4, "result": [4, 6, 12], "difficult": 4, "thu": [4, 5, 6, 12, 14], "costli": 4, "maintain": [4, 10, 13], "multipl": [4, 10, 12, 13], "therefor": [4, 10, 12, 13], "streamlin": [4, 10], "optim": 4, "alloc": 4, "resourc": [4, 6, 8, 12], "simplifi": 4, "integr": [4, 5, 6, 8, 10, 13, 14], "certifi": [4, 6, 12, 13], "strengthen": 4, "promot": [4, 10], "inclus": 4, "consolid": 4, "best": 4, "practic": [4, 13], "maxim": 4, "deploy": 4, "qualiti": [4, 8], "infrastructur": [4, 10], "provis": 4, "adequ": 4, "accommod": [4, 12], "basi": 4, "acquir": [4, 10, 14], "full": [4, 10], "In": [4, 5, 6, 8, 10, 12, 13, 14], "order": [4, 5, 8, 14], "achiev": 4, "object": [4, 5, 6, 12, 13], "notifi": [4, 6, 8, 12, 14], "scheme": [4, 5, 6, 8, 10], "evolut": 4, "envisag": 4, "progress": 4, "wai": [4, 6, 8, 12], "migrat": 4, "purpos": [4, 8, 10, 14], "defin": [4, 5, 6, 8, 12, 13, 14], "involv": [4, 6, 10, 12], "find": [4, 8, 13], "accord": [4, 5, 6, 8, 12, 13, 14], "realiabl": 4, "set": [4, 5, 6, 8, 12, 13, 14], "mdl": [4, 8], "cbor": 4, "format": [4, 5, 6, 8, 12], "sd": [4, 6, 8], "jwt": [4, 6, 8, 12, 13], "gener": [4, 5, 6, 8], "jw": [4, 6, 8, 12, 13], "openid4vci": [4, 6, 12], "openid4vp": [4, 6, 8, 12], "pseudonym": 4, "siopv2": [4, 8], "backup": 4, "restor": 4, "self": 4, "sovereign": 4, "ssi": 4, "acronym": 4, "properti": [4, 5], "endpoint": [4, 8], "configur": 4, "statement": [4, 6, 8, 13], "long": 4, "live": 4, "privaci": [4, 6, 8, 10, 13, 14], "consider": [4, 8], "q": [4, 8, 12, 14], "mdoc": [4, 8], "high": [4, 5, 8, 14], "level": [4, 8, 10, 13, 14], "flow": [4, 5, 12], "detail": [4, 5, 10, 12, 14], "push": 4, "token": [4, 5, 8, 13], "lifecycl": 4, "extern": 4, "end": [4, 6, 8], "same": [4, 6, 12], "remot": [4, 5, 12], "cross": [4, 12], "uri": [4, 6], "rst": 4, "librari": [4, 12], "code": [4, 5, 6, 8, 12], "snippet": 4, "algorithm": [4, 5, 6, 8, 12, 13], "how": [4, 8, 12, 13], "contribut": 4, "standard": [4, 12, 13], "law": 5, "allow": [5, 6, 8, 10, 12, 13, 14], "authenitc": 5, "carri": [5, 6, 10, 12], "famili": [5, 6], "first": [5, 6], "birth": [5, 6], "place": [5, 6], "uniqu": [5, 6, 8, 12, 13, 14], "taxpay": 5, "number": [5, 6, 8, 12, 14], "extend": [5, 6, 14], "assur": [5, 13, 14], "oidc": [5, 6, 8, 10, 12], "ida": 5, "bind": [5, 6, 12, 13], "give": [5, 6, 8, 12], "evid": 5, "proof": [5, 6, 8, 10, 12, 13, 14], "procedur": [5, 10], "underli": [5, 14], "proxim": 5, "issuer": [5, 8, 10, 12, 13], "mai": [5, 6, 8, 12, 14], "ani": [5, 6, 8, 10, 12, 13], "entitl": 5, "elettron": 5, "recipi": 5, "know": [5, 10, 12], "sourc": [5, 10], "rp": [5, 6, 8, 12, 13], "describ": [5, 6, 8, 12, 13], "section": [5, 6, 8, 12, 13, 14], "given": [5, 6, 12, 13], "json": [5, 6, 8, 12, 13], "payload": [5, 6, 8], "select": [5, 6, 8], "disclosur": [5, 8, 13], "specifi": [5, 6, 13], "terbu": 5, "latest": 5, "sign": [5, 6, 8, 10, 12, 13], "_sd_alg": 5, "5": [5, 6, 8, 12, 13], "other": [5, 6, 8, 10, 12, 14], "some": [5, 6, 12], "them": [5, 8, 10, 12, 13, 14], "disclos": [5, 6, 8, 10, 12], "indic": [5, 6, 8, 12, 13], "hash": [5, 6, 8], "digest": 5, "salt": 5, "one": [5, 6, 8, 10, 12, 13], "omit": [5, 6], "instead": [5, 8, 10, 12], "respect": [5, 6, 14], "decoi": 5, "arrai": [5, 6, 8, 12, 13], "_sd": [5, 8], "each": [5, 6, 8, 12, 13, 14], "map": [5, 8, 12], "calcul": 5, "random": [5, 6, 8], "when": [5, 6, 8, 10, 12, 14], "sent": [5, 6, 8], "holder": [5, 10, 12, 13], "togeth": 5, "combin": [5, 12], "seri": [5, 13], "base64url": [5, 6], "encod": [5, 6, 8], "separ": [5, 8, 13], "next": [5, 8], "singl": [5, 6, 8, 10, 12], "tild": 5, "charact": [5, 6], "n": [5, 6, 8, 12], "see": [5, 6, 12, 13], "more": [5, 6, 8, 12, 13, 14], "jose": [5, 6, 8], "header": [5, 6, 12], "mandatori": [5, 6, 12, 13], "typ": [5, 6, 8, 12, 13], "rfc7515": [5, 6, 8], "4": [5, 6, 8, 12, 13], "9": [5, 6, 8, 13], "alg": [5, 6, 8, 12, 13], "kid": [5, 6, 8, 12, 13], "8": [5, 6, 8, 13], "trust_chain": [5, 8, 12, 13], "chain": [5, 6, 8, 13], "fed": [5, 8, 12], "3": [5, 6, 8, 12, 13, 14], "i": [5, 13], "e": [5, 6, 8, 10, 12, 13], "iss": [5, 6, 8, 12, 13], "url": [5, 6, 8, 12, 13], "string": [5, 6, 8, 12, 13], "rfc7519": [5, 6], "sub": [5, 6, 8, 12, 13], "thumbprint": [5, 6, 13], "jwk": [5, 6, 8, 12, 13], "cnf": [5, 6, 8, 13], "jti": [5, 6, 8, 13], "id": [5, 6, 8, 12, 13], "should": [5, 8, 12, 13], "uuid4": [5, 6], "7": [5, 6, 8, 12, 13], "iat": [5, 6, 8, 12, 13], "unix": [5, 6, 8, 12, 13], "timestamp": [5, 6, 8, 12, 13], "numericd": [5, 6, 8, 12], "7519": [5, 6, 8, 12], "6": [5, 6, 8, 12], "exp": [5, 6, 8, 12, 13], "expiri": [5, 6, 12], "valid": [5, 6, 10, 12, 13], "materi": [5, 6], "confirm": [5, 6], "declar": 5, "rfc7800": 5, "type": [5, 6, 8, 13], "obtain": [5, 6, 8, 12, 13, 14], "metadata": [5, 6, 8, 10], "For": [5, 6, 12, 14], "case": [5, 6, 12, 13], "personidentificationdata": [5, 6, 8], "verified_claim": [5, 8], "element": [5, 10, 13], "regard": [5, 12, 13], "addit": [5, 6, 8, 12, 13], "whether": [5, 6, 12, 13], "nsd": 5, "structur": 5, "trust_framework": 5, "eidas2": 5, "oid": 5, "assurance_level": 5, "loa": [5, 6, 13, 14], "dure": [5, 10, 12, 13, 14], "convei": [5, 12], "least": [5, 6, 8, 14], "electronic_record": 5, "record": 5, "have": [5, 6, 10, 12, 13, 14], "mean": [5, 6], "cointain": 5, "follwo": 5, "organization_nam": [5, 6, 8, 12, 13], "organ": [5, 6, 8, 10, 12, 13], "handl": 5, "organization_id": 5, "ipa": 5, "country_cod": 5, "countri": 5, "iso3166": 5, "alpha": 5, "g": [5, 6, 10, 12], "syntax": 5, "note": [5, 12], "without": [5, 6, 8, 10, 12, 13], "given_nam": [5, 6, 8, 12], "core": [5, 6], "0": [5, 6, 8, 12, 13, 14], "family_nam": [5, 6, 8], "birthdat": [5, 6], "place_of_birth": [5, 6], "subclaim": 5, "local": [5, 6, 8], "unique_id": [5, 6, 8], "anpr": 5, "regist": [5, 6, 13], "resid": [5, 8, 13], "popul": [5, 8], "tax_id_cod": [5, 6], "tax": [5, 6], "etsi": 5, "en": [5, 6], "319": 5, "412": 5, "tinit": 5, "italiantaxidentificationnumb": 5, "ministero": 5, "dell": 5, "interno": 5, "m_it": 5, "xxxxxxxx": 5, "xxxx": 5, "xxxxxxxxxxxx": 5, "mario": 5, "rossi": 5, "1980": 5, "01": 5, "10": [5, 6, 8, 13], "rome": 5, "xxxxxxxxxxxxxxxx": 5, "correspond": [5, 6, 12, 13], "verson": 5, "db67gl7ck3tfiiaf7n6_7shvqk0mdymeqcogglkuaaw": [5, 6], "nehrderpynlhy3m5wldwtwz2auhm": 5, "eyjhbgcioijsuzi1niisimtpzci6": 5, "ikjydmzybg5oqu11sfiwn2fqvw1b": 5, "pidprovid": 5, "org": [5, 6, 8, 12, 13], "nzblsxh8udccd7nowxfzafhkxzsrgc9x": 5, "urn": [5, 6, 13], "uuid": [5, 6, 8], "6c5c0a49": 5, "b589": 5, "431d": 5, "bae7": 5, "219122a9ec2c": 5, "1541493724": [5, 8], "kty": [5, 6, 8, 12, 13], "sig": [5, 6, 8], "1ta": [5, 6, 8], "se": [5, 6, 8], "aqab": [5, 6, 8, 12], "yhnfs3ync9tjicaivhwlvuj3axwggz_98urfaqme": [5, 8], "ogm7ryxgt5xzlevp": 5, "hu": 5, "utk0a": 5, "txaapaobqv1piwmfw": 5, "8jjozbfovmnvq3hflmpwy4o19gpxs61fwhjzebu589": 5, "bomgktw1rbikntw8fzx_bel4ybandr6ahsdgpatfcig": 5, "cflgzentgnrfngnlvvqvcoafi05r6rjux": 5, "rdbldefew": 5, "ju_stahcngs32x": 5, "0ajhrd1": 5, "hclckpt5yqgcfqme168w": 5, "vqi": 5, "s1mt1kxfq2o8j9io7xmmx2mixag9m9pejvqrmca": 5, "zvdghcmclmvwluggsgpskcpkehz4u9owj1sliblcc1o": 5, "sha": [5, 6], "wyiyr0xdndjzs1f2zunmr2zyeu5stjl3iiwgimv2awrlbmnliiwgw3sidhlw": 5, "zsi6icjlbgvjdhjvbmljx3jly29yzcisicjyzwnvcmqioib7inr5cguioiai": 5, "zwlkyxmuaxquy2lliiwginnvdxjjzsi6ihsib3jnyw5pemf0aw9ux25hbwui": 5, "oiaitwluaxn0zxjvigrlbgwnsw50zxjubyisicjvcmdhbml6yxrpb25fawqi": 5, "oiaibv9pdcisicjjb3vudhj5x2nvzguioiaisvqifx19xv0": 5, "2glc42skqvecfgfrynrn9w": 5, "wyjlbhvwnu9nm2dttkljoevzbnn4qv9biiwginvuaxf1zv9pzcisicj4ehh4": 5, "ehh4ec14ehh4lxh4ehgtehh4ec14ehh4ehh4ehh4ehgixq": 5, "eluv5og3gsnii8eynsxa_a": 5, "wyi2swo3de0tytvpvlbhym9tnxrtdlzbiiwgimdpdmvux25hbwuilcaitwfi": 5, "aw8ixq": 5, "6ij7tm": 5, "a5ivpgbos5tmvva": 5, "wyjlsthav205uw5luhbougvozw5izghriiwgimzhbwlsev9uyw1liiwgiljv": 5, "c3npil0": 5, "ei8zwm9qnkppnpenenhdhq": 5, "wyjrz19pnjr6cuf4ztqxmmexmdhpcm9biiwgimjpcnrozgf0zsisicixotgw": 5, "ltaxltewil0": 5, "qg_o64zqaxe412a108iroa": 5, "wyjbsngtmdk1vlbycfr0tjrrtu9xuk9biiwginbsywnlx29mx2jpcnroiiwg": 5, "eyjjb3vudhj5ijogikluiiwgimxvy2fsaxr5ijogiljvbwuifv0": 5, "ajx": 5, "095vprpttn4qmoqroa": 5, "wyjqyzmzsk0ytgnoy1vfbehnz3zfdwzriiwginrhef9pzf9jb2rliiwgilrj": 5, "tklulvhywfhywfhywfhywfhywfgixq": 5, "pc33jm2lchcu_lhggv_ufq": 5, "eyj0exaioij2yytzzc1qd3qilcjhbgcioijsuzuxmiisimtpzci6imqxmjzhnme4ntzmnzcyndu2mdq4ngzhowrjntlkmtk1iiwidhj1c3rfy2hhaw4iolsitkvoumrfunbzbmxiwtnnnvdszfduv1oyyvvobsauli4ilcjleupoykdjau9pslnvekkxtmljc0ltdhbaq0k2ic4uliisiklrsllkbvp5ykc1b1fvmtftrkl3tjjgcvzxmuigli4uil19": 5, "eyjpc3mioijodhrwczovl3bpzhbyb3zpzgvylmv4yw1wbguub3jniiwic3viijoitnpithnyadh1renjzddub1dyrlpbzkhrefpzukddovhzli4uiiwianrpijoidxjuonv1awq6nmm1yzbhndktyju4os00mzfklwjhztctmje5mtiyytllyzjjiiwiawf0ijoxntqxndkznzi0lcjlehaioje1nde0otm3mjqsinn0yxr1cyi6imh0dhbzoi8vcglkchjvdmlkzxiuzxhhbxbszs5vcmcvc3rhdhvziiwiy25mijp7imp3ayi6eyjrdhkioijsu0eilcj1c2uioijzawcilcjuijoimvrhlxnfiokapiisimuioijbuufciiwia2lkijoiwwhorlmzww5doxrqaunhaxzov0xwvuozqxh3r0d6xzk4dvjgyxfnruvzin19lcj0exblijoiugvyc29uswrlbnrpzmljyxrpb25eyxrhiiwidmvyawzpzwrfy2xhaw1zijp7inzlcmlmawnhdglvbii6eyjfc2qiolsit0dtn3j5wgd0nvh6bgv2cc1ids1vvgswys1ueefhuefvynf2mxbjv01mdyjdlcj0cnvzdf9mcmftzxdvcmsioijlawrhcyisimfzc3vyyw5jzv9szxzlbci6imhpz2gifswiy2xhaw1zijp7il9zzci6wyi4smpvekjmb3zntnzrm0hmbg1qv3k0tze5r3b4czyxrldialplylu1odlfiiwiqm9nr2t0vzfyymlrbnr3oez6ef9czuw0wwjbbmrynkfic2rncgf0rknpzyisikngted6zw50r05srm5nbkxwvlfwy29brmkwnxi2ukpvwc1yzgjmzevmzxcilcjkvv9zvgfiq25nuzmywc0wywpicmqxluhdtenrcfq1wxfny2zrbwuxnjh3iiwivlfjlvmxbvqxs3hmctjvoeo5aw83ee1nwdjnsxhhrzlnovblslzxck1jqsisinpwzgdoy21dbe1wv2xvz0dzr3bta0nqa0viwjr1ow9xajftbelcbenjmw8ixx19lcjfc2rfywxnijoic2hhlti1nij9": 5, "wzeifaojnobqisjtq92jtkexrn": 5, "2sgvjklpu4idc_ct2t6tm8z6sqbvy6n94aaev": 5, "hfsv5jost6yjpdngzoxn_w_131rilu8yaint8w31nrgivhjjic0w": 5, "hhicg1lmvjshsmct3rheaprcmso7xkhwmusjt37dozeageti5i47hnzabu7vwxsvulbnnn8v7tjblspo2q0vnwhedx1hq7ih1b8okh": 5, "_aqrhwvm9bcs9cg8o6n9iqubcspfi6gty4zzgheb95knetvhw8il10z9p_hr9twxzqaccc8xrnh4afwr9tidqztr92m7luyvdfmzvghcponi7vbhqmrqzvyqydhq6ejbtrtisyenla5nskbjv8etdlec94vjahznzue9anuqexae55v5m5o9wlowhgv2vl4xv5c": 5, "n5s5uzs08gaxo": 5, "cuanod3bqe9vfrt47ibcm4hucnvdise_awncekoqabv1j9_tv9lwzsecvuuuwwwelhcuxgdyia3qtutxz": 5, "pdnd": 5, "ragioneria": 5, "general": 5, "dello": 5, "stato": 5, "qlhcfc": 5, "preivou": 5, "decod": [5, 6, 8, 13], "healthinsurancedata": 5, "2jir18gfeashygb27s7ss3s_iq4xxfixcryiohrbfn": 5, "1iztq7bov64xtybdkwfc44_vjwe029hzqxeuiloqun4": 5, "enno31jfzfp8y2dw0r": 5, "fimewwe7elgvgohmwmbpu14": 5, "fv2cdnwutqtgohaftvvaumbf0olmnyxmswyf4uixrhi": 5, "dzwjq7mjssx": 5, "xti_hwue8b2x6idm5l": 5, "dod_ybpkjao": 5, "ghyi19frbd_i4boawenojc3lcnmj4pbgnqcsbj_qm4q": 5, "zwlkyxmuaxqucgruzcisicjzb3vyy2uioib7im9yz2fuaxphdglvbl9uyw1l": 5, "ijogiljhz2lvbmvyawegr2vuzxjhbgugzgvsbg8gu3rhdg8ilcaib3jnyw5p": 5, "emf0aw9ux2lkijogilfmsengqyisicjjb3vudhj5x2nvzguioiaisvqifx19": 5, "xv0": 5, "wyjlbhvwnu9nm2dttkljoevzbnn4qv9biiwgimdpdmvux25hbwuilcaitwfyaw8ixq": 5, "wyi2swo3de0tytvpvlbhym9tnxrtdlzbiiwgimzhbwlsev9uyw1liiwgiljvc3npil0": 5, "wyjlsthav205uw5luhbougvozw5izghriiwgimjpcnrozgf0zsisicixotgwltaxltewil0": 5, "wyjrz19pnjr6cuf4ztqxmmexmdhpcm9biiwginbsywnlx29mx2jpcnroiiwg": 5, "wyjbsngtmdk1vlbycfr0tjrrtu9xuk9biiwginrhef9pzf9jb2rliiwgilrj": 5, "eyjpc3mioijodhrwczovl2lzc3vlci5legftcgxllm9yzyisinn1yii6ik56ykxzwgg4durdy2q3bm9xwezaqwzia3hac1jhqzlycy4uliisimp0asi6invybjp1dwlkojzjnwmwytq5lwi1odktndmxzc1iywu3ltixoteymme5zwmyyyisimlhdci6mtu0mtq5mzcyncwizxhwijoxntqxndkznzi0lcjzdgf0dxmioijodhrwczovl2lzc3vlci5legftcgxllm9yzy9zdgf0dxmilcjjbmyionsiandrijp7imt0esi6iljtqsisinvzzsi6innpzyisim4ioiixvgetc0ug4ocmiiwizsi6ikfrquiilcjrawqioijzae5guznzbkm5dgppq2fpdmhxtfzvsjnbehdhr3pfoth1ukzhcu1frxmifx0sinr5cguioijizwfsdghjbnn1cmfuy2veyxrhiiwidmvyawzpzwrfy2xhaw1zijp7inzlcmlmawnhdglvbii6eyjfc2qiolsimmpjuje4z2zlqvniwudcmjdzn3ntm1nfave0ehhgsxhdunlpb2hyqmzucyjdlcj0cnvzdf9mcmftzxdvcmsioijlawrhcziilcjhc3n1cmfuy2vfbgv2zwwioijoawdoin0simnsywltcyi6eyjfc2qiolsimwl6dhe3ym92njr4vflirgtxrmm0nf9waldlmdi5afpxwgvvswxvcvvoncisikvotm8zmwpmekzwofkyrfcwui1msu1lv3dln0vmr3zhb0hnd01cchuxneuilcjgvjjdre5xdvrxvgdpsgfmdhzwyxvtqkywt2xtbnl4txn3ewy0dul4cmhziiwizfpxane3buptu1gtwfrjx0hxduu4qjj4nklkttvsrs1kb0rfeujws0phbyisimdiwwkxowzyykrfatrcb2fxru5pammzbenutwo0cgjhtlfjc0jqx1fnnfeixx19lcjfc2rfywxnijoic2hhlti1nij9": 5, "dy8idmbmzl5qsxahiytv9fg0hhii": 5, "afiwl2slnevi5itxcne0rex2w": 5, "bo78by0ukof5lhbljgv_l5wbx6pvdy0v193ifp7kzjipj2juuq": 5, "xr7rhng9rfdjksj7urvyaseqxka97vwcjxnx7byklq6jkodxl0cxmfdg00hta1mno7opwdrit7bldyl0hfwq": 