From 908208659b2e6cb411eef3963aa95e4261c1ef52 Mon Sep 17 00:00:00 2001 From: Rany Date: Thu, 4 Sep 2025 21:35:33 +0800 Subject: [PATCH 01/60] refactor: email and sms mfa 1. Update MFA README 2. Update configure MFA 3. Update the order of MFA second pages 4. Add SMS for MFA & Email for MFA 5. Update Email templates & SMS templates 6. Update Reset password --- .../email-connectors/email-templates.mdx | 2 + .../sms-connectors/sms-templates.mdx | 2 + docs/end-user-flows/mfa/README.mdx | 4 +- .../mfa/authenticator-app-otp.mdx | 2 +- docs/end-user-flows/mfa/backup-codes.mdx | 2 +- docs/end-user-flows/mfa/configure-mfa.mdx | 47 +++++- docs/end-user-flows/mfa/email-mfa.mdx | 147 ++++++++++++++++++ docs/end-user-flows/mfa/sms-mfa.mdx | 145 +++++++++++++++++ docs/end-user-flows/mfa/webauthn.mdx | 2 +- .../sign-up-and-sign-in/reset-password.mdx | 24 ++- .../en/img/assets/configure-mfa.png | Bin 429762 -> 128738 bytes .../assets/email-mfa-setup-scenario-1-1.png | Bin 0 -> 449119 bytes .../assets/email-mfa-setup-scenario-1-2.png | Bin 0 -> 427654 bytes .../img/assets/email-mfa-setup-scenario-2.png | Bin 0 -> 286529 bytes .../img/assets/email-mfa-setup-scenario-3.png | Bin 0 -> 485870 bytes .../assets/email-mfa-verification-flow.png | Bin 0 -> 184068 bytes .../img/assets/sms-mfa-setup-scenario-1-1.png | Bin 0 -> 454205 bytes .../img/assets/sms-mfa-setup-scenario-1-2.png | Bin 0 -> 449104 bytes .../img/assets/sms-mfa-setup-scenario-2.png | Bin 0 -> 298866 bytes .../img/assets/sms-mfa-setup-scenario-3.png | Bin 0 -> 499597 bytes .../img/assets/sms-mfa-verification-flow.png | Bin 0 -> 183492 bytes 21 files changed, 363 insertions(+), 14 deletions(-) create mode 100644 docs/end-user-flows/mfa/email-mfa.mdx create mode 100644 docs/end-user-flows/mfa/sms-mfa.mdx create mode 100644 static-localized/en/img/assets/email-mfa-setup-scenario-1-1.png create mode 100644 static-localized/en/img/assets/email-mfa-setup-scenario-1-2.png create mode 100644 static-localized/en/img/assets/email-mfa-setup-scenario-2.png create mode 100644 static-localized/en/img/assets/email-mfa-setup-scenario-3.png create mode 100644 static-localized/en/img/assets/email-mfa-verification-flow.png create mode 100644 static-localized/en/img/assets/sms-mfa-setup-scenario-1-1.png create mode 100644 static-localized/en/img/assets/sms-mfa-setup-scenario-1-2.png create mode 100644 static-localized/en/img/assets/sms-mfa-setup-scenario-2.png create mode 100644 static-localized/en/img/assets/sms-mfa-setup-scenario-3.png create mode 100644 static-localized/en/img/assets/sms-mfa-verification-flow.png diff --git a/docs/connectors/email-connectors/email-templates.mdx b/docs/connectors/email-connectors/email-templates.mdx index b01b7340443..fe141ad3c90 100644 --- a/docs/connectors/email-connectors/email-templates.mdx +++ b/docs/connectors/email-connectors/email-templates.mdx @@ -56,6 +56,8 @@ Logto offers three distinct approaches for email template management: | OrganizationInvitation | Use this template to [send users an invitation lin](/end-user-flows/organization-experience/invite-organization-members#configure-your-email-connector) to join the organization. | link: string
organization: `OrganizationInfo`
inviter?: `UserInfo` | | UserPermissionValidation | During app usage, there may be some high-risk operations or operations with a relatively high risk level that [require additional user verification](/end-user-flows/account-settings/by-account-api#verify-by-sending-a-verification-code-to-the-users-email-or-phone), such as bank transfers, deleting resources in use, and canceling memberships. The `UserPermissionValidation` template can be used to define the content of the email verification code users receive in these situations. | code: string
user: `UserInfo`
application?: `ApplicationInfo` | | BindNewIdentifier | When a user modifies their profile, they may [bind an email address to their current account](/end-user-flows/account-settings/by-account-api#update-or-link-new-email). In this case, the `BindNewIdentifier` template can be used to customize the content of the verification email. | code: string
user: `UserInfo`
application?: `ApplicationInfo` | +| MfaVerification | When [email MFA](/end-user-flows/mfa/email-mfa) is enabled, this template is used to send verification codes to users during the multi-factor authentication process. | code: string
application: `ApplicationInfo`
organization?: `OrganizationInfo` | +| BindMfa | When [email MFA](/end-user-flows/mfa/email-mfa) is enabled, this template is used to set up email verification code for MFA. Users receive this verification code when they bind or configure their email address as an MFA factor for their account. | code: string
user: `UserInfo`
application?: `ApplicationInfo` | ## Email template variables \{#email-template-variables} diff --git a/docs/connectors/sms-connectors/sms-templates.mdx b/docs/connectors/sms-connectors/sms-templates.mdx index f5990f748cf..070cdd89953 100644 --- a/docs/connectors/sms-connectors/sms-templates.mdx +++ b/docs/connectors/sms-connectors/sms-templates.mdx @@ -20,6 +20,8 @@ There are some examples just for reference: | OrganizationInvitation | Use this template to [send users an invitation lin](/end-user-flows/organization-experience/invite-organization-members#configure-your-email-connector) to join the organization. | Logto organization invitation verification code: `{{code}}`. Expires in 10 mins. | | UserPermissionValidation | During app usage, there may be some high-risk operations or operations with a relatively high risk level that [require additional user verification](/end-user-flows/account-settings/by-account-api#verify-by-sending-a-verification-code-to-the-users-email-or-phone), such as bank transfers, deleting resources in use, and canceling memberships. The `UserPermissionValidation` template can be used to define the content of the SMS verification code users receive in these situations. | Logto verification code: `{{code}}`. Expires in 10 mins. | | BindNewIdentifier | When a user modifies their profile, they may [bind a phone number to their current account](/end-user-flows/account-settings/by-account-api#manage-phone). In this case, the `BindNewIdentifier` template can be used to customize the content of the verification SMS. | Logto account linking verification code: `{{code}}`. Expires in 10 mins. | +| MfaVerification | When [SMS MFA](/end-user-flows/mfa/sms-mfa) is enabled, this template is used to send verification codes to users during the multi-factor authentication process. | Logto 2-step verification code: `{{code}}`. Expires in 10 mins. | +| BindMfa | When [SMS MFA](/end-user-flows/mfa/sms-mfa) is enabled, this template is used to set up SMS verification code for MFA. Users receive this verification code when they bind or configure their phone number as an MFA factor for their account. | Logto adding 2-step verification code: `{{code}}`. Expires in 10 mins. | It's important to understand these parameters: diff --git a/docs/end-user-flows/mfa/README.mdx b/docs/end-user-flows/mfa/README.mdx index a4949789e17..55eaa634f99 100644 --- a/docs/end-user-flows/mfa/README.mdx +++ b/docs/end-user-flows/mfa/README.mdx @@ -37,6 +37,8 @@ Logto simplifies the MFA activation process with a one-click toggle, removing th **Supported MFA factors**: -- [Authenticator app OTP](/end-user-flows/mfa/authenticator-app-otp): Use a time-based one-time password (TOTP) generated by an authenticator app like Google Authenticator or Authy. - [Passkeys (WebAuthn)](/end-user-flows/mfa/webauthn): Use a security key or biometric authentication for a passwordless experience. +- [Authenticator app OTP](/end-user-flows/mfa/authenticator-app-otp): Use a time-based one-time password (TOTP) generated by an authenticator app like Google Authenticator or Authy. +- [SMS verification](/end-user-flows/mfa/sms-mfa): Use SMS messages to send one-time codes (verification codes) for authentication. +- [Email verification](/end-user-flows/mfa/email-mfa): Use email messages to send one-time codes (verification codes) for authentication. - [Backup codes](/end-user-flows/mfa/backup-codes): Generate one-time-use backup codes for emergency access. diff --git a/docs/end-user-flows/mfa/authenticator-app-otp.mdx b/docs/end-user-flows/mfa/authenticator-app-otp.mdx index c97d477e8ba..13de6b44b4a 100644 --- a/docs/end-user-flows/mfa/authenticator-app-otp.mdx +++ b/docs/end-user-flows/mfa/authenticator-app-otp.mdx @@ -1,5 +1,5 @@ --- -sidebar_position: 2 +sidebar_position: 3 --- # Authenticator app OTP diff --git a/docs/end-user-flows/mfa/backup-codes.mdx b/docs/end-user-flows/mfa/backup-codes.mdx index d8bf78e3370..2db377bb7cc 100644 --- a/docs/end-user-flows/mfa/backup-codes.mdx +++ b/docs/end-user-flows/mfa/backup-codes.mdx @@ -1,5 +1,5 @@ --- -sidebar_position: 4 +sidebar_position: 6 --- # Backup codes diff --git a/docs/end-user-flows/mfa/configure-mfa.mdx b/docs/end-user-flows/mfa/configure-mfa.mdx index 636972233d2..a4fbbb748b1 100644 --- a/docs/end-user-flows/mfa/configure-mfa.mdx +++ b/docs/end-user-flows/mfa/configure-mfa.mdx @@ -15,8 +15,10 @@ Follow these steps to enable MFAs in users' Logto sign-in flow: 1. Navigate to: Console > Multi-factor auth. 2. Enable the supported verification factors for your users. 1. Primary factors: - - [Authenticator App OTP](/end-user-flows/mfa/authenticator-app-otp): The most common and widely accepted method. Use a time-based one-time password (TOTP) generated by an authenticator app like Google Authenticator or Authy. - [Passkeys (WebAuthn)](/end-user-flows/mfa/webauthn): A high-security option suitable for web products supporting device biometrics or security keys, etc., ensuring robust protection. + - [Authenticator App OTP](/end-user-flows/mfa/authenticator-app-otp): The most common and widely accepted method. Use a time-based one-time password (TOTP) generated by an authenticator app like Google Authenticator or Authy. + - [SMS verification](/end-user-flows/mfa/sms-mfa): A convenient method that sends one-time verification codes via SMS to the user's registered phone number, ideal for users who prefer mobile-based authentication without additional apps. + - [Email verification](/end-user-flows/mfa/email-mfa): A widely accessible method that delivers one-time verification codes to the user's registered email address, suitable for users across all platforms and devices. 