From 22f4c78bc4169e8f1dd2d613e0241a3dfb708ac1 Mon Sep 17 00:00:00 2001 From: HunterCML <5335527+HunterCML@users.noreply.github.com> Date: Sat, 16 May 2026 20:23:31 -0500 Subject: [PATCH] Add enterprise integration secret rotation gate --- .../README.md | 24 ++ .../acceptance-notes.md | 12 + .../demo.js | 79 +++++ .../demo.mp4 | Bin 0 -> 95327 bytes .../demo.svg | 43 +++ .../index.js | 319 ++++++++++++++++++ .../requirements-map.md | 19 ++ .../test.js | 105 ++++++ 8 files changed, 601 insertions(+) create mode 100644 enterprise-integration-secret-rotation/README.md create mode 100644 enterprise-integration-secret-rotation/acceptance-notes.md create mode 100644 enterprise-integration-secret-rotation/demo.js create mode 100644 enterprise-integration-secret-rotation/demo.mp4 create mode 100644 enterprise-integration-secret-rotation/demo.svg create mode 100644 enterprise-integration-secret-rotation/index.js create mode 100644 enterprise-integration-secret-rotation/requirements-map.md create mode 100644 enterprise-integration-secret-rotation/test.js diff --git a/enterprise-integration-secret-rotation/README.md b/enterprise-integration-secret-rotation/README.md new file mode 100644 index 0000000..334d9a5 --- /dev/null +++ b/enterprise-integration-secret-rotation/README.md @@ -0,0 +1,24 @@ +# Enterprise Integration Secret Rotation + +This module adds an Enterprise Tooling slice for institutional API and webhook governance. It is intentionally self-contained and synthetic-data-only so reviewers can validate the behavior without credentials, third-party services, or local platform setup. + +It covers the issue's enterprise API and webhook requirements by evaluating: + +- institutional API clients for stale credentials, unauthorized scopes, owner gaps, expiry, and break-glass misuse +- webhook destinations for signing-secret age, unsafe overlap windows, missing HMAC policy, weak idempotency, dead-letter gaps, and recipient verification +- dashboard-ready risk metrics for admins +- deterministic audit evidence packets suitable for compliance exports + +## Local Validation + +```sh +node enterprise-integration-secret-rotation/test.js +node enterprise-integration-secret-rotation/demo.js +``` + +## Demo Evidence + +- [demo.mp4](demo.mp4) shows the problem, implementation scope, acceptance behavior, and validation commands. +- [demo.svg](demo.svg) provides a static preview of the admin risk queue. +- [requirements-map.md](requirements-map.md) maps the implementation to issue #19. +- [acceptance-notes.md](acceptance-notes.md) lists