5, "x08yk23zx2po90p1pbiwmlqnkfezwqiwyz6lvfck7ocleylmzhtlr5qmyhbibu9oghn00hv0q94tchegpsm8wmfuj": 5, "dv6yvfwtkcstg7bjmawt6b4w_ymwv9psmoc1euwo1svoyadqxjgbinmlt4ha": 5, "relev": [6, 10, 14], "releas": [6, 8, 10, 13], "compliant": 6, "eudi": [6, 8, 14], "thes": 6, "genuin": [6, 13], "entir": [6, 12, 13], "product": [6, 14], "own": [6, 10, 12, 13, 14], "offer": [6, 8, 14], "being": [6, 10, 13], "assess": [6, 12], "cab": 6, "compos": [6, 8, 13], "oidc4vci": 6, "13": [6, 8, 13], "saml2": [6, 10], "idp": 6, "preexist": 6, "act": [6, 8], "send": [6, 8, 13], "prior": 6, "start": [6, 8, 12], "fig": 6, "show": [6, 8], "highlight": 6, "step": [6, 14], "previou": [6, 8], "pictur": 6, "setup": 6, "preliminari": 6, "phase": [6, 8, 10, 12, 13], "out": [6, 12], "consist": [6, 14], "assert": [6, 13], "queri": [6, 8], "anchor": [6, 13], "fetch": [6, 12], "interoper": [6, 10, 12], "fresh": [6, 8], "pair": [6, 13, 14], "check": [6, 8, 12], "iam": [6, 10], "proxi": 6, "happen": [6, 13], "consent": [6, 8], "bound": [6, 12], "held": 6, "expand": 6, "under": [6, 8, 10, 13, 14], "assumpt": 6, "store": [6, 10, 12, 14], "most": 6, "9126": 6, "pkce": 6, "exchang": [6, 8, 10, 14], "7636": 6, "consid": [6, 12, 13], "immedi": [6, 12], "discoveri": [6, 8, 12], "part": [6, 8, 12], "protocol": [6, 12], "well": [6, 8, 12, 13, 14], "known": [6, 8, 12, 13, 14], "oauth2": 6, "client": [6, 8, 12, 13], "sinc": [6, 8, 10, 12], "protect": [6, 8], "7521": 6, "insid": [6, 8, 12], "client_assert": 6, "authorization_detail": 6, "rar": 6, "9396": 6, "post": [6, 8, 12, 13], "host": [6, 8], "x": [6, 8, 12, 13], "www": [6, 8], "urlencod": [6, 8], "response_typ": [6, 8, 13], "client_id": [6, 8], "thumprint": 6, "code_challeng": 6, "e9melhoa2owvfremtjguchaoek1t8urwbugjsstw": 6, "cm": 6, "code_challenge_method": 6, "s256": 6, "eyjhbgcioijsuzi1niisimtpzci6imsyymrjin0": 6, "ew0kic": 6, "jpc3mioiaiczzcagrsa3f0myisdqogimf1zci6icjodhrwczovl3nlcnzlci5legftcgxllmnvbsisdqo": 6, "ginjlc3bvbnnlx3r5cguioiaiy29kzsbpzf90b2tlbiisdqogimnsawvudf9pzci6icjznkjozfjrcxqz": 6, "iiwnciaicmvkaxjly3rfdxjpijogimh0dhbzoi8vy2xpzw50lmv4yw1": 6, "client_assertion_typ": 6, "ietf": [6, 13], "param": [6, 13], "oauth": [6, 8, 13], "walletinstanceattest": [6, 8, 13], "fifyx03bnosd8m6gyqifnhnp9cm_sam9tc5nlloiirc": [6, 12], "fyziol9lf2cekunt2jzxilrdink0upcd": 6, "openid_credenti": 6, "credential_definit": 6, "redirect_uri": [6, 8], "eudiw": [6, 8, 12, 13], "return": [6, 8, 12], "201": 6, "cach": 6, "request_uri": [6, 8], "bwc4jk": 6, "esc0w8acc191": 6, "y1ltc2": 6, "expires_in": 6, "60": 6, "get": [6, 8, 12, 13], "3aietf": 6, "3aparam": 6, "3aoauth": 6, "3arequest_uri": 6, "3abwc4jk": 6, "dynam": [6, 12], "perspect": [6, 12], "11": [6, 8], "redirect": [6, 8], "univers": 6, "app": [6, 8, 13, 14], "so": 6, "latter": 6, "resolv": [6, 12, 13], "pass": [6, 8], "302": 6, "found": 6, "locat": [6, 10], "splxlobezqqybys6wxsbia": 6, "3a": 6, "2f": 6, "2fpid": 6, "12": [6, 8], "dpop": 6, "certain": 6, "sender": 6, "draft16": 6, "mitig": 6, "misus": [6, 10], "leak": 6, "stolen": 6, "attack": [6, 8, 13], "14": [6, 8, 13], "code_verifi": 6, "private_key_jwt": [6, 13], "eyj0exaioijkcg9wk2p3dcisimfszyi6ikvtmju2iiwiandrijp7imt0esi6ik": 6, "vdiiwieci6imw4dezyahgtmzr0vjnoukldukrzoxpda0rscejorjqyvvfvzldwqvdcr": 6, "nmilcj5ijoiovzfngpmx09rx282nhpivfrsy3vosmfqsg10nny5verwcluwq2r2r1j": 6, "qsisimnydii6ilatmju2in19": 6, "eyjqdgkioiitqnddm0vtyzzhy2mybfrjiiwiahrtij": 6, "oiue9tvcisimh0dsi6imh0dhbzoi8vc2vydmvylmv4yw1wbguuy29tl3rva2vuiiwia": 6, "wf0ijoxntyymjyynje2fq": 6, "gxa6t8lp4vfrg8v": 6, "fdwp0a0zdrj8igimlvqrmuvwnqg": 6, "4ptflbdlxiossx0x7nvi": 6, "fnyjk70nfbv37xrzt3lg": 6, "grant_typ": [6, 13], "authorization_cod": 6, "dbjftjez4cvp": 6, "mb92k27uhbuju1p1r_ww1gfwfoejxk": 6, "bearer": 6, "eyjhbgcioijiuzi1nii": 6, "15": [6, 8, 13], "success": 6, "c_nonc": 6, "200": 6, "ok": 6, "access_token": 6, "kz": 6, "8mxk1ealyznwh": 6, "lc": 6, "1fbao": 6, "4ljp": 6, "zspe_neo": 6, "gxu": 6, "token_typ": 6, "2677": 6, "tzign": 6, "snfbp": 6, "c_nonce_expires_in": 6, "86400": 6, "18": [6, 8], "shall": 6, "Then": 6, "19": [6, 8], "schema": [6, 12], "registr": [6, 12], "later": 6, "nmilcj5ijoiovzfngpmx09rx282nhpivfrsy3vosmfqsg10nny5verwcluwq2r2r": 6, "1jeqsisimnydii6ilatmju2in19": 6, "eyjqdgkioijlmwozvl9is2ljoc1mquvciiwiahrtij": 6, "oir0vuiiwiahr1ijoiahr0chm6ly9yzxnvdxjjzs5legftcgxllm9yzy9wcm90zwn0z": 6, "wryzxnvdxjjzsisimlhdci6mtu2mji2mjyxocwiyxroijoizlvieu8ycjjam0rantnf": 6, "c05yv0jimhhxwg9htnk1oulps0nbcwtzbvffbyj9": 6, "2ow9rp35yrqzhrtnp86l": 6, "ey71": 6, "optxrimpptoa1plemagr6pxhf8y6": 6, "yqyvnmcw6fy1dqd": 6, "jfxsyomxhajplja": 6, "7b": 6, "22type": 6, "22": 6, "5b": 6, "22personidentificationdata": 6, "5d": 6, "7d": 6, "22proof_typ": 6, "ace0": 6, "9c5210e16c32": 6, "proof_typ": 6, "eyjrawqioijkawq6zxhhbxbsztplym": 6, "0b434530": 6, "e151": 6, "4c40": 6, "98b7": 6, "74c75a5ef760": 6, "aud": [6, 8], "1504699136": 6, "nonc": [6, 8, 13], "20": [6, 8], "suitabl": 6, "succe": 6, "proceed": 6, "storag": [6, 12], "pragma": 6, "lupixvcwjk0eot4cxqe1nxk": 6, "wzwmhmn9oqp6yxx0a2l": 6, "fgff7": 6, "ukhla": 6, "6749": 6, "challeng": 6, "deriv": [6, 12], "grant": [6, 8, 10, 12, 13], "per": [6, 8], "iana": [6, 8, 13], "registri": [6, 8, 10, 12], "symmetr": [6, 8], "mac": [6, 8], "7638": 6, "section_3": 6, "assum": [6, 8, 13], "implicit": 6, "session": 6, "side": 6, "32": [6, 8, 13], "alphanumer": 6, "authrequest": 6, "top": 6, "media": [6, 8, 13], "8259": 6, "strong": [6, 14], "pseudorandom": 6, "lifetim": 6, "second": [6, 13], "posit": 6, "integ": 6, "server": 6, "browser": 6, "serial": 6, "ad": 6, "abl": [6, 12, 13], "deleg": [6, 13], "submit": [6, 8], "accept": [6, 8], "invalid": [6, 12, 13], "error": [6, 8], "invalid_dpop_proof": 6, "7515": [6, 8], "8725": [6, 8], "chosen": [6, 8, 13, 14], "rfc7517": [6, 8], "7517": [6, 8, 12], "assign": [6, 8, 12], "v4": [6, 8], "4122": [6, 8], "htm": [6, 8], "attach": [6, 8], "9110": [6, 8], "htu": [6, 8], "target": [6, 8], "fragment": [6, 8], "accomplish": [6, 14], "methodolog": 6, "match": [6, 13], "9068": 6, "princip": 6, "subject": [6, 12], "field": [6, 8, 10, 13], "subjectidtyp": 6, "prevent": [6, 8, 13, 14], "reus": 6, "reject": 6, "jkt": 6, "approv": 6, "upon": 6, "make": [6, 12, 13], "ath": [6, 8], "ascii": 6, "associ": [6, 13, 14], "previous": [6, 12, 13], "denot": 6, "mso_mdoc": [6, 8], "doctyp": [6, 8], "appendix": 6, "renew": [6, 12], "openid_credential_issu": [6, 12], "fanfs3ync9tjicaivhwlvuj3axwggz_98urfaqme": 6, "1649610249": 6, "1649437449": 6, "credential_issu": 6, "authorization_endpoint": [6, 13], "token_endpoint": [6, 13], "pushed_authorization_request_endpoint": 6, "dpop_signing_alg_values_support": 6, "credential_endpoint": 6, "credentials_support": 6, "cryptographic_binding_methods_support": 6, "cryptographic_suites_support": 6, "displai": 6, "italiano": 6, "di": 6, "esempio": 6, "logo": [6, 8, 12, 13], "svg": [6, 8, 12, 13], "alt_text": 6, "questo": 6, "background_color": 6, "12107c": 6, "text_color": 6, "ffffff": 6, "credentialsubject": [6, 8], "true": [6, 8, 13], "nome": 6, "cognom": 6, "nascita": 6, "luogo": 6, "identificativo": 6, "univoco": 6, "codic": 6, "fiscal": 6, "federation_ent": [6, 8, 12], "homepage_uri": [6, 8, 12, 13], "policy_uri": [6, 8, 13], "privacy_polici": [6, 13], "tos_uri": [6, 13], "info_polici": [6, 13], "logo_uri": [6, 8, 12, 13], "openid_relying_parti": [6, 12], "doc": 6, "ask": [8, 10, 14], "demonstr": 8, "differ": [8, 10, 13], "analyz": 8, "chapter": 8, "take": [8, 13], "account": 8, "scenario": [8, 10, 12], "util": [8, 14], "final": [8, 12], "futur": 8, "qr": 8, "frame": 8, "page": [8, 14], "login": [8, 10], "button": 8, "scope": [8, 12], "insert": 8, "shown": 8, "extract": 8, "invok": 8, "capabl": [8, 12, 13, 14], "deselect": 8, "17": 8, "successfulli": 8, "base64": 8, "retriev": [8, 13], "correct": 8, "quartili": 8, "up": [8, 12, 13], "25": 8, "good": [8, 10, 13], "balanc": 8, "between": [8, 10, 12, 14], "densiti": 8, "space": 8, "remain": [8, 10], "readabl": 8, "even": [8, 10, 12], "damag": 8, "partial": 8, "obscur": 8, "raw": 8, "zxvkaxc6ly9hdxrob3jpemu": 8, "y2xpzw50x2lkpwh0dhbzoi8vdmvyawzpzxiuzxhhbxbszs5vcmcmcmvxdwvzdf91cmk9ahr0chm6ly92zxjpzmllci5legftcgxllm9yzy9yzxf1zxn0x3vyaq": 8, "action": [8, 10, 14], "made": [8, 12], "scan": 8, "legitim": 8, "walletinstanceattestationproofofpossess": 8, "dedic": [8, 12], "herein": 8, "doesn": [8, 12], "t": [8, 12], "break": 8, "do": [8, 12, 13], "miss": 8, "would": [8, 10, 13], "lowest": 8, "supported_alg": 8, "therein": [8, 12], "l8tfrhx": 8, "34tv3hricrdy9zckdlpbhf42uqufwvawbf": 8, "y": [8, 12, 13], "9ve4jf_ok_o64zbttlcunjajhmt6v9tdvru0cdvgrda": 8, "crv": [8, 12, 13], "p": [8, 12, 13], "f47c96a1": 8, "f928": 8, "4768": 8, "aa30": 8, "ef32dc78aa69": 8, "1562262616": 8, "fuhyo2r2z3dz53esnrwbb0xwxoany59iikcaqksmqeo": 8, "e0bbf2f1": 8, "8c3a": 8, "4eab": 8, "a8ac": 8, "2e8f34db8a47": 8, "miicajccadogawibag": 8, "awz": 8, "2w3": 8, "sf2": 8, "europa": [8, 12], "client_id_schem": 8, "entity_id": 8, "response_mod": 8, "direct_post": 8, "vp_token": [8, 13], "response_uri": 8, "callback": 8, "2c128e4d": 8, "fc91": 8, "4cd3": 8, "86b8": 8, "18bdea0988cb": 8, "3be39b69": 8, "6ac1": 8, "41aa": 8, "921b": 8, "3e6c07ddcb03": 8, "1672418465": 8, "1672422065": 8, "sequenc": [8, 12], "alias": 8, "suffici": 8, "entropi": 8, "reason": 8, "expir": [8, 12, 13, 14], "after": [8, 13, 14], "usag": [8, 14], "presentation_definit": [8, 13], "still": [8, 12, 13], "better": 8, "here": [8, 14], "input_descriptor": 8, "constraint": [8, 12], "path": [8, 12], "limit_discolusr": 8, "prefer": [8, 14], "mention": [8, 13], "condit": 8, "presentation_definition_uri": 8, "point": [8, 13], "client_metadata": 8, "taken": 8, "client_metadata_uri": 8, "why": 8, "techniqu": [8, 10], "call": [8, 12, 13], "ssl": 8, "split": 8, "could": [8, 10, 13], "malici": 8, "intecept": 8, "network": 8, "traffic": 8, "environ": [8, 14], "firewal": 8, "reduc": [8, 10], "eyjhbgcioijfuzi1nii": 8, "9t2lq": 8, "decrypt": 8, "pt0ixx0": 8, "presentation_submiss": 8, "definition_id": 8, "32f54163": 8, "7166": 8, "48f1": 8, "93d8": 8, "ff217bdb0653": 8, "04a98be3": 8, "7fb0": 8, "4cf5": 8, "af9a": 8, "31579c8b0e7d": 8, "descriptor_map": 8, "period": [8, 12, 13], "vbexjksm45xphtanncig6mcyuu4jfgnzopgukvogg9c": [8, 13], "3978344f": 8, "8596": 8, "4c3a": 8, "a978": 8, "8fcaba3903c5": 8, "1573029723": 8, "0s6_wza2mj": 8, "expos": [8, 12], "2hnofs3ync9tjicaivhwlvuj3axwggz_98urfaqme": [8, 12], "1649590602": 8, "1649417862": 8, "5s4qi": 8, "wallet_relying_parti": [8, 12], "application_typ": 8, "client_nam": 8, "x5c": [8, 12, 13], "contact": [8, 12], "op": [8, 13], "default_acr_valu": 8, "gov": 8, "spidl2": 8, "spidl3": 8, "vp_format": [8, 12], "jwt_vp_json": [8, 13], "eddsa": [8, 12], "es256k": [8, 12], "limit_disclosur": 8, "filter": [8, 12], "const": 8, "intent_to_retain": 8, "sampl": 8, "iso": 8, "18013": 8, "namespac": 8, "fals": [8, 13], "portrait": 8, "driving_privileg": 8, "default_max_ag": 8, "1111": 8, "jarm": 8, "authorization_signed_response_alg": 8, "authorization_encrypted_response_alg": 8, "authorization_encrypted_response_enc": 8, "a192cbc": 8, "a128gcm": 8, "a192gcm": 8, "a256gcm": 8, "subject_typ": 8, "pairwis": 8, "require_auth_tim": 8, "id_token_signed_response_alg": 8, "id_token_encrypted_response_alg": 8, "id_token_encrypted_response_enc": 8, "home": 8, "polici": [8, 12, 13], "static": [8, 12], "tech": [8, 12], "authority_hint": [8, 12], "while": [8, 10], "spec": [8, 12], "tbd": 8, "paradigm": 10, "complet": [10, 12, 14], "ownership": [10, 14], "determin": [10, 12, 14], "actor": [10, 14], "abil": [10, 13, 14], "revok": [10, 12], "said": 10, "histori": 10, "tradit": 10, "intermedi": 10, "signific": [10, 13], "fact": 10, "envis": 10, "option": 10, "compani": 10, "want": [10, 12, 13], "anoth": 10, "becaus": 10, "someth": 10, "individu": 10, "publish": [10, 12], "educ": 10, "institut": 10, "crucial": 10, "phone": 10, "portabl": 10, "principl": 10, "character": 10, "choos": 10, "whom": [10, 12], "risk": [10, 13], "collect": [10, 12], "leverag": [10, 14], "advanc": 10, "avoid": [10, 13], "theft": 10, "fraud": 10, "unauthor": [10, 13, 14], "vulner": [10, 12], "central": 10, "seamless": [10, 14], "across": 10, "border": 10, "effici": [10, 12, 13], "cost": [10, 12], "reduct": 10, "elimin": 10, "repetit": 10, "purchas": 10, "physic": 10, "ag": 10, "restrict": [10, 