2. Backup factors: - [Backup codes](/end-user-flows/mfa/backup-codes): This serves as a backup option when users can't verify any of the primary factors mentioned above. Enabling this option reduces friction for users' access successfully. 3. Choose if you want to enable **Require MFA**: @@ -36,12 +38,15 @@ For products with a multi-tenant architecture that support [Organizations](/orga ### MFA set-up flow \{#mfa-set-up-flow} -Once the MFA is enabled, users will be prompted to set up MFA during the sign-in and sign-up process. Users can choose to skip this setup process if and only if the “User-controlled MFA“ policy is enabled. +Once the MFA is enabled, users will be prompted to set up MFA during the sign-in and sign-up process. Users can choose to skip this setup process if and only if the “Require MFA“ policy is disabled. 1. **Visit sign-in or sign-up page**: The user navigates to the sign-in or sign-up page. 2. **Completes sign-in or sign-up**: The user completes the identity verification process within the sign-in or sign-up flow. -3. **Set up MFA primary factor**: The user is prompted to set up their primary MFA factor (either Authenticator app OTP or WebAuthn). If multiple primary factors are enabled, they can choose their preferred option. If the “User-controlled MFA” policy is enabled, they can also skip this step by selecting the "Skip" button. -4. **Set up MFA backup factor**: If **Backup codes** are enabled, the user is prompted to set up backup codes after successfully configuring their primary authentication factor. Auto generated backup codes will be displayed to the user, which they can download and store securely. User must manually confirm the backup codes to complete the MFA setup process. +3. **Set up MFA primary factor**: The user is prompted to set up their primary MFA factor (either passkey, Authenticator app OTP, SMS code, or email code). + - If multiple primary factors are enabled, they can choose their preferred option. + - If the primary factor is the same as the sign-up identifier (e.g., SMS or email), it will be pre-verified, allowing users to skip the verification step and proceed directly to the next step (e.g., "Add another one 2-step verification" or "Save your backup factors"). + - If the “Require MFA” policy is disabled, they can also skip this step by selecting the "Skip" button. +4. **Set up MFA backup factor**: If **Backup codes** are enabled, the user is prompted to save backup codes after successfully configuring their primary authentication factor. Auto generated backup codes will be displayed to the user, which they can download and store securely. User must manually confirm the backup codes to complete the MFA setup process. MFA set-up flow @@ -50,7 +55,11 @@ Once the MFA is enabled, users will be prompted to set up MFA during the sign-in Users who have set up MFA will be prompted to verify their identity using their configured MFA factors during sign-in. The verification factor will depend on the MFA configuration in Logto and the user settings. - If a user has set up only one factor, they will verify it directly. -- If a user has set up multiple factors as 2FA, they will need to choose one to verify. +- If a user has set up multiple factors for 2FA, the system will present verification options based on the following priority rules: + - **Passkey priority**: If the user has a passkey configured, it will be presented as the default verification method. + - **Last-used preference**: If no passkey is available, the system will prioritize the verification method the user last successfully used. + - **Selection list**: If neither of the above priorities apply, the 2-step verification page will display all available bound verification methods for the user to choose from. + - Users can click "Try another method to verify" to switch between different verification options at any time. - If all the enabled primary factors are not available to the user, and backup code is enabled, they can use the one-time backup code to verify their identity. MFA verification flow @@ -76,3 +85,31 @@ For applications that don't require MFA during initial registration, you can imp - **Gradual onboarding**: Present MFA setup as part of a progressive security enhancement flow Learn more about implementing these patterns with [Account API](/end-user-flows/account-settings/by-account-api). + +### Manage user's MFA in Console + +In the Console > User management, administrators can manage user MFA settings effectively: + +- **View user MFA status**: Check which MFA factors are enabled for each user. +- **Remove user MFA**: Delete all MFA factors for a user, requiring them to set up MFA again. + +### FAQs + +
+ +### What happens when administrators remove user's existing MFA factors? + +When administrators remove all of a user's primary MFA factors (passkey, authenticator app OTP, SMS, or email), the following scenarios will occur during the user's next sign-in: + +**Scenario 1: No MFA factors remain** + +- If no MFA factors exist (including no backup codes) and the [MFA policy](#global-mfa-configuration) requires MFA, the user will be allowed to sign in without MFA verification and will be immediately prompted to set up MFA again. + +**Scenario 2: Backup codes still exist** + +- If backup codes are still available, the user must first verify using a backup code during sign-in. +- After successful backup code verification, the user will be prompted to set up a new primary MFA factor. +- Whether the user can skip this setup depends on your configured MFA policy. +- This approach prevents users from being locked out of their accounts when no primary factors are available. + +
diff --git a/docs/end-user-flows/mfa/email-mfa.mdx b/docs/end-user-flows/mfa/email-mfa.mdx new file mode 100644 index 00000000000..4a6915b4fb5 --- /dev/null +++ b/docs/end-user-flows/mfa/email-mfa.mdx @@ -0,0 +1,147 @@ +--- +sidebar_position: 5 +sidebar_label: Email for MFA +--- + +# Email verification for MFA + +Logto supports email-based multi-factor authentication (MFA) functionality that enhances account security by sending one-time verification codes to users' registered email addresses. Email MFA serves as a second authentication factor and can be combined with other MFA factors (such as TOTP, passkeys, backup codes) to provide users with flexible two-factor authentication options. + +## Concepts + +Email verification is one of the most universally accessible MFA methods. It leverages the widespread availability of email accounts to deliver temporary, one-time verification codes directly to users' email inboxes. Unlike app-based authenticators that require additional software installation, email MFA utilizes existing email infrastructure that is already accessible to virtually all internet users through web browsers, email clients, or mobile apps. This makes it immediately available to users without any special hardware requirements or additional setup beyond having an email account. + +## Configure email verification for MFA + +**Step 1: Configure email connector and templates** + +1. Navigate to Console > Connectors > Email and SMS connectors +2. Select an appropriate email connector (SendGrid, Mailgun, etc.) +3. Configure connection parameters. +4. Set up the [email template](/connectors/email-connectors/email-templates) for MFA with the dedicated usage types: + + - `MfaVerification` usageType for verifying MFA. + - `BindMFA` usageType for binding MFA. + - Tips: [Logto Email Service](/connectors/email-connectors/built-in-email-service) provides build-in email templates. + +5. Refer to [Email connectors](/connectors/email-connectors) for provider-specific setup instructions + +**Step 2: Enable email for MFA** + +1. Navigate to Console > Multi-factor authentication +2. Enable the "Email verification code" factor. Recommend to use email MFA in combination with other MFA factors (TOTP, passkeys, SMS, backup codes) to reduce single-factor dependency. +3. Configure your preferred MFA policy (required vs. optional) +4. Save your configuration changes + +:::note Important usage considerations + +1. **Sign-in method limitation**: Email verification codes cannot be used simultaneously as both a [sign-in method (1FA)](/end-user-flows/sign-up-and-sign-in/sign-in) and an MFA factor (2FA). Choose one authentication flow per email implementation. + +2. **Sign-up method compatibility**: Email verification codes can be used simultaneously for both sign-up method and MFA. Logto will optimize the end-user registration flow based on your selected MFA policy to avoid requiring email verification twice for the same email address. + +3. **Password recovery compatibility**: While email verification codes can be used simultaneously for both [Forgot password](/end-user-flows/sign-up-and-sign-in/reset-password) and MFA, this combination is **not recommended**. This configuration reduces MFA security effectiveness, as users could potentially bypass MFA by using forgot password email verification to reset their password, then use the new password for primary authentication (1FA) followed by the same email method for MFA verification. + +::: + +## Email MFA setup flows + +The MFA setup prompt can appear during user registration or after sign-in, depending on your configured [MFA policy](/end-user-flows/mfa/configure-mfa#global-mfa-configuration). Users may also enable email MFA from their [Account settings page](/end-user-flows/account-settings/by-account-api#update-or-link-new-email). + +The email MFA setup flow is affected by the following factors: + +- **Number of MFA primary factors**: If there are multiple