the reviewer checks. diff --git a/enterprise-integration-secret-rotation/acceptance-notes.md b/enterprise-integration-secret-rotation/acceptance-notes.md new file mode 100644 index 0000000..35c0091 --- /dev/null +++ b/enterprise-integration-secret-rotation/acceptance-notes.md @@ -0,0 +1,12 @@ +# Acceptance Notes + +Reviewer checklist: + +1. Run `node enterprise-integration-secret-rotation/test.js`. +2. Run `node enterprise-integration-secret-rotation/demo.js`. +3. Confirm the DSpace production API client is marked critical because it is expired, over-scoped, and has unjustified break-glass access. +4. Confirm the ELN webhook is marked critical because its signing secret is overdue, its overlap window is too long, and its idempotency/dead-letter policy is incomplete. +5. Confirm the Canvas/NIH-style low-risk integrations remain in monitor state. +6. Confirm the evidence packet includes deterministic `sourceDigest`, `findingDigest`, and `packetDigest` values. + +This is a narrow Enterprise Tooling implementation rather than a broad placeholder. It targets a payment-relevant gap for real institutions: keeping API credentials and webhook signing secrets safe while still producing admin and compliance evidence. diff --git a/enterprise-integration-secret-rotation/demo.js b/enterprise-integration-secret-rotation/demo.js new file mode 100644 index 0000000..37f2831 --- /dev/null +++ b/enterprise-integration-secret-rotation/demo.js @@ -0,0 +1,79 @@ +"use strict"; + +const { evaluateEnterpriseIntegrationGovernance } = require("./index"); + +const input = { + generatedAt: "2026-05-17T01:25:00.000Z", + apiClients: [ + { + id: "api-dspace-prod", + name: "DSpace institutional archive sync", + systems: ["DSpace", "ORCID"], + environment: "production", + scopes: ["repository:read", "publication:write", "admin:*"], + allowedScopes: ["repository:read", "publication:write"], + owner: { name: "Research IT", email: "research-it@example.edu" }, + credentialLastRotatedAt: "2026-01-01T00:00:00.000Z", + credentialLastUsedAt: "2026-05-16T10:00:00.000Z", + expiresAt: "2026-05-10T00:00:00.000Z", + hasBreakGlassAccess: true, + }, + { + id: "api-orcid-prod", + name: "ORCID affiliation updater", + systems: ["ORCID", "HRIS"], + environment: "production", + scopes: ["person:read", "affiliation:write"], + allowedScopes: ["person:read", "affiliation:write"], + owner: { name: "Identity Team", email: "identity@example.edu" }, + credentialLastRotatedAt: "2026-04-28T00:00:00.000Z", + credentialLastUsedAt: "2026-05-16T09:30:00.000Z", + expiresAt: "2026-10-01T00:00:00.000Z", + hasBreakGlassAccess: false, + }, + ], + webhooks: [ + { + id: "hook-eln-publication", + name: "ELN publication webhook", + destinationSystem: "Benchling ELN", + eventTypes: ["project.published", "review.completed"], + allowedEventTypes: ["project.published", "review.completed"], + transport: "https", + signatureAlgorithm: "hmac-sha256", + signingSecretLastRotatedAt: "2026-03-01T00:00:00.000Z", + activeSecretCount: 2, + activeSecretWindowStartedAt: "2026-05-13T00:00:00.000Z", + idempotencyKeyPolicy: "optional", + deadLetterQueue: false, + recipientVerification: true, + }, + { + id: "hook-funder-report", + name: "Funder compliance report webhook", + destinationSystem: "NIH RePORTER", + eventTypes: ["export.ready"], + allowedEventTypes: ["export.ready"], + transport: "https", + signatureAlgorithm: "hmac-sha256", + signingSecretLastRotatedAt: "2026-05-05T00:00:00.000Z", + activeSecretCount: 1, + idempotencyKeyPolicy: "required", + deadLetterQueue: true, + recipientVerification: true, + }, + ], +}; + +const result = evaluateEnterpriseIntegrationGovernance(input); + +console.log(JSON.stringify({ + dashboard: result.dashboard, + topFindings: result.findings.slice(0, 3).map((finding) => ({ + id: finding.id, + severity: finding.severity, + action: finding.action, + issues: finding.issues, + })), + evidencePacket: result.evidencePacket, +}, null, 2)); diff --git a/enterprise-integration-secret-rotation/demo.mp4 b/enterprise-integration-secret-rotation/demo.mp4 new file mode 100644 index 0000000000000000000000000000000000000000..0094096bee587ed23a3d16224f1a6555e7749cc7 GIT binary patch literal 95327 zcmeFYbx>SQ);K)4ySux)I|O%kcX#&y!6mpuaM$4O7J_>qxVuB(8=hzPeRsEhe}7eP z)pkwaqkX#1={tS<-01-T0K^t<-cHu8j`jcmDBuGEE32`GDT}=mI|~4S_-60u=m7u# z?Cd?P%z*G;3fLjA`A+}{;N$bZ<=+S(`#)&m|JD3|VW7Z1soh+RZGl2PH`~AZ1p61o ze^>+d`=8}M`uTtL3ju5c`gcomb2B$rAc=2o=j!$kQ$PzJcESHKW`uluGizg@jM(1n zKYiy1>O2C}2mflxU}a|K@(&vT4{I~?f8rld14uhc89SKSnSbaY$l6;wSO5`p5BtB2 z{_C*G&Hk3*o4J^O=zNq9IlQ}z9r52d0-URxi5(E{admV3=Y)Ld)P77F5Pp<@wfPqV z;=^qzAo@{13J8WAP@j{Pk(HZ~g_(ue&f3I_m6QE%;a^wm_je%V0BVVWm;s31e*tSP7y71Q`GT1AJV-dapupj6eY3Ru}OTe;yw{+9Ep{yE*~k$1pxBx`~_1-!TSJ zV+7J41>4o_ulRr9A3Coe_aCqT`K}-H@=-n*AF>w!0BXzhfAydL<^$*HFFEW#;6LdP z@}u2f_JHue^1tKp-}w9;hmYIizxT&~zaRfyAO8Lx{C9o)I}ZO{AODU6@cRGX`Uu?H z{S|k7;B(*fub%(v`=5J)4+stpl==Ka_5px<1>b6*nhp@B{70n#!jC-$6|jEbAC>+; zXqx|HH0QsMmq;E+s{reVZze$h)&E@%Nc<1_|C+!5IbU4=?hg(skp75)9I$@G-~w3x zb-o4ugZ{tfKkI*tpYGpjypPSh9xchd!1}NLhx`Zqf6f2@94|EhU^58xNefuf zUENF_f$*aM*94@GJi^4?%*_}Gb?nXmf*&%Hf6c{!