12], "item": 10, "necessari": [10, 12, 13], "abov": [10, 12], "reveal": 10, "legitimaci": [12, 14], "distribut": 12, "mark": 12, "509": [12, 13], "appli": 12, "subordin": 12, "leaf": 12, "represent": [12, 14], "plai": [12, 14], "except": 12, "summari": 12, "pki": 12, "build": 12, "tamper": [12, 14], "compris": 12, "forg": 12, "adversari": 12, "preserv": [12, 13, 14], "doe": [12, 13], "track": [12, 13], "against": [12, 13], "guarantor": 12, "histor": 12, "save": 12, "year": 12, "retent": 12, "rotat": 12, "flexibl": 12, "modifi": 12, "domain": [12, 13], "simultan": 12, "disabl": 12, "certainti": 12, "propag": 12, "been": 12, "adopt": [12, 13, 14], "effect": [12, 14], "wide": 12, "rang": 12, "softwar": 12, "kit": 12, "rapid": 12, "scalabl": [12, 13], "coverag": 12, "satisfi": 12, "onboard": 12, "recognis": 12, "similar": 12, "rest": [12, 13], "publicli": 12, "summaris": 12, "itself": [12, 14], "third": [12, 13], "superior": 12, "trust_mark_id": 12, "motiv": 12, "serv": [12, 14], "plain": 12, "default": 12, "howev": 12, "enter": [12, 14], "keep": 12, "maximum": 12, "max_path_length": 12, "1649375259": 12, "1649373279": 12, "3i5vv": 12, "_": 12, "root": 12, "ca": 12, "x2zomhngsdc4zlbrcxhmt3mzrmrzog9jd3o2qjzdam51cuhhufruowd0wq": 12, "1knr9ar3mzmokyty8brvriue85nixryx4xd3k4jw7vi": 12, "slt14644zbyxyf": 12, "xmw7apdlbmuw3t1urwi4nafmtkri": 12, "ta": 12, "federation_fetch_endpoint": 12, "federation_resolve_endpoint": 12, "federation_list_endpoint": 12, "federation_trust_mark_status_endpoint": 12, "trust_mark_statu": 12, "trust_marks_issu": 12, "behalf": 12, "concern": 12, "cryptograf": 12, "entity_typ": 12, "trust_mark_issu": 12, "trustworthi": [12, 13, 14], "trust_mark_own": 12, "trust_mark": 12, "intend": [12, 13], "wallet_provid": 12, "automat": [12, 13], "em3cmnzghiyfsq090n6b3op7laaqj8rghmhxgmjstqg": 12, "1649623546": 12, "1649450746": 12, "metadata_polici": 12, "subset_of": 12, "email": 12, "request_authentication_methods_support": 12, "one_of": 12, "request_object": 12, "request_authentication_signing_alg_values_support": 12, "jwt_vp": 12, "pleas": [12, 14], "allowed_leaf_entity_typ": 12, "real": 12, "onlin": 12, "unavail": 12, "concaten": 12, "pertain": 12, "produc": 12, "beyond": 12, "updat": [12, 13], "earliest": 12, "No": 12, "forc": 12, "higher": 12, "abstract": 12, "entityconfigur": 12, "signedjwt": 12, "selfissu": 12, "byleaf": 12, "entitystat": 12, "bytrustanchor": 12, "origin": 12, "eyjhbgcioijfuzi1niisimtpzci6imveuknosghwyxpwd01vrlpjmvu0ulrremmxsjrnmgrvyuu4mwvvwk5vmvuywkdsm1lqrmztv2h1uveilcj0exaioijhchbsawnhdglvbi9lbnrpdhktc3rhdgvtzw50k2p3dcj9": 12, "eyjlehaioje2ndk1ota2mdisimlhdci6mty0otqxnzg2miwiaxnzijoiahr0chm6ly9ycc5legftcgxllm9yzyisinn1yii6imh0dhbzoi8vcnauzxhhbxbszs5vcmcilcjqd2tzijp7imtlexmiolt7imt0esi6ikvdiiwia2lkijoizursq05iafzhelz3tvvgwmmxvtrsvgt6yzfkne0wzfvhrtgxzvvatluxvtjar1izwwpgzlnxahvrusisimnydii6ilatmju2iiwieci6ik1wvlvheuhloghqvhh5dklzrfd2nnjpzhn5adfdufb2tg94zu0wuwhan3cilcj5ijoidf95zlbrd1z1am5os25fnvznt05wcw93uzjvzgzwvwxfwnnvv1uztdrhtsj9xx0sim1ldgfkyxrhijp7im9wzw5pzf9yzwx5aw5nx3bhcnr5ijp7imfwcgxpy2f0aw9ux3r5cguioij3zwiilcjjbgllbnrfawqioijodhrwczovl3jwlmv4yw1wbguub3jnlyisimnsawvudf9yzwdpc3ryyxrpb25fdhlwzxmiolsiyxv0b21hdgljil0simp3a3mionsia2v5cyi6w3sia3r5ijoirumilcjrawqioijlrfjdtkhovmf6vndnvuzayzfvnfjua3pjmuo0ttbkvwffodflvvpovtfvmlphujnzakzmu1dodvfriiwiy3j2ijoiuc0yntyilcj4ijoitxbwvud5sgu4afbuehl2svlev3y2cmlkc3lomunquhzmb3hlttbrafo3dyisinkioij0x3lmuff3vnvqbmhlbl81vmdptlzxb3dtmm9kznbvbf9ac29xvtnmnednin1dfswiy2xpzw50x25hbwuioijoyw1lig9migfuigv4yw1wbgugb3jnyw5pemf0aw9uiiwiy29udgfjdhmiolsib3bzqhjwlmv4yw1wbguuaxqixswiz3jhbnrfdhlwzxmiolsicmvmcmvzaf90b2tlbiisimf1dghvcml6yxrpb25fy29kzsjdlcjyzwrpcmvjdf91cmlzijpbimh0dhbzoi8vcnauzxhhbxbszs5vcmcvb2lkyy9ycc9jywxsymfjay8ixswicmvzcg9uc2vfdhlwzxmiolsiy29kzsjdlcjzy29wzxmioijlds5ldxjvcgeuzwmuzxvkaxcucglkljegzxuuzxvyb3bhlmvjlmv1zgl3lnbpzc5pdc4xigvtywlsiiwic3viamvjdf90exblijoicgfpcndpc2uifswizmvkzxjhdglvbl9lbnrpdhkionsizmvkzxjhdglvbl9yzxnvbhzlx2vuzhbvaw50ijoiahr0chm6ly9ycc5legftcgxllm9yzy9yzxnvbhzllyisim9yz2fuaxphdglvbl9uyw1lijoirxhhbxbszsbsucisimhvbwvwywdlx3vyasi6imh0dhbzoi8vcnauzxhhbxbszs5pdcisinbvbgljev91cmkioijodhrwczovl3jwlmv4yw1wbguuaxqvcg9sawn5iiwibg9nb191cmkioijodhrwczovl3jwlmv4yw1wbguuaxqvc3rhdgljl2xvz28uc3zniiwiy29udgfjdhmiolsidgvjaeblegftcgxllml0il19fswidhj1c3rfbwfya3miolt7imlkijoiahr0chm6ly9yzwdpc3ryes5lawrhcy50cnvzdc1hbmnob3iuzxhhbxbszs5lds9vcgvuawrfcmvsewluz19wyxj0es9wdwjsawmviiwidhj1c3rfbwfyayi6imv5smggxhuymdi2in1dlcjhdxrob3jpdhlfagludhmiolsiahr0chm6ly9pbnrlcm1lzglhdguuzwlkyxmuzxhhbxbszs5vcmcixx0": 12, "dirbryfesmi_6ogrjahayupctxsvbzbmdokvztjyygzmkep6eslixa8nuu9bwbwp_elngdkbpqusbwigx66d5w": 12, "eyjhbgcioijfuzi1niisimtpzci6ilfwunvxse5fwtjzmfdhnw5hshb3vjjkvgrtd3hirupvy2pcdk9fehnwmfext0dnmfzwqnhhbtuyt0eilcj0exaioijhchbsawnhdglvbi9lbnrpdhktc3rhdgvtzw50k2p3dcj9": 12, "eyjlehaioje2ndk2mjm1ndysimlhdci6mty0otq1mdc0niwiaxnzijoiahr0chm6ly9pbnrlcm1lzglhdguuzwlkyxmuzxhhbxbszs5vcmcilcjzdwiioijodhrwczovl3jwlmv4yw1wbguub3jniiwiandrcyi6eyjrzxlzijpbeyjrdhkioijfqyisimtpzci6imveuknosghwyxpwd01vrlpjmvu0ulrremmxsjrnmgrvyuu4mwvvwk5vmvuywkdsm1lqrmztv2h1uveilcjjcnyioijqlti1niisingioijncfzvr3lizthoufr4exzjwurxdjzyawrzewgxq1bqdkxvegvnmffowjd3iiwiesi6inrfewzquxdwdwpuaetuxzvwz09ovnfvd1myb2rmcfvsx1pzb1dvm0w0r00ifv19lcjtzxrhzgf0yv9wb2xpy3kionsib3blbmlkx3jlbhlpbmdfcgfydhkionsic2nvcgvzijp7inn1ynnldf9vzii6wyjlds5ldxjvcgeuzwmuzxvkaxcucglkljesicblds5ldxjvcgeuzwmuzxvkaxcucglklml0ljeixx0sinjlcxvlc3rfyxv0agvudgljyxrpb25fbwv0ag9kc19zdxbwb3j0zwqionsib25lx29mijpbinjlcxvlc3rfb2jqzwn0il19lcjyzxf1zxn0x2f1dghlbnrpy2f0aw9ux3npz25pbmdfywxnx3zhbhvlc19zdxbwb3j0zwqionsic3vic2v0x29mijpbiljtmju2iiwiulm1mtiilcjfuzi1niisikvtnteyiiwiufmyntyilcjquzuxmijdfx19lcj0cnvzdf9tyxjrcyi6w3siawqioijodhrwczovl3rydxn0lwfuy2hvci5legftcgxllmv1l29wzw5pzf9yzwx5aw5nx3bhcnr5l3b1ymxpyy8ilcj0cnvzdf9tyxjrijoizxlkagigxhuymdi2in1dfq": 12, "rigdha7coap3so3znsjdwt7": 12, "8tea41an3ybw": 12, "qawfndqmuzctqrwcd4vtx6tzeeoro3keu8bjeaklikhrhzobg": 12, "eyjhbgcioijfuzi1niisimtpzci6imvvrldsakjkylhveu5tmhrhv1jrylhcmwvurlbjazv6uzbgrvftmwfnvfpeytnowk1wukturtr5y3cilcj0exaioijhchbsawnhdglvbi9lbnrpdhktc3rhdgvtzw50k2p3dcj9": 12, "eyjlehaioje2ndk2mjm1ndysimlhdci6mty0otq1mdc0niwiaxnzijoiahr0chm6ly90cnvzdc1hbmnob3iuzxhhbxbszs5ldsisinn1yii6imh0dhbzoi8vaw50zxjtzwrpyxrllmvpzgfzlmv4yw1wbguub3jniiwiandrcyi6eyjrzxlzijpbeyjrdhkioijfqyisimtpzci6ilfwunvxse5fwtjzmfdhnw5hshb3vjjkvgrtd3hirupvy2pcdk9fehnwmfext0dnmfzwqnhhbtuyt0eilcjjcnyioijqlti1niisingioijcr1vooxn6zg0xt1rxvwhuq3jkcwrmqjhttujqb2jcyk5nd2jxznd4c3pziiwiesi6ikdnmuhcngvjrwjhqja4nejiuw5qx0lsefjzytnhvvrhstf0aw5qtmvsdmmifv19lcj0cnvzdf9tyxjrcyi6w3siawqioijodhrwczovl3rydxn0lwfuy2hvci5legftcgxllmv1l2zlzgvyyxrpb25fzw50axr5l3royxqtchjvzmlszsisinrydxn0x21hcmsioijleupoyibcdtiwmjyifv19": 12, "kr2obdmfqlgcz2zqn0fgop7cwsw4clxbaj4": 12, "j_c3hc": 12, "yeeck6sllnk00bgqoee2ncmy2lqk9dyqo1iaub_zg7a": 12, "At": 12, "short": 12, "attain": 12, "compat": [12, 14], "less": 12, "24": 12, "hour": 12, "As": 12, "possibl": 12, "furthermor": [12, 14], "longer": [12, 13], "inquir": 12, "hardwar": 12, "amount": 12, "matter": 12, "line": 12, "gdpr": [12, 13], "There": 12, "especi": 12, "perimet": 12, "like": [12, 13], "jurisdict": 12, "eg": 12, "snapshot": 12, "back": 12, "cloud": 12, "explicit": 12, "permiss": 12, "overload": 12, "manipul": 13, "forgeri": 13, "attempt": 13, "fulfil": 13, "meet": 13, "guarante": [13, 14], "belong": 13, "sustain": 13, "criteria": 13, "task": 13, "light": 13, "fast": 13, "variou": [13, 14], "simplic": 13, "therebi": 13, "accur": 13, "measur": 13, "tool": 13, "reusabl": 13, "usabl": 13, "repeat": 13, "loss": 13, "delet": 13, "lost": 13, "becom": [13, 14], "pseudonymis": 13, "imposs": 13, "absenc": 13, "art": 13, "comprehens": [13, 14], "pose": 13, "theoret": 13, "databas": 13, "launch": 13, "everi": 13, "replai": 13, "proce": 13, "formal": 13, "readi": 13, "consum": 13, "go": 13, "those": 13, "asc_values_support": 13, "context": 13, "These": [13, 14], "mainli": 13, "low": 13, "medium": 13, "grant_types_support": 13, "equival": 13, "token_endpoint_auth_methods_suppo": 13, "rted": 13, "token_endpoint_auth_signing_alg_v": 13, "alues_support": 13, "experiment": 13, "websit": 13, "5t5yypbhn": 13, "egieei5iuzr6r0mr02lnvq0omekmnkcji": 13, "qrjrj3af_b57sboirrcbm7br7woc8ynj7lhfpteffuk": 13, "1h0cwdyggvu8w": 13, "kpku_xycocunt2o0bwsliqtnpu6im": 13, "basic": 13, "token_endpoint_auth_methods_support": 13, "token_endpoint_auth_signing_alg_values_support": 13, "es384": 13, "pagopa": 13, "1687171759": 13, "1709290159": 13, "var": 13, "walletinstanceattestationrequest": 13, "porvid": 13, "comma": 13, "6ec69324": 13, "60a8": 13, "4e5b": 13, "a697": 13, "a766d85790ea": 13, "4hnpti": 13, "xr2pjyrjkgmnz4wmdnqd_ujsq4r95nj98b44": 13, "liznsb39vfjhygs3k7jxe4r3": 13, "cogfqwztpbirqpnlrg": 13, "1686645115": 13, "1686652315": 13, "whose": 13, "let": 13, "va": 13, "yet": 13, "problem": 13, "limit": 13, "durat": 13, "asc": 13, "Of": 13, "agreement": 13, "response_types_support": 13, "vp_formats_support": 13, "jwt_vc_json": 13, "request_object_sign": 13, "_alg_values_support": 13, "_uri_support": 13, "boolean": 13, "transfer": 13, "eyjhbgcioijfuz": 13, "6s0a": 13, "jjla": 13, "h9gw": 13, "miibjdcc": 13, "xfehgkqa": 13, "alg_values_support": 13, "request_object_signing_alg_values_support": 13, "presentation_definition_uri_support": 13, "1687281195": 13, "1687288395": 13, "two": 13, "our": 13, "cater": 14, "asset": 14, "total": 14, "legisl": 14, "primari": 14, "conveni": 14, "pid\u00b9": 14, "along": 14, "short\u00b9": 14, "vital": 14, "adher": 14, "address": 14, "android": 14, "io": 14, "actual": 14, "engag": 14, "manner": 14, "asymmetr": 14, "exclus": 14, "Their": 14, "utmost": 14, "execut": 14, "tee": 14, "\u00b3": 14, "distinct": 14, "performed\u00b2": 14, "unlock": 14, "pin": 14, "biometr": 14, "fingerprint": 14, "facial": 14, "recognit": 14, "unambigu": 14, "confid": 14, "view": 14, "providers\u00b9": 14, "parties\u00b9": 14, "share": 14, "rel": 14, "revert": 14, "circumst": 14, "voluntarili": 14, "remov": 14, "\u00b9": 14, "inherit": 14, "write": 14, "\u00b2": 14, "depend": 14, "trusti": 14, "enclav": 14}, "objects": {}, "objtypes": {}, "objnames": {}, "titleterms": {"cryptograph": 0, "algorithm": 0, "backup": 1, "restor": 1, "rst": [1, 7, 9], "gener": [1, 7, 9, 12, 13], "properti": [1, 7, 9, 12, 13], "requir": [1, 7, 9, 12, 13, 14], "attribut": [1, 7, 9], "implement": [1, 7, 9], "consider": [1, 7, 9, 12], "librari": [1, 7, 9], "code": [1, 7, 9], "snippet": [1, 7, 9], "extern": [1, 7, 9, 14], "refer": [1, 7, 9, 14], "how": 2, "contribut": 2, "defin": 3, "term": 3, "acronym": 3, "italian": 4, "eudi": [4, 12], "wallet": [4, 12, 13, 14], "technic": 4, "specif": 4, "introduct": [4, 10], "index": 4, "content": 4, "pid": [5, 6], "q": [5, 6], "eaa": [5, 6], "data": 5, "model": [5, 12], "sd": 5, "jwt": 5, "paramet": [5, 6, 12], "verif": 5, "field": 5, "claim": 5, "non": [5, 12], "norm": 5, "exampl": 5, "mdoc": 5, "cbor": 5, "issuanc": 6, "high": [6, 13], "level": 6, "flow": [6, 8], "detail": [6, 8, 13], "push": 6, "author": [6, 8], "request": [6, 8, 13], "endpoint": [6, 12, 13], "par": 6, "http": [6, 8], "respons": [6, 8], "token": 6, "access": 6, "credenti": 6, "entiti": [6, 8, 12, 13], "configur": [6, 8, 12, 13], "issuer": 6, "pseudonym": 7, "reli": [8, 12], "parti": [8, 12], "solut": [8, 14], "same": 8, "devic": 8, "remot": 8, "cross": 8, "object": 8, "dpop": 8, "header": [8, 13], "uri": 8, "revoc": 9, "list": 9, "self": 10, "sovereign": 10, "ident": 10, "ssi": 10, "standard": 11, "The": 12, "infrastructur": 12, "trust": 12, "feder": 12, "role": 12, "api": 12, "common": 12, "anchor": 12, "leav": 12, "intermedi": 12, "metadata": [12, 13], "type": 12, "statement": 12, "evalu": 12, "mechan": 12, "attest": [12, 13], "instanc": [12, 13, 14], "chain": 12, "offlin": 12, "repudi": 12, "long": 12, "live": 12, "privaci": 12, "about": 12, "decentr": 12, "end": 13, "design": 13, "static": 13, "view": 13, "compon": 13, "dynam": 13, "format": 13, "provid": 13, "payload": 13, "eudi_wallet_provid": 13, "federation_ent": 13, "signatur": 13, "lifecycl": 14, "initi": 14, "process": 14, "transit": 14, "valid": 14, "state": 14, "return": 14, "oper": 14, "deactiv": 14}, "envversion": {"sphinx.domains.c": 2, "sphinx.domains.changeset": 1, "sphinx.domains.citation": 1, "sphinx.domains.cpp": 6, "sphinx.domains.index": 1, "sphinx.domains.javascript": 2, "sphinx.domains.math": 