primary factors, the user must choose one to configure. Primary factors are MFA methods other than backup codes. +- **Backup codes enabled**: When enabled, backup codes are generated automatically after the primary MFA factor is configured; the user is prompted to save them. +- **Sign-up identifier configuration**: If the email address was used as the [sign-up identifier](/end-user-flows/sign-up-and-sign-in/sign-up#set-up-the-sign-up-identifier) and the user already verified it with an email verification code during registration, the system will automatically bind that email as an MFA factor and no further verification is required. If other primary factors exist, the UI will surface an "Add another 2-step verification" option (the user may skip it), which also clearly indicates that MFA is enabled. +- **Existing user data**: When an existing user sets up MFA after signing in, they must first complete primary authentication and then proceed with MFA setup. If the account already contains a verified primary email address, the setup behaves the same way as the sign-up identifier case above. + +Below are three common email MFA binding scenarios. + +### Scenario 1: Email address only used for MFA (Typical flow) + +When the email address is not one of the sign-up identifiers, and only for MFA, follow the standard setup sequence: + +- If there is only one email MFA factor, show the setup UI for that factor directly. +- If there are multiple primary MFA factors, show a "Set up MFA" list page and let the user choose which factor to configure. + +**Examples:** + +
+ + Sign-up: `Phone number + SMS verification code + Password` | MFA: `Email verification code + + Backup codes` + + Email MFA setup flow 1-1 +
+ +
+ + Sign-up: `Phone number + SMS verification code + Password` | MFA: `Email verification code + + Passkeys + Authenticator app OTP + Backup codes` + + Email MFA setup flow 1-2 +
+ +### Scenario 2: Email verified as the sign-up identifier + +If the email address is the sign-up identifier and the user has already verified it with an email code during registration, the system will auto-bind that email as an MFA factor — no additional verification is needed. + +**Examples:** + +
+ + Sign-up: `Email address + Email verification code + Password` | MFA: `Email verification code + + Backup codes` + + Email MFA setup flow 2 +
+ +### Scenario 3: Email verified but multiple primary factors available + +If the email address was verified at sign-up (as the sign-up identifier) but the account has multiple primary MFA factors (e.g., email plus passkeys or authenticator apps), the UI will prompt the user with "Add another 2-step verification". The user may choose to add another factor or skip; the prompt also communicates that MFA is already enabled. + +**Examples:** + +
+ + Sign-up: `Email address + Email verification code + Password` | MFA: `Email verification code + + Passkeys + Authenticator app OTP + Backup codes` + + Email MFA setup flow 3 +
+ +## Email MFA verification flows + +When a user with email MFA enabled signs in, after successfully completing primary authentication (1FA), they will be prompted to verify their identity using the email verification code as the second authentication factor (2FA). + +If multiple MFA factors are available, users can select from their configured factors. The system determines which MFA factor to prompt first based on the priority order specified in [Configure MFA](/end-user-flows/mfa/configure-mfa#mfa-verification-flow). + +**Examples:** + +
+ + Sign-in: `Phone number + Password` | MFA: `Email verification code (last time used) / + Authenticator app OTP / Backup codes` + + Email MFA verification flow +
+ +## Error Handling + +1. **Email address not bound** + + - Error code: `session.mfa.mfa_factor_not_enabled` + - Handling: Guide user to bind email address first + +2. **Incorrect verification code** + + - Error code: `verification_code.code_mismatch` + - Handling: Prompt user to re-enter, limit retry attempts + +3. **Verification code expired** + + - Error code: `verification_code.expired` + - Handling: Prompt user to request new verification code + +4. **Sending rate limit exceeded** + - Error code: `connector.rate_limit_exceeded` + - Handling: Show wait time, limit resending diff --git a/docs/end-user-flows/mfa/sms-mfa.mdx b/docs/end-user-flows/mfa/sms-mfa.mdx new file mode 100644 index 00000000000..eea3d53e7cb --- /dev/null +++ b/docs/end-user-flows/mfa/sms-mfa.mdx @@ -0,0 +1,145 @@ +--- +sidebar_position: 4 +sidebar_label: SMS for MFA +--- + +# SMS verification for MFA + +Logto supports SMS-based multi-factor authentication (MFA) functionality that enhances account security by sending one-time verification codes to users' registered phone numbers. SMS MFA serves as a second authentication factor and can be combined with other MFA factors (such as TOTP, passkeys, backup codes) to provide users with flexible two-factor authentication options. + +## Concepts + +SMS verification, also referred to as Phone Number verification, is one of the most accessible MFA methods. It leverages the ubiquity of mobile phones to deliver temporary, one-time verification codes directly to users' devices via text messages. Unlike app-based authenticators that require additional software installation, SMS MFA utilizes the existing messaging infrastructure that comes standard with every mobile device, making it immediately available to users without any setup requirements. + +## Configure SMS verification for MFA + +**Step 1: Configure SMS connector and templates** + +1. Navigate to Console > Connectors > Email and SMS connectors +2. Select an appropriate SMS connector (Twilio, SMS Aero, etc.) +3. Configure connection parameters. +4. Set up the SMS template for MFA with the dedicated usage types. + - `MfaVerification` usageType for verifying MFA. + - `BindMFA` usageType for binding MFA. +5. Test the connector functionality to ensure proper message delivery +6. Refer to [SMS connectors](/connectors/sms-connectors) for provider-specific setup instructions + +**Step 2: Enable SMS for MFA** + +1. Navigate to Console > Multi-factor authentication +2. Enable the "SMS verification code" factor. Recommend to use SMS MFA in combination with other MFA factors (TOTP, passkeys, backup codes) to reduce single-factor dependency. +3. Configure your preferred MFA policy (required vs. optional) +4. Save your configuration changes + +:::note Important usage considerations + +1. **Sign-in method limitation**: SMS verification codes cannot be used simultaneously as both a [sign-in method (1FA)](/end-user-flows/sign-up-and-sign-in/sign-in) and an MFA factor (2FA). Choose one authentication flow per SMS implementation. + +2. **Sign-up method compatibility**: SMS verification codes can be used simultaneously for both sign-up method and MFA. Logto will optimize the end-user registration flow based on your selected MFA policy to avoid requiring SMS verification twice for the same phone number. + +3. **Password recovery compatibility**: While SMS verification codes can be used simultaneously for both [Forgot password](/end-user-flows/sign-up-and-sign-in/reset-password) and MFA, this combination is **not recommended**. This configuration reduces MFA security effectiveness, as users could potentially bypass MFA by using forgot password SMS verification to reset their password, then use the new password for primary authentication (1FA) followed by the same SMS method for MFA verification. + +::: + +## SMS MFA setup flows + +The MFA setup prompt can appear during user registration or after sign-in, depending on your configured [MFA policy](/end-user-flows/mfa/configure-mfa#global-mfa-configuration). Users may also enable SMS MFA from their [Account settings page](/end-user-flows/account-settings/by-account-api#manage-phone). + +The SMS MFA setup flow is affected by the following factors: + +- **Number of MFA primary factors**: If there are multiple primary factors, the user must choose one to configure. Primary factors are MFA methods other than backup codes. +- **Backup codes enabled**: When enabled, backup codes are generated automatically after the primary MFA factor is configured; the user is prompted to save them. +- **Sign-up identifier configuration**: If the phone number was used as the [sign-up identifier](/end-user-flows/sign-up-and-sign-in/sign-up#set-up-the-sign-up-identifier) and the user already verified it with an SMS verification code during registration, the system will automatically bind that number as an MFA factor and no further verification is required. If other primary factors exist, the UI will surface an “Add another 2-step verification” option (the user may skip it), which also clearly indicates that MFA is enabled. +- **Existing user data**: When an existing user sets up MFA after signing in, they must first complete primary authentication and then proceed with MFA setup. If the account already contains a verified primary phone number, the setup behaves the same way as the sign-up identifier case above. + +Below are three common SMS MFA binding scenarios. + +### Scenario 1: Phone number only used for MFA (Typical flow) + +When the phone number is not one of the sign-up identifiers, and only for MFA, follow the standard setup sequence: + +- If there is only one SMS MFA factor, show the setup UI for that factor directly. +- If there are multiple primary MFA factors, show a "Set up MFA" list page and let the user choose which factor to configure. + +**Examples:** + +
+ + Sign-up: `Email + Email verification code + Password` | MFA: `SMS verification code + Backup + codes` + + SMS MFA setup flow 1-1 +
+ +
+ + Sign-up: `Email + Email verification code + Password` | MFA: `SMS verification code + Passkeys + + Authenticator app OTP + Backup codes` + + SMS MFA setup flow 1-2 +
+ +### Scenario 2: Phone verified as the sign-up identifier + +If the phone number is the sign-up identifier and the user has already verified it with an SMS code during registration, the system will auto-bind that number as an MFA factor — no additional verification is needed. + +**Examples:** + +