`J0Qelha4K^go5c`tO8~qTJ2# z!yti~@n4OBMuB&hv4;gPDPjSBm_L#!XbTr}a{!1rk3CQexMQk@gm`~1Uza%Q+Fy}s zNu^&VULiZb_{f}y8Hi0CUCfDDI5~)2*jQQFh?&{BnN3ZYfdVN;paPS;l7u7!JF$p{ z7*Ny9+!QDfb9C~yGq-RfW@Tn(V_;=wP-oQq{tD%dT01G2Cuo3V=Y;WylZf5vl5r~@` zx)?iHnhUUS5}R7NINBQ<0-LfBySbR#*;%^+HMqUF%}m{ZEK_HDAZcc9Z06(W05s1+ z&%#1%VeIN==;Uf^?ewAXw*hA-Lq`h>S93R@x|@{?uz{-pC$XKQqph(OkTCowkCoWf z&e{|>lz%dqi5*=2>cZ68-q`J97}gGM<}P-|KqVmG#LnHt*xS(5(ca1U!?r0fLcli( z)($`uKt&hh4;>2^V|#N~0XAY2Lnm(_Zfyn(go&ZCnX%J{6DEcx*2W)h0q-31zufXP zx3;u$GXcsRoy;8!EghYJ(!ZG>KG~Xk18obiaxnh`H3a7OK$6(i)ZD?`)ZI;ho%v&! zF2)}bbuo9f0ycLsHT)lU1z0|40aF(XVtZhoZ2sXEkPu*HV`L_F{%}TsnUNESI(-=a z3mSU~aPj~du5RW|0_?=rPQW<=-VeYj1oma@44nRt$pi!eSBOXRFP{Ni?~7i9?_Gzi zyNbRQwBX@QFTuRI>CyZnOffiL_?FdTdq1-I|M`HunlW=?l+ID!0$+vz`4C%j%#cfy zAi5w|7O(-+-!Z|@`p|zkC&$exqK-_!2}sb>FD2PP2=^>w?s56>5b&lQV7ig-H>Ar0 zaz>$S(&5&i{y@q|D_3D{`Nb4FJUYiEdCK1@r8GAB%F*X_i-e36+Rrh@n%0-woyIOC@o{#zfe)rN^5eIx$%rV^HD7MqW(`aGO{U}49u z;#2&xV(6s7w*iW^lWv@C&0ObzJBVSTONOByB1;Z;U517N`fs1!n=U@JXF{a=8(Ojw z>F|&57wpSKNb>%&efX)x$&Lf%6JK+D=;~`FPZpHS)#om>ZbGIE%4SUeZO+gcq*lVG z+Krmca-dp!K9qknkgJZfgwad^2Jynyd+~_RHkC1-3b~Ul`O=WUst)yZOH@J#0M5ua zaN|uoT~eydT>S+YNm;`9h#hWM-HIe{KRWCfP9rpsI*+!I{PaUafSp{52BGB60F3@M zsx8$#ui36>##F()>IADk@r(0_@XGXW$xaRW#%#c_+hHidao=KrMcq{oD4J1#6Qtk+ z>8~gEyrnA~3eaz^nV+-MZW-vTGKCIz4G*=$u~E>zM}!yQ8t`e17i@!k#^X;5;i$xv z=@Z7zC`(XWIvnA_c>GC>x1r|-uQY-4vK1yKl@yv<(P%}0<4SAT7{@cpiCmZZ-Gd;O z*`SMV*hDw97JaGt>ABE$?PoArTlXEK>Y-dWfg`g&{u3q*!E!dXWz4ohuY`9%tVTGgtL?Xj_oJwGuz}9SywK0QUQXzBLkCfX1<6H161=JK)oM_V!(P+080g4U2Wdag zzGcNzM#Pg-x)62yB+Ap6*H=ZlMa%dWVKHBIqbzX;6Si}!{n+}A1CFb;WIO09LcNaU z1qzc9DZ(lyVh@X(a7sLSH_`*b{yyBYoC?`p^7RGJa27IP!B@l$mAnKEqTqdq>D^8A zQmknU+X~?q5s{fSIrIgR454nKxZlsa1{{vU^tip=e8zSBtsI6UQy98O1LFJx`qB+u z7p;DCc^x|rBApE}6Z8)H%BEupU*@V&@YGnUa=~VlKlGaYg8-Q1DtubMHU~^?4XUq#b}pgZ(@l(b*rL^6xQ2m*>Z)RNG-tcu{73XV~!9tktv`Nd6}5kRk@o`aqkwZaOQ zzWeJ`J_or)g-B5eQe6SJ${SurhD9&|o)zi-ekcl--De^ZQ-qf?%_?+ F{->u8QF zY|OHDN`2ZG0z{#B!Y88_k>eNJGFNAh1a*&KvC}u}(9U7OcL!0=XONyhWMtn|a?vu) zCY&^wQd3D$Nho2;5$CvQWywh7y-t&D+gBDyM<-(sG6J1x1hH{C1-;sL zf5C;knCQ*TeJk!fL##6&6@VWLGK&nX_LPdhsJEi#y>JLK$swzgz zZR!jRSj7EQrWb15-QP}3PDLTqw{@WIrE8O{8@wX>)@fI=rJ96QKQ}p`aT2ouItaX4$ZHhkTFDeziOW*ti_!C%pMo2Z@>kTv zb>3CbzYfAF6a0QgTU|m6=D~xlM}wdRxz4bs-!iK%gGJd@F zIYXtY@vm5B=rP7_Io|mF`iR*lX*)^V=iY^T&Z2ur=WG1bemtK{xo5=l=P;gwISHM+ z=+LT%Pk&a=iKfs21BdrHRwo4iw3n*xE8{TN zNyL!u*lt-x>=m^?Ck&*P0pFa3P$LyKq$hof0yVkl8sZnF<1Ikb05 z15UPr!cd^p?T=xDobY_Y>$Rv@-3;BnQB*DWo)?ejcmDP72+0y>q7m<{p!G^hhQecz z&ePtJ28WUs=x<)K@Vt8(vfSN?!i&4q6wt$ekWo6s6BCvs!tjv@ptWfMzi$gVZFyN( z12*YmBHq~|$l2yLFesMq<9O$FWNDvf{UdC_VmYboLP7?