2, "sphinx.domains.python": 3, "sphinx.domains.rst": 2, "sphinx.domains.std": 2, "sphinx.ext.intersphinx": 1, "sphinx.ext.todo": 2, "sphinx": 56}}) \ No newline at end of file +Search.setIndex({"docnames": ["algorithms", "backup-restore", "contribute", "defined-terms", "index", "pid-eaa-data-model", "pid-eaa-issuance", "pseudonyms", "relying-party-solution", "revocation-lists", "ssi-introduction", "standards", "trust", "wallet-instance-attestation", "wallet-solution"], "filenames": ["algorithms.rst", "backup-restore.rst", "contribute.rst", "defined-terms.rst", "index.rst", "pid-eaa-data-model.rst", "pid-eaa-issuance.rst", "pseudonyms.rst", "relying-party-solution.rst", "revocation-lists.rst", "ssi-introduction.rst", "standards.rst", "trust.rst", "wallet-instance-attestation.rst", "wallet-solution.rst"], "titles": ["Cryptographic algorithms", "backup-restore.rst", "How to contribute", "Normative Language and Conventions", "Italian EUDI Wallet Technical Specifications", "PID/(Q)EAA Data Model", "PID/(Q)EAA Issuance", "pseudonyms.rst", "Relying Party Solution", "revocation-lists.rst", "Self Sovereign Identity", "Standards", "The Infrastructure of Trust", "Wallet Instance Attestation", "Wallet Solution"], "terms": {"tutti": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "gli": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "esempi": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "contenuti": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "questa": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "documentazion": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "sono": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "da": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "intendersi": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "come": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "non": [0, 1, 2, 3, 4, 6, 7, 8, 9, 10, 11, 13, 14], "normativi": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "all": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "exampl": [0, 1, 2, 3, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14], "contain": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "thi": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "document": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "ar": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "meant": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "norm": [0, 1, 2, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14], "The": [0, 2, 3, 4, 5, 6, 8, 10, 13, 14], "follow": [0, 2, 4, 5, 6, 8, 10, 12, 13, 14], "must": [0, 3, 4, 5, 6, 8, 12, 13, 14], "support": [0, 6, 8, 12, 13, 14], "oper": [0, 4, 6, 8, 12], "refer": [0, 3, 4, 5, 6, 8, 10, 12, 13], "rs256": [0, 5, 6, 8, 12], "signatur": [0, 3, 4, 5, 6, 8, 12, 13, 14], "rfc": [0, 5, 6, 8, 12], "7518": 0, "rs512": [0, 5, 6, 12], "rsa": [0, 5, 6, 8, 12], "oaep": [0, 8], "kei": [0, 1, 3, 5, 6, 7, 8, 9, 10, 12, 13, 14], "encrypt": [0, 6, 8, 12], "256": [0, 5, 6, 8, 12, 13, 14], "7516": [0, 6, 8], "a128cbc": [0, 8], "hs256": [0, 8], "content": [0, 5, 6, 8], "a256cbc": [0, 8], "hs512": [0, 8], "recommend": [0, 3, 6, 12], "es256": [0, 6, 8, 12, 13, 14], "es512": [0, 6, 12, 14], "ps256": [0, 12], "ps512": [0, 12], "ecdh": 0, "es": [0, 13], "a128kw": 0, "a256kw": 0, "NOT": [0, 3, 5, 6, 8], "none": [0, 6, 8], "rsa_1_5": 0, "hs384": [0, 8], "length": [0, 8], "equal": [0, 6, 8], "greater": 0, "than": [0, 12], "2048": 0, "bit": 0, "A": [0, 3, 6, 8, 10, 12, 13, 14], "4096": 0, "what": [1, 4, 7, 9, 10, 12], "useful": [1, 7, 9], "todo": [1, 5, 7, 9, 11], "req": [1, 7, 8, 9], "1": [1, 5, 6, 7, 8, 9, 12, 13, 14], "2": [1, 5, 6, 7, 8, 9, 13], "tabl": [1, 5, 6, 7, 9, 12], "paramet": [1, 4, 7, 8, 9, 13, 14], "claim": [1, 3, 4, 6, 7, 8, 9, 12, 13], "descript": [1, 3, 5, 6, 7, 8, 9, 12], "valu": [1, 5, 6, 7, 8, 9, 12, 13, 14], "IT": [2, 3, 4, 5, 6], "wallet": [2, 3, 5, 6, 8, 10], "project": [2, 4], "includ": [2, 5, 6, 8, 10, 12, 13, 14], "an": [2, 3, 5, 6, 8, 10, 12, 13, 14], "open": [2, 14], "develop": [2, 4, 12], "process": [2, 3, 4, 6, 8, 10, 12], "approach": [2, 10], "ensur": [2, 4, 5, 10, 12, 13, 14], "access": [2, 4, 8, 10, 12, 14], "invit": 2, "interest": 2, "parti": [2, 3, 4, 6, 10, 13, 14], "particip": [2, 3, 4, 12], "consequ": 2, "stakehold": 2, "nation": [2, 3, 4, 5, 6, 10, 14], "intern": [2, 4, 8], "commun": [2, 4], "member": [2, 4, 6, 10, 12], "onli": [2, 3, 5, 8, 10, 12, 14], "encourag": 2, "also": [2, 3, 6, 10, 12, 13, 14], "heartili": 2, "welcom": 2, "refin": [2, 8], "technic": [2, 3, 6, 8, 12], "rule": [2, 3, 4, 5, 12], "below": [2, 3, 5, 6, 8, 12, 13, 14], "sever": [2, 13], "method": [2, 6, 8, 14], "avail": [2, 5, 8, 12, 14], "github": 2, "issu": [2, 3, 5, 6, 8, 10, 12, 13, 14], "By": [2, 5], "you": [2, 4], "can": [2, 4, 6, 8, 10, 12, 14], "seek": [2, 13], "clarif": 2, "propos": [2, 4], "enhanc": [2, 4, 10, 13], "report": 2, "editori": 2, "typo": 2, "If": [2, 6, 8, 12, 13], "work": 2, "we": [2, 5, 12, 13, 14], "draft": [2, 5, 6, 8, 12], "pull": 2, "request": [2, 4, 10, 12, 14], "link": [2, 6, 13], "repres": [2, 5, 6, 8, 12, 13, 14], "activ": [2, 4, 10, 12, 14], "typic": [2, 10], "alwai": [2, 3, 10, 12], "base": [2, 6, 8, 10, 13], "discuss": [2, 8, 13], "onc": [2, 6, 8, 14], "initi": [2, 4, 6], "facilit": [2, 12], "review": [2, 14], "chang": [2, 8, 12], "befor": [2, 6, 12], "thei": [2, 3, 10, 12, 13], "merg": [2, 13], "main": [2, 6, 10, 12], "branch": 2, "version": [2, 13, 14], "corrent": 2, "italia": 2, "slack": 2, "channel": 2, "messag": [2, 6, 13], "applic": [2, 3, 6, 8, 10, 12, 14], "design": [2, 4, 10, 14], "busi": [2, 4], "connect": [2, 5, 6, 12, 14], "peopl": [2, 10], "inform": [2, 5, 8, 10, 12, 13, 14], "need": [2, 6, 8, 10, 12, 13, 14], "from": [2, 4, 5, 6, 8, 12, 13, 14], "public": [2, 3, 4, 5, 6, 8, 10, 12, 13, 14], "administr": [2, 4, 10, 12], "technician": 2, "student": 2, "citizen": [2, 3, 4, 5, 10], "ha": [2, 6, 8, 12], "everyon": 2, "join": 2, "free": 2, "http": [2, 4, 5, 12, 13, 14], "where": [2, 5, 6, 8, 10, 12, 13], "learn": 2, "about": [2, 4, 8, 10, 13, 14], "partak": 2, "word": 3, "requir": [3, 4, 5, 6, 8], "shall": [3, 6], "should": [3, 5, 6, 8, 12, 13], "mai": [3, 5, 6, 8, 12, 14], "option": [3, 10], "interpret": 3, "describ": [3, 5, 6, 8, 12, 13], "bcp": 3, "14": [3, 6, 8, 13], "rfc2119": 3, "rfc8174": 3, "when": [3, 5, 6, 8, 10, 12, 14], "appear": 3, "capit": 3, "shown": [3, 8], "here": [3, 8, 14], "user": [3, 4, 5, 6, 8, 10, 12, 13, 14], "trust": [3, 4, 5, 6, 8, 10, 13, 14], "servic": [3, 4, 6, 10, 12, 13, 14], "model": [3, 4, 6, 8, 10, 13, 14], "list": [3, 4, 5, 6, 10, 12, 13, 14], "framework": [3, 4, 5, 6, 12, 14], "attribut": [3, 4, 5, 8, 10, 12, 13, 14], "electron": [3, 4, 5, 12, 13, 14], "attest": [3, 4, 6, 8, 10], "provid": [3, 4, 5, 6, 8, 10, 12, 13], "tsp": [3, 12], "person": [3, 5, 6, 8, 10, 12, 13, 14], "identif": [3, 4, 5, 6, 8, 10, 12, 14], "data": [3, 4, 6, 8, 10, 12, 13, 14], "pid": [3, 4, 8, 12, 14], "revoc": [3, 4, 6, 8, 12, 13, 14], "qualifi": [3, 12, 14], "qtsp": [3, 12], "eaa": [3, 4, 8, 12, 14], "eida": [3, 4, 5, 6, 10, 12], "arf": [3, 4, 6, 12], "definit": [3, 8, 10, 13, 14], "which": [3, 5, 6, 8, 10, 12, 13, 14], "us": [3, 4, 5, 6, 8, 10, 12, 13, 14], "further": [3, 6, 12, 14], "insight": 3, "topic": 3, "complement": 3, "interact": [3, 6, 8, 10, 12, 13, 14], "compon": [3, 4, 6, 12], "accredit": [3, 12, 13], "bodi": [3, 6, 12], "entiti": [3, 4, 13, 14], "feder": [3, 4, 6, 8, 14], "author": [3, 4, 10, 12, 13, 14], "respons": [3, 4, 12, 14], "manag": [3, 10, 13, 14], "verif": [3, 4, 6, 10, 12, 13, 14], "certif": [3, 10, 12, 13], "ecosystem": [3, 4, 10, 12, 14], "role": [3, 4, 10, 14], "digit": [3, 4, 5, 6, 8, 10, 12, 14], "ident": [3, 4, 5, 6, 14], "recogn": [3, 10], "state": [3, 4, 6, 8, 10, 12], "identifi": [3, 5, 6, 8, 12, 13, 14], "issuanc": [3, 4, 5, 8, 12, 13, 14], "master": 3, "alreadi": [3, 4, 6], "present": [3, 4, 5, 6, 8, 10, 12, 13, 14], "italian": [3, 5, 6, 12], "system": [3, 4, 6, 10, 12, 14], "govern": [3, 4, 10], "guidelin": [3, 4], "administ": 3, "directli": [3, 6], "through": [3, 5, 12, 13], "its": [3, 6, 8, 12, 13, 14], "intermediari": [3, 8, 12], "statu": [3, 5, 6, 8, 12, 14], "elig": [3, 4], "evalu": [3, 4], "It": [3, 5, 6, 8, 10, 12, 13, 14], "perform": [3, 6, 8, 13], "oversight": 3, "function": [3, 4, 5, 14], "instanc": [3, 4, 5, 6, 8], "solut": [3, 4, 6, 12, 13], "instal": [3, 6, 13, 14], "mobil": [3, 10, 12, 13, 14], "devic": [3, 4, 6, 10, 12, 13, 14], "control": [3, 5, 6, 10, 14], "specif": [3, 5, 6, 8, 10, 12, 13, 14], "who": [3, 4, 6, 10, 12], "sole": 3, "owner": [3, 6, 10, 12], "enabl": [3, 5, 10, 12, 14], "fulli": [3, 12], "autonom": [3, 12], "privat": [3, 4, 5, 6, 8, 12, 13], "conform": [3, 6, 13], "profil": [3, 5, 6], "verifi": [3, 5, 6, 8, 10, 12, 13, 14], "prove": [3, 5, 10, 12], "secur": [3, 6, 8, 10, 12, 13, 14], "compliac": [3, 12], "qeaa": [3, 14], "form": [3, 5, 6, 8, 10, 12, 14], "substanti": 3, "s": [3, 5, 6, 8, 10, 12, 13, 14], "possess": [3, 5, 6, 8, 10, 12, 14], "reli": [3, 4, 6, 10, 14], "natur": [3, 5, 14], "legal": [3, 10, 12, 14], "implement": [3, 4, 6, 12, 13], "authent": [3, 4, 5, 6, 8, 10, 12, 13, 14], "submiss": 3, "mechan": [3, 4, 5, 8, 14], "complianc": [3, 4, 6, 12, 13, 14], "regulatori": 3, "cryptograph": [3, 4, 5, 6, 8, 10, 12, 14], "cannot": [3, 5, 12], "repudi": [3, 4], "over": [3, 5, 10, 12, 13, 14], "time": [3, 5, 6, 8, 12, 13, 14], "relat": [3, 4, 5, 6, 8, 12, 13], "particular": [3, 12], "layer": [3, 8], "architectur": [3, 4, 6, 12, 13, 14], "establish": [3, 4, 6, 10, 14], "reliabl": [3, 5, 12, 13, 14], "level": [3, 4, 8, 10, 14], "assur": [3, 5, 13, 14], "degre": 3, "confid": [3, 14], "vet": 3, "credenti": [3, 4, 5, 8, 10, 12, 13], "same": [3, 4, 6, 12], "whom": [3, 10, 12], "wa": [3, 4, 6, 8, 13], "oid4vp": [3, 8], "openid": [3, 5, 6, 8, 12, 14], "vc": [3, 5, 6, 8], "vp": [3, 8], "api": [3, 4, 14], "program": 3, "interfac": [3, 6, 14], "loa": [3, 5, 6, 13, 14], "stand": 4, "commonli": 4, "name": [4, 5, 6, 8, 12, 14], "eu": [4, 8, 12, 14], "regul": [4, 10], "910": 4, "2014": 4, "transact": [4, 6, 14], "market": 4, "repeal": 4, "old": 4, "direct": [4, 13], "1999": 4, "93": 4, "ec": [4, 8, 12, 13, 14], "new": [4, 5, 6, 10, 13], "european": [4, 10], "overcom": 4, "dissimilar": 4, "both": [4, 5, 10, 12, 14], "technolog": 4, "experi": [4, 10, 14], "term": [4, 12, 13, 14], "exist": [4, 14], "among": [4, 12, 13, 14], "21": 4, "eid": [4, 6, 14], "current": [4, 5, 6], "within": [4, 6, 8, 12, 14], "mani": 4, "16": [4, 6, 8], "creat": [4, 6, 8, 12, 13], "improv": [4, 10], "respond": 4, "input": [4, 14], "receiv": [4, 6, 13], "area": 4, "innov": 4, "decentr": 4, "awar": 4, "To": [4, 8, 13, 14], "date": [4, 5, 6, 12, 13], "three": [4, 14], "coexist": 4, "itali": [4, 6], "web": [4, 6, 8, 12, 13, 14], "card": 4, "cie": [4, 5, 6], "spid": [4, 6, 8, 12], "health": 4, "ts": 4, "cn": 4, "result": [4, 6, 12, 13], "difficult": 4, "thu": [4, 5, 6, 12, 14], "costli": 4, "maintain": [4, 10, 13], "multipl": [4, 10, 12, 13], "therefor": [4, 10, 12], "streamlin": [4, 10], "optim": 4, "alloc": 4, "resourc": [4, 6, 8, 12], "simplifi": 4, "integr": [4, 5, 6, 8, 10, 13, 14], "certifi": [4, 6, 12, 13, 14], "strengthen": 4, "promot": [4, 10], "inclus": 4, "consolid": 4, "best": 4, "practic": [4, 13], "maxim": 4, "deploy": 4, "qualiti": [4, 8], "infrastructur": [4, 10], "provis": [4, 5], "adequ": 4, "accommod": [4, 12], "basi": 4, "acquir": [4, 10, 14], "full": [4, 10], "In": [4, 5, 6, 8, 10, 12, 14], "order": [4, 5, 8, 14], "achiev": 4, "object": [4, 5, 6, 12, 13], "notifi": [4, 6, 8, 12, 14], "scheme": [4, 5, 6, 8, 10], "evolut": 4, "envisag": 4, "progress": 4, "wai": [4, 6, 8, 12], "migrat": 4, "purpos": [4, 8, 10, 14], "defin": [4, 5, 6, 8, 12, 13, 14], "involv": [4, 6, 10, 12], "find": [4, 8], "accord": [4, 5, 6, 8, 12, 13, 14], "realiabl": 4, "set": [4, 5, 6, 8, 12, 13, 14], "mdl": [4, 8], "cbor": 4, "format": [4, 5, 6, 8, 12, 14], "sd": [4, 6, 8], "jwt": [4, 6, 8, 12, 13, 14], "gener": [4, 5, 6, 14], "jw": [4, 6, 8, 12, 13, 14], "openid4vci": [4, 6, 12], "openid4vp": [4, 6, 8, 12], "pseudonym": 4, "siopv2": [4, 8], "backup": 4, "restor": 4, "self": 4, "sovereign": 4, "ssi": 4, "languag": 4, "convent": 4, "acronym": 4, "properti": [4, 5], "endpoint": [4, 8, 13], "configur": [4, 13, 14], "common": 4, "anchor": [4, 6, 13], "leav": 4, "intermedi": [4, 10], "metadata": [4, 5, 6, 8, 10, 