+ + Sign-up: `Phone number + SMS verification code + Password` | MFA: `SMS verification code + + Backup codes` + + SMS MFA setup flow 2 +
+ +### Scenario 3: Phone verified but multiple primary factors available + +If the phone number was verified at sign-up (as the sign-up identifier) but the account has multiple primary MFA factors (e.g., SMS plus passkeys or authenticator apps), the UI will prompt the user with “Add another 2-step verification”. The user may choose to add another factor or skip; the prompt also communicates that MFA is already enabled. + +**Examples:** + +
+ + Sign-up: `Phone number + SMS verification code + Password` | MFA: `SMS verification code + + Passkeys + Authenticator app OTP + Backup codes` + + SMS MFA setup flow 3 +
+ +## SMS MFA verification flows + +When a user with SMS MFA enabled signs in, after successfully completing primary authentication (1FA), they will be prompted to verify their identity using the SMS verification code as the second authentication factor (2FA). + +If multiple MFA factors are available, users can select from their configured factors. The system determines which MFA factor to prompt first based on the priority order specified in [Configure MFA](/end-user-flows/mfa/configure-mfa#mfa-verification-flow). + +**Examples:** + +
+ + Sign-in: `Email address + Password` | MFA: `SMS verification code (last time used) / + Authenticator app OTP / Backup codes` + + SMS MFA verification flow +
+ +## Error Handling + +1. **Phone number not bound** + + - Error code: `session.mfa.mfa_factor_not_enabled` + - Handling: Guide user to bind phone number first + +2. **Incorrect verification code** + + - Error code: `verification_code.code_mismatch` + - Handling: Prompt user to re-enter, limit retry attempts + +3. **Verification code expired** + + - Error code: `verification_code.expired` + - Handling: Prompt user to request new verification code + +4. **Sending rate limit exceeded** + - Error code: `connector.rate_limit_exceeded` + - Handling: Show wait time, limit resending diff --git a/docs/end-user-flows/mfa/webauthn.mdx b/docs/end-user-flows/mfa/webauthn.mdx index 5d4737a43ac..40f257ea89d 100644 --- a/docs/end-user-flows/mfa/webauthn.mdx +++ b/docs/end-user-flows/mfa/webauthn.mdx @@ -1,5 +1,5 @@ --- -sidebar_position: 3 +sidebar_position: 2 --- # Passkeys (WebAuthn) diff --git a/docs/end-user-flows/sign-up-and-sign-in/reset-password.mdx b/docs/end-user-flows/sign-up-and-sign-in/reset-password.mdx index 256f541ae8c..42c58b545fe 100644 --- a/docs/end-user-flows/sign-up-and-sign-in/reset-password.mdx +++ b/docs/end-user-flows/sign-up-and-sign-in/reset-password.mdx @@ -4,15 +4,29 @@ sidebar_position: 4 # Reset password -The password recovery feature will be automatically enabled to you when you have a valid [Email connector](/connectors/email-connectors) or [SMS connector](/connectors/sms-connectors) configured. User can reset their password by providing their registered email address or phone number. +Logto provides a comprehensive password reset functionality that allows users to securely recover access to their accounts when they forget their passwords or want to change them. This feature supports multiple verification methods including email and SMS, ensuring users can regain access through their preferred communication channel. ## Forgot password for account recovery \{#forgot-password-for-account-recovery} -Once the reset password feature is enabled, a "Forgot password" link button will be displayed under the sign-in form. Users can click the "Forgot password" link to initiate a password reset process. +### Configuration -:::note -Not seeing the "Forgot password" link? Make sure you have a valid **Email** or **SMS** connector configured. -::: +To enable forgot password functionality: + +1. **Configure connectors**: Set up [Email](/connectors/email-connectors) or [SMS](/connectors/sms-connectors) connectors in Console > Connectors > Email and SMS connectors + +2. **Collect user contact info**: Ensure users have email/phone registered during [sign-up](/end-user-flows/sign-up-and-sign-in/sign-up) or via [account settings](/end-user-flows/account-settings/by-account-api#update-or-link-new-email) + +3. **Enable verification methods**: + + - Go to Console > Sign-in experience > Sign-up and sign-in + - Enable **Password** as a sign-in method + - Add **Email verification code** and/or **Phone verification code** for **Forgot password** + +4. **Save and test**: Save changes and test using [Live Preview](/customization/live-preview) + +### User experience flow + +Once the reset password feature is enabled, a "Forgot password" link button will be displayed under the sign-in form. Users can click the "Forgot password" link to initiate a password reset process. 1. **Visit sign-in page**: User visits the sign-in page. 2. **Click on Forgot password link**: User clicks on the "Forgot password" link. diff --git a/static-localized/en/img/assets/configure-mfa.png b/static-localized/en/img/assets/configure-mfa.png index 1aedab181a4ceddbee5d511ce2d6f6635807e8d6..c6e0d12cf074eb44b9a0fcb94583103b07171d9b 100644 GIT binary patch literal 128738 zcmcF~gsQqmpLwM&SC)FO>YcXxM5EX@)kxl2kfDN+hc2(rWy zck%bW|G>S^-G^tN<$TYXGc#xAGv~~APNcTxYXbad_y7QaKt)+W7XWw!0RSHCKD>`< zas6oC4FKG`)K=G5yuH0e?xB|FPJe7{TwPsJ(a?H$eKZ$2zP!AAt)zK=aq;)>-?Ou` zFI7z+!GR9l?~ad;`-g^5DAexnzeh($fByUddwYAox!u|R)7}A{pFI8j>jY8{P0!4V zj*0d03;5{cx4g2F6rZ)Vd4SyCpBP_AP09W7^XJ;?Z(0V%?3`TtE~kyn&BdkV^2*A% zgv5~WaQ~p7wI4qMKLsZyrx?C5URmB=L~L$tZRh3}Z2UyRM@A~EYkvLuO-;?TfLN?+ zXlQHwIx{<)nx4M0x>itBG(Y!aVsi2sEght>sjjwlcW=)Q`u5Z35C&$J^&fkE{R2%c zEj_)x+dDfgZS4_JG5rGrvvcz`wYA}qks#o^VHm9UTOSKM$JqGz%=C(mzJaQW&gamu z_bx8qr=~KqbBaq!5eq-rxwuVDY@wZ9F|mmwqhr#tuYRoUX=}Y19GDn^&xC|TTUy&d zJNo1l6nnqI<`)(sA`+|{fDQHS&&6K8l$1I+IPC5m5_&Fb+hRXHHvfBf7dABY_N|+r zZ%Aobxx-th+}u({Wfgrr6IVA66*YC=fIwT2otBPX-?!2D*z~FC8B=o$P`l&d;i0;g zwu`e@a%!4}x1g zn~N?ybpCdA_e{b6!aJ`!DlbQRPn}<0K^ohS_HWA)|7HiHz98y02hTfybWQKg?EL-J zx7pwM!esk;g$Z!MdX|y769@GXTF0GRs!`9qVXo?y{GqkI4Jgs3$T+ee9Fbjw!yT72^@>9?lQz_OKv76#QOrP>hgSE)5q%qM zy~X3tYzEsO_2UE9vF7$ednon6>UkHvj2Hm$p*RtVarLj?6riV{v$Cqd+H0}>lrTa} z8;^Q(?c>>Mn+PCAMgV!qls1(Jm(B1KCs!KwE{pQ%XdFy4M+b*~W=LX2y&6jFW_IsX zldyTbly3|(KBy>K(?F>_khJUtWM_@Fs{muYX%JqOo@Xv`B zM2n`8oyj%HBRK?&VNsTGHZ`?_@)L{oFw6SG%=ftw;DQkojZ zmmG~ej0kxR9-d1oNH?GNk{DO2FgGn8Ms-cEdlll>l;b=a)++1{aeXzv*S?cVydyb_ zEY23xOTLannQTA3IiqUjM~IH3y}&4(blyT>K$GRdc>3zoRrZSc-bwRC52GOyVnP`l zZBvd>k*wiTul^y6=;|Ai9clYBbl1VPRL)WlscEY)B77|G=Kd}S;-!qDg1ZxA)Txi| z)t_L&?E|KBdmj#-SGJxNoAZ2;g~Y!btN}uLs{Gr~=Hz=7lDH@gX^xsNR{dztAy*6R zVix}2Kri=q;6MRut(BB5?c|wm$WO`EtkN!Lf4y+ z6|;Ul2#NejF*rxiP9*&~>1R*L5EiSk4ySv0q|;BejT4?SvEUMYlZ%WFZ+o|-F(|_0 zs8I>~*^%aK*z1{WZkr`jFUV<#Lxe--^F(c+xHTwG@>GAy=XlIdINL=idj$scnmrE) zzg|V#fp?0FkM{PmU2e)NeCS+~&$UqvKsP$cbxXwO-oQ}=wAxb4Fz{By6g({^UpRHSXEr zp-0D$amp}j%pb}K^&)z-8!nwXv>Pn)sSVozF}!gKH@>)nGp5ikkMjl20(mp(LfO_i z%5gsv+7ktTdn;{etRS9G|Kawj9dMEuwB}d$OC{m_4I%P!jQyZ1W zSo%Mg)+t>bjat^B$CM(Uod-rizHv)itc?8=`yXlln7OC=|5EAD(~>^>Q_bJ{#N~x4 zqO=jZ7PPB|FxW99lDPH@1WkySeIqae?^82ghMZU3-~DNcn8=gz%}TReumjoOiC#ty zR*Q+YHAwL<35poO)kRUUlszj#GTv9rAOq#Au_b%kx@H zc8teLHR#74Z2HWB7AJpl8pZ*Q<$~?jfk$5x+uonFDoN)qw8e|+ZnZ#I7A%pbt!I<2 zzJoxP#t-ySGOu*N->M<@rGfUKZ1KYCL1%S)?vwQzGJCug?=-$*43jy;`QOy!%y6Ph z`9oj>BXjFszdlpW6rPb-9~lDFf0mCmxvWG(NcQAPMy=2m(x+eR&v0QmFI{CaYs!%; z`zvv+{tdmt7N~Q*GqCVRiq)NqujyGKEDKi#_zl^`Ff}Ck;g}-9d{u&BW_n^$CS~1_btu^a(NOc3M)p(D$<@?*;oH;D>nZ4h36U#j$h-stma& zN0}$h!*rIWlT$8^PXET!7%2bw-V7LgaV+@H_2U?DbxhYh~1-lr4joH1*J0zRq zAdfP|LS&Y;L4igQM2_eB5$RtU*kY3 zayf(_by2u-lE09h9B@(>OVXLgjcoX&YZQGw^LpUl$anvM#l1-<^*W>SH_INH!}rNZ z8H3u(DBHsPFxGw*H3W1H^$d;IFY;BWG9WrdDpFb6lj{?n_-i%hXELs_QzHQL6lcJ@ ztVdyy_fQ`VQ3w{)8%I+uS1o6S>D|1Mttx7s*3; z^z@hUoX~E2Rr2}wXjBPuQUP>GOU|TX8&CW>EO4#pN>5-i%BZ%#6tafJq}e+!8#8jc zQeutwn60GGR~tnuj|ikM(UnMiswh8)=5VBF&?H+}Lm(FZv%+Ey->|$_&t*1dQ*)b^ zE12vAKx9qP+Y4*-3Gmv|dI2257o$>)pCe3pby2L1i#=~!e>O2caF|kUc4H$-kVoR$ zlmzytL-eX@c{atK$>EkDi&49}Z}d~8=A5qeLJv$4kw!~AbOF-K_#m$?tl3KBnwtGt zA#$qYJyqQoq|kUrK#et=&*?XbNZiypmGTqIwG)rs`Um}K*WIP2$0=e2qILv>TMGW5 za^+=F)qS1&jC@lw-mdYx2Y(CiJwTf_Q;Gjwj81Y*&h)*xtvHz-*%~l3Z_qJTJqHLu(C6|x=Hl>Bwg%h54KbcAC zid*7Iz)9o_Sg|m#HrOlkS^!RmDn(WmRpYNIgUYweo(Z;b^pnAje&3_^O}VD6PrYU% zzCSe?|0uOpiqls$f>w2a^}g$(HmW2-r}DabUo+L@HWJeCAFK^RAzq;RnkRa84dyRA zt=@G>SaC||V6(sKZ&Kn(ZfQ|MxJP88WB|jU_u9LYKV|8jknGQ+{kfsLO3t8ssz&8R zNH#auz++-pRUMQ8bX{t3-4wyPE?g%yrz8nMn1OC>>mVd8kXt)W^x1Zvpl9mJ%1F^| zbro{{L8u(D)#orrez+#CeyxuV>OH9g>KjLJx3E}e7vFYgw`yhf|EN+q;W_>Da;gNUog3>TUHvL5GX~20x33 zkxw?1OkqVIg(II}yOYD$MJJ-d7}qL`0SjVJ;}!Y_^w8(B*Jr`K3rL=Y9965wk_FP% zRXQ-e$(XzV*lFQ>@$bI z46mj65G{ojs|)7*wU07S!4FW0;2#Y7bsJ}>FOQ(W-6!k28q1!4%LUc28`_Qk-SF%x+NqZ<2ifll-YvuBF`x!gP0fn~fIaS=a+xiNxr+4{eomy!<3cIN9r z!B{C06qC2)Kj==*5d0lR_-pso<0W`)b2ZL+9JUftEI2ZbjSITEveK2q&+xO!drQ*h zmzz~m7%%sJJ52^Bvu0McCBxZbjLiXn`!`r7c9#zVO*K!uO3rs;uExvJt44;7&i(2a zviX^HJD8E|k)4+-QuOCFXD8wwi2W_6#JUc`Ks3D};pWTep6cVNsabyezB%JqL$J_} zi-^6D>}Se=N)dH=ytkZa>|CLbHyUk9j`D`Zn2)0JNP`vscFzb@Y9>l z2XuJG^Byt*T%hhUh?9s7))QOXDo9=0B!l?;^oCkT z3!w;3uixJmsoo=P|7$+%s5sb&YI1fGFZ65If%A!4-#VO;kId(eTM(0%CT772MKvEq zbKkEI4;LrumH&F@rlYqhE+|)&Emb+hg<(~jj(f}lE2ft9@x{u$`qbRPdv=5G=3mt) z|KYHyg262~YF8cxDfT$49zRgltkHWGJ3OBE3HacN+MlnV(w;7krD!0eI3zqmWA<3x zx(c|^n+_6Vgf9q`(xV2!FVfmx!ER2S$tT<(5qm%2>b zZ{qWp&(QfdaYfyY9S@pQX{B$i-VjqvJwtAVkINt3zvKAvi3}?$N^vk!ilBLNkWKt6 zZnzQZ(t~F_juTG$Mn8Q~!j+IvuGItF1GV-t&z35z8CcyE{E%sf!Q;)b@=<(rGJk$y z3624H01>F4v!aVyS|hPYrS(Y982RnPm;dD$bO=AluN_&h1bno%0=oxbR~2~r1fgy2 zup$i6cWU%jH`oqykTBIy_5|CUR+U$(8ko6$)EoXd<(xu&dZFGxAf?i(t@pE{ z9;wh%0bNHAU1R-9d{u3ouM2W^hy7X9I~xnG8*jS#9XO-bzZlg`ct`>CsO#iil6TJTYtquI~VcE;;L4e=nTukH)QVgbe9F z$wn$+5)@x30xsIT`VC(CF{-0L=@-UN>^Pps@nSeaAs~r0zsWs#a zM6%uOm-`C#oKcvx2|(j%ng+^!e+M?OA(^IxjsxBn%TxY)GN$h)T*i-^mm_IchP<$| zRQ6H*C7@$B9?<6~h#BY*vpVtxGLl@4_$YbP;4N%d2+!bX7v?OQ$7ByCIX(*wNGCkf z!Wpw8A{yB`ai^oWhZ$t@#VLvc`Wqfvp2Rl&+ru$A*XAxEv=@4&7=10BLZTI(DXGEs zuP46n4aOBc40;a21^j>hVgT=FG)D@= zZHP^LsAK30jZ=MPDZ3Udzb4rTq3v4a zMDHv0b}P5C^Ata6z4KRj>oWe~%#L@dt|T^$j12$xKVJ;ac^Yp8>ZHz_VgZz+fZ+tL zI$LU0eD?qe#4tkYbqL%@+x!85fhs9?$?H~c!K15q^|otG#PYic08p8LtogqFQF4_) zbj3G|fIbx5wg3HQ{<=7!Xy0{)Xz#;|;Rp7G*@)|o?34>QTm_SGWk4AJ`1|^cs7!ZF z>%jhn_z2|Z_PG^*?V4Qm{wqTXJWiiv#fd)g#~W&WlQ3k!ibm}*VXcS+fJF|{_?4r2 zfBgOR#3@R!$ut2OZrnt&*m<7$UIB8px4XI*&S!VFS34@fc^{B~4bz0OA&9nH_z@7; zO$$fVhMhn8ypF?(bhHI6O(4<8Te|M&^ijWzB5qzHw4y3te^1V*yys;^&-R?NMExcR z0ba?#a`R*)QT|o?K2I((exuH7%;z$@3+?U5OmJUJng|JPogbkQstL#W{B&XfyK{?) z5x476k{nS-#M8jgqNkhz3SroZGa%9(uFly-yX&G1sGw=ldR1>bAlrEUiL^+0jbWJw* zg0jiD3Iqn^A82eQ!~AVSh~*+$7+`!R9NhC_=R#fiNysk)q`SfKN0u5WHA^ z?0C;ny7CZqZJCdkf4pgk+0j6zhF7K*M@J>M)f(a?ktK3ueyK|{nOtWqw#39*bgQO_ zo%K(V#_I*;I|YE}@~gfLmNd1b3>7l15aXD8(QL%^*iloa;@TB4GM<+(I+S?z;OHU&wvUfnjD_8=JaMn&`S6t@DP$DbtzE# zR*CBe)llI(YkWR7^slfgs7CV$-ky3z8E`^dq%jmL=m;kL<<0wMe!7aR;?6)#U!?}8 zqffv?OCwKzdD*OVXHD?5&)5#3cuxY7|M&Vn{hTXHi2L2D_fy!vdh@-F;AddJ2I_6! znLJ4sW#$9tg}CKXtZ&=(!;Ab5gV_odUFU0le^Sr-`|H3 za9O%EfXA7|*|Xp0B2nhERyMd_>pg5C*>g_PUXxDpkmUKa&|7JLujAd{h^2>@dsoPP z?sicqX8P}OJP!w8hE19i;QNt|QjdU!dn$fyg;I_IPsVoCf{@<1Em#_k8n(87CnbxD z&alSzYR;(j7#2TeBgZMhti*M$BZW!VitUoGvPI!rZgeKBzBOiaMh+B#+@I{_ot6-v z;IyIQfGr2BDi^4>ajCtU=1G6+vfH&!&+&)K0HO;*zP0MLgO$%6QlWFzr3XXN__RTS zh;aDU??uxnSI7o6CBK%8t^-zr@T(!zwk?dii*!ZvI_I;nRD4}b+a7=;bz~3UU}THF zkP&gnDdJXbCiY?eLMq7mcW>|2Mdm*ZL~*rLkWBN3j3Ey4 zgT!5?^;`(0anlb}r~4H{^N@gNQa`yzbLy*KVDsoS z+(%HY?=y!1ar1ui6Z3otucEFaw0Fc%a_*sbX7dy3^fW_Rm}Pa9^GP(}*KiHB|P_|L0+9~{*3@_Sc@pC#7htQ1Q zt|xRv6;)}|kO7$Y#Mh#>5((8hSd^vd5DTbww5giae`bdMJL2o7%`2Z^uAuYbbbZf@ z!2`1PQ>z%9Q|0qOazxSq*Ip7~P(l4Q1t~ek*Vggd-B^%sB?Y;S0fv32T;$GN<3m<7 z+On(o(6SwuR|U)%LR@tHhFGp=E>+Vn#@&0vmV7xO9;;(rTB!Co$xCrn(}@d0tL||- zQ1&DaO2Jm%JQ%FCD;d%9gH@u2^SKaq#HGhxW73MsWe1ik1os2yYwy=y&m<9JV`HDo zBGb>`4Xgde{fZ~?=nL-&He+%Zeyv!#YZ(6-G@yv{@*>ChLoSyGzLh4*y6S-O=qlC; zPL=Mg3O>PjDk?MSnrbyIx1~?A95@sR6STCrh5PWr?l7&1_L1B|VV2U&?27_D4V}ir z8z*(JPsYzDI$nW~!(v||UQTOy>e?6T?eP-7#{hb=XrMYFS2I?ADw1joif5&aQh4G0 z;bS)RG)j*3=(z^6WEX0FJ`;7)K95zb+i<)Qb=d|yd@xbq<=t5{xm&j56zcqOhX#o~ zPkNXt%8q^}&G!k9zsnPnjWLbZi4-J~=O-I_TDFSbbSDXU7a^7!7(#-VR(_O&)1F?5 zetFbfjNlXjL{v+T_&Pjj8V8K-v7GZics=>|WU_9DL|kS5aD!p-9=q>tgi+hl`Nlek z&DYV-Uu9OYYh<1I#rZvw6OZYygI(R*=oHJ8wS8*6P3C0(r;=KoKpFk9q+WN-J1a!` zc_K!8nka$2EqB~p%EOVHMe%JbU{w6^lk}&^_7*|YnvL)Sl-0ATL zEplQ*Z^)bF`3{@=yXt#1v`hEoV01LSjn{@#FHN1wO&qfAQ<9}POp;W1JW=8B8u%&)sP*o=KK?!|K&o`I7`n#m#dB_iATTw% ziuAf?lv~HG|27es>yLlRXOY_uKCx_rcb_HjZUlzLtAI_G4309>Fj3*eN1g@kT>&hw z-t%iVze!2@#~RN=#y+T7#frp*%A(31PeHUVBKm&H<_|UUiLiPC>oeQb{(8BsG(KZSMz(3=NB%+F}9NY;p~|u!2wkE?{|v4rEvHypC^tK4A8N+oxeFs2#>6+FZT* zo|lo>Qn(nV-5- zn77g5V%QG9;(h|-r~ zQx@n3A#_cTqqc3L%4*#1X5qo13%#5a!n;-LFgI@#o+URuSc;2#vSV-NQUMGkxd6Jz zVlapJ{ny}xoR2oT2R-M3-(Z^LWbpgP$^H(Svpi z#RDhTjj7L{FHVGOMfD+l`H5P8*&j0ASRclj7d_qp#GO6fS#bMYq{c#l!cFahA~v2}^yDiO?MVHHPet37e@;D%yJ5dDtE0<1+^U`?IlDj}9v*m2 zd$plyW$|lqhF#eZ6qCGp~G{)6SWXdCqwLp%SXWF)ma1&i++v)>}99k+*4jqQo)NM=#hatp#! zi>~jv$aXZj8fx+x&#(p++S`a7Xk0_1Dk3O=qr5A+^0a-aF?S3Wwm=aw+M^@8{R{f(@4Hp*)CUcHe!j z?&nFYzDqNwb<44g@{mxD(-dq2LJxzG~e z{%iPuKl)=Rpu$(gSukl3E6SOkQ{iO|S^WQtf~ef-h1Nid=fNC=KRUP3L_9o?o|?bG zZirxK=S~!P!AZW!6|Eo4KrW}9z&%AfzhK5sgZyN&jSZ3*nYp33VMK_=#dK4Wkeozk z6K!rTXCg#hTF&z*?He9COneY5Z1gh;0g8RU3JduGPLrI<*EQw&WhQzuTu9P?!{^dP zdBq-$zbDEoZX}j7;pD-1j6FerqxH8R!ZYGy{SMfwIn3j#7K}^kpcNXPQyeQHME8k+ z7T*UD_P0DFNZx)C5bqJZu(rh-ag(e_1af;bmB|JIn0F9+2k#KwQux>yr-8aeUO-IQ z|9+ywOOHaTlq*&i?C<>64pHiQHmM?srXUa(wxK~xUe8 zUska)`O^53)*6~Kxji`b5J3~SDtl9emoWR%$XN9i|Bef!)T9v=h~0QrivRg{$8G}o zswVoaqHuPzVg7j-PXs;8aTeXgn)d5>-&mTEBPRbyI*wf&65iV9tS&$Asy<+6IF2r5NGcI`S#|AX%D$Ds$9K|e1j4hoRiC(W+4A&&GaBpt7dOBa zf)CQVsN7Yx{~C<@kOXiL%%)MYO{k?1n!;4p6pJKmF;S3S{hs%XwA)Dl*D0(&r(cna zdg|s~2j?eVDbkIr}3E=vW$aYW@$Gwe0#sp3#PlE+$B3h|*<)O;iv&#PBu9v(i zky{2N%LEN?acX`gF0UnuOFeJXFU_Td-!I*LSps)j6y!e7S3Xpn%d*mhld>|EA26p< zCsdlMYpYkj{oYx3W()R`Dv)}Gi$pN%IkdiNZ`yQ54~97zI@U!}!2t-@s`xdos*M;cBs8NlMCE(MuUT zlTz-(MD#IccF~|GYLyPPa_4oN7_aNDjCKoqp{xvpw)sS<9=xMQxGZwSzfcRzk%~dW zPEYLc)R&Be16C&g4AUt}E9w0G1O%QHRm8AFRVlEVu}|wz5u~c;t@DficG;S{dB>lf z_NOwVPe?u|xOS+0Yf0P@trkH_^}22{qR5o&Ub4pwPxu*DY2K0cawn(D8Ljp5_;{J3 zm6F{!-;w7?n@^li?K9tG`IFP~(s)7GHEm_%be`6Zv=5=9_20)lOwJ3u%N8Od-{=$8 zQztXZ35KHnS}1%GtfjRfdmKrAB#~WS?LnZ|n(>uTRYRM{sA!CmQn$)P$-U**y0x6$ zUtf{Ey;g$GqM1d{A^M&7K&kJs%!&S+sJ#4^KQqfhgYsbulzNL#(T7SdpE#murnr27 zbX%kA+D{Mz(+qFt**_kZ`NnV^+~bIF7ySFd_4*vvdD2_zrvPJ&nsk)zT({*10bgr) zSFs-l4N;a(poi!tDY{k;q1S^67!--N#<;Y`qtTa>mvp7lX0{5IWG#tZ5P~)m`tZbS zaTda`;p5qtTr5n`b3SMcQav!;KgcaLq7woa&^wR!3l|heH>NKM;m@0KuV5X@PxU`# zQl#@s?|O1v9pCMPE>z1&)Q^h_dQ#pvVW`YFn>W9E@5stTGNEwy$;< zAPS_NM$J>gi@g@Fsp--&2h^gpy7AS$LJlY+GxVm@azM{rt=70}we5hw(e0Kofzh_K z^*DrGP+tLj=f<;mhVCEPW(^7$CjOb{2D|V;>TC10!z#$+`Bzg8TRw@ma6PHSkzYO8 zIYu0j|7)O(cLq9uu-n5oOfhkNY8{C$%D9ZzkQ#yHO3?Ug|JnO|Tg@+620OODjVVdRYEa)UumbtZKb&q^pF2}9Fim5-iIljYR~2{fkbQZ)!P0L5)&}^ zLoxB9^>NGXNmHC)>FUqS6lv`r`5L{u-9F-(`4!L# zqw_|z={{ykNQ#xfSTz+;W?awjhVA#4AQ(2+f%x5O#8I32w24U}~p(iQA>8|%0tgU2mrP*2X z8xgtR_s!yG&`0Gcwf+HO729MvV(w^ttXDiC1q_^1v~?=B{MdX}wVl{zNS-=W&k<4k z62cgKQOL&M$(5;f^3l}}C9#IU%|BZWG3yOoCb#)z2pFOoGJZ++J&Z%bSCApqKVvl} zvi+0%fhCs&-M*>5wH6^6oNx6(qLfrGS$e(xFxO_g2%qjfQ8T}8G;osRx6vR9_I@t$ zxeqV3=N~h6x6JmvI@K4CR^Y4Gtpz@kbQ4~^+)#UZ?i+#yiAMw_6eYX_+@kL-m`eG( zuSo&$IpLt~*Qx%mUX$Q}T$W|>$6o{A@!u3hWM6;fQR?>;s)~Qy-p>d!Qg(2)TH)1n zZ8fhM5PwMum);@8nc4sQo;Wu_7jd?8l^w{ytcRNX@NlH0KKFfEbzjy}^k@_ZXKmG9 z;eJ48XUxPKZLr|0G|op+uy;sKp&3?V@td7{D%z0rSck|L{U(TL##E_ma(j_e9)+;w z9(`2g%7}2QTZJ~N6O<_>(`!+7^~sLx*vw9y3cCLDWQF~H4a}Gf@BN_i%k{2zGrZg4 zm>Uu8N;j`7C%+(9HvW8+T)SU~%#*?n6T$QFA{?v_0nT1@vR;zGrI9b;vSrA(DoJI| z{^&gRVb{iJK|Ta|5?k7N0c0&%Jk;kZ4wCO4lVkUeehyKHWZJO?xg=~MADQ$vz}*r% zkSHdI4P3NffE%ztnbcvZ4}RI(poN$?VUNR4t=-82dc6NEWV-M2eK0)LAD;RskMWE@ z)!cI-X!lnYjgK+{1ojGMu3cGo4Tr@0a3;&c`LrH9bQ+&IX~n(otXM3E7!Z;}+^wJ# zUHs6A)Dipu(U({;8FuO+`EJoU5$qdp+xBc?M!nx4W=97VNU0o)qbe+Y>WAQ=hBc!S39!|bzA2F6F+J~`3 zB0+j9PHJhg<JQBb@&*b^BLZ~Wt*l_Sa}f=BCHBZe@VnGVN+}E{R5whY?Wc?S;Hv4*>PP}3rI#- z>03zw(m5EI50N<{K>wPXsurLYQ=l$FO2H3=ZXI^ral$c1240$eXwgZs> zu$5HzH3O5{wE}LHsgx5;9CD)*%HE}mD1r{(crDc-t5QsIca708IZaoUYFmEb0`r*k zBHfppPxX|P+a^-FY5|o<%9mqACSSC{xi8y% z;Rs4+Ct;~Ogm1VcR30 z2W`XOwD*#!1#)5QWqGBVr=C{@z3nf8vA&rK7zMZXN!2aB=`i#`8wLHux0#Jqwk9p7O&!L&gp z(LMj!gH0i9?fnn4*d2ntAco?x#pHX=6Bhvcc_!|H-BS{OTmV0h0ai2X^W$Zk;6BAv zINkWms(TBR+wg#a0Aa*!%%g(u>!wr>({oZ4sf*qfA`cSzgq_|o$R7lzLs}i$7N7qO zZN>>|PJ{C`+OtQP$_vw{h+Q{fN(sC-m?vx8-^&Qv)fBwQ;*C%Wg+zlwAQaHluJDtr z+t*$g{ajr7$stH=WyFJboTfJ((e%bpJH19Kn#AjYj0BD2)y$L*xg^Sfx96h@pNk+a zD(*s(1xONklGkO)t8aUiru+TfW_ZU3O`qB-wP0~Ny5Ti5X+4nYYEp`F%SFn_b4kpV zWX3;66FdY>?1-&D8XwLc*4EnBp1ZM>lHM{r(Ar!s4-+(w2JqO;*s}x6qwZA$L-Xut zzAZKnzilsCscaUPigM~ujFoK7`0+uf6jHp*?DDgFB<7ttN!LJ@%W$yL^Q=e*`83|t z6{#uDuMc0^+(J{j9Eb5XCq)_}Kx<_Tz=gPYPBj_4E%_Mr z7#E}JIZ+lhBXik1|9NET1yUw4n7Z)S?Mb6=PeqfwJgc-kZRpSRS5?;~3gdXn=fooM z1yGOi9~1J;!7pUln@wRe9GhV|+8lZu&@o%(xIqqWi&4Jd(b*qkqW0HdOHqL7bF0@(UVWT9y42iEBUzP+vT9>i zYCUg0{>eo8J_5peoGAb7;zN5Nj5!@0R<)PwIgCtV+{4fRF$rtyIjUS2AdS7*6oQx{ zptnyd?iPsP9CKX+yqSs#pI1zD7cu!8CfQs8cod~m*m&HvMZ2 zs1aNGvpIy6^q@jSj8>H937prQrlZY1kuV&4y^5*SgM+3;`yMX%cvq`QsUj!%$M&z9 zz-d-3ZiDDaWkOy*3u3zAboP_%aCRmpN98=EJJo#`fu5uR^oO@b#EJ2C-lag+Js00U z0b`fJDVP&5y-~b#k8%F7a(0rrg2Gg?B%;_XaQd*kdYsW1^@92%t~44mY5PeY24n$ND%ZrjVY10<$wG~oE17e{|0J$OnO zOCCATiBMEfPyqU{s-dhK*tNi|axG6xQ7|S8ZAf$k=2Mc0ESt^k6%q}JtV!gh9wcmk zRQzGzqgL~Y>)v~aL0!HLuqV%nVkNx~Iqtes zm^Wu@QQ}ULCr>ghB9m5VAUjwX8TXz;S|**q_-Y&FlRl3g5+Ece6(yMyM}`#M|@rI^h_Vc;y8aNO$&a&xyq~s z_z2W)#)>(Bhz^hP9GwJ_Q4C*h4)7qKR{qBzCx*cdxuM~sN&lzmo6l{~-W!Bs%<;r9 zI!IUpaE*zcIMZvTT;9tQ>xr-SFdmuAU;KU#tP5t7<6cYkWim5UP(MM8;Y)}mpPE5$$^GVRX>LIolNnM(n6w;4HJuIlO z9EAQ@wE^?%ajVDhj}%bWF{wx<%tu$hJ$Z%P_Y}HCm@q+b@t}{@H#vq!=&xvXr<{a>3YjBUpeMyHI%{u2a>2It+&ABWIKDpYgoq+e%1`S5L3O;@mi9 zZ{xDmGxb;ky8DZ**Si^<{JB(wpc%QhVsJ-?$zx=r1^?q1iiFs|gDeHVcBa^5HtdYR z3&Ibl%Q1BeBY34gzVbnn&`QBHX=RoCglat4?5mj3Kbu$9@$VZ~ueRqmfPaw&PKE0P zFjfNs5)TFFaG3$N5ZoOH5&U`&t(N6_tySCKaTo$O*?i$%Z;q=!I~6Eu-aFwm{2w~| z=}6~9sX8jE@yl1$iAf~%LHS88Lls1ZIP?ko4koGw&nV&EP4^dIkQpzpG3ZF=-L6oLusJhF<_%a#ZCDb(c0=(`6=d1 zRVXWIKl{`gbegJr83^%`o67TCWRbVa770+_lhXZ!U-e*8?=_ zYyOnsDK)|yYR6-w{spQb^{o8y9&(-G4Rq@V=^e{V1E=Zc5@lEb>|lmr zbirVcf@H#@b{nMuab7gJrB;s?pcR2kYF!=y2Vib~Rm_n6{G;uI~^7feCukL>4| zM!~yVxU(!00D%78-BfK2OzolUbJ#fOFz!9&!%rOe!3se+7PtP|lsICp4sq`Na0$JE zN8Mm7z{7uC9qx+yy<5Nv8ol=p(@I?o0F;0` z5v&qtc9?=c=ecASiB?hxz}E}AbYuM)Z3>cdCW2OpA52%YT!9D zFKocM!zn3jJc&pZ01yn|QUP}h194Z8D-8sF48&pIi`}>IDiDEUL58fFO=P!ak-*F&3u(;5tPn)c7yzg@ftNTGaFNA);^vq27eqv2O#Nm6IKMO>D1r!Q)%FgqvxVF~ zA-xM>*DEk-ita;Alv$;|&q0*o;|-?_WFYokBvrUIg-}?%p>x0cjVIvL2j8PrkT;;^_PWs=2_C`trNld?+8F7;P6ux~E)y?2n; z<%{2=>%;I@;n*?#o`Pqc{}Vr-6>a8!{s*WPoq z*ppVM;R1i3!B6gr{a?D!_KOWz9tG^)a8x$-H!p=+fXWlxuc}62SWTU0d+Tk(57i;j zB0E-^dL?u?FGx#>r;9b@1IHviZ`R!{Va! zgFZ<2JY9U1C?>#ijAbH{8KMEkH7Q}3uu8thjv-;%`BXNn_7zHxv$~}x@PAl)>%SDL&5Tv_Px>H)Zq?VEfDHo8gr5l6=6l4*W_^!{_`|StCZ}3@3Y_Y6EG)yc@`Fn($$2urHL!0L8{N3O+gY#Y!qA z7WSFXef56qaJh74-#PwFsbA|EA)Xr}9oQO<;{E9!eVHMqlURkg8B#iC4PUO$W4{r*@a{ujVR`c~lua0BR>6<4Nm4XUHDB%l7rVIj& zhq6J|i4+$ZJEJ-;UM_<{WR&H`@5giEgzu!7DkfHv-4u<=7t;d4q&?916SFT zfLlC%$Tqi?&W?E3HrEWx<}RO$&l!_deK6(q+s)3cIWgDjWtwBvG^l1}!<_uWd3=~% zpi9NrIrL8t6z}639-|10?w-zDO<2HWF8BVyQ^UAnCvE9$txqd^O@HJKBC5h|WXGNc zpe_D1zxcvlLC%K#=!Qu+$rQM>tutwNbDW7oPtiXcgZ9fPm&=Vn?_Pi0j`WdsjwxQ2 zR`;!FEZ_@9WeZy0$&_;ZW4y0iXzE}V=wj>srcxPHfFUgLTiVMTl$r`(cS#Y~O03ly z$kl|+x{`jqT>{9EV{934QDJKxgekLCu z)-@)Arb7v5(i%M$O>YL!-_nD)$0>vW2=w+fD=dDZ>z&IJQP>p5{roeI zPyZnR6iY29{tdv+bgzvlOFMD`Ettdnz)x2R^;VMF$&{Ilc8%@T;NXmoW`M}p7t-x4 z%Z`i?Xq8N^Mc$?rVX;)=imNGg3uashXP!JE@x|}jRSm-KW~+t-7@5l4 zrb+}?Z$?5Rr1Cobci0}L#hhKt9|!|2)JM;k&6xzt#yFvTu{ z3$wrlt6*V@9Dl%;spNAGS4>fS~F4V9kkhtP0463J*+~g2I*&CqV?|%#=%d3Zzem z<~{6OqgjJW+r5J1NFJ;D_~7hrQ7UltvOsn7xNZg&m_Jt3*4{$?gA!w@6A2|@j~Z9w`>`3(RW`=p;F##YfQ>;n53lx!xs(=ug1OT`gXfBIFoc11NW4;r5( zurexiu{o2RF-B-6+w+heahrP>aVPS0Qo9(w*z50``SrjScL?tzU;~A zFzH{E5)eZhYm*l>SpWB_gKaf?kyq&{_!s9h>=oq-p{Vridbz9Memr`RqQN?NYlPXu z<>AL+HTC0e2BPf0g~=#!vepP^`EO56JJnM;8rU^n24(sGURNI-7b*bRXI<3E^aY9N zm@u9GNdgR@;`(U83h~x%JC`Ul0Awd@l?I$bg(O{hCSNaU;@42$jwd zGu@8@a#fMwRhc0ajvH}!n?p$e8C3Jl;>#>(V#GpEWpn!pJN!ym31cs4rP^bKt|TO8 z;w~7pq40A)39xdT8ZTMnWs6HRC-P5~2!UQh>SbA_i=cMp?v=*VDzL}*NHiF9 zVy9MZbP}Kr+N`8=YVIcKbKrgUDwq!3btw{obBO@e2Mym-leY>3`B1%uF;~`}i7h_l zn?qQNfRlS!