13], "type": [4, 5, 6, 8, 13, 14], "statement": [4, 6, 8, 14], "chain": [4, 5, 6, 8, 13], "offlin": 4, "long": 4, "live": 4, "privaci": [4, 6, 8, 10, 13, 14], "consider": [4, 8], "q": [4, 8, 12, 14], "field": [4, 6, 8, 10, 13], "mdoc": [4, 8], "high": [4, 5, 8, 14], "flow": [4, 5, 12], "detail": [4, 5, 10, 12, 14], "push": 4, "par": 4, "token": [4, 5, 8, 13, 14], "issuer": [4, 5, 8, 10, 12, 13], "lifecycl": 4, "transit": 4, "valid": [4, 5, 6, 10, 12, 13], "return": [4, 6, 8, 12, 13], "deactiv": 4, "header": [4, 5, 6, 12], "payload": [4, 5, 6, 8], "wallet_provid": [4, 12], "federation_ent": [4, 6, 8, 12], "extern": 4, "static": [4, 8, 12], "view": [4, 14], "dynam": [4, 6, 12], "remot": [4, 5, 12], "cross": [4, 12], "dpop": [4, 6], "uri": [4, 6], "rst": 4, "librari": [4, 12], "code": [4, 5, 6, 8, 12], "snippet": 4, "algorithm": [4, 5, 6, 8, 12, 13, 14], "how": [4, 8, 12, 13], "contribut": 4, "standard": [4, 12, 14], "law": 5, "allow": [5, 6, 8, 10, 12, 13, 14], "authenitc": 5, "carri": [5, 6, 10, 12], "famili": [5, 6], "first": [5, 6, 8], "birth": [5, 6], "place": [5, 6], "uniqu": [5, 6, 8, 12, 13, 14], "taxpay": 5, "number": [5, 6, 8, 12, 14], "extend": [5, 6, 14], "oidc": [5, 6, 8, 10, 12], "ida": 5, "bind": [5, 6, 12, 13], "give": [5, 6, 8, 12], "evid": 5, "proof": [5, 6, 8, 10, 12, 14], "procedur": [5, 10], "underli": [5, 14], "proxim": 5, "recipi": 5, "know": [5, 10, 12], "sourc": [5, 10], "rp": [5, 6, 8, 12, 13], "section": [5, 6, 8, 12, 13, 14], "select": [5, 6, 8], "disclosur": [5, 8, 13], "specifi": [5, 6, 13, 14], "terbu": 5, "latest": 5, "sign": [5, 6, 8, 10, 12, 13, 14], "_sd_alg": 5, "5": [5, 6, 8, 12, 13], "other": [5, 6, 10, 12, 14], "some": [5, 6, 12], "them": [5, 8, 10, 12, 13, 14], "disclos": [5, 6, 8, 10, 12], "indic": [5, 6, 8, 12, 13], "hash": [5, 6, 8], "digest": 5, "salt": 5, "one": [5, 6, 8, 10, 12, 13], "omit": [5, 6], "instead": [5, 8, 10, 12], "respect": [5, 6, 14], "decoi": 5, "arrai": [5, 6, 8, 12, 13, 14], "_sd": [5, 8], "each": [5, 6, 8, 12, 13, 14], "map": [5, 8, 12], "calcul": 5, "random": [5, 6, 8], "sent": [5, 6, 8], "holder": [5, 10, 12, 13], "togeth": 5, "combin": [5, 12], "seri": [5, 14], "base64url": [5, 6], "encod": [5, 6, 8], "separ": [5, 8, 13], "next": 5, "singl": [5, 6, 8, 10, 12], "tild": 5, "charact": [5, 6], "n": [5, 6, 8, 12], "see": [5, 6, 12, 13], "more": [5, 6, 8, 12, 14], "jose": [5, 6, 8], "mandatori": [5, 6, 12, 13], "typ": [5, 6, 8, 12, 13, 14], "rfc7515": [5, 6, 8], "4": [5, 6, 8, 12, 13], "9": [5, 6, 8, 13], "alg": [5, 6, 8, 12, 13, 14], "kid": [5, 6, 8, 12, 13, 14], "8": [5, 6, 8, 13], "trust_chain": [5, 8, 12, 13], "json": [5, 6, 8, 12, 13], "fed": [5, 8, 12], "3": [5, 6, 8, 12, 13, 14], "i": [5, 13], "e": [5, 6, 8, 10, 12, 13, 14], "iss": [5, 6, 8, 12, 13, 14], "url": [5, 6, 8, 12, 13, 14], "string": [5, 6, 8, 12, 13, 14], "rfc7519": [5, 6], "sub": [5, 6, 8, 12, 13, 14], "thumbprint": [5, 6, 13, 14], "jwk": [5, 6, 8, 12, 13, 14], "cnf": [5, 6, 8, 13], "jti": [5, 6, 8, 13], "id": [5, 6, 8, 12, 13], "uuid4": [5, 6], "7": [5, 6, 8, 12, 13], "iat": [5, 6, 8, 12, 13, 14], "unix": [5, 6, 8, 12, 13, 14], "timestamp": [5, 6, 8, 12, 13, 14], "numericd": [5, 6, 8, 12], "7519": [5, 6, 8, 12], "6": [5, 6, 8, 12], "exp": [5, 6, 8, 12, 13, 14], "expiri": [5, 6, 12], "materi": [5, 6], "confirm": [5, 6], "declar": 5, "rfc7800": 5, "obtain": [5, 6, 8, 12, 13, 14], "For": [5, 6, 12, 14], "case": [5, 6, 12, 13, 14], "personidentificationdata": [5, 6, 8], "verified_claim": [5, 8], "element": [5, 10], "regard": [5, 12, 13], "addit": [5, 6, 8, 12, 13], "whether": [5, 6, 12, 13], "nsd": 5, "structur": [5, 14], "trust_framework": 5, "oid": 5, "assurance_level": 5, "dure": [5, 10, 12, 13, 14], "convei": [5, 12], "least": [5, 6, 8, 14], "electronic_record": 5, "record": 5, "have": [5, 6, 10, 12, 13, 14], "eudi": [5, 6, 8, 14], "gov": [5, 8], "mean": [5, 6], "cointain": 5, "follwo": 5, "organization_nam": [5, 6, 8, 12, 14], "organ": [5, 6, 8, 10, 12, 13, 14], "act": [5, 6, 8], "organization_id": 5, "ipa": 5, "urn": [5, 6, 14], "namespac": [5, 8], "ipa_cod": 5, "country_cod": 5, "countri": 5, "iso3166": 5, "alpha": 5, "g": [5, 6, 10, 12, 14], "syntax": 5, "note": [5, 12, 14], "without": [5, 6, 8, 10, 12, 13], "given_nam": [5, 6, 8, 12], "core": [5, 6], "0": [5, 6, 8, 12, 13, 14], "family_nam": [5, 6, 8], "birthdat": [5, 6], "place_of_birth": [5, 6], "subclaim": 5, "local": [5, 6], "unique_id": [5, 6, 8], "anpr": 5, "given": [5, 6, 12, 13], "regist": [5, 6], "resid": [5, 8, 13], "popul": [5, 8], "tax_id_cod": [5, 6], "tax": [5, 6], "etsi": 5, "en": [5, 6], "319": 5, "412": 5, "tinit": 5, "italiantaxidentificationnumb": 5, "ministero": 5, "dell": 5, "interno": 5, "m_it": 5, "xxxxxxxx": 5, "xxxx": 5, "xxxxxxxxxxxx": 5, "mario": 5, "rossi": 5, "1980": 5, "01": 5, "10": [5, 6, 8, 13], "rome": 5, "xxxxxxxxxxxxxxxx": 5, "correspond": [5, 6, 12, 13], "verson": 5, "db67gl7ck3tfiiaf7n6_7shvqk0mdymeqcogglkuaaw": [5, 6], "nehrderpynlhy3m5wldwtwz2auhm": 5, "eyjhbgcioijsuzi1niisimtpzci6": 5, "ikjydmzybg5oqu11sfiwn2fqvw1b": 5, "pidprovid": 5, "org": [5, 6, 8, 12, 13, 14], "nzblsxh8udccd7nowxfzafhkxzsrgc9x": 5, "uuid": [5, 6, 8], "6c5c0a49": 5, "b589": 5, "431d": 5, "bae7": 5, "219122a9ec2c": 5, "1541493724": [5, 8], "kty": [5, 6, 8, 12, 13, 14], "sig": [5, 6, 8], "1ta": [5, 6, 8], "se": [5, 6, 8], "aqab": [5, 6, 8, 12], "yhnfs3ync9tjicaivhwlvuj3axwggz_98urfaqme": [5, 8], "ogm7ryxgt5xzlevp": 5, "hu": 5, "utk0a": 5, "txaapaobqv1piwmfw": 5, "8jjozbfovmnvq3hflmpwy4o19gpxs61fwhjzebu589": 5, "bomgktw1rbikntw8fzx_bel4ybandr6ahsdgpatfcig": 5, "cflgzentgnrfngnlvvqvcoafi05r6rjux": 5, "rdbldefew": 5, "ju_stahcngs32x": 5, "0ajhrd1": 5, "hclckpt5yqgcfqme168w": 5, "vqi": 5, "s1mt1kxfq2o8j9io7xmmx2mixag9m9pejvqrmca": 5, "zvdghcmclmvwluggsgpskcpkehz4u9owj1sliblcc1o": 5, "sha": [5, 6], "wyiyr0xdndjzs1f2zunmr2zyeu5stjl3iiwgimv2awrlbmnliiwgw3sidhlw": 5, "zsi6icjlbgvjdhjvbmljx3jly29yzcisicjyzwnvcmqioib7inr5cguioiai": 5, "zwlkyxmuaxquy2lliiwginnvdxjjzsi6ihsib3jnyw5pemf0aw9ux25hbwui": 5, "oiaitwluaxn0zxjvigrlbgwnsw50zxjubyisicjvcmdhbml6yxrpb25fawqi": 5, "oiaibv9pdcisicjjb3vudhj5x2nvzguioiaisvqifx19xv0": 5, "2glc42skqvecfgfrynrn9w": 5, "wyjlbhvwnu9nm2dttkljoevzbnn4qv9biiwginvuaxf1zv9pzcisicj4ehh4": 5, "ehh4ec14ehh4lxh4ehgtehh4ec14ehh4ehh4ehh4ehgixq": 5, "eluv5og3gsnii8eynsxa_a": 5, "wyi2swo3de0tytvpvlbhym9tnxrtdlzbiiwgimdpdmvux25hbwuilcaitwfi": 5, "aw8ixq": 5, "6ij7tm": 5, "a5ivpgbos5tmvva": 5, "wyjlsthav205uw5luhbougvozw5izghriiwgimzhbwlsev9uyw1liiwgiljv": 5, "c3npil0": 5, "ei8zwm9qnkppnpenenhdhq": 5, "wyjrz19pnjr6cuf4ztqxmmexmdhpcm9biiwgimjpcnrozgf0zsisicixotgw": 5, "ltaxltewil0": 5, "qg_o64zqaxe412a108iroa": 5, "wyjbsngtmdk1vlbycfr0tjrrtu9xuk9biiwginbsywnlx29mx2jpcnroiiwg": 5, "eyjjb3vudhj5ijogikluiiwgimxvy2fsaxr5ijogiljvbwuifv0": 5, "ajx": 5, "095vprpttn4qmoqroa": 5, "wyjqyzmzsk0ytgnoy1vfbehnz3zfdwzriiwginrhef9pzf9jb2rliiwgilrj": 5, "tklulvhywfhywfhywfhywfhywfgixq": 5, "pc33jm2lchcu_lhggv_ufq": 5, "eyj0exaioij2yytzzc1qd3qilcjhbgcioijsuzuxmiisimtpzci6imqxmjzhnme4ntzmnzcyndu2mdq4ngzhowrjntlkmtk1iiwidhj1c3rfy2hhaw4iolsitkvoumrfunbzbmxiwtnnnvdszfduv1oyyvvobsauli4ilcjleupoykdjau9pslnvekkxtmljc0ltdhbaq0k2ic4uliisiklrsllkbvp5ykc1b1fvmtftrkl3tjjgcvzxmuigli4uil19": 5, "eyjpc3mioijodhrwczovl3bpzhbyb3zpzgvylmv4yw1wbguub3jniiwic3viijoitnpithnyadh1renjzddub1dyrlpbzkhrefpzukddovhzli4uiiwianrpijoidxjuonv1awq6nmm1yzbhndktyju4os00mzfklwjhztctmje5mtiyytllyzjjiiwiawf0ijoxntqxndkznzi0lcjlehaioje1nde0otm3mjqsinn0yxr1cyi6imh0dhbzoi8vcglkchjvdmlkzxiuzxhhbxbszs5vcmcvc3rhdhvziiwiy25mijp7imp3ayi6eyjrdhkioijsu0eilcj1c2uioijzawcilcjuijoimvrhlxnfiokapiisimuioijbuufciiwia2lkijoiwwhorlmzww5doxrqaunhaxzov0xwvuozqxh3r0d6xzk4dvjgyxfnruvzin19lcj0exblijoiugvyc29uswrlbnrpzmljyxrpb25eyxrhiiwidmvyawzpzwrfy2xhaw1zijp7inzlcmlmawnhdglvbii6eyjfc2qiolsit0dtn3j5wgd0nvh6bgv2cc1ids1vvgswys1ueefhuefvynf2mxbjv01mdyjdlcj0cnvzdf9mcmftzxdvcmsioijlawrhcyisimfzc3vyyw5jzv9szxzlbci6imhpz2gifswiy2xhaw1zijp7il9zzci6wyi4smpvekjmb3zntnzrm0hmbg1qv3k0tze5r3b4czyxrldialplylu1odlfiiwiqm9nr2t0vzfyymlrbnr3oez6ef9czuw0wwjbbmrynkfic2rncgf0rknpzyisikngted6zw50r05srm5nbkxwvlfwy29brmkwnxi2ukpvwc1yzgjmzevmzxcilcjkvv9zvgfiq25nuzmywc0wywpicmqxluhdtenrcfq1wxfny2zrbwuxnjh3iiwivlfjlvmxbvqxs3hmctjvoeo5aw83ee1nwdjnsxhhrzlnovblslzxck1jqsisinpwzgdoy21dbe1wv2xvz0dzr3bta0nqa0viwjr1ow9xajftbelcbenjmw8ixx19lcjfc2rfywxnijoic2hhlti1nij9": 5, "wzeifaojnobqisjtq92jtkexrn": 5, "2sgvjklpu4idc_ct2t6tm8z6sqbvy6n94aaev": 5, "hfsv5jost6yjpdngzoxn_w_131rilu8yaint8w31nrgivhjjic0w": 5, "hhicg1lmvjshsmct3rheaprcmso7xkhwmusjt37dozeageti5i47hnzabu7vwxsvulbnnn8v7tjblspo2q0vnwhedx1hq7ih1b8okh": 5, "_aqrhwvm9bcs9cg8o6n9iqubcspfi6gty4zzgheb95knetvhw8il10z9p_hr9twxzqaccc8xrnh4afwr9tidqztr92m7luyvdfmzvghcponi7vbhqmrqzvyqydhq6ejbtrtisyenla5nskbjv8etdlec94vjahznzue9anuqexae55v5m5o9wlowhgv2vl4xv5c": 5, "n5s5uzs08gaxo": 5, "cuanod3bqe9vfrt47ibcm4hucnvdise_awncekoqabv1j9_tv9lwzsecvuuuwwwelhcuxgdyia3qtutxz": 5, "pdnd": 5, "ragioneria": 5, "general": 5, "dello": 5, "stato": 5, "qlhcfc": 5, "previou": [5, 6, 8, 13], "decod": [5, 6, 8, 13], "d126a6a856f7724560484fa9dc59d195": 5, "oians5wycwk4wftestvycn_xow9edkmngh33_q6_pbi0xaty7p3apugjo0ivk5c1nqavy6pzmcpq8p1y0cbac9strmzvtvdqcooclhvy2zlcxtu39ooglnra8_lqsama386lo_qmw4": 5, "uy6dbgzy4vhkscvac9fizydpafqwbequnv2qofmh5vpoihctkhwmgxnzbatyobg57xsoux": 5, "bvho_sfmm3k4rvsxcr3mfojahlfwutu_jk9k7n9kr_mnc5ipioyhzw_sumf6samrqsspp42kd10hpmw0yjtdmyxbdhrmfesmhyimy4obbt43__a55zili_cnik4241wovgvw": 5, "healthinsurancedata": 5, "2jir18gfeashygb27s7ss3s_iq4xxfixcryiohrbfn": 5, "1iztq7bov64xtybdkwfc44_vjwe029hzqxeuiloqun4": 5, "enno31jfzfp8y2dw0r": 5, "fimewwe7elgvgohmwmbpu14": 5, "fv2cdnwutqtgohaftvvaumbf0olmnyxmswyf4uixrhi": 5, "dzwjq7mjssx": 5, "xti_hwue8b2x6idm5l": 5, "dod_ybpkjao": 5, "ghyi19frbd_i4boawenojc3lcnmj4pbgnqcsbj_qm4q": 5, "zwlkyxmuaxqucgruzcisicjzb3vyy2uioib7im9yz2fuaxphdglvbl9uyw1l": 5, "ijogiljhz2lvbmvyawegr2vuzxjhbgugzgvsbg8gu3rhdg8ilcaib3jnyw5p": 5, "emf0aw9ux2lkijogilfmsengqyisicjjb3vudhj5x2nvzguioiaisvqifx19": 5, "xv0": 5, "wyjlbhvwnu9nm2dttkljoevzbnn4qv9biiwgimdpdmvux25hbwuilcaitwfyaw8ixq": 5, "wyi2swo3de0tytvpvlbhym9tnxrtdlzbiiwgimzhbwlsev9uyw1liiwgiljvc3npil0": 5, "wyjlsthav205uw5luhbougvozw5izghriiwgimjpcnrozgf0zsisicixotgwltaxltewil0": 5, "wyjrz19pnjr6cuf4ztqxmmexmdhpcm9biiwginbsywnlx29mx2jpcnroiiwg": 5, "wyjbsngtmdk1vlbycfr0tjrrtu9xuk9biiwginrhef9pzf9jb2rliiwgilrj": 5, "eyjpc3mioijodhrwczovl2lzc3vlci5legftcgxllm9yzyisinn1yii6ik56ykxzwgg4durdy2q3bm9xwezaqwzia3hac1jhqzlycy4uliisimp0asi6invybjp1dwlkojzjnwmwytq5lwi1odktndmxzc1iywu3ltixoteymme5zwmyyyisimlhdci6mtu0mtq5mzcyncwizxhwijoxntqxndkznzi0lcjzdgf0dxmioijodhrwczovl2lzc3vlci5legftcgxllm9yzy9zdgf0dxmilcjjbmyionsiandrijp7imt0esi6iljtqsisimuioijbuufciiwidxnlijoic2lniiwia2lkijoizdeynme2ytg1nmy3nzi0ntywndg0zme5zgm1owqxotuilcjhbgcioijsuzi1niisim4ioijvawfuczv3wunxazr3rnrfu3rwwwnux3hpdzllzetntkdimznfctzfcejjmfhhvfk3udnhcfvnak8waxzrnwmxtlfbvlk2ufpty1brofaxwtbjqkfdovnuum16dlr2rffjt29jtghwetjabgnyvhuzow9pr0xocme4x0xrc2fnqtm4nmxpx3fnvzqtdvk2rgjhwlk0dkhru2n2qum5rklawurqywzxv0jfuvvovjjrt0znsdvwug9paenus0h3tudyblpcyxrzt2jnntd4u09vwc1idmhpx3ngtw0zazrsdnnyy3iztuzvakfotgz3dxr1x2plows3tjllul9ttmm1sxbpt3lowndfc1vtrjztyw1scxntuha0mktemtboue1xmflkvernwxhczehytuzlu01iwulnwtrvqkjundnfx2e1nxpjtelfq25jazqyndf3t3zhdncifx0sinr5cguioijizwfsdghjbnn1cmfuy2veyxrhiiwidmvyawzpzwrfy2xhaw1zijp7inzlcmlmawnhdglvbii6eyjfc2qiolsimmpjuje4z2zlqvniwudcmjdzn3ntm1nfave0ehhgsxhdunlpb2hyqmzucyjdlcj0cnvzdf9mcmftzxdvcmsioijlawrhcyisimfzc3vyyw5jzv9szxzlbci6imhpz2gifswiy2xhaw1zijp7il9zzci6wyixaxp0ctdib3y2nhhuwwjea1dgyzq0x1zqv2uwmjlownfyzvvjbg9xvu40iiwiru5obzmxamz6rna4wtjevzbslwzjtwvxd2u3ruxhdkdvse13tujwdte0rsisikzwmknetld1vhfuz09iywz0dlzhdw1crjbpbg1uexhnc3d5zjr1sxhyafkilcjkwldqctdtslntwc1yvelfsfd1rthcmng2swrnnwxflwrvrf95qnblsmfviiwiz0hzate5znjirf9pnejvyvdftk9qyznsq25najrwykdouwnzqmpfuu00usjdfx0sil9zzf9hbgcioijzagetmju2in0": 5, "prvt9qpf1wmforkncgxw6lokranomsl": 5, "foxmqmuiyk2ao0twm5laveqret9bb5a0fpq7rxnqlu57ngv3o8vzklhfkbkm1_wta5xuzxbfz0qgcmip6tzqu9yavxy162h6_i4foinyhol8i5mnpfthfy0nbytyvkcscfbc2ccv4i7rsalbpbpvitpoyvbzfwtdokuumed5xwkpw9": 5, "vf_jk11yajj880walzu5tz3xaob0kkfus3scmskko5wmm1seas7xl5iipsnamtmrlmke6qcwakddx": 5, "hnegzncwbjhastwb2udayk8c": 5, "wfgdwrrwgq3mu0rfuxmifkjv4gdi8q": 5, "relev": [6, 10, 14], "releas": [6, 8, 10], "compliant": 6, "thes": 6, "genuin": [6, 13], "entir": [6, 12, 13], "product": [6, 14], "own": [6, 10, 12, 14], "offer": [6, 8, 14], "being": [6, 10, 13], "assess": [6, 12], "cab": 6, "compos": [6, 8, 13], "oidc4vci": 6, "13": [6, 8, 13], "saml2": [6, 10], "end": [6, 8], "idp": 6, "preexist": 6, "send": [6, 8, 13, 14], "prior": 6, "start": [6, 8, 12, 13], "fig": 6, "show": [6, 8], "highlight": 6, "step": [6, 14], "pictur": 6, "setup": 6, "preliminari": 6, "phase": [6, 8, 10, 12, 13], "out": [6, 12], "consist": [6, 14], "assert": [6, 13, 14], "queri": [6, 8], "fetch": [6, 12], "ani": [6, 8, 10, 12, 13], "interoper": [6, 10, 12], "fresh": [6, 8], "pair": [6, 13, 14], "check": [6, 8, 12], "iam": [6, 10], "proxi": [6, 8], "happen": 6, "consent": [6, 8], "bound": [6, 12], "held": 6, "expand": 6, "assumpt": 6, "store": [6, 10, 12, 14], "most": 6, "been": [6, 12], "9126": 6, "pkce": 6, "exchang": [6, 8, 10, 14], "7636": 6, "consid": [6, 12, 13], "immedi": [6, 12], "discoveri": [6, 8, 12], "part": [6, 8, 12], "protocol": [6, 12], "well": [6, 8, 12, 13, 14], "known": [6, 8, 12, 14], "oauth2": 6, "client": [6, 8, 12, 14], "sinc": [6, 8, 10, 12], "protect": [6, 8], "7521": 6, "insid": [6, 8, 12], "client_assert": 6, "authorization_detail": 6, "rar": 6, "9396": 6, "post": [6, 8, 12, 14], "host": [6, 8], "x": [6, 8, 12, 13, 14], "www": [6, 8], "urlencod": [6, 8], "response_typ": [6, 8, 13], "client_id": [6, 8], "thumprint": 6, "code_challeng": 6, "e9melhoa2owvfremtjguchaoek1t8urwbugjsstw": 6, "cm": 6, "code_challenge_method": 6, "s256": 6, "eyjhbgcioijsuzi1niisimtpzci6imsyymrjin0": 6, "ew0kic": 6, "jpc3mioiaiczzcagrsa3f0myisdqogimf1zci6icjodhrwczovl3nlcnzlci5legftcgxllmnvbsisdqo": 6, "ginjlc3bvbnnlx3r5cguioiaiy29kzsbpzf90b2tlbiisdqogimnsawvudf9pzci6icjznkjozfjrcxqz": 6, "iiwnciaicmvkaxjly3rfdxjpijogimh0dhbzoi8vy2xpzw50lmv4yw1": 6, "client_assertion_typ": 6, "ietf": [6, 14], "param": [6, 14], "oauth": [6, 8, 13, 14], "walletinstanceattest": [6, 8, 13], "fifyx03bnosd8m6gyqifnhnp9cm_sam9tc5nlloiirc": [6, 12], "fyziol9lf2cekunt2jzxilrdink0upcd": 6, "openid_credenti": 6, "credential_definit": 6, "redirect_uri": [6, 8], "eudiw": [6, 8, 12, 13], "201": 6, "cach": 6, "request_uri": [6, 8], "bwc4jk": 6, "esc0w8acc191": 6, "y1ltc2": 6, "expires_in": 6, "60": 6, "get": [6, 8, 12, 14], "3aietf": 6, "3aparam": 6, "3aoauth": 6, "3arequest_uri": 6, "3abwc4jk": 6, "perspect": [6, 12], "11": [6, 8], "redirect": [6, 8], "univers": 6, "app": [6, 13, 14], "so": 6, "latter": 6, "resolv": [6, 12, 13], "pass": [6, 8], "302": 6, "found": 6, "locat": [6, 10], "splxlobezqqybys6wxsbia": 6, "3a": 6, "2f": 6, "2fpid": 6, "12": [6, 8], "certain": 6, "sender": 6, "draft16": 6, "mitig": 6, "misus": [6, 10], "leak": 6, "stolen": 6, "attack": [6, 13], "code_verifi": 6, "private_key_jwt": [6, 14], "eyj0exaioijkcg9wk2p3dcisimfszyi6ikvtmju2iiwiandrijp7imt0esi6ik": 6, "vdiiwieci6imw4dezyahgtmzr0vjnoukldukrzoxpda0rscejorjqyvvfvzldwqvdcr": 6, "nmilcj5ijoiovzfngpmx09rx282nhpivfrsy3vosmfqsg10nny5verwcluwq2r2r1j": 6, "qsisimnydii6ilatmju2in19": 6, "eyjqdgkioiitqnddm0vtyzzhy2mybfrjiiwiahrtij": 6, "oiue9tvcisimh0dsi6imh0dhbzoi8vc2vydmvylmv4yw1wbguuy29tl3rva2vuiiwia": 6, "wf0ijoxntyymjyynje2fq": 6, "gxa6t8lp4vfrg8v": 6, "fdwp0a0zdrj8igimlvqrmuvwnqg": 6, "4ptflbdlxiossx0x7nvi": 6, "fnyjk70nfbv37xrzt3lg": 6, "grant_typ": [6, 14], "authorization_cod": 6, "dbjftjez4cvp": 6, "mb92k27uhbuju1p1r_ww1gfwfoejxk": 6, "bearer": 6, "eyjhbgcioijiuzi1nii": 6, "15": [6, 8, 13], "success": 6, "c_nonc": 6, "200": 6, "ok": 6, "access_token": 6, "kz": 6, "8mxk1ealyznwh": 6, "lc": 6, "1fbao": 6, "4ljp": 6, "zspe_neo": 6, "gxu": 6, "token_typ": 6, "2677": 6, "tzign": 6, "snfbp": 6, "c_nonce_expires_in": 6, "86400": 6, "18": [6, 8], "Then": 6, "19": [6, 8], "schema": [6, 12], "registr": [6, 12], "later": 6, "nmilcj5ijoiovzfngpmx09rx282nhpivfrsy3vosmfqsg10nny5verwcluwq2r2r": 6, "1jeqsisimnydii6ilatmju2in19": 6, "eyjqdgkioijlmwozvl9is2ljoc1mquvciiwiahrtij": 6, "oir0vuiiwiahr1ijoiahr0chm6ly9yzxnvdxjjzs5legftcgxllm9yzy9wcm90zwn0z": 6, "wryzxnvdxjjzsisimlhdci6mtu2mji2mjyxocwiyxroijoizlvieu8ycjjam0rantnf": 6, "c05yv0jimhhxwg9htnk1oulps0nbcwtzbvffbyj9": 6, "2ow9rp35yrqzhrtnp86l": 6, "ey71": 6, "optxrimpptoa1plemagr6pxhf8y6": 6, "yqyvnmcw6fy1dqd": 6, "jfxsyomxhajplja": 6, "7b": 6, "22type": 6, "22": 6, "5b": 6, "22personidentificationdata": 6, "5d": 6, "7d": 6, "22proof_typ": 6, "ace0": 6, "9c5210e16c32": 6, "proof_typ": 6, "eyjrawqioijkawq6zxhhbxbsztplym": 6, "0b434530": 6, "e151": 6, "4c40": 6, "98b7": 6, "74c75a5ef760": 6, "aud": [6, 8, 13], "1504699136": 6, "nonc": [6, 8, 13], "20": [6, 8], "suitabl": 6, "succe": 6, "proceed": 6, "storag": [6, 12], "pragma": 6, "lupixvcwjk0eot4cxqe1nxk": 6, "wzwmhmn9oqp6yxx0a2l": 6, "fgff7": 6, "ukhla": 6, "6749": 6, "challeng": 6, "deriv": [6, 12], "grant": [6, 8, 10, 12, 14], "per": [6, 8], "iana": [6, 8], "registri": [6, 8, 10, 12], "symmetr": [6, 8], "mac": [6, 8], "7638": 6, "section_3": 6, "assum": [6, 8, 13], "implicit": 6, "session": [6, 8], "side": 6, "32": [6, 8, 13], "alphanumer": 6, "authrequest": 6, "top": 6, "media": [6, 8, 12, 13, 14], "8259": 6, "strong": [6, 14], "pseudorandom": 6, "lifetim": 6, "second": 6, "posit": 6, "integ": 6, "server": 6, "browser": 6, "serial": 6, "ad": 6, "abl": [6, 12, 13], "deleg": [6, 13], "submit": [6, 8], "accept": [6, 8], "invalid": [6, 12, 13], "error": [6, 8], "invalid_dpop_proof": 6, "7515": [6, 8], "8725": [6, 8], "chosen": [6, 8, 13, 14], "rfc7517": [6, 8], "7517": [6, 8, 12], "assign": [6, 8, 12], "v4": [6, 8], "4122": [6, 8], "htm": [6, 8], "attach": [6, 8], "9110": [6, 8], "htu": [6, 8], "target": [6, 8], "fragment": [6, 8], "accomplish": [6, 14], "methodolog": 6, "match": [6, 14], "9068": 6, "princip": 6, "subject": [6, 12], "subjectidtyp": 6, "taken": [6, 8], "prevent": [6, 8, 13, 14], "reus": 6, "reject": 6, "jkt": 6, "approv": 6, "upon": 6, "ath": [6, 8], "ascii": 6, "associ": [6, 13, 14], "previous": [6, 12, 13], "denot": 6, "mso_mdoc": [6, 8], "doctyp": [6, 8], "appendix": 6, "renew": [6, 12], "openid_credential_issu": [6, 12], "fanfs3ync9tjicaivhwlvuj3axwggz_98urfaqme": 6, "1649610249": 6, "1649437449": 6, "credential_issu": 6, "authorization_endpoint": [6, 13], "token_endpoint": [6, 14], "pushed_authorization_request_endpoint": 6, "dpop_signing_alg_values_support": 6, "credential_endpoint": 6, "credentials_support": 6, "cryptographic_binding_methods_support": 6, "cryptographic_suites_support": 6, "displai": 6, "italiano": 6, "di": 6, "esempio": 6, "logo": [6, 8, 12, 13, 14], "svg": [6, 8, 12, 13, 14], "alt_text": 6, "questo": 6, "background_color": 6, "12107c": 6, "text_color": 6, "ffffff": 6, "credentialsubject": [6, 8], "true": [6, 8, 13], "nome": 6, "cognom": 6, "nascita": 6, "luogo": 6, "identificativo": 6, "univoco": 6, "codic": 6, "fiscal": 6, "homepage_uri": [6, 8, 12, 14], "policy_uri": [6, 8, 13, 14], "privacy_polici": [6, 13, 14], "tos_uri": [6, 13, 14], "info_polici": [6, 13, 14], "logo_uri": [6, 8, 12, 13, 14], "openid_relying_parti": [6, 12], "doc": 6, "ask": [8, 10, 14], "demonstr": 8, "differ": [8, 10, 13], "analyz": 8, "chapter": 8, "take": 8, "account": 8, "scenario": [8, 10, 12], "util": [8, 14], "final": [8, 12], "futur": 8, "qr": 8, "frame": 8, "page": [8, 14], "login": [8, 10], "button": 8, "scope": [8, 12], "insert": 8, "extract": 8, "invok": 8, "capabl": [8, 12, 13, 14], "deselect": 8, "17": 8, "successfulli": 8, "base64": 8, "retriev": [8, 13, 14], "correct": 8, "quartili": 8, "up": [8, 12], "25": 8, "good": [8, 10, 13], "balanc": 8, "between": [8, 10, 12, 14], "densiti": 8, "space": 8, "remain": [8, 10], "readabl": 8, "even": [8, 10, 12], "damag": 8, "partial": 8, "obscur": 8, "raw": 8, "zxvkaxc6ly9hdxrob3jpemu": 8, "y2xpzw50x2lkpwh0dhbzoi8vdmvyawzpzxiuzxhhbxbszs5vcmcmcmvxdwvzdf91cmk9ahr0chm6ly92zxjpzmllci5legftcgxllm9yzy9yzxf1zxn0x3vyaq": 8, "action": [8, 10, 14], "made": [8, 12], "scan": 8, "legitim": 8, "walletinstanceattestationproofofpossess": 8, "dedic": [8, 12], "herein": 8, "doesn": [8, 12], "t": [8, 12], "break": 8, "do": [8, 12, 13], "miss": 8, "would": [8, 10, 13], "lowest": 8, "supported_alg": 8, "therein": [8, 12], "l8tfrhx": 8, "34tv3hricrdy9zckdlpbhf42uqufwvawbf": 8, "y": [8, 12, 13, 14], "9ve4jf_ok_o64zbttlcunjajhmt6v9tdvru0cdvgrda": 8, "crv": [8, 12, 13, 14], "p": [8, 12, 13, 14], "f47c96a1": 8, "f928": 8, "4768": 8, "aa30": 8, "ef32dc78aa69": 8, "1562262616": 8, "fuhyo2r2z3dz53esnrwbb0xwxoany59iikcaqksmqeo": 8, "e0bbf2f1": 8, "8c3a": 8, "4eab": 8, "a8ac": 8, "2e8f34db8a47": 8, "miicajccadogawibag": 8, "awz": 8, "2w3": 8, "sf2": 8, "europa": [8, 12], "client_id_schem": 8, "entity_id": 8, "response_mod": 8, "direct_post": 8, "vp_token": [8, 13], "response_uri": 8, "callback": 8, "2c128e4d": 8, "fc91": 8, "4cd3": 8, "86b8": 8, "18bdea0988cb": 8, "3be39b69": 8, "6ac1": 8, "41aa": 8, "921b": 8, "3e6c07ddcb03": 8, "1672418465": 8, "1672422065": 8, "sequenc": [8, 12], "alias": 8, "suffici": 8, "entropi": 8, "reason": 8, "expir": [8, 12, 13, 14], "after": [8, 13, 14], "usag": [8, 14], "presentation_definit": [8, 13], "still": [8, 12, 13], "under": [8, 10, 13, 14], "better": 8, "input_descriptor": 8, "constraint": [8, 12], "path": [8, 12], "limit_discolusr": 8, "prefer": [8, 14], "mention": [8, 13], "condit": 8, "presentation_definition_uri": 8, "point": [8, 13], "client_metadata": 8, "client_metadata_uri": 8, "why": 8, "malici": 8, "agent": 8, "gain": 8, "plaintext": 8, "transmit": 8, "network": 8, "possibl": [8, 12], "environ": [8, 14], "emploi": [8, 14], "tl": 8, "termin": 8, "Such": 8, "techniqu": [8, 10], "webserv": 8, "handl": 8, "manner": [8, 14], "deciph": 8, "transmiss": 8, "either": 8, "forward": 8, "negoti": 8, "actual": [8, 14], "intend": [8, 12, 13], "actor": [8, 10, 14], "segment": 8, "could": [8, 10, 13, 14], "intercept": 8, "sensit": 8, "unencrypt": 8, "snif": 8, "eyjhbgcioijfuzi1nii": 8, "9t2lq": 8, "decrypt": 8, "pt0ixx0": 8, "presentation_submiss": 8, "definition_id": 8, "32f54163": 8, "7166": 8, "48f1": 8, "93d8": 8, "ff217bdb0653": 8, "04a98be3": 8, "7fb0": 8, "4cf5": 8, "af9a": 8, "31579c8b0e7d": 8, "descriptor_map": 8, "period": [8, 12, 13], "vbexjksm45xphtanncig6mcyuu4jfgnzopgukvogg9c": [8, 13], "3978344f": 8, "8596": 8, "4c3a": 8, "a978": 8, "8fcaba3903c5": 8, "1573029723": 8, "0s6_wza2mj": 8, "expos": [8, 12], "2hnofs3ync9tjicaivhwlvuj3axwggz_98urfaqme": [8, 12], "1649590602": 8, "1649417862": 8, "5s4qi": 8, "wallet_relying_parti": [8, 12], "application_typ": 8, "client_nam": 8, "x5c": [8, 12, 13], "contact": [8, 12], "op": [8, 13], "default_acr_valu": 8, "spidl2": 8, "spidl3": 8, "vp_format": [8, 12], "jwt_vp_json": [8, 13], "eddsa": [8, 12], "es256k": [8, 12], "limit_disclosur": 8, "filter": [8, 12], "const": 8, "intent_to_retain": 8, "sampl": 8, "iso": 8, "18013": 8, "fals": [8, 13], "portrait": 8, "driving_privileg": 8, "default_max_ag": 8, "1111": 8, "jarm": 8, "authorization_signed_response_alg": 8, "authorization_encrypted_response_alg": 8, "authorization_encrypted_response_enc": 8, "a192cbc": 8, "a128gcm": 8, "a192gcm": 8, "a256gcm": 8, "subject_typ": 8, "pairwis": 8, "require_auth_tim": 8, "id_token_signed_response_alg": 8, "id_token_encrypted_response_alg": 8, "id_token_encrypted_response_enc": 8, "home": 8, "polici": [8, 12, 13, 14], "tech": [8, 12], "authority_hint": [8, 12], "while": [8, 10], "spec": [8, 12], "tbd": 8, "paradigm": 10, "complet": [10, 12, 14], "ownership": [10, 14], "determin": [10, 12, 14], "abil": [10, 13, 14], "revok": [10, 12], "said": 10, "histori": 10, "tradit": 10, "signific": [10, 13], "fact": 10, "envis": 10, "compani": 10, "want": [10, 12], "anoth": 10, "becaus": 10, "someth": 10, "individu": 10, "publish": [10, 12], "educ": 10, "institut": 10, "crucial": 10, "phone": 10, "portabl": 10, "principl": 10, "character": 10, "choos": 10, "reduc": 10, "risk": [10, 13], "collect": [10, 12], "leverag": [10, 14], "advanc": 10, "avoid": [10, 13], "theft": 10, "fraud": 10, "unauthor": [10, 13, 14], "vulner": [10, 12], "central": 10, "seamless": [10, 14], "across": 10, "border": 10, "effici": [10, 12, 13], "cost": [10, 12], "reduct": 10, "elimin": 10, "repetit": 10, "purchas": 10, "physic": 10, "ag": 10, "restrict": [10, 12], "item": 10, "necessari": [10, 12, 13], "abov": [10, 12], "reveal": 10, "legitimaci": [12, 14], "distribut": 12, "mark": 12, "509": [12, 13], "appli": 12, "subordin": 12, "leaf": 12, "represent": [12, 14], "plai": [12, 14], "except": 12, "call": [12, 13], "summari": 12, "pki": 12, "make": [12, 13, 14], "build": 12, "tamper": [12, 14], "compris": 12, "forg": 12, "adversari": 12, "preserv": [12, 