^qdx$cMgm**cw92(gXd9D>Wd(w(Rf2X^iIX*YytE$P{!M`1qEYSwTS< zHM1x%hj6aMYdR+8T2DFD)`g8J=k06yH=*E*R#hw_iAgE#`2QeW%=(X;j{vH>H2zWk zIIxyi9^rpPujoh+5j+qqR^kT`;mTH!2D_}U-}teIF;HaW$86g$-(g~zV@C5wS9Fbj zd}Xa-)BE{Nj*;uo80)((RQ1jp$I=}h1^Wa2;%bS*pO%RA7Z9=j`ftIN1~niws;MfivbmP}MMa2`dxdDF)Tb&uBx!|3-n)L68d7}Hks1>~_u=W*o20t2!7!{}2nT8Ohwn6eDF<-O3_g3@fd8hL4Vvt2Xu&fn zKU)qxo`&QuKLPb)me<}F-!1h6UAmX6j@s&dGn5}ome&+BlAnuV0new-5|)+~RTtKD zNL%rDa_kT{h{Q0WVF`bV3}~_>?clA(S*1;4SJ^Nzai(yodKF`yKtjS4g+31+nF4Kv zAWatb3yjts2^-9)Z`OR>$bk3d{o6jGhQ=d&y!43C2NiwZHOv7{5|;)i@)h1E@2ebH0j zqUD?b^DEnaZo!lccP~}6_2~C%>C%N{K7%!==THcR~ zD%bW*p>Boh`7%d}a(0=_dv5osG6=|d%S6TH-s5X`l%zr(g{hL2+5!xzIv!a_J6diqN-=h+)c{@XvPy)9R8%#=mR#@~f;=UrQGm+AJ- zbp6GrBxMicR6c!)^!L_Ln%r4ZUt8|K?_+8)@zovUr%2_cP|nY>cPx`dg1oC8KP;Av z@^bd@^}l$z=aCN43b9it-hr4(NSvm(P0c+99`+X@kL@uZnEhQf(W3?K9q3eq+Py7F zm~#})m-s#xjnHYhd(Q;jR4KU1eTJQgpZK=xp6O>0_5qC@8lwhn_0T6`UW)JGHYJ&5 z*g1m~$v)f?Xf4y$3Vn+P!|M=a@63dZ4(p;S+km1`~`= zV~xoneu}!QbE)h+WZ zs&R84jz;RhhIJ^xIwvNrz>H4e?%X`>(hdmbIwmJsU*TBds2WPOVRxCGXqGJJORh9) zrZ%iEv0Gli5|G#N*=q&clpU62XtyK1O9Nwe8xe6dbxO#!TbV<^dlp+s!9=#L1ERS+{I6 zo=+u>eP{yXaQeZX^u>F-=$rWSm)96la$MR9l~B$CrfMPC%XY2 zBa`OlLsReO7|q>I)q(CPfheCF6W@0~4ugm}GMGhE_RG9ntwu}<3rdJnco8Ka*+_ig zY+KcltmMz@DPhRCdz23Oc^W7r3T^0Hw*15Wg74GI?{5-9xc4wok1KX)+C$;zUfMbT zyw{5z9M}eOMvpWzgrS#xbALeBB~r9ZdY6;S4QENWOEQ3A@=3n2Rghj~X8F^(_k|0phC)Z(CBIAz9`t<^EFvSbxV^B@9tB~v^qkZk>+@-rx=9jjU{Tn5A zB4ulW7bciYEEc&h$}4{S=D~J@G6PYMvGAb!;de$MC*4q80#^3Kg-c&PS{0>+(TL=+u)Pd-~)%m>?i89$+ z=|_DRP~r-zmHLxZ6CPdDLFj8F$G|WVtp*X{SBum)sFf!+c{=>fl)my-=PTcb#(Xh7 zP6-#g44e}-pPFB9lYDr(BS$-m-(=DDWj|6r7s^ji7IJBhZ_uXLU;$-5@Kt_O_pI_? zP60RR_=2&hKE#cZTo$!`*L@5e?I-n!Zc%c*;*5@F{l%)Mgk$_3l4NX!iCZt$QhDkn0=a?;!|aJX(8oQ@y{CTs z`q6l)DCEcu$MiT|J!BQr&k|r=nxLaD24@q?MmcJ*Y)QOtVYoRXg&U0!*(dW}u&-aX z<7!zw1Zs3_Yn}cJ>_>ciU?<=JE1hKMFF&*X5PvrnFYb+ekhT|)-A?8MvVXzx6GkGc zb4vph!CZhPKZU;ZVu@j z2@PcDA*%@Ov)yhKU7Wa}R-9(g@-UeF{9HVv@?WINnn5>$$b32)O50&yc<8^oD|r7j zB;7B(9xOEScg}pTd@JwBuZ*mhxIx`YM25cL$oSM~x=&=g*_poB&;HpY$@-O#>5<9J ztnk3g75e@_mwa^@P<8jwoH=T@w25`3>8mmYlx=8IvT%<_0x$y;=$E9+9Yo8%IA$_R z$S7x03H3Qpkyg!+%U;$!CV0mfuLhCe$y}6;VgY_>&ms6*m^i&lscJwQrV9bO69?#0 zzC*?YK3ZVdrNl4D=H)iNToD(jG@P(}YYXe26Q|Js=rUWKL58C@VAK5C26#>+GVgrhuV=k^WLp0UtzPx)O>}wbRKs)W@nnetwfa<887uEe*8p9K zZPcFq*6+Q?3&g2tR(m-XX$m={XpcxKRiXv3rW&|AaRE!5XKYtRnZP8`HTEw?l4ae1 zmu&_dHa;>H5u9D*$7S-XEb(>wd|W-ahzXMmm78fI@vRxeFRnEfozH@EY+WE(wiGIj zlet&<2A+(0^{2LCG;*=Y7`jdxs|Jy>iH6Uu{!j8vgyfIO;2juZHflOPKDNp~>bVQ> zwW@@wBhJ)yn*N}ViB_}Pyyw>c>$iVB_02>-^Ri-~72g+53a6mYn0UGqsS5b@7f!En zZEHS_Xoqw^i?^!yO}Wq{u_QpWKsv{Pl`D>_cg@Pe)hypGX-&2-hZPs*?=xvKhw~v} zd?y3cw1cJVGU^XEySGZ zU<&n_7sOpcxR~!)sh)3nQbz7QQ3Lc}%ypoA2OQuJ`)g5{-6Zy39AylGBtI(>dNN$sb1V^!xRSM~ngNxa!W!S=H@8(iGA}uo({4XUUH|f`EwL z{Qdo@qN#SE`a3aggZ0>qt5MojXZEImQUkOtWwHDyt=jQxoe+-ZQn5rkA7>Ey?q`2J zK+<>X@?x=+8U?e207sJ<+%nmhHhNq=AL7k@)$GXm*y4K6;zrC9-+bHSW3y-$sD|or z^kCFbXaW7u{zaJSzLsQ!4lxt>Y~u`K8se0$wn*FgYfc zV<35yJ0r)Y#^tS@H5=8&$2sL!~TQKBxsu9dtUc^QaufmIx`g=f}Knq?^8)Zkdrh~Q( zP>pjnmgV2LYoWp~z9=a3C`es!p(%Xh#^kfqgWZM~efK(-4-|P3eL~!N^6>4x^$2w} zKT}yM%c4zzm%2g*dGXtuFOjx$Pvo*Z`DkxX@jrqVc+&zAD82YcE1WONU3|IoL8mUj zlJ+lpc&qqv8Rnc+Hb&=4&5aM++VZm958tqJ=NQH!Uq}?92_pY9|Kb14uLH9|${DPB zdduB|Al(}#=!Ou2PmP^7w+j=Yvj>%ulTY%Qmu3wbhXjF~5;Ex5!8HW|3lBN(dwzLW zg2L=VPbBw>3zfOy?WNSZJSNtKWO%w5)$`%mj_-HM`QI5%XBhY%Q?!GqvxURYyJI&< zKk9{B;QEFND5b;`rMGO+6q=V$QoIjX4(>*0(8JXs0Fv{td*=;i;W4z9n*Vtup_a8Z z+AKAIrT1ZKZBFn;Wqwag=u-A|v2JtUF!B}uf{babnw9V}M4v3plC=`FkjY~0a<4tR zbNG!T957d|Wg1iZFD|Eu8cg)3;3Mcg0_E4+&)mT$%U?r)1Gg_E{5&sT%T!;z2VVZN z@O$iCx(}yKEV-c)jIA#R@GyU8k|= zoYzG{fbvEY0!~TgpDrhy#F_$YR<l~f4*H!sRNYZfAKAB;6n(`)0ptUQRnlr2@FF%>{XsU0WeqX=~sQzNG94|bdMV3 zP+s~IAK#DiY>Tq&$0PsL*o9TbWTpRsj1y|-sud(-+V)vS1`--rD6xe7$^ zxTX%FR6iO;h5f#B{%v>Bq;dVaVC&`aQuf4?^Vz)Dg5*iQGIx-ODa38sq~t;KE+3IR zli!H3;XoRGLn$PvYDl3c{7##7;k&F#>MXTEfq?;Gtq29*s~8 z`};5sP*yL)83v3Y4T|L6{(&tB+vY69t5b-q)ISB{oK|ME%>q9dp2E?5Z{^G06Wmoe zcBeML&+Dz_C0NA@Y2}L6Eao|w$+0?4gDSJYDJ3^j>1bs^sDs(9dC;38t(M0xzZ7+r zw(2hc#u=NMY7Vi}fZW$NWIk)(61$3%-mCfwSYc#8fN3%w5&f-WK-;KDft2%P7kqo{ zcKhOzO9ZX=fFu=(`2Dh}zSBG?lMj1PFy}$?u#)kapF$sD_&CUN>=innDcK?miq0K|cf6qc?x}B3ujl%tWp~sbA z(eVAhvHtzrQo;n>PR&tfsEi56bD>yj3F+XBcdKgfiDkkDMnP>_$#=Q<0dct4L(j5q z=yCu|)KV=ACSMM+lOg9Y`R&W=8Z+x|j5lq6d+`aZ1_p|Y4*H06kq}#tY!bR8Pur7J zK~seP?}1mQ6uNd2Vk^#@g&*?s8HveB7PQazZ)X-6v1$BN3eYB{q2Re2f~m`XVUN5Q z{rEEO-yac)p=b0I4sJ$zIf(#8wE&dd3iG!i)05F38Pv|s7{uqn(u93UgRUAfVh>GC z)tfH}iCzo?*qtmvoqiII6&H@^Yf@s;o@Xqkyet{3+iJIl6nTy!C?+^OQ8l{Y;t$z^ zIk;)iE&+iER7o;7qIc$T9QcM#wtASqt$A_E!@d|1aZDxn1^%hBt9YTHfH*&^ps4|y zyppEk!rkxf#Ta%PLdL$Do|a>ipfv@JSFoFefo5N}VCn6=7~Np^AZ+-R z)vR#2t@0u|gJMJN+6}t}1Jl|Nfc-u?^%EFE1(i(@`Ttb(3+Q3d~@ugpqCenX4sMUr>zTLxZaJ!Z@ZE1Yc?%P_lAD6 zxd@L?BQ<))k?U|*{uz$lI{4tb;rLb6rjd#J<_qhgKAf3_V74IC*CqQlu2q%A02x?4 zsO6&z{qh@Q^&FX3O+QB`VnVYz-4P4#zcEzX6Rhu?vq3In^##tbi;(*4CE};vx2+Qe z1wb6{KQB~ZpXk^!8}4=8K;$DoR0YBv&p$`E#B=#aEkMmnLWM+tYL=H zr3*#-P+tXZ022v?+*4wQpe@VSQ%^oM*4>s~vbMqtbgjb-%fG+ENlBptP{l|&2S$&%2tFq-b!o*)v>BcDK(mX62mMC>-bcMn0cs$P^#iFYeAo?THj%ZR8x|AOZp!>ZI zv+|L%-5>@9>9s+ppK+yC?*GkcVbNjm|>B&03i@xJk`Kv?ki|=}( z5K4GBc#DGYCJN6GSx)TY`o&1r%rUaN!iYQcz)>fu-ts5e?gc9ATbkIHB?(UM7%yJ< zC^v}ue3p3CNM|IH6u^x7g9}0{ZPi|LbtgUr@KaK_S#=|oBl2C)?ZoVOTntt~BY;4zJQF)ma?Y)&|cB{XB2>ZN#E_?3$GAZ zX|MbF^i@%Et`bPb#4n%CVCx<}pF%lPXxVIK4#&Jm?7 zqsUTn4+TlPp{4Kw+y54|me6q7(pLx)MiL=jPVlgoC66Dp#DQX5eKMU1z5PR4-ez^u zYNg}GSI=g(Sn?g`=J-sO19FpldP5onI-{25>HjjhQB8UqdzEoK=HImZX9dPcR=gn4 zRo}#mw7!e|6kv5q&MD2If+kP9GfI;32OvXNBv+WElu8Ab@a}t@zd@r7LXs`0LZQ#Y z+Es{EgT0pwiOCN-K@lyRBP@rf4bWXs7v z_9;HIsDS*Sv{x>scn)t)UyK2ZKvlYMos4>wrN^J-6aJT{k|4i|FsOxEQYe$63Q-xB-6kEp5Rt#KhVIugH^CK=!2w+75yNGW6i5#|ICsL*uh7)7~{Z@O#s)C zl}QGHZWAq4{N(%>GB$sb(!oWU#5ByKz1ZRMr!GIq4G$-XEo=$?NZg+TcFu4*09I(j zF;8nrp|6WUU-%#~tDiIHow0*DhDq_H@D#xJhS%TNn_e5MaBuH-wg`rq(5DL$yO!Li6!7ncIU7a8bu!CTld zXK{yukeL#7X?tThQPGdsM6JRG}N1zOKYHKm&IA?h6-x zF&s&@C)u<&2@zHhn8SSoM~!rC{E-FS7ydNQ{(xxzV5MKA{wDx=XB4Dm^~FU7Vzq#A zSRA_kX2i?6nABQgV_e-=8Kqpdn{XVV8yXc)+8zudc3cr61Qde?`QumSGo|AEQ9n3U zjkLFtIBNTfDNw4&`zuL>Vw+{ro+Mf37Y+kJGf{uqd;82nt`C@EXwtk*8uqz8Mt*95 zUGw*C9X_mZ2VPri8(BS0Mu}umP_av_YwkQ2CK_WBwXni<1zwP~GqQ##PxxgmO%edgYgl_mx?ZVd7uXE`sL0SZ20$kLEk^M)q+?eIBU zk5B5G`lfY!w*^J0zV1nZWEFdlc=o1ZTULSdMg^Y(XaSO$!op((iY2<0n?N4P>(HAS z5E;w*L_Jd^EEfn8iE(H0d?;jY7qC}B9Twf=koDu5F84>#uz)@OL}`(*16`kr+fDs~ zg(43i6$ zJ3)SfXSlttO2=s{I5vY5@<$;;tX{`T{$13q(<4 z>I%UZ@5eDeAq=B!&$Atu+GC9-pDb%@mibt*k=1Bfqpc0AJD|uu;*zKvICSyE2}X?a z_`Q8*&LB+wGj5D~O4XV{oiJAWn`>4M z)&~}yK9+-?_Y_-=A!s8*z4c%I#c+RMkYG zwlM_}7*URexgnE;+CAY49@CnrGhMP;(E{se-g72?S2zBFpj?I&)H{J}sIFa1NgFuS!>w{Hx~`acu&ra<<*FxI8d2y69pWi7Ppn)2G}`J_jM#I z^KCQzZt>r6IgDhE3CD@`V`m?#xrHI>A2k`lbfdF)&b5-f%&>dE z#;3%ZjJ_J$*s%$z_uws(Z+X(y*UK#Un=0Bc?w8*+f%c$b{$$8uQV>xrFc{->$Js9O zQ%I!Nh)~G%U!a;lj}!z^M!$@boQ|MB^5^7kukp=w~Bjj%&Jn43uAJlPRF#g8Y9*FFE7`-MM2@)MGehchch+l473*AKpt zU%JYI+0IPf6uciBYFck2^(0A!8yzE1GAyoruy>`FFk<@3z3o&pgCDYzZUaZ>3_$X| z(Mou@Um2w!wCS>v&LC%M=RZrQLU`ZnM@_iSV%0Cxp=&O$>E3~P8)QmLZ?ee;eS6<# z(ms5{N4UeTFSiv25$b7fT1J``t3;)Ed?l+y5~JRmh38HNDafM=Z*>N(QpQYyr38kK z5MK!sUiNJBGFnGsnU;#S?|4!#4)giZel;rxtyc|zUi~wpH|B?l#?qf^%m}_YCK#08 zxhiyNx-Cq$R^mkUUqD0lmjTjRdvwdqPaAeawKKc9q|!3?zuBL~Pz zD5?f&Oun(3=3LGt`w~@Y{HuR?;9V>(jk>y)bxC++CT%d&s8zlQ#Eht(LA56y3xoBh zJt~f*KL!BG4G2@BK?qkPxF+pgMK8$G1KU^VL1;(Wk+87F2dOq`9?hW#ai(J#&0F`| zch4q_FMv)_z7koDHaRXxdtf)8upT-WB&2es_LjZC21oe}jcQtXV-P$|0dIn@>KClG zDvVqzwYoX|!#l>`PX-8P9nUQaxh|QQ@#rOn7V>_t5$K;u4;OW}lOwWG^B?8=xiCzllBbo(llRICvC4{FcD_Wicc zyKdiiIW1ah|MN-YzhCd~HwIVPdBZ?v!Ov@p(}=OynUEgx`d*PAc$aKF&jDYxdVyMJ zX!*ya-+@TdMve=i0?$aR&};Z)1VXS~%`F#!wDl4houx^jFG8k}t#AQYKloy@ePWt> zHc237G%9%AcI$w4H`a|_2XxIP0f!>ny>df(B)7ylaMW@H-|4@>~TtHuQyc z!DEZyelAQ&`=U=$m;_xEWyKr`oLu?XWqSlVQKT;wYTBaaHBXKhFkScXz6sUH%jt;f z%3%zxDH1(rM44UEbF?6z?R?0uPtH0juBL!z_1rpRzRXYS`S~OEnCV{v%l)%66+~YE ztIV-(cp`%ml*(*+lIp~%Bqz%hrT$JT6E*e{?vGcy7DBU%QnF@};|fk|3~Wk=Q{ryw-qb+-Oa2 zq%%g2+YUc5pNABQv7y3@jd6R}@Kv^duak6+C`Gs~U*xHyd?47qE|FQXq4};;#J@Nx z_skK5kn89)?^DDN{Bxe|TbTe~5a4-l#^TqNMM24BSatdB0|A|eim&w6{k++1RdLY+L1+{SjDh z|6-Mm3=d4lMoL*m9V5Qk@&=Ua3UtF~gGGGs>lEHnhjl7TahrgG$Zvzttsa&RpLX#6 zjjkC84!yk;tS=Gs9_eTz4{Z1M4`iiGO_GE(alPiG4qS3I_R5gDL?jLl;cNY`(98YL ze!^7m*jEUOuoNn~wWTC(-hF|Dbwcf3v{@uNGKG%;8q3h07+2_SDy_t6SVo`T7{E%T zwv(zr6()80$lf2e(3-*8W0C`HRs^A@WLR+dtoQd<8oK=Wh$|hE><;v z@{CB;kvSm3k*Gf6WrKhUy>Iv)fIW3@IsA$)$cg`ez8ap>g!wFS2TGLICekp zc*OpuYcuZ{5>Wc!D&Er*SFZDMpxz0ceYc4yXVVL}h~c4cwq4hORwoHWjZeH=!p+rV zY9IEyo}TN{j{Hpt&K=wq|Cp<1XQ({sbKiN`TSy7HXGq>QV8rX}*yP9E3f!8jiL2O?F-#uPm=noBX)H=hpDt z>xCv2dPv^h za!LFi(Dk*&ZJV6E_*gmf&z!uxS9{ChY zzcBzRIh1%^;u#vLYX5hNxxl=cjU2qa^8ju&=YJOPVg!bL@~T~-|KgEbpe-nOU2jhI zphLz$=ipN~FlgTR!z;J-b>%B{^Is|6f4j-QP8wc+pe%=?4-Ygz@l=gnGr>p-TI4ey z{qAmvZr$UNUnxX1&$E79`$Szp8%=C<`Diyx#F1`B+w=0H&XwrLSJ{-DTIjNNm=5gj zI4tP^ZWS$75r%x|+d_>u{)l^JXv8jzQ;O+&w$^LgUwOa)i7gejs6eVRcF2A%&U-v( z;$xJ)PE$r`2YW8fXm-U(iHav-TnYdmlhoX>-Bj5~yVlL3)o!?S-KroTo7%#{m5^IZ za0N{#V21-4S4%@Ue7QwoXH{XPMen1Io5$B!Ds>_=pgw0&zRFYS1~g7X+@#Qj6=py8)Zb_T8FE3Ntfs@*kMK2XH9+02d*;$6hIM*Cqtn2=X&or%@B_7CEWV3 zVo6^4cvI@2(vhw?UQPp-H`v(4ig;DJJB4Uv>r#1?7o(BndfDJxCnl(9XvJN8owDoNLo?{zXhvMKPH z(7}h4UsTtT3vxK(

?kZeFY{8aT=;1ks2a>CEDhVx$lYTm0rVJbO1(>GHAyd^`@s zz>5=7G)IeQ*Yv8#>f{MwVmyj*{A&uFpC;t&NwDSL&~*IKdnMR&49#d7fFF)C$o}ap z>F=6(4BplTK#M{2)9c!s#vF5*v`gICum)&}`xCBR?j3IC6lQzqmzX7s{k=E?-_VAX zB}tK)m16sz?8nE~{cL(tzw-Y)j*EtA7K(dhy9pj$0@;DN4i5cm-dQ z%wvN1s8rtgI`n^@VxbGWI3I19lVo!W8R$Y}Wdj1o(+UT@*RZpTmzWq?sekbpzQP`-P8I8tAWQN4Mj+O@8BWK0NcQj2Sw&RL< zFYP;A@m%&P6Ze+bPvJ_krN;(_HrPc%A{}cjeWY9@iLCD2WQiy5Joiia{e^m#W=e{a!}xx{~~Dj0ABzY)`6h3!e+ZmX(Eijr>=qcH6Is#jqc7%e&V(&opL&}So3&fZD(D=F*4&V{|BU6KAbl>hN4wOmRp_g&B=`>PWE56t)SHsWv;!y5VOCdH>fJ5itF+HwSgY&N^2rgogNmUfTLyD>G+A}_Jk<} zgQBCzjWK6 zYi8z@1dEVF)t&M)%$tSq*jHJA;zD}va-gyIbyY@d*v)3`T1HDIh<<)uJN16xuB_h; z=vI8}#vfK{HsLKq^7YN*Cj%Hk4NdOhME2vWlCbdeU7qO@`=G3lcq@ApliKMYAfsV4 zH?Pp-u60je=^DHLykS!xb~yj7_IRc1MNlrKPohu;5;D?!k;=!^o)k;WKmpSVw@h_Y zh#*iVnNyw4oXEc6yUkkzJPBWYAK)b{+p^24!3CqzmLO7HitLsn2<;r-lx4;h8SNXg zw(olIWezZKkTo7leQaUWXr?wxO3N2p6Y`<08+7(w((#he+j?t0bEMa^8x%{@Cd8K7 zAnQ0}xD>vhgH@`J1K2D_+?HtSh5ehDCstzF1)bOE^iQa+(&f8Y@mXvPMci&;t~nkD zO)mYB1y3E3Kk;aB+mVy#Yt_9(<6T!A_Su{6vVVV9yY)Y*arSt^Jl_vo)|Z4m?y9%| zI$P*Z4Sk1(pQLIK7eLl7&n#l{UejKV&C;?l6y!`iz05Svns3Om*pi=^2sms_eX|YO z4a&B_e#XuWp1NzTJH^V2mKxbCx>(t=|6fqigIT)g4Zpne(O)ZGcr(-%5XcEeLUTz9 zuUKgB)h&z^?9#~Ha5drV;qU^zbfJ8?|5Y)8uD%h<;u|FxN(PtH8Xr)9 z&LDE0+M}$5mTAz$xpbCe2-tr-2+hfo&HSk z=JxAdt>aMkrKLs$V45~wcDg(Rw4lF6lsbEhgu89OWBUms{?IygtHosM9uIe|#_~(x z8Z9(#GiTU!Wnv%U=~?}}78&QI&Uu-m_|P*GJoE@wOti=$cVQ}QMW*(4<&<7dvA5s) zCszqB&#SkZ{60eqHjV?vCL|wJch~eF^uQ#o-eF&ExMFA~=jpU(?p?w}Xx4S-Cx8X- zmh;4P@z*H}UJ;=vUEiqPi;d9JhTO6DhC<2jL&$NltOfZT$CEZL&$<1mWu>+VGQxQx zKQ>p`9A|+N7gw3&XiyZX*j4ASm$Id>+9-;UnhEzSbrb`7I8?NZbYK*`Z^bmdLga5a zHxSoHPLV>({KW&c>eL>aWq>OSf0OpV8l2%v#n;RlnLvUBxQ*KeUJyuqt;_$mfHYaz zIMWj$KFfSyRq%%NoA)&B_g@H{u?3|GPW_~n_#~U8ZGj!GPBceHQO$Z+(}%>*&h>KM z)l18XB)(DBS=;pGKb{d4ceZl?ZETB;Zo_e6B_j6SUj4xZr{#p}n|tJ7+5cUlI=aF= zE>Q(mkJqi3XM-#op(1zq`d{3i=Ge7GjJ7EBMP_7dGn@-$8aaCo(g`fz?eEnLar6wi z6J}ZPqaT`oll(i?HEJaAVkG)(e_{3V>^*9<%La#`!Gv_Oqk7sYG2WizTZR;TBShJA zCDg5qenQ&B0`mUQLLdQ!eE`w9=RIZK@;!o1=ja<24KGS(TOcA?6rxKXr<5uwu=DC7 zjb~Lkd^YNAVymHhE9I^B26Hz(uu0OL3)y=wS&BAj7ja?SdTlnC2ZN|udjbE3rVYY) zGE8?eW*NdXM_L1`IR@2ppbyK9l==8}&GJ@Q5dOwYZ-$TITW3AaaP=gzySZ7 z6vOw#da_`SH42L)|Jgq%4|I8LsPqAUzt0kZN-6~1(TsxW{RDQ`rs9LD5W zOgu$&@^1&HTallg>=6u+OH@EFJ)Su2`aw-P-ms)s2=Zy?*0=N>t*Oh39QVKJunB5n zTp{E=wKB-aK{O8Rih^+Kq}Dgaw`ZSS=NLy3@?t@9r`oq1bDFSB z9flji>^@gyyWM#m_{`PjAbuag`tV==*KBARbyf|l1XtVgtSAqn_e04#o87rxeBP!cn<2aPmZ0N)}rC8Ct$-8!>sRqNVR! zS8ht)-1mA9xZ+2`Qe$NPsq)^5s7*?r*A|`YKd<_T?1tPkRE5)|K*tWN(v2?k$MC&S z)zgG9e$>Rldi~ba-2xKTp}Fa218Dr#ZfFdfKqZ%N+7s-ET5i#_7~Xj#Q9w%Zd!2P2 z6rph+(>vO}kT=S7f(SB$>Y8%*6(DEbSNs(COloVS2WO|dDX~6wQ*-l)+UgUHmJ#>k zy$qdoBqDc`Qs_rix#pqas=%-$b>C%P+WtuNln5`*qAWH}CH?#!{bzmCw)Q3?Avk4C86&^OVa zK7P?GDv@w*V*#m6aoXhZW>dUUrG{_XEOAxGAs=9@#|N2<|Btt~ z3~MXu+6Du(xE6PJin|so6n80wA_-QcKnX4_rBIvz1&S6e4#5dlJZN!(Yk?Aq2P-h? z^StwY^JD(Zb|MgN=X(jaEnH_t zdavUz!AgR}@Tg~PjcmM@#7)9^rL>SirVzFObC&&-Lp+`Q2%o^z4OAfe;U}yp*tp)5 zAn&}d?^>C!bDDLAEM8j;@}A$|A*oHGvk$jb?3Xd`w8W7$h3lQ6n1d05eqy2p^P%#p zh*wVTB>7-p>{2*=cg6m)^Jpb>*rv0SD->Nww!=GxKr+t(Gejt8Y*70Z?rlfnf0w~L zb8v$K=4>h>wmSosdabUB4pA{#-4f=hhR#gsWKfEebfm?1zrPB{4u{bhva9*2)~S|c zpqFZCG^yVkC!04NoHe#%&8BlKo$|>C+Yj8k3ix4Hb@5*%DR|1no+bA~GIDQoS+{|9Psm1YMR@BZa@Me2_J-HLQi4lk|~^h)`m`C>m4lLvr{(dKsiXQ)C4Gk^Hn- zr<^(1dVCTgCu(>#@g zdWSEJtPysaOC5!e=g~#4F{sf9n}#>&SnsAg01tBuukVq>tAmBmOJhe7HnC+*_RaI} z>Ssj_@3|9<(SCGTFr~Rwh?a5ZMim39v`IkGE3kXZ(CL+->VB{a^4+jtbE0;0vl1oGWhJQ zF^-ut>{}@%H?wQ2@ov5~>C&h0BAN>LsJVRG#FVvw&ckwhy8h*uZHxWaJ1HF}vO#4H zlIlE@-on>brswaC*YGL{6q*k#DoUw>dl+Yp_Q+qT%g;Xg$kgACIs4Y2ZfIE|{60dp z28sNh1pa{PTV{QZAd$Bfrnx^px{Y{dZvPVBN;skZI1hwxzA+xXh5fhwd_nK&vI2S} z*s7c^^OY-pzJ*A^&U&SxKMaLP947SW9`HaU+jYXB`^y$|1guvRMu}uC>;l}x4;*HH z-r?V_>)Zc(M`zBWF;7AZx(qOQTDK;nAKX4Z?0>hFc#yFHz`%~!Q2K^Uf_;E|;rZ)l zsk!2E@L-om%xWKkdoTWP%?QJLa~bBC7D7#;DDZLR_yL;`yEjY~fe{#M9AeG*u%GqF z;qI-Ic)VY?(u;iecNZR)$hyxqXxX~zt#H%;Jpj_)(0knof_x6Pz>W^ija@Q1Tg1l5 z2yr-QHxJta9L_hQ*9#aSHUJ@9XlxM}~iw%`K&b@e~3 zt%?}7%6a^doF|y0Zs>!Z-5@!1m^wLgNB}|GgeKS(S6B)KsLcpbgBq)ax6Vn(b=#xR zT}>bP=Myc_gcmOtszZ&{!!^b?q_Ayi^SrnqIii^I_11TaF9H6o;N`nTHUuw6x3PQI zO&GwY`gM>tIw>2?%mp9M`j?vhfBzZY54pR&yB@h@zIYV=8vJLWIGzU$XujKnFuOj~p%eR(LHIKN>Cg=n%3zg!?(}*jWNY`K>X3Zs z-!aMCoG@B~$&*Axy2bZ(z5Di{h_U(EbwyRFeI|3#w0^hvYncLMG$QJfM>Jd~2Sz z^>HNx#z@yl#^mBfXNZ#B_Bbt#*-3gYl_2fj!$;Ffgt=0ZQ9^Xzl0jW;G{^YpC&--))+yb$TcF<( zht<l8o{NN)iVli?HbFmNyO2rUP!5_L&*NV-L(&N66Jpx5eN6UU3R;q+~1DYtW;l#L7P~9 zME^Ng&~kqUjT6Vg*_f_{9n^2g4A0_7L1oTkt z%Ec3mG)$IOzRC2-OyN7#WhXDbO1VSpO(VV1k?4J;_1cNK>0ZT@+kku{Cn+a$;8?|& z^3Ss}^kuV2=o6x&IerdA&2Zhm8gdM?9UaeDm( z7zXQp90hiH|2NXaTa9D<>%Dngv?g1}Yh$QVscgB}Pfs=-aPx#f<()91_o{@z?V3C) zn&VdLQ5%wVJB1rJ4sNAWJ@8TLjXd;YH;K1|bO}L)?gUp5{qqdu$hO}j{Ovzmy?omu zOoTnfMC0sf3}l~^dF9X(T5~53a%cGmKBgW~c^C-~RY|Z__;<}H|_gnJ6*p&rSN43aYNLt%t@fRqAA zCUwE+c_W))2-R<#;u7isDs_1NI-ush#l)NhdY=6tiUUEEYy-}1tCrm9f(-&7NC(A* zfZ&CN&fcHYir@buVx8mx+QG1mRr4ZBD`qT6QW&jmdfKk6pu1FD-Wgw!?B1MVgOQV5 zho<0Ohc$KEk=54yx-^oF7tknIIlI9c-5>xvlk=|IC;s5Rtr z*PBgShCwf-<#XC`PVHxskW2DV&-6u)~lo zx2gnAEHft_Z6KQQH>k+*VWDR=QA!=kCO~ zvH5E0twK69=Y*DfeDkb0ZZQyEwhfytZh|oRD2>kUWB5t18B@|=x4w5wE9?p^ftYl9 zcr?J1P?!b^;ZmS!E~1spR1xNidvTjQOMH&rJtCyD9%dn2`5ejJ`p`{ z(gY)u$G)8%hydxIMQvbc`OazYFNWus6)$i(0R9kN2Y=Mk38aPJKefGG^tB54#LYiK zhjB|1)##GsLFZ|jk%(fRK@+j)&gq1kp;8vcK8%QAQWOki!z_O*~k_kNgIU2nJ^qFa) zB$gdD*^k+6Gm+gVE`__c&!5wC%i-Ik16%x`mK=7|q)@v+<@_9J2 z=M&G(+MPal0xrC9+c%%~)BWH5iG?1%vGqyHT#tD$Qm~L>JtJMBd-fwFHtaJG07JEa zEgv0aO+xc_FM4m2#Gauev2u{o<@K*s)d>JP4jcZGqx7HFRCFLVOl(k$j>`y@i@`Jki^wVww z8C{7iiV<~DJ}1X3TlHdSE79yQf@+6^NAsXbq<^PDtbb#v72zLrI2>Y;k(HsB^)eFD z8u0$7!R9E(IfLl`(qMfw#sxE7Ct+b@lTd~WUSO~p#RHoSihxQ_1|Q_Z z6DU68qE~Qql;EHZ9+?0yfm4wh8w-=+Rr*IU|LhAc=q(TT&|3NYJPoN~tA1%%ANxPe z!7yZkd*LE{by561yFX$kwa;$Z?e{0I%9^QFps65u3Gcpv;_%?@qc zYX23HujcX>LzDZV>|e=~K?-u=CqTL2I`K1UX~eFk;J5Z!wTHF7cN`O;01>K2W^L#e zd5swl7`e44nE5|anD})x7l5Rt7x2Z%`~{2P0>Opb9q3x4H1K!q!(V|YPy4_RZU|je zU0vOq&lCZd7LYr}Emd6J>za=aKi<9*fBrv$xK>~4H89ZQ&~v^1aTW*sJL-W!!jO$j zejLgMD~BNYN7>P}Ca;*>Q<@Xm5kma|%sUqSmr~$wGmMP!WdB?M#JVWvphE`N7#}A{ zdG%vy9{o18zhj0+cBRzd98L#dZci z=^U31sUq4?7D4PbWoUom{zH+lq|xd9IM)$ctOAW%Kogc5LeqV{oOT-+3UhK|OI@F+ z72Ux9EHohkH9!Z;*gw-ZyM;?J8j>W#%fzQY7ZX9bHBpTW)N`A_KTm?4#M)zkF$y4v zLUOc^XmYKtPK~Hk3j1`;2jJ_S^HKRs%f4LG61raa{ag`PDpSNbqYJPuCL<^Rg*#m} z!XDb}o@Gy>9~_w?;y<1uwGp7&DHwKb&@)+esICUL8KAtl39I$lF(LX8Z6b%r=?&%o z`36e#HuH0Q(hJ)U44AT=-k~Bx`$AlZ%m9G6Aa!|L76ZndwAEMSMm^GtUs_m+fg{L~ zB04@w$>ysQ@dofgMGsK_gQ6NDgrVcZ>ByBDO3(BNzA7@Y?DJRVMDLVVzAEnWN4;ie zO*S%N=UEg&y{K~NJ}>1flA03v03R<~#3C#6hAu_j^G(Q{5(|%;s&OH99vX?r|1hu1 zz~IhF$c|(2ZCcN8r<^Qdb@_MCpqE*ty50)WM|%D@L!3y<^_S9!8vU#@ezXxDH)O7Q z7G>hvhlJD}cXI@-iTg0}WL{lJXRT-M%EnQo^KrvE{2I~I?#Z|>`zEivH)hJ+rpvXb z>(M(xG&l*)6r5IyWij{OFKGFfXe}Ji_Vd=W@rOtrDced>Ply6m;h>OxN>3F4!i!=~ zLPi`{y;amiX&k!?$0~S@Q$TX8t*sN+^dTb)DWZi8(+cxsxFl}g9G)>9?>5Djv5()s zvvU(MM4cjTA=WS?8~4J*Yo*RGIrH(V0-v?chpP)Qd+1#eCoHA|a^ne(*1UkM5RNU> z32@WofAISCQw0pLUVaWiVhU@I(~B?trVZs|vTP-Ht4Zvx9~jfz0WyCO`Vq;3p!bUn zB2tf!e3n?pob*Q?R#vAYpqTuKvoze%ah&317#*ihPC5sy zxE{%dPM~W}qU}MG*`V{=VM|5}*54C6(@hKsftnYBkvQLK#VF zx;bFsN!Y=-`$U2b;+JbmRbC~?MF%biuJH>hoDskUWf3k7Gp$h8Jdx_kzVPDlTMEtrnB1%{=k#&32of|)_yKT%?n*1WhK{S*Tk+>f78mj-;%=}@p-l#ASrzEslIQ&i& zTYArD1Nzv)cKwTB{2DLj0FnL*?mZ|uhQ_iGY5AIMCgJj>d#228j zBy=-{zt%;)X(@Z~hvxNqbpe^TzO-zWYoV+i1_Ve4U)k!P^#oDgiT<4T-uV5p)VlB8 zi4L}7Ox{4^_Z!|ZRyj0bg+SEfpeBfG=16+BqfqIxa*!Itx=`?-QO+PTS~dx}-;i9b z^aWLo)nX8oVqk&Qm)ss5Ct~TSk0V(DoUpq}f|n*>lB+j~_xMFdj_oo-uXe-v6${1NBcE8DrV8I8Pub)Q^44J*iq|bS zwn)$%W0LS=_74f)OP&et%(|N28onrac;2+jbo&|7zxL)0{VlmLsLM})W#U5zMC zONMjX+Z~3V^H+JfE)VSQigd}Q#q9;a1)60aDQ`8b7q7O1O%I*s*^`iTzSfC3XFO`> zQ7Ijg{M9=_FGFoyhoKIqL?Q6hq6P_&mP%(bjewFHRYHuC4^)uo^JC-lFY0@duRlsy z%AbkRu)EXN(fx7Yj!A8fSS+Io65(|3@anublaNcvVL+!rJKtUdrKZQHOD?5Xme{w% zYjtFIWNVGf!R%5pd$Lm^{lbB_yXtCTCIvJ`NE9`m0T`lKc90ECL6hUgG`&WQRJWbw zwZxx_j%#TYeIf3`d-K`<9BVJdwj`oMkK$=sx4mERmuLNpb2MCXE_5k5Jd2?ReKh+Q zbtg~w>$PP!IKuzBmVJ#Ve8I}*3c+8YV*jCtKqzC)WLP^v$^RYRgXSCsU+2+GpGg^4 zi_K|r6Lyj=b*QwE3&Lr9j z(JozZuQs^zDVjaNs(2mPT>ts!UUPl%#}uStE_992u;1AeO~+0_bjN9Nvy`G2m%&<+ zj$Cy>JGta8KRZi^(Bc68Zq(nGJ^hip>c=IJe{OCbsaZ}$&9!L`(ArfPyj zW_g!N8%6(0*LK8;|KHi>gTa$4@+w5^?uq~3);aax1#M_r{_{jTC^?yLPks_m=tWC2 zH_|P&6z$)vn4*lX?`rD;e}B9rsIn|fI8yL0pR3ut?0V3y**d||S1DQjeH*rPfJ2g< zh-Pg-Yl+O)bf`0fTqy$y7ENAHwMLs-;=FOt%w0FIi#aTxSICO%gkQT`J~jFC{$5AIA2>=RBwQ*krv55MEOP9MlPLD4_r4(bhmjAr z2$MyWF3~u=T3i>ZXGb{cpx7=EY%&P$HyrcQkd-JP&J`IN^uMlTps$Id7C_Tnem91e zo~bfDy;(H|l^i`Q21?}|KjwrvELDGoLC`<9KMnSh{rX~R70(nxHCi-vkFYeJ!QNizZ*e~iGx=0H*SP{zfs5>O{=qN z@Nf!FWZs+hx#Q}OZ5D31d^#?#-fIKV9r|c}_)c_QF#37ldX=K6#ABE$S1}I|c>**x&P8<37KWKJeTQ=iNtPkPbWmpM<7QezI%VKH!5b!)&TLX`8K?w$N8)G*$>NPmg3wL2lT*(?WR> z`3{Se&H84p%chG|D-wBYYV@8kvbH6(mlypyG@6Q%{qW_^+F1NL5w6&jZr#uhe{3x& z#v#`|rGlX2m%r{g+HOyybhvoF2!^gGDzq=dGg^3`1=Vx0vN@>gE zC0(DjZp6h2;ZN^Crt=s7O!c!4`bLbLF91EgeY>}P(774{Ptkb}-71y+N}+tzKT8*= z>zg2Rrl`-pirP?;$o-#6R>7Zue(uG+oLZ=#Nnhp<>!?Tu=V#WGQ~h{{+4sgAQabt- zp0>G}p|?$TBGIK!ETa8hz-^pP6sZZfMm|y0Kz;HqKBXWaIn!9*t4Zes;2s3U1J{~R zm}mKzhpGY8d|&pp^eP_JT8Cf#-ifi|_;1Rr#!u0@sAHyNBq03X8Qa~Apw!p`W-G!r z+a}O@@fv6s9=LWQ19=W`)fT@N;traiP?T!}MGj2A3lW^8$Z>`qsBefQBhfSB-{_Qp zNvX)l8iD69Tbc*~Gep&KguSCS_z1(~Xk%Ivdbx#y9w-VLLX9J&f~r;N9oR$|YtWl9^q;5RRR&!Q~8;S1d@|g0Ou@~&qbOnc)@MH z{VA<(a+wa)B_U3XtC_NV=w)VyS7*5jma=}-R#z;NB1&1=WI&($pJPz+Accv2`WkYk zKfgfmJZMWR33*_gjr9Db3$`Jr=uAbvGii9`v_NSGttbqc|E!JbluCf9%Z!@|X{)Z3 z4;L10t$gCSd^PBSJH0t+ii%-C?tOXqrHZ&yT{+AOg*La#Sff>qX5InZx1+X!BjMd3&&@{!Kh* z@?@Ehz@Atpkt=90)k(*&qMS+yZ|cmi+e)SU-#q)LsoknzEepr=Ma0mjuYt-hM5gXfP>61Zivq+WB ze-WKOw|QeuSpXM(xsO-g4jEwy!OQ4O2*+-vlQ72m=)}!bbJRJO~wQ z$?}va<@3BZ*#6l`AADVzp@`Pno{EZi(POK zM|I{)jk(DIVFg_Yp>G~Ir8@}1-kRcxQ$z2r&vfeYr2G6AAp|pX$8k_f$lB!W zS{BmD?{GpC)MC<1l^jQ8Q|-z+>-YiMs_5sx(tAdQ~qPkx?a*@^!^|_k(>YP=9BuRCIzn zp!WxQvC~ZR#Ut|4lp9OEUEC>JT`G5>mE`2OUDE`g9>DePAAk=UtcY|&)XJhiG-`|~ z9(A+6|EtbkADwOU$}zEAUdczv?Bx(`y}J=UKTrQ%0MRcc4ox4usETbGwuw}J2=0eC#WFhW6y}xND$lFf?U=Y$7-I0ye}IQ zNw~VkjC5L}?6@CjQp7E3#MR=I)i68z=?Ddj+6*qMKW_Hq(0^N(+M7!J>1!V8L2!rZ z{_UJx{Bk*Sbvakuriea$@$kcl$%^6_pS{E#GLu?%#q|x!{_ZjExAdY1#qxJ^_geA`QFlcbjkP@PE& zQ7I)JeGe7WO$du(4*iSDs;L5j!C>u0rJ$p%ywH0^F;eiz!rHGveVha2Ydkx@H%KZy z1Y?3!U(xQJd{63^pSW&?QLNah7Vo_+ZluwGKUUN}23;6&275__Z_NJ2#|&BUtkObW z7Kjix*9~;pgbBC|l&@XE{*#t6lW#$@y=B_nbNcb;Jofjd0p>?EKc`+c{P-rP%OCxN zsq+Jsh&yrWV9YpjId&vFD6Ya0+=4T!%MT{jS#f>hL-Bo*`+1q~=uQw|1^e*%@4=TB z9i|eJ>t`zULmyz@*s!U^O{^N!(L^nIQ(vG?RKoeAC)9>y7|%-~4RV168zws3mp>)( z3X8b^Zsbl#Xk%6s7qBJ&bf?7nVr0)p4)x_p`1_6Qhu>n0l|jSZReKi3JS*Fo=}7-r z)d^np=Z%>1tYy9TnSqSKLhDV=I(Mj7G0)QsIr>Y#^7cuTVz zxxC-6;0^t_DX*SD-A%uKTV~?Qm!(%KhUJ(MM}>MFe@9dUm2=C6$}xCmeV(|*)U&^a zZ6As#Cv{2l6{gzHJNwEWR+XSBB|V6whj!#$?ew!K%5%MDBza5N#Gin=uwUY|z6{SU zMp`L9ZJtx@tH|ySFpzu6u9arc5#+kIpUM{>)5hwYE64p%t+PB zlRuYLEZA>a3{Z{7?=A``ZFNg+gqEB07Fk^@-*e--;#hI2jcqLSzhcaJ^{3BcDqN`h z;?bKX=7t?fI$P@)K`Z1onX(Tj53)H~cs1a-tQe-2ksey~PYl>L3?jI&bQNN*HsR;}*D7?Af&wb+tSGPp5|_cEhP-?cMMPAkAdO4d*jF zhNv(1*W|-rpj%o?KHR-3l&&3?&&)IXbu>N?;vdbwP&aiu5n;Ue;G;?TRwwmvQ!~~m zVEB>9LT@p2ONSE5^tMrE&%~n~DNj$95Rk@X*BdhygiufU`hIRoZee&l)6<-^l4p{5 zavL}8Q=qBx+UiIGmbLDS!(Ewv#{F(?woU_Z4zMYz{lALey`fGRWBDpomf`9ETElu+ z7&)t;0!v#nuClz8?JQt8A2}k`MJrs~>o>nSNyO5R4N${HmWA1LPnX5mf%@)MI%ZA6 z*XX|$&^4iQ4%r3M$5>f6@6e3bGrRA(MJ+C@d|af4&A$Tvd*FeF1Uyd|h{2_|*3q9M?q%|{10G-njq~e-}Cfqq@ z5WT$o*BvGmS-+FwrD?;4xo;>qLpQ897yqkNzp0{yo=mfHBBM(7(^QrfPP&`O&+e%! zu8?aFoi1DcAPGgg&lFA!2T$@K_T&<1$h?;)=IguKtQZG@B*xbsaqs`gKE=tH92Ufk z)8UMF=CWa2l_=|*r2`4sYB-ryfIhR;t_B(NLP?)8zBUxh{E8cE&nH3c$}*8#N_@0W zu%9oP(J{0BR2`2$cvYU)kt}AYi|D=gwZR>Ny^0x6%!i z-kfZRvQBNu1i#sS`@9Ik6NLRk)GK3=QN{)!Wa)Hi>~?5u>3GciyAeUL)oKdH*-Bm6 z@L$piUEK}Hgw`Auee$($ThQdt;FDXiORQ>n_Q?UtKOMQRsK0`bnpj z_m>W7lXLK7X*hoOk8ssR!