13, 14], "doe": [12, 13], "track": [12, 13], "against": [12, 13], "guarantor": 12, "histor": 12, "save": 12, "year": 12, "retent": 12, "rotat": 12, "flexibl": 12, "modifi": 12, "domain": [12, 14], "simultan": 12, "disabl": 12, "certainti": 12, "propag": 12, "adopt": [12, 13, 14], "effect": [12, 14], "wide": 12, "rang": 12, "softwar": 12, "kit": 12, "rapid": 12, "scalabl": [12, 13], "coverag": 12, "satisfi": 12, "onboard": 12, "recognis": 12, "similar": 12, "rest": [12, 13, 14], "publicli": 12, "summaris": 12, "itself": [12, 14], "third": [12, 13], "superior": 12, "trust_mark_id": 12, "motiv": 12, "serv": [12, 14], "plain": 12, "default": 12, "howev": 12, "enter": [12, 14], "keep": 12, "maximum": 12, "max_path_length": 12, "1649375259": 12, "1649373279": 12, "3i5vv": 12, "_": 12, "root": 12, "ca": 12, "x2zomhngsdc4zlbrcxhmt3mzrmrzog9jd3o2qjzdam51cuhhufruowd0wq": 12, "1knr9ar3mzmokyty8brvriue85nixryx4xd3k4jw7vi": 12, "slt14644zbyxyf": 12, "xmw7apdlbmuw3t1urwi4nafmtkri": 12, "ta": 12, "federation_fetch_endpoint": 12, "federation_resolve_endpoint": 12, "federation_list_endpoint": 12, "federation_trust_mark_status_endpoint": 12, "trust_mark_statu": 12, "trust_marks_issu": 12, "behalf": 12, "concern": 12, "cryptograf": 12, "entity_typ": 12, "trust_mark_issu": 12, "trustworthi": [12, 13, 14], "trust_mark_own": 12, "trust_mark": 12, "automat": [12, 13], "em3cmnzghiyfsq090n6b3op7laaqj8rghmhxgmjstqg": 12, "1649623546": 12, "1649450746": 12, "metadata_polici": 12, "subset_of": 12, "email": 12, "request_authentication_methods_support": 12, "one_of": 12, "request_object": 12, "request_authentication_signing_alg_values_support": 12, "jwt_vp": 12, "pleas": [12, 14], "allowed_leaf_entity_typ": 12, "real": 12, "onlin": 12, "unavail": 12, "concaten": 12, "pertain": 12, "produc": 12, "beyond": 12, "updat": [12, 13], "earliest": 12, "No": 12, "forc": 12, "higher": 12, "abstract": 12, "entityconfigur": 12, "signedjwt": 12, "selfissu": 12, "byleaf": 12, "entitystat": 12, "bytrustanchor": 12, "origin": 12, "eyjhbgcioijfuzi1niisimtpzci6imveuknosghwyxpwd01vrlpjmvu0ulrremmxsjrnmgrvyuu4mwvvwk5vmvuywkdsm1lqrmztv2h1uveilcj0exaioijhchbsawnhdglvbi9lbnrpdhktc3rhdgvtzw50k2p3dcj9": 12, "eyjlehaioje2ndk1ota2mdisimlhdci6mty0otqxnzg2miwiaxnzijoiahr0chm6ly9ycc5legftcgxllm9yzyisinn1yii6imh0dhbzoi8vcnauzxhhbxbszs5vcmcilcjqd2tzijp7imtlexmiolt7imt0esi6ikvdiiwia2lkijoizursq05iafzhelz3tvvgwmmxvtrsvgt6yzfkne0wzfvhrtgxzvvatluxvtjar1izwwpgzlnxahvrusisimnydii6ilatmju2iiwieci6ik1wvlvheuhloghqvhh5dklzrfd2nnjpzhn5adfdufb2tg94zu0wuwhan3cilcj5ijoidf95zlbrd1z1am5os25fnvznt05wcw93uzjvzgzwvwxfwnnvv1uztdrhtsj9xx0sim1ldgfkyxrhijp7im9wzw5pzf9yzwx5aw5nx3bhcnr5ijp7imfwcgxpy2f0aw9ux3r5cguioij3zwiilcjjbgllbnrfawqioijodhrwczovl3jwlmv4yw1wbguub3jnlyisimnsawvudf9yzwdpc3ryyxrpb25fdhlwzxmiolsiyxv0b21hdgljil0simp3a3mionsia2v5cyi6w3sia3r5ijoirumilcjrawqioijlrfjdtkhovmf6vndnvuzayzfvnfjua3pjmuo0ttbkvwffodflvvpovtfvmlphujnzakzmu1dodvfriiwiy3j2ijoiuc0yntyilcj4ijoitxbwvud5sgu4afbuehl2svlev3y2cmlkc3lomunquhzmb3hlttbrafo3dyisinkioij0x3lmuff3vnvqbmhlbl81vmdptlzxb3dtmm9kznbvbf9ac29xvtnmnednin1dfswiy2xpzw50x25hbwuioijoyw1lig9migfuigv4yw1wbgugb3jnyw5pemf0aw9uiiwiy29udgfjdhmiolsib3bzqhjwlmv4yw1wbguuaxqixswiz3jhbnrfdhlwzxmiolsicmvmcmvzaf90b2tlbiisimf1dghvcml6yxrpb25fy29kzsjdlcjyzwrpcmvjdf91cmlzijpbimh0dhbzoi8vcnauzxhhbxbszs5vcmcvb2lkyy9ycc9jywxsymfjay8ixswicmvzcg9uc2vfdhlwzxmiolsiy29kzsjdlcjzy29wzxmioijlds5ldxjvcgeuzwmuzxvkaxcucglkljegzxuuzxvyb3bhlmvjlmv1zgl3lnbpzc5pdc4xigvtywlsiiwic3viamvjdf90exblijoicgfpcndpc2uifswizmvkzxjhdglvbl9lbnrpdhkionsizmvkzxjhdglvbl9yzxnvbhzlx2vuzhbvaw50ijoiahr0chm6ly9ycc5legftcgxllm9yzy9yzxnvbhzllyisim9yz2fuaxphdglvbl9uyw1lijoirxhhbxbszsbsucisimhvbwvwywdlx3vyasi6imh0dhbzoi8vcnauzxhhbxbszs5pdcisinbvbgljev91cmkioijodhrwczovl3jwlmv4yw1wbguuaxqvcg9sawn5iiwibg9nb191cmkioijodhrwczovl3jwlmv4yw1wbguuaxqvc3rhdgljl2xvz28uc3zniiwiy29udgfjdhmiolsidgvjaeblegftcgxllml0il19fswidhj1c3rfbwfya3miolt7imlkijoiahr0chm6ly9yzwdpc3ryes5lawrhcy50cnvzdc1hbmnob3iuzxhhbxbszs5lds9vcgvuawrfcmvsewluz19wyxj0es9wdwjsawmviiwidhj1c3rfbwfyayi6imv5smggxhuymdi2in1dlcjhdxrob3jpdhlfagludhmiolsiahr0chm6ly9pbnrlcm1lzglhdguuzwlkyxmuzxhhbxbszs5vcmcixx0": 12, "dirbryfesmi_6ogrjahayupctxsvbzbmdokvztjyygzmkep6eslixa8nuu9bwbwp_elngdkbpqusbwigx66d5w": 12, "eyjhbgcioijfuzi1niisimtpzci6ilfwunvxse5fwtjzmfdhnw5hshb3vjjkvgrtd3hirupvy2pcdk9fehnwmfext0dnmfzwqnhhbtuyt0eilcj0exaioijhchbsawnhdglvbi9lbnrpdhktc3rhdgvtzw50k2p3dcj9": 12, "eyjlehaioje2ndk2mjm1ndysimlhdci6mty0otq1mdc0niwiaxnzijoiahr0chm6ly9pbnrlcm1lzglhdguuzwlkyxmuzxhhbxbszs5vcmcilcjzdwiioijodhrwczovl3jwlmv4yw1wbguub3jniiwiandrcyi6eyjrzxlzijpbeyjrdhkioijfqyisimtpzci6imveuknosghwyxpwd01vrlpjmvu0ulrremmxsjrnmgrvyuu4mwvvwk5vmvuywkdsm1lqrmztv2h1uveilcjjcnyioijqlti1niisingioijncfzvr3lizthoufr4exzjwurxdjzyawrzewgxq1bqdkxvegvnmffowjd3iiwiesi6inrfewzquxdwdwpuaetuxzvwz09ovnfvd1myb2rmcfvsx1pzb1dvm0w0r00ifv19lcjtzxrhzgf0yv9wb2xpy3kionsib3blbmlkx3jlbhlpbmdfcgfydhkionsic2nvcgvzijp7inn1ynnldf9vzii6wyjlds5ldxjvcgeuzwmuzxvkaxcucglkljesicblds5ldxjvcgeuzwmuzxvkaxcucglklml0ljeixx0sinjlcxvlc3rfyxv0agvudgljyxrpb25fbwv0ag9kc19zdxbwb3j0zwqionsib25lx29mijpbinjlcxvlc3rfb2jqzwn0il19lcjyzxf1zxn0x2f1dghlbnrpy2f0aw9ux3npz25pbmdfywxnx3zhbhvlc19zdxbwb3j0zwqionsic3vic2v0x29mijpbiljtmju2iiwiulm1mtiilcjfuzi1niisikvtnteyiiwiufmyntyilcjquzuxmijdfx19lcj0cnvzdf9tyxjrcyi6w3siawqioijodhrwczovl3rydxn0lwfuy2hvci5legftcgxllmv1l29wzw5pzf9yzwx5aw5nx3bhcnr5l3b1ymxpyy8ilcj0cnvzdf9tyxjrijoizxlkagigxhuymdi2in1dfq": 12, "rigdha7coap3so3znsjdwt7": 12, "8tea41an3ybw": 12, "qawfndqmuzctqrwcd4vtx6tzeeoro3keu8bjeaklikhrhzobg": 12, "eyjhbgcioijfuzi1niisimtpzci6imvvrldsakjkylhveu5tmhrhv1jrylhcmwvurlbjazv6uzbgrvftmwfnvfpeytnowk1wukturtr5y3cilcj0exaioijhchbsawnhdglvbi9lbnrpdhktc3rhdgvtzw50k2p3dcj9": 12, "eyjlehaioje2ndk2mjm1ndysimlhdci6mty0otq1mdc0niwiaxnzijoiahr0chm6ly90cnvzdc1hbmnob3iuzxhhbxbszs5ldsisinn1yii6imh0dhbzoi8vaw50zxjtzwrpyxrllmvpzgfzlmv4yw1wbguub3jniiwiandrcyi6eyjrzxlzijpbeyjrdhkioijfqyisimtpzci6ilfwunvxse5fwtjzmfdhnw5hshb3vjjkvgrtd3hirupvy2pcdk9fehnwmfext0dnmfzwqnhhbtuyt0eilcjjcnyioijqlti1niisingioijcr1vooxn6zg0xt1rxvwhuq3jkcwrmqjhttujqb2jcyk5nd2jxznd4c3pziiwiesi6ikdnmuhcngvjrwjhqja4nejiuw5qx0lsefjzytnhvvrhstf0aw5qtmvsdmmifv19lcj0cnvzdf9tyxjrcyi6w3siawqioijodhrwczovl3rydxn0lwfuy2hvci5legftcgxllmv1l2zlzgvyyxrpb25fzw50axr5l3royxqtchjvzmlszsisinrydxn0x21hcmsioijleupoyibcdtiwmjyifv19": 12, "kr2obdmfqlgcz2zqn0fgop7cwsw4clxbaj4": 12, "j_c3hc": 12, "yeeck6sllnk00bgqoee2ncmy2lqk9dyqo1iaub_zg7a": 12, "At": 12, "short": 12, "attain": 12, "compat": [12, 14], "less": 12, "24": 12, "hour": 12, "As": 12, "furthermor": [12, 14], "longer": [12, 13], "inquir": 12, "hardwar": 12, "amount": 12, "matter": 12, "line": 12, "gdpr": [12, 13], "There": 12, "especi": 12, "perimet": 12, "like": [12, 13], "jurisdict": 12, "eg": 12, "snapshot": 12, "back": 12, "cloud": 12, "explicit": 12, "permiss": 12, "overload": 12, "manipul": 13, "forgeri": 13, "attempt": 13, "fulfil": 13, "meet": 13, "guarante": [13, 14], "belong": 13, "sustain": 13, "criteria": 13, "task": 13, "light": 13, "fast": 13, "variou": [13, 14], "simplic": 13, "therebi": 13, "accur": 13, "measur": 13, "tool": 13, "reusabl": 13, "usabl": 13, "repeat": 13, "loss": 13, "delet": 13, "lost": 13, "becom": [13, 14], "pseudonymis": 13, "imposs": 13, "absenc": 13, "art": 13, "comprehens": [13, 14], "pose": 13, "theoret": 13, "databas": 13, "guard": 13, "replai": 13, "formal": 13, "now": 13, "readi": 13, "explain": 13, "var": 13, "walletinstanceattestationrequest": 13, "porvid": 13, "comma": 13, "6ec69324": 13, "60a8": 13, "4e5b": 13, "a697": 13, "a766d85790ea": 13, "4hnpti": 13, "xr2pjyrjkgmnz4wmdnqd_ujsq4r95nj98b44": 13, "liznsb39vfjhygs3k7jxe4r3": 13, "cogfqwztpbirqpnlrg": 13, "1686645115": 13, "1686652315": 13, "whose": 13, "let": 13, "openid4vc": 13, "haip": 13, "problem": 13, "limit": 13, "durat": 13, "attested_security_context": 13, "context": [13, 14], "Of": 13, "agreement": 13, "response_types_support": 13, "vp_formats_support": 13, "jwt_vc_json": 13, "request_object_sign": 13, "_alg_values_support": 13, "_uri_support": 13, "boolean": 13, "transfer": 13, "experiment": [13, 14], "5t5yypbhn": [13, 14], "egieei5iuzr6r0mr02lnvq0omekmnkcji": [13, 14], "eyjhbgcioijfuz": 13, "6s0a": 13, "jjla": 13, "h9gw": 13, "miibjdcc": 13, "xfehgkqa": 13, "basic": [13, 14], "alg_values_support": 13, "request_object_signing_alg_values_support": 13, "presentation_definition_uri_support": 13, "1687281195": 13, "1687288395": 13, "cater": 14, "asset": 14, "total": 14, "legisl": 14, "primari": 14, "conveni": 14, "These": 14, "pid\u00b9": 14, "along": 14, "short\u00b9": 14, "vital": 14, "adher": 14, "address": 14, "android": 14, "io": 14, "engag": 14, "asymmetr": 14, "exclus": 14, "Their": 14, "utmost": 14, "execut": 14, "tee": 14, "\u00b3": 14, "distinct": 14, "performed\u00b2": 14, "unlock": 14, "pin": 14, "biometr": 14, "fingerprint": 14, "facial": 14, "recognit": 14, "unambigu": 14, "providers\u00b9": 14, "parties\u00b9": 14, "share": 14, "rel": 14, "revert": 14, "circumst": 14, "voluntarili": 14, "remov": 14, "outlin": 14, "datetim": 14, "hous": 14, "attested_security_context_values_support": 14, "low": 14, "medium": 14, "grant_types_support": 14, "token_endpoint_auth_methods_suppor": 14, "ted": 14, "token_endpoint_auth_signing_alg_va": 14, "lues_support": 14, "asc_values_support": 14, "websit": 14, "qrjrj3af_b57sboirrcbm7br7woc8ynj7lhfpteffuk": 14, "1h0cwdyggvu8w": 14, "kpku_xycocunt2o0bwsliqtnpu6im": 14, "token_endpoint_auth_methods_support": 14, "token_endpoint_auth_signing_alg_values_support": 14, "es384": 14, "pagopa": 14, "1687171759": 14, "1709290159": 14, "two": 14, "our": 14, "\u00b9": 14, "inherit": 14, "write": 14, "\u00b2": 14, "depend": 14, "trusti": 14, "enclav": 14}, "objects": {}, "objtypes": {}, "objnames": {}, "titleterms": {"cryptograph": 0, "algorithm": 0, "backup": 1, "restor": 1, "rst": [1, 7, 9], "gener": [1, 7, 9, 12, 13], "properti": [1, 7, 9, 12, 13], "requir": [1, 7, 9, 12, 13, 14], "attribut": [1, 7, 9], "implement": [1, 7, 9], "consider": [1, 7, 9, 12], "librari": [1, 7, 9], "code": [1, 7, 9], "snippet": [1, 7, 9], "extern": [1, 7, 9, 14], "refer": [1, 7, 9, 14], "how": 2, "contribut": 2, "norm": [3, 5], "languag": 3, "convent": 3, "defin": 3, "term": 3, "acronym": 3, "italian": 4, "eudi": [4, 12], "wallet": [4, 12, 13, 14], "technic": 4, "specif": 4, "introduct": [4, 10], "index": 4, "content": 4, "pid": [5, 6], "q": [5, 6], "eaa": [5, 6], "data": 5, "model": [5, 12], "sd": 5, "jwt": 5, "paramet": [5, 6, 12], "verif": 5, "field": 5, "claim": 5, "non": [5, 12], "exampl": 5, "mdoc": 5, "cbor": 5, "issuanc": 6, "high": [6, 13], "level": [6, 13], "flow": [6, 8], "detail": [6, 8, 13], "push": 6, "author": [6, 8], "request": [6, 8, 13], "endpoint": [6, 12, 14], "par": 6, "http": [6, 8], "respons": [6, 8], "token": 6, "access": 6, "credenti": 6, "entiti": [6, 8, 12], "configur": [6, 8, 12], "issuer": 6, "pseudonym": 7, "reli": [8, 12], "parti": [8, 12], "solut": [8, 14], "same": 8, "devic": 8, "remot": 8, "cross": 8, "object": 8, "dpop": 8, "header": [8, 13, 14], "uri": 8, "revoc": 9, "list": 9, "self": 10, "sovereign": 10, "ident": 10, "ssi": 10, "standard": 11, "The": 12, "infrastructur": 12, "trust": 12, "feder": 12, "role": 12, "api": 12, "common": 12, "anchor": 12, "leav": 12, "intermedi": 12, "metadata": [12, 14], "type": 12, "statement": 12, "evalu": 12, "mechan": 12, "attest": [12, 13, 14], "instanc": [12, 13, 14], "chain": 12, "offlin": 12, "repudi": 12, "long": 12, "live": 12, "privaci": 12, "about": 12, "decentr": 12, "design": 13, "static": 13, "compon": 13, "view": 13, "dynam": 13, "format": 13, "payload": [13, 14], "lifecycl": 14, "initi": 14, "process": 14, "transit": 14, "valid": 14, "state": 14, "return": 14, "oper": 14, "deactiv": 14, "provid": 14, "wallet_provid": 14, "federation_ent": 14}, "envversion": {"sphinx.domains.c": 2, "sphinx.domains.changeset": 1, "sphinx.domains.citation": 1, "sphinx.domains.cpp": 6, "sphinx.domains.index": 1, "sphinx.domains.javascript": 2, "sphinx.domains.math": 2, "sphinx.domains.python": 3, "sphinx.domains.rst": 2, "sphinx.domains.std": 2, "sphinx.ext.intersphinx": 1, "sphinx.ext.todo": 2, "sphinx": 56}}) \ No newline at end of file diff --git a/en/ssi-introduction.html b/en/ssi-introduction.html index 16afd065c..a6c01b1d0 100644 --- a/en/ssi-introduction.html +++ b/en/ssi-introduction.html @@ -14,7 +14,7 @@ - + @@ -579,7 +579,8 @@