%I!8(aWt634Kuvy!ujwytoI`k$V#W}v5h>Ae~y_NjN| z@8BmrG%n32l<;)9ws;ZZcw=zXmb=(>Kv?8l4RjMD@-g<_+3v6B{6Q%@zGIc{Z!GnB zgU)duDx}zFs+@fioPmTOy{{UTJi2mRzkT=BI`$sBFeT>u=CkKuyvRNL z#zN`LRJmbyC6fQCZ5F34Q<5b#2BJXE0ec&PH5I_gI5Zh>(PA8u!OK2lC^6g zW#Xu<8l|K3V>N1vc&TEy6uTm*7;K@CXimLXV(~Xt;cCrrF45$wW{|zZ=u;8uIm`fN zU%IKMN&?fYU)2&Rj~;zyzoEx5orB0Gz`KqJY~ochcxTe z=fTdY`)m`FI%q!<@o(ge*~wdxlP_~^-K@Wb-J7M}Mffp3$TGK|z5c*JJoq|nmD;dC zMPN3-?Vc6nng9Gv3v|;zN7%RLB@O>=>Gz`ZFSJ(Z;!C5O_L|=%4HA0QS~hTfE`FNZ zKb-Kzn#AR4Sb@OemWZ)qeM3zXJ^rAa46eXejx;31Z+i-COz|$0ea6p$VRh#$E zXo3ki=;~FSnztlciX(O;QD#U76Af{fr%a0GnctC>nXi!J z2@_vKq*V|#h6pb8ta|bj1uH}|M2I49>c6WE<)b#GW;t$(QZ{rpWXp6lBO#r1Gc;3x z_ZGtu}(p6@@k#8(Oh1OxOm8=ez8Ax%a-IYZH~Sg6PT!N7^AKhO&1bne6MGJn@{3PCxSB%O40XUFjgo$6Q(>ma zpSB{`yR*y!!}=J@u^DtdT-rO#q^vG*+9tpc!$o^mEE7dDjq|s5Mr6aCWE(x)uG!@d zqGY)ySDg2gNcB8IGwne$U~FTC)|lB}bJZ1x%&vDGQqhOIq@bY++j;ti!q{D2xegMO z#VQ`;!T!yreX_Vcnm4`q_rEoWLaL^GJeVQQ1kC*ELu>p;D7l|j!vJAdYl~*ea~m_* zckh1vXhqsb*Bsq#_(pI!moV0a$$l$O9mI<0Er-oD8|>fWR<}I#%+nYXp4`Lz2M_T@#DI3uD@GM$f?5I zk$}Cx`ik*k5L0%LJT2!8_pA|jhkj0-g-^omhiPM4_#YNn{tMB2fwzt!f8SAWSmIb5 z+k=`h<6eO9_5>&}1+KU#zablFS%%Z!zx<^BWCsRgl3g4=0M@>gZThcS{?a3BOgMd? zn`}a~*TnW{Fj&0&aD-(ov;;bB^Z41mLx;p3b~X!p$*K{!0&Sh@h0ye9rh^?@&m!nF ztwDfzbFu*ngMg=0{mtkxzlr?RkclK_{@Z@Bs-y3w)`XHnC-(lRyyoWNKb^Z?qBQ~B z|J7#T>ikbpdaYBy2XvVhbFgcnz~(vGC?P-0&jf=n1e(V9Zsl>(8uwCkM+9H^DU(Zr zeedFmyiV?6HtS&R7Lzi9FKUGVb zJV8yd?c7!=glp*>NwsmWXP9u*@{mR5j`)lAtbP}|!I{(4fQ_|3rF)4a`e)9C_V=gpQbqHt?!C;i z-d!TH;6?h`qJ5B9;1k-40SYIc_*Ey3!eB8RfI0c6K@-&TDj=SA%A{5|&W%@0 z<{O@ICgL)R#53b3t(fV=Zb2eC`e-sqbynJ{Q$W|RH- z@*3({O+WaMJYR?$M+_d{#INwedQV6cj<~0B3ute;dO}@lqUG*6XwO5JrXC*i+a(Gu zo4l{O#5F(nK6XFP-gvy6wB>#rle%)~^k8jss|YSd5)a1m!kX_~_8q1z9C%z z*W!1cUc>kEG6TI2=zDrgHmdRkJNwI?x^VNP&nM4^yf8a(I|#&#Ot_x1yj2=be|>+6 z>ig$UZS)X##VZvLXBr45VtVnuzji4MVUW!qGoDsAVc!r+FRd(5n#oqB)DfPAPDFWf z7F>h$8;!iMttu7bD2L6n)s45(3=hWWw+S{l+i#`+y;UF{e6vFhKFGj*#sc`TkT&!E z2iE-^%ljL@CzOV0q#_SG>ja%%@(=p>{}kl-|6W(6+&2J*{lL_mj~Gg;LFlicX*nN% z430A{sS&DT(1cRO>whlTbG9DH{XuS!G=;^&m0x^rf98lHj|GIad7zz(beeh!c*#ql`*MdT9A7d1k~Q`%KjN13QqXU3vrryv3S%mdv zEKHi%G3zMGDnb@FT=!F7mk7Who{NaBEkz+)b>%6%bJ2h7{^ajF>GrNjxd?pRaQ8)# zUxk$Dy&9)PnS?55eN@@#SfBozW5>pZ;K|)ByOUGb>fZq!U<<_6SmSrM$TNEKf3annpZY|(l5g_x$r(1lJPP=ntTQaa+OI&FXBHnYe7t| zbnTyZD%91fcEE_8LKK&T+C6^>2_5mXJ+#&+byDC6;(OhxFT zl%rhy@L;TGNPAMzDH*x{jyjJOO%y>M%v`UKLaVimZ5cIo^cOBETLU;B!YCPFpDM$Y zvmTIG=W;}1%}UDj^;x6h+|1rLMsHN>f^$6zYRB}5x+wzy|6tP5(E=XOpoFNdi)Vu0 zwjpjkG!Ts~2VWZNUm0{q88!LqDHBZ{M}}{4_GP#r3QmO|dhlo$fQja|;tP?66;;o) z{wond8uGzjGmxh&#Ywnnh+t`tMEJ>64joL#w*M72iq`C8nCo^Vu`(K6i5{<#3(@}Z zFWx^?di0QnF4%{&ut-UaO?EvakxD0Y9R2k~ zl%V7bi?XJ&k+SH%$zn;&9MwyMx8QT;voY&wxv=h_h!2-HcZ98fbGu&U%Hv#RAy>|& z`0bJGWgDTs)+6rH zmCaLX4k4|2s2H(X1q}2)9bnxZ%6*{C#ku3Aa|aA7x&Ed8X7|}ego1P38mFvz4h#}f zuHjR+c|LXq?eL=tfaj$yfd*9TY|1*zIc`(7wmw@NvUiZ8p#uQGDpwHg@0C-J72w2D z&`B$GUa(AuAoA(#v9EmIVpKA^Ca%CcFBC_hSM`l4hoZ?!;3T3;pt^p>Qn&0J*1CK^fs=$;1Zhb>T~P@EytlKf&7 z1${x+2Ka}U1g4Doa%|{IC@ZRs#9R=VpNJ8oLK}N)&c4b;s|87V1(ZZztsE}cdsY_` zc>Myc@-XF}znz)^fQOdKHGFw})b{R9!bZHB>w(@MB)Dki&sbF5%=xx^^C@B+K5e0O za#IXDJGG`XJmPg)@ZpdyL4JAtjwmkX(OJ(PXDgL><+;W{T){+Gia?pOfl z=%onv#1sX*-tAo{Zx^=X6bu7Z;S5^9vxrgb_Y?43EmNt72VQwcK+9vx5deU$IPGyK zS5W6%9UIZp_Y;JGW{iGfK>Re_)mJ3sqtYe^?2-^r>Rw_G$bav+)X8-#G?r_G%oPK? zlElUa{CpNc^g6}5?S*=}?PV^;`jnG7AwYcUu(KJS@DPWwP6|XHqiOjJ+Dm{Pt{VFS z3~>H#84HY}CIm#?mtdd|bt5DB(umD%@{UIa)Z=KlQ#x=yX0vvF1aq!ZVRi8(Yp5u|;n^z)t2vWX+O^c%C7e%L zn;-b4AKFzD$nLqlU`Y9qR7Lzb#2WVnnAPmponmd)I|P;f6$N|QqjO*-OV z-=&bMME~YML?!{L?KxME-V_JqqiMn0ZK!^nQVg+o>q4oCM4o!%hl}WCQ7cca{hZ|b z%>iTmNILrhO27&i?9*yrs{uF6w{$Z$T03M$?jRU%6)*VV3GxKBIo!sBSWL^h1KbB` zz8q8LihOXvk5}9;ps^2FA4$hFQQe!4B;R2NT(_04ml8lRU$2UR8Z=r`0i-cPA7vAg ze_R(rkSft(DIBmXrDwR4alj}K)UdtA3a~43pcTH_;`I`{VTW4|Ej{T2&kOKLSU70` zFB&q@0bQWiM#1}nt}sgznXyR^4{4>b$Lc$qOYbW6{ob+J-De{iKdW&wyzgUi8|Yt0 zVVQ48XKMP7ZrDn_RU|Wz!*6)vy7W!0fFOo!Z&gy*Rpo$=FoBa8%e5Cnw8rtEFsAwF zvy|T*0AZ`dPy?b}G@fg0^2y;T7IO4MQsi4Q82_>jgf&Y<& zSs{tIfm47gAjlTvm1BonG~9pQoEvf`6^WAb>8_f*`;?>lqF?^9HMoml&?2sA zmONJo{jUJ=+(8~(mO9CECktvKVm=}*K5;#DRkGbmZ#I_?4kjr;cGVAv0kDi%WPLGZl;zKe4C;{{j9{>HI2QC>65$A;f`#wY}j%X;Q3ho93 zNR77Q=rk>GGh)TQCJ*VrzL=DP6sUackt`6H{U{7OKWZ)z5V5`U8@{TS`|;^S4U?^z z=Mm@NI}0l;`fzW*L@{i2ZdfwwEg-wm;!(+_0A09@>WEy}Q&>=g&j&bJxAe1;i|uWm zbz1YgD%0^^oq!8xG2tgp!8FG=Wr;ci+3DA!gP&DNRdCVpcT%*LDs`Z+u|HHncR(Rn zWr_m+(j%EiOHz&iLUq+zTFY@WeH8DAOoybN(of~p4-hB4s0)mIM<_Gboq=Fj4*dt( z_^-7JToXciC=6c}UeRBsDHp~xY^C2!$Ct#qWc506Y*K>k&PIO&^L}v)xv{&}k{0aH z5`_KF&UNZ57{7(8BOgPL?qgs(sDoOl*u=ZZ@aD`pmC=rp6C5CI-@f>XUqG(-^IB&=UkjCetVv}_A2{XYd!xZ zz2Qa~;2YQ(TqhIjBgFKbMk?Z|b>|X+$-3dh8B{0vOSqJ297BtZIG{&3kti#o_kb)> zjkca|l@x*0-bSv21Uv4I4ZFKnrlTLgq!~R4-w>U#RK$yIh1EMpf)-TUf8JT_s~||{ zs9^GwBXXf`4d_~aLGYVxwTzQiC{Y=w>o?~%&RL|-jNnrVE$iSGf8|y>iu-1oW_`C|Hz#%@1YJE?q<5h2)@)}1| zqa93dh#=9NrMSnHzxeh0L^NbaY@3zmWtffme6@=~$JK1jHH3?5n|x9UHmhAz!;WmO zQ@QMT8FtzNZG+C;V>A*)*6=`VB(2Q};_(*Cq3B(>ySi!Y{INyWB<=KhInxD2(*uOl z!P^N?O_rdd>D{A3)Ayoh#0YF=Bv1GKFk;T3U~FgoEqospoL9=u3jD2F+s(*|86eGW zw#g}^V-bq^>}Y`t=#%{^=8IQnlnok_s*t58c(512ju8V}OuHLC`hrMl5Tb%+bIZ_p zP0w0m93H6u*)5JRamfCGxW#B`2Ab?}oUN|mwF~KY71i!Z;e04+_>{$AwLRx<7;zPX z0-ya#+P=1PCja^?OuH_e0Xf@HUAH~cJ|2yTza0RPlt5PSg;Z2KrPpi_pXL8SZfF(dE}lBXA}gwJ-nYd z`(>I>B^&+RLV14YXpn}VV0rr2C-?_nbUA?Nt0ta$^i}vgX5e`+x2(kT*d3J~PgwYx zkk?L;D~D80IPn+8XRoM5y5^m~eDLY|jG-Kq7(alwPdvZ~$ePg>IC1x9>w!yVGS(+D z_;XX6j;~t;?I-6h_CQO2>l>D~lb_p9R{9+7D`x_B?~5>eem@#+YNewFG3kowOXK25 zK+`jf{qCIzOpI&ZWNw+KqBroqAJ&neJc_>wlFw*pKNuNIAD!@wvwD zZ>~#yurS;wxg$4z*Uoi>t8ko2;`v*Rkz|6@ovX}NW-sN@bfza}b?FNwrS8^=_PUGx z$3qmdDF&8PU4d#wjxF=eI}~rk`7ftyQ2t8n?)9IP zd>V}l;V-^VigkH>awXuSFc7tjSYT{X4l*;FuWwk}E|Ho#;sHN2x#n1D+X|y(K!y(m zBr`XlpJ~nvwTa|8=ZfqyU0^uRXABN?c_6aq=hq|?^vJeD_MAN?hGhevafoj^cZCzA#t?}g+T`aUT(gc<_i;MeP72F9{NGz#!b`YnrD%dnHXrJjo zPRWWO+ghf^LU*le+!B0w;n!wJzSg~FPZy{ULXxQkAttGuVPaX`$GQm+>gwcbazfl3 z_Ze0mxqY(J!SaKNu^G^ty4+Y_*cflM78{ma0{VTpF%c zQPb?Na{H(n8+Z9i9s(9QT)~R0SUHfmIJ-!w40IM&o!KiWYEtt8-P>j8)mf#iS03L2 z5RK0}jelvrD<5i=(ExT%{NaCg&&ig82v0-edIy28(V3v3%BUs}DAJVNvg zNU2GDn0a6WyAi%|Wxf94#zaScw>!S8Uj&@-a_cH-+c=rhwF9=5F=kc^&yXOq{GqX( zjn}yQ%oi;dwZgmW9?a*Xm3(@cgB%*VG%L=V3l;*3rQ`>#@!W8YHU!`9(==-abl)*S z8o@_1cut1-+Nwv@uOZn3)xV?NYBJ(|m^-4b=S9D=zC>vKO9;N7SrjCoSX-kJPz6*v z;;wU!uz@jK&}|FL%2;iS2Q&E1fEyFD7d9nxx74YNhfEs}7L@=;E;VTI|Sn@<0CM8z+t_f`HHTCDz1Sdoj{FIAos;3haFDFL8W2(gGo`eB$Y z3mPr#UXQvHBP*I{D_ABo>_U}9!?zRU9Nn1M#-lvLzZyNRh>7kynSZB&p!!lmsDY?s0l~meG{pGUM5<24&(kOpVnkFjba)o z^<;1u@$L%hVeGH-zE<79T&%~Ku6yA8Go32-E!6)@hZL~mWKX*^?hMJ-fp&pJ_|9x! zPQ;ZJjJ%GEw=p-7g>NBW6*kNxi2uQ8?J$d(R{oKl0VojcB+0mM&wU}rM{b!b2aI1w z-qFg*E9!N*R574qXU|*0`j_-y?(YvUe7L&+KKFoZU8eem_X1PO)Z#_c5?}E41g0fl z1FCWDOI3w=QDuX;&Y;)iQCyfw}RU*CnaO~$Q{p%y0VJ?N03bLqitm-_vhMq zkD5R*GgzD~FOn}Cqy}wam&+Za7yg13%5=fLiqp;I=L6%OW?)K}JcF8WRM!X(xX&y4 zGrizC?L&EGW%y|n{FeaQDKHP%?r(Uz9IhdB>*jabRRWOGUvMMx3pBuzFxgYB5&sr? z_4JUz(}P*mjG>mH=7_n4M`QVe^W&w{7OxsOi%Yj;O57_z@SFOMpUGz5xlJ&C^NRs_ z+z!;~zGKi748|xhiT2DX#Wg+79<#-NoP_3{n^lxgw->NYZfdGzMrOLv&c2t}P{W)I zo5tI?bz@X5#B3H!Mc|i1lEu5etHO_A%94CafK316J+^n4o`)N<7->7K@OU)4LZ;9O zX$$fdUoac@r3>ddwCzV0O^1l`>mSCxPC;gDZpkUkE#38qb{U=KnOwB{z%U_kfXk82 zF2g68Acup(fc>Qpty7XIJwAaKEXf&c8=*_2KKQp~7qAv#@#wd3YL0wSlO2AO`3+lP zeBG4>+aMT?%~yf9pboGV)rfK0%i-;k8vS28WI?bFu2-VRbnaLDKFqG1s|N1NQ{*@L zFQ#z14d~SWBdE|K;A_>rsU-y;gc@8?hS@6ssJkM_03utWr%C9eJOfaBIngIRz5(MT zD$X2GquDz9kWoNaF4`lH!P(yU9f=QrSO^jbuEvMyZ$)S17NAQ3GMOeIvA7) z60hm%$Z5(7G8fn!<0GN`18sKGr|D|u`p3Fv{)+C9Irt8+0uqrEHegm25w*)lbtAQ}j60za!0;6!%B!w_) z^uGo{F!#Q4M;zA|eL+R5uM+R+34MCl#eer<4{NVSM5M|aQYkx;pE?!!@%aon%>?+S zVn^7Qk3+b8dS+zD<-UtpJeZJK7{+i3Z8z-oM=jSg9C2w9FBUqn6(Ka_HJpITR#M z_U{)+j~epI6GoI|OZ+qa2D}^jzaNTjyPWdIe)!1Cai_l}jXseo`Qz`NFPm2A6i38l)qpwKEMk$EDI~3y!&!3AgCkT-n0Y7%8MLh zPt8TgbrXzXiv4l4DJGn~zsu2;vmXN4Re0Z2fZJS{i8gdbK= z`l2zrDJirUWeO1OFf7t^bh!`Pf5+l;FOc%#Pre-qoiP>b<_b;sNfYth5@>!5CoD~2 zXjy6rwLzh&)L2ceb9aInlz`@=7l$_m%hVXb(x=ZeoJ1V^=zc}}vmATnFR;O|`V8l`16EWe9+0;i%O*KxDpT*7VrDkml8D<2`t4vZcl()kxl%i{JM0Aw$Y&5ybg^d>(vc+pb|X(Vl|J`gCo zZNp9_&*=W(y|wBU8`fG>+FNpEZZg>vgv22IpK6sTExb3LPkqo_+`f1-o5631zSDnk zc+|T0CaN|xc<1wI=e@KsQdy7uw8shcRS;@fw$fckwcvXsR23CTQ&6~YoD9RH()41K z%>-AM(Ua#C39T%p%E>;$#nIbD)UO^@Oox1t!_9jWMT_|hKZ_xK^dd^2N7msFJ@US- zd|N(R@D;(zZaP!iV5T+rMZP>NjaT&ZgopM$|DIC&>A%ykrhQIXwMU=y2FJ!I{Qj_8 z=bq%I*;}qz^GMRbf)MclGd%wQFoT%}W))@OAtV#Hq=@Wz$fHDQOO}ck4xZb;KA{j0 z=v#WXJe-vw%GHgue%EhVcldRMwowX6w0PX^#k7}H9w5Jm9QwHtwsSt;Rk$>n6{>(F zSKa<5om9Tq>a&mRCc}MQyM#gUmb21r-On5gTzm0(Iuxbi?~Wp}D``BQ7Lx~ym!T(& zC8o|4UVCND_1NNqi;}9Sv{ggvYE>8}lYqO8rBC>JrJUZ&9DK>+)mdFh<7)0U-+j}6 zTt6$_<2fAB+{}1UYFOwxLeI36&p1O$o{%iQ(kwa+LA@Q%^mrs1-S-Cp){Uh6G+Qvs z_USpC7Y6IMK%ifj>`4T5pt@8eE%7*;1J+TCb@k(O%m0Wr^-joYYAA=ZtdHm6mIy(M z0ESE&GkPxpAezyCi6)BS@QdhHK;lWSrCChIx={KWFm`W7J1Gg%WaQ_5PWGGBZ;pDi zSb}g`%a*_eatEA5z2&hR)u}V9*xZZwWDq$gkp^K;XT4hKG-e3E?oX`W-pxAnscJn0 zpOIkb4;+5#5~h}g!Il&T-QMM7sFc_t6t?kiy0A4;?Ex4cpvq;e3!UIAIv)-7bhbk` z<I*JlL)s3b;z`eSV$Vjl7M z8CbBD^Vj=Vmt^3Mm%Xym>=%FLe3;bTlQ{9ea=BKGH>zUyxj5i|@3c;-j*(S<)*`6` zVTUrUQj>uz2`n@-g*0_V9_TgFgM%1)KQ+D`V7*vuzqbCNl}?)5EW0Q;34_^VgN!cY zwK0GB)=(~4uQh0(4|$em6e?}OQ{0A|6ozg%^oivEQ5hbd8Jb8wA5xb05s$@3bYN=Y zFZu<_=&H3b99h28volrYrPTus>JS6v^lU3Wu@Ct5Gn9Q!Bunm0Uz+}=xT*~%q4vrb zd0HTthwuCv)NlTn?eaV@Pwh2zCPS0{d)J|WfGns(s@(XJq`}0j6wEcKMd6SYhH8!S)WgW@r#FA|Ek}$J{=NBrNICRc7QYPL z%JY1-{L`)@iB>l?YwXuy!Qa;0Rkq+YvCYaOq4?)_vsyX+DFCLHui6l*02z*^Oj7sa zN|7a>28So)uJy271}06B+JbfQ7 z`Deiwi^;wIm~9Q~bka~4!=A*tOwq&$zKJR+9m38HP@`;m%IX)*S5?s38bSh({(#U< zC%3HDh1mZJ8P4|fO>xUD4fh)<2CB_Ip;B^*z;gaxiH4>1BeJbt1!*H)$oTbld~5EESwV4af_Dg0`5czO2Cf|yFA8;KZmvk<=%j4B zw<4CxJ@-EUm%eV7@OqcMolLkJDw-Qf__>@JuC3VFdo;1^8m)7rPR?> zO0(ETUE!Jg2%zS`x3(cRaF{xt@YmM{zAp010JcCfOF$$hX+yjAh?3gm#z7>puCC|o z;6^IP;(9W~d{>IDm%Q)}7ptmkl79!UA5aO}M<)@HFHeG`@;BCm^hZ1JhgX2X!})4F zar(qiV<;lUBv@yhi6(n^Dw%fzxfq2ik5T4DLs>E1=sZJ_$fyx zqDI6*_7fZri=>sy==v6U&i}KEg29SEF`lg9F;+yqtj{qn1!}f~r0T?fv9(saUGA7y zhj$S&E`Z7JNJVr&(fXT*IIG&Ur#)HXso7y5Jx@YXb!uK(#!3WBiAY=hU7k< z`-MFeeEcGB(r4~Y7FqMz?XK2gKTIzza_fDz-fUM<+MXz@U`$d5EPhfGIPnM+%fe%8 zJczJ8OPd~5;_ZH0VEo^vG+|!GfgZt=5zgiibzkh#=YvoDzK@iAvx+ipdpW{IEw