      {{ item.title }}

    • Introduction to SSI
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -606,31 +629,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -782,31 +874,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -605,31 +628,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -781,31 +873,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -606,31 +629,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -782,31 +874,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -606,31 +629,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -782,31 +874,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • Same Device Flow
    • Remote Cross Device Flow
    • Authorization Request Details
      • -
    • Request Object Details
      • +
    • Request Object Details +
    • Request URI response
    • Authorization Response Details
    • Relying Party Entity Configuration
      • @@ -916,317 +1054,43 @@

      Requirements -

      High-end design

      -
      -

      Static view of the components

      +
      +

      High-level Design

      +
      +

      Static Component View

      -The image shows how the Wallet Provider and the Wallet Instances are contained within the Wallet Solution, which is managed by the Wallet Provider. +The image illustrates the containment of Wallet Provider and Wallet Instances within the Wallet Solution, managed by the Wallet Provider.
      -
      -

      Dynamic view of the components

      -

      This section describes the format of the Wallet Instance Attestation and how it is issued by the Wallet Provider.

      +
      +

      Dynamic Component View

      +

      This section describes the Wallet Instance Attestation format and how the Wallet Provider issues it.

      -The figure shows the sequence diagram for issuing a Wallet Instance Attestation. The steps will be described below. +The figure illustrates the sequence diagram for issuing a Wallet Instance Attestation, with the steps explained below.
        -

      • Message 1: The User initializes the Wallet Instance. In particular, this process happens after the Wallet Instance installation and after the expiration of the Wallet Instance Attestation is launched and every time the User wants to request or present a credential.

        • -

      • Message 2-3: The Wallet Instance obtains metadata about its Wallet Provider. Among these, we also find the list of supported algorithms, public keys, endpoints.

        • -

      • Message 4: The Wallet Instance verifies that the Wallet Provider is trustworthy by resolving the provider's trust chain up to the Trust Anchor.

        • -

      • Message 5-7: The Wallet Instance creates a new key pair and requests a nonce from the Wallet Provider (as a measure against replay attacks).

        • -

      • Message 8: The Wallet Instance generates a Wallet Instance Attestation Request, in JWS format, signed with the private key associated with the public key for which it wants to obtain the attestation.

        • -

      • Message 9-13: The Wallet Instance sends the Wallet Instance Attestation Request to the Wallet Provider which verifies its validity and issues the signed attestation.

        • -

      • Message 13-14:The Wallet Instance receives the Wallet Instance Attestation signed by the Wallet Provider and proceeds with a formal verification.

        • -

      • Message 15:The Wallet Instance Attestation is ready to be consumed.

        • +

      • Message 1: The User starts the Wallet Instance mobile app, a new Wallet Instance Attestation is automatically obtained if the previous one results expired.

        • +

      • Message 2-3: The Wallet Instance retrieves metadata about its Wallet Provider, including the list of supported algorithms, public keys, and endpoints.

        • +

      • Message 4: The Wallet Instance verifies the Wallet Provider's trustworthiness by resolving the provider's trust chain to the Trust Anchor.

        • +

      • Message 5-7: The Wallet Instance generates a new key pair and requests a nonce from the Wallet Provider to guard against replay attacks.

        • +

      • Message 8: The Wallet Instance creates a Wallet Instance Attestation Request in JWS format, signed with the private key associated with the public key for which it seeks attestation.

        • +

      • Message 9-13: The Wallet Instance sends the Wallet Instance Attestation Request to the Wallet Provider, which validates it and issues a signed attestation in return.

        • +

      • Message 13-14: The Wallet Instance receives the Wallet Instance Attestation signed by the Wallet Provider and performs formal verification.

        • +

      • Message 15: The Wallet Instance Attestation is now ready for use.

      -
      -

      Detail design

      -

      We will go into the detail design below.

      -
      -

      Format of the Wallet Provider Entity Configuration

      -

      The Wallet Provider Entity Configuration is a JWS containing the public keys and the supported algorithms within the Wallet Provider metadata definition. It is defined according to OpenID Connect Federation and Section Trust Model of this specification.

      - -
      -

      Payload

      - - - - - - - - - - - - - - - - - - - - - - - - -

      key

      value

      iss

      The public url of the Wallet -Provider.

      sub

      The public url of the Wallet -Provider.

      iat

      Configuration release timestamp.

      exp

      Configuration expiration -timestamp.

      jwks

      Containing the keys attribute -which is an array of all the -public keys associated with the -domain (they could also match -those of the Wallet Provider).

      metadata

      This attribute will contain for -each entity its own -metadata. In this case we -will have the Wallet -Provider metadata contained within -the eudi_wallet_provider -attribute and the more generic -entity federation_entity.

      -
      -
      Payload eudi_wallet_provider
      - - - - - - - - - - - - - - - - - - - - - - - - -

      key

      value

      -
      jwks
      -

      -

      -
      -
      -
      Containing the keys attribute
      -
      which is an array of all the
      -
      Wallet Provider's public keys.
      -
      -
      -
      token_endpoint
      -

      -
      -
      -
      Endpoint for obtaining the Wallet
      -
      Instance Attestation.
      -
      -
      -
      asc_values_supported
      -

      -

      -

      -

      -

      -

      -

      -

      -

      -

      -

      -

      -

      -
      -
      -
      List of supported values for
      -
      the certified security context.
      -
      These values define a level of
      -
      assurance about the security of
      -
      the app. In particular we will
      -
      mainly have 3 values associated
      -
      with low, medium and high
      -
      security. An attested security
      -
      context is defined according to
      -
      the proof that the Wallet
      -
      Instance is able to send to the
      -
      Wallet Provider.
      -
      ⚠️ This parameter is not standard
      -
      and is still under discussion.
      -
      -
      -
      grant_types_supported
      -

      -

      -

      -

      -

      -

      -
      -
      -
      The type of grants supported by
      -
      the endpoint token. Therefore,
      -
      for the Wallet Provider the token
      -
      is equivalent only to the Wallet
      -
      Instance attestation, therefore
      -
      this attribute will contain an
      -
      array with only one element.
      -
      -
      -
      token_endpoint_auth_methods_suppo
      -
      rted
      -

      -
      -
      -
      Supported authentication method
      -
      for the endpoint token.
      -

      -
      -
      -
      token_endpoint_auth_signing_alg_v
      -
      alues_supported
      -
      -
      -
      List of supported signature
      -
      algorithms.
      -
      -
      -
      -

      Note

      -

      The parameter asc_values_supported is experimental and still -under discussion.

      -
      -
      -
      -
      Payload federation_entity
      - - - - - - - - - - - - - - - - - - - - - -

      key

      value

      organization_name

      Organization name.

      homepage_uri

      Organization website.

      tos_uri

      Url to the terms of use.

      policy_uri

      Url to the privacy policy.

      logo_uri

      URL of the organization logo.

      -

      Below a non-normative example of the Entity Configuration.

      -
      {
-  "alg": "ES256",
-  "kid": "5t5YYpBhN-EgIEEI5iUzr6r0MR02LnVQ0OmekmNKcjY",
-  "typ": "entity-statement+jwt"
-}
-.
-{
-"iss": "https://wallet-provider.example.org",
-"sub": "https://wallet-provider.example.org",
-"jwks": {
-  "keys": [
-    {
-      "crv": "P-256",
-      "kty": "EC",
-      "x": "qrJrj3Af_B57sbOIRrcBM7br7wOc8ynj7lHFPTeffUk",
-      "y": "1H0cWDyGgvU8w-kPKU_xycOCUNT2o0bwslIQtnPU6iM",
-      "kid": "5t5YYpBhN-EgIEEI5iUzr6r0MR02LnVQ0OmekmNKcjY"
-    }
-  ]
-},
-"metadata": {
-  "eudi_wallet_provider": {
-    "jwks": {
-      "keys": [
-        {
-          "crv": "P-256",
-          "kty": "EC",
-          "x": "qrJrj3Af_B57sbOIRrcBM7br7wOc8ynj7lHFPTeffUk",
-          "y": "1H0cWDyGgvU8w-kPKU_xycOCUNT2o0bwslIQtnPU6iM",
-          "kid": "5t5YYpBhN-EgIEEI5iUzr6r0MR02LnVQ0OmekmNKcjY"
-        }
-      ]
-    },
-    "token_endpoint": "https://wallet-provider.example.org/token",
-    "asc_values_supported": [
-      "https://wallet-provider.example.org/LoA/basic",
-      "https://wallet-provider.example.org/LoA/medium",
-      "https://wallet-provider.example.org/LoA/high"
-    ],
-    "grant_types_supported": [
-      "urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation"
-    ],
-    "token_endpoint_auth_methods_supported": [
-      "private_key_jwt"
-    ],
-    "token_endpoint_auth_signing_alg_values_supported": [
-      "ES256",
-      "ES384",
-      "ES512"
-    ]
-  },
-  "federation_entity": {
-    "organization_name": "PagoPa S.p.A.",
-    "homepage_uri": "https://wallet-provider.example.org",
-    "policy_uri": "https://wallet-provider.example.org/privacy_policy",
-    "tos_uri": "https://wallet-provider.example.org/info_policy",
-    "logo_uri": "https://wallet-provider.example.org/logo.svg"
-  }
-},
-"iat": 1687171759,
-"exp": 1709290159
-}
-
      -
      -
      -
      -
      +
      +

      Detailed Design

      +

      The detailed design is explained below.

      Format of the Wallet Instance Attestation Request

      To obtain a Wallet Instance Attestation from the Wallet Provider it is necessary to send a Wallet Instance Attestation Request from the Wallet Instance containing the associated public key and a nonce previously requested to avoid replay attacks.

      -
      -

      Header

      + -
      -

      Payload

      +
      +

      Payload

      @@ -1270,13 +1134,13 @@

      Payload

      @@ -1300,7 +1164,7 @@

      Payload

      @@ -1354,7 +1218,7 @@

      Payload . { "iss": "vbeXJksM45xphtANnCiG6mCyuU4jfGNzopGuKvogg9c", - "sub": "https://wallet-provider.example.org", + "aud": "https://wallet-provider.example.org", "jti": "6ec69324-60a8-4e5b-a697-a766d85790ea", "type": "WalletInstanceAttestationRequest", "nonce" : "....." @@ -1380,8 +1244,8 @@

      Payload

      Format of the Wallet Instance Attestation

      A JWT was chosen as the format for the Wallet Instance Attestation. Let's see below the various fields that compose it.

      -
      -

      Header

      +
      +

      Header

      key

      -
      sub
      +
      aud
      The public url of the Wallet
      -
      Provider
      +
      Provider.
      String. It must be set to
      -
      WalletInstanceAttestationRequest
      +
      WalletInstanceAttestationRequest.
      @@ -1396,13 +1260,10 @@

      Header¶ Provider to sign the attestation.

      - +

      key

      typ

      Media type, in this case we use -the value va+jwt (Verifiable -Assertion JWT). -This parameter is currently -non-standard as it is not yet -registered as IANA Media -Types.

      Media type, set to +wallet-attestation+jwt, +according to +[OPENID4VC-HAIP]

      x5c

      Array containing the X.509 @@ -1418,8 +1279,8 @@

      Header
      -
      -

      Payload

      +
      +

      Payload

      @@ -1498,7 +1359,7 @@

      Payload

      @@ -1509,7 +1370,7 @@

      Payload

      @@ -1519,12 +1380,12 @@

      Payload

      key

      -
      Url to the privacy policy
      +
      URL to the privacy policy
      of the wallet.
      -
      Url to the terms
      +
      URL to the terms
      of use of the Wallet Provider.
      -
      Logo url of the Wallet Provider.
      +
      URL of the Wallet Provider logo in SVG format
      -
      asc
      +
      attested_security_context



      @@ -1624,14 +1485,13 @@

      Payload

      Note

      -

      The claim asc (Attested Security Context) is under discussion +

      The claim attested_security_context (Attested Security Context) is under discussion and must be intended as experimental.

      -
      -
      -

      Signature

      -

      The Wallet Instance Attestation JWS is signed using the -private key of the Wallet Provider.

      +
      +

      Note

      +

      The Wallet Instance Attestation JWS is signed using the private key of the Wallet Provider.

      +

      Below is an example of Wallet Instance Attestation:

      {
   "alg": "ES256",
@@ -1641,7 +1501,7 @@ 
      Signature    "eyJhbGciOiJFUz...jJLA",
     "eyJhbGciOiJFUz...H9gw",
   ],
-  "typ": "va+jwt",
+  "typ": "wallet-attestation+jwt",
   "x5c": ["MIIBjDCC ... XFehgKQA=="]
 }
 .
@@ -1652,7 +1512,7 @@ 
      Signature  "policy_uri": "https://wallet-provider.example.org/privacy_policy",
   "tos_uri": "https://wallet-provider.example.org/info_policy",
   "logo_uri": "https://wallet-provider.example.org/logo.svg",
-  "asc": "https://wallet-provider.example.org/LoA/basic",
+  "attested_security_context": "https://wallet-provider.example.org/LoA/basic",
   "cnf":
   {
     "jwk":
@@ -1687,26 +1547,6 @@ 
      Signature
-
      Endpoints
      
-
      The Wallet Provider that issues the Wallet Instance Attestations must
-make available a series of APIs in REST format that follow the OpenID
-Federation standard.
      
-
      
-
      Metadata
      
-
      A GET /.well-known/openid-federation endpoint for retrieving the Wallet
-Provider Entity Configuration.
      
-
      
-
      
-
      Wallet Instance Attestation
      
-
      A second POST /token endpoint that takes two parameters as input:
      
-
      grant_type which in our case is a string:
-urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation
      
-
      assertion which contains the signed JWT of the Wallet Instance Attestation
-Request.
      
-
      The response will then contain the Wallet Instance Attestation.
      
-
      
-
      diff --git a/en/wallet-solution.html b/en/wallet-solution.html index a5bf1a883..d384b5d9b 100644 --- a/en/wallet-solution.html +++ b/en/wallet-solution.html @@ -579,7 +579,8 @@

      {{ item.title }}

    • Introduction to SSI

    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -606,31 +629,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • -
  • Defined Terms
  • PID/(Q)EAA Data Model
    • @@ -782,31 +874,77 @@

    {{ item.title }}

  • High-Level PID flow
  • High-Level (Q)EAA flow
  • Detailed Flow
    • -
  • Pushed Authorization Request Endpoint
    • -
  • Authorization endpoint
    • -
  • Token endpoint
    • -
  • Credential endpoint
    • +
  • Pushed Authorization Request Endpoint +
    • +
  • Authorization endpoint +
    • +
  • Token endpoint +
    • +
  • Credential endpoint +
  • Wallet Solution
  • Wallet Instance Attestation
  • Relying Party Solution
    • Same Device Flow
    • Remote Cross Device Flow
    • Authorization Request Details
      • -
    • Request Object Details
      • +
    • Request Object Details +
    • Request URI response
    • Authorization Response Details
    • Relying Party Entity Configuration
      • @@ -930,6 +1068,229 @@

      Deactivation +

      Wallet Provider Endpoints

      +

      The Wallet Provider that issues the Wallet Instance Attestations must +make available a series of APIs in REST format that follow the OpenID +Federation standard.

      +
      +

      Wallet Provider Metadata

      +

      A GET /.well-known/openid-federation endpoint for retrieving the Wallet +Provider Entity Configuration.

      +

      The Wallet Provider Entity Configuration is a JWS containing the public keys and supported algorithms of the Wallet Provider metadata definition. It is structured in accordance with the OpenID Connect Federation and the Trust Model section outlined in this specification.

      +
      + + +
      +

      Payload

      + + + + + + + + + + + + + + + + + + + + + + + + +

      Key

      Value

      iss

      Public URL of the Wallet +Provider.

      sub

      Public URL of the Wallet +Provider.

      iat

      +
      Issuance datetime in

      Unix Timestamp format.

      +
      +
      +

      exp

      Expiration datetime +in Unix Timestamp format.

      jwks

      Contains an array of all public +keys associated with the domain. +These could match the Wallet +Provider's keys.

      metadata

      For each entity, this attribute +houses its metadata. In this case, +it contains the Wallet Provider's +metadata within the +wallet_provider attribute +and the generic entity +federation_entity.

      +
      +

      Payload wallet_provider

      + + + + + + + + + + + + + + + + + + + + + + + + +

      Key

      Value

      jwks

      Contains an array of all the Wallet +Provider's public keys.

      token_endpoint

      Endpoint for obtaining the Wallet +Instance Attestation.

      attested_security_context_values_supported

      List of supported values for the +certified security context. These +values specify the security level +of the app—low, medium, or high. +An attested security context is +defined by the proof that the +Wallet Instance can send to the +Wallet Provider. Note: this +parameter is defined in this +specification

      grant_types_supported

      The types of grants supported by +the endpoint token. It MUST be set to +urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation

      token_endpoint_auth_methods_suppor +ted

      Supported authentication method for +the endpoint token.

      token_endpoint_auth_signing_alg_va +lues_supported

      List of supported signature +algorithms.

      +
      +

      Note

      +

      The asc_values_supported parameter is experimental and under review.

      +
      +
      +
      +

      Payload federation_entity

      + + + + + + + + + + + + + + + + + + + + + +

      Key

      Value

      organization_name

      Organization name.

      homepage_uri

      Organization's website URL.

      tos_uri

      URL to the terms of service.

      policy_uri

      URL to the privacy policy.

      logo_uri

      URL of the organization's logo in SVG format.

      +

      Below a non-normative example of the Entity Configuration.

      +
      {
+  "alg": "ES256",
+  "kid": "5t5YYpBhN-EgIEEI5iUzr6r0MR02LnVQ0OmekmNKcjY",
+  "typ": "entity-statement+jwt"
+}
+.
+{
+"iss": "https://wallet-provider.example.org",
+"sub": "https://wallet-provider.example.org",
+"jwks": {
+  "keys": [
+    {
+      "crv": "P-256",
+      "kty": "EC",
+      "x": "qrJrj3Af_B57sbOIRrcBM7br7wOc8ynj7lHFPTeffUk",
+      "y": "1H0cWDyGgvU8w-kPKU_xycOCUNT2o0bwslIQtnPU6iM",
+      "kid": "5t5YYpBhN-EgIEEI5iUzr6r0MR02LnVQ0OmekmNKcjY"
+    }
+  ]
+},
+"metadata": {
+  "wallet_provider": {
+    "jwks": {
+      "keys": [
+        {
+          "crv": "P-256",
+          "kty": "EC",
+          "x": "qrJrj3Af_B57sbOIRrcBM7br7wOc8ynj7lHFPTeffUk",
+          "y": "1H0cWDyGgvU8w-kPKU_xycOCUNT2o0bwslIQtnPU6iM",
+          "kid": "5t5YYpBhN-EgIEEI5iUzr6r0MR02LnVQ0OmekmNKcjY"
+        }
+      ]
+    },
+    "token_endpoint": "https://wallet-provider.example.org/token",
+    "attested_security_context_values_supported": [
+      "https://wallet-provider.example.org/LoA/basic",
+      "https://wallet-provider.example.org/LoA/medium",
+      "https://wallet-provider.example.org/LoA/high"
+    ],
+    "grant_types_supported": [
+      "urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation"
+    ],
+    "token_endpoint_auth_methods_supported": [
+      "private_key_jwt"
+    ],
+    "token_endpoint_auth_signing_alg_values_supported": [
+      "ES256",
+      "ES384",
+      "ES512"
+    ]
+  },
+  "federation_entity": {
+    "organization_name": "PagoPa S.p.A.",
+    "homepage_uri": "https://wallet-provider.example.org",
+    "policy_uri": "https://wallet-provider.example.org/privacy_policy",
+    "tos_uri": "https://wallet-provider.example.org/info_policy",
+    "logo_uri": "https://wallet-provider.example.org/logo.svg"
+  }
+},
+"iat": 1687171759,
+"exp": 1709290159
+}
+
      +
      +
      +
      +

      Wallet Instance Attestation

      +

      The token endpoint requires two parameters as input, in HTTP Post method:

      +

      grant_type which in our case is a string: +urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation

      +

      assertion which contains the signed JWT of the Wallet Instance Attestation +Request.

      +

      The response will then contain the Wallet Instance Attestation.

      +
      +

      External references

      ¹ Definitions are inherited from the EUDI Wallet Architecture and Reference Framework, version 1.1.0 at the time of writing. Please refer to this page for extended definitions and details.