#&)txz<7;dxx^Nqu9ye8S zTIUA~uUZr8W>2MC(0?NMjB0)`_?s! zWrvtW$2o&vgT?HKQ9xohZqB2f%UXZ_uDuRMS@lNB%o~-X=o0=qseDl6yyW+j@uzc$ zN`90C-tr-y4duZ|@fTW{&l}uP&>KeZA;nP2UI&%gKf`3Nijk^}ibXn((VQL(I>&Qd zWWo_2kw3GQH`iX8VI|4T;6Rqo>H3U(Q&C}`Icme_I&+kSjl)Wv)!xaJ#P+fJ!qnG# zOMnr!)cENQ{WRnj17-x|L;!g;f&mUycX(A@Me#?mzVz7A7TWyS%ZywmLWX}Id5HG| zZu4knr)jzFr|xJ714|}_M*;a~k7K+qNWm|ChzCOhJkeD7@Et-BRY7-JP`P6-jW|*> z1yyK1aaN>_+Sb%Yv-b8&FL7Q|d|M}00ZLV0X)>ptq-ih4dfAPZ(|<7T-?DXz;~B_J zKcRb3D|IjfYK5F&71C$$$Flu*)FABK8-!5@h$SOYa@gMLzEWr}lD6#)VH!M>`yhdz zfVdOyFFwOwNFnV!*~7ZoT-UNJ$J7xwd1yS7I@G2348wAL9_%_t@_&PeZ*LsLscyA8i1mANG4dpE2A6ojW4Ig8CigbzJEyg-1dm*|N zz=$3oW0MgGeYZDA@L6Rzf8AtdP!q2qg?TSvwa}Xp&wD_>EFk3rRXJ{2m(GFTHcvI? z-4|O5Yq9dGguwG}ZSXAgPeKWj5iu9?MiG?btk@M_i= z4iCu1aR)vYxz)Nq6Mik=`$TL~t!(upHW6-=eGci7&&x&cdu2SuRHcX6%zHl6qL}(@ zKg>hl&nx-FGSvkosNydC7gX*+A%N;AA=9o$o?8O$&q+w#Ww!LIBuZby7;q;H4MNo$|uz05z zsmAFg+tHs?#AaUV@Cd@j%Oq!CyLk_`xC`aGvo92>EE3Q)1I5!#vGjGG!c41 z_N$kj&=jbMN$n(TzN+Hes~->%VE@XH_s#K3W^ZN?=1wbPtEpK+6xhG?+T6x#@|edL z1f0PS+pMCPI)D<5Y$wy$E2!*Q9=au;>a-A>mW0PwsjSLlE5Tf8rpceey*kqDkwbSt zf_#?PW{Q)9G_Z*vT_uOZh#jb7cL=r%Tof@jXhW%ZRzVs|pnk*L4Ut79?Tp zBvf40W;lV5Lo^u8ytfZuA8=Ra`o*dcK5wqA6lY^e_lm#dvdGc3by9o)*Y-qPC*$Pn zA#tGuk6oS}RI_3%J?Hmk0=^L8 z7fgxOXc4-A*j+fWue2f(_;tqEqKNrs%6jknotEHbZlf$VqvpWixo@LTT{3#$W|-Ud z&X-w_YU(`X6wOmh&4FdHno8)v>l|S(aP#16A`Ay57GXk>e(e{`BAX1H-OdY1_54`K zgGzfUzNk<^D$S4q96#;onVmTtOYX6@QEu#q z5bxwMjd_4+j$$$DMg<0^HYcvkr`($LP$ZFvGR^TT?5HLFb<0P<)snp&y5M?doUH*l zOS(2WEeu6j+U&V$_%d67SuDlCxD-v!`|h6mjJL`=%^i-a4q-#8?qI)S|1gPdZrfLE z+Rf!C&$Q*uRpO4A@f$^v-y}3`2Jm%ogg(W;RIzu;6+LGaxd($1nh_ms7EajZYnk~I`3?}MM5KsW~TnVUyHe}!*cR16coQBXWI3#ntew+yQDI1Q+Wzv_PIhk z-^*M3MEsO6{bHi{^{Muv5Sx1AdOVO@>}VRYdAVam?KWOF*m2;!nh5O^W@M(aeO;UX zaOwV0J4H}QmU8;906PBDEI`o7kcF=fIp4QI#xE2_Zb-E&(BTJk!tk%ALzAfm`O~^D zjAw|KkyWlL+2TpcUN{5~GCwY6{qx|FQ;I=eBRK-6uOtm1a34%fZqz#tLhpH@JtuS3 z+>wV0_U<60k55nPt3^~;P!gi>#JLEdpuO`TiBwE``GR@26IvHqhNhbPX?1t>C{jU;2aWNHKIo=#^vn1xG-XS9 z{=v2+^Tmbs6_~8GCE-&aahgt+VkN?!{nXuvy@ghrK3OxQ8ppe+Amq=lvF-JW0K%1T ziYz)sM%FjxGbSKuKe7qT1-~Nan)e1xx8RsvSqGFfr)>nFf?@%);Q-6=={#!$7wGf? zHp?2ipAG2!!9LCfOt02a;V&-V4Jk%JR+bAa8_F~ZXlr-}jK}12CPVBtIqqQR-^K@{ z*Jk&)v~kpIou{~st`L(@ig46w-*w(qj zRlt4q%7{O$WW((EDLnd1{N_^`L3G&~@Z?k78f(f7sCZtn@(?C|YF*qP7wEtK4&3@f z!-kGiIY`AHz2P@-*3RN-{Wzx|P@XJQTkxoF=Q-(fU;7H%5*qBvZ=(I+6Gj;nFJ=gx z%^FSC!kI~fJFscUxue3Eb-e`5?a^^uTdBdKZ@p_3fKY$mRi8GlLy`JDa7C3bT`&zc zJ?xaYHn1V()Ab=Ggo!EuL`m=S%rT>8qC+Q$LE`{hUh!_rBYq%XKAE%Tc2(j4W1^1c zL{Z4vETX-T{R<_ZsXGEJVkr)Z{p>v%nOX=ZDC9q6>>vvLia%@Q4PcFy!A0q>lJN@) z-R_dL49E?Bi_T*ooYXfLo=}V&erxS*lR z+}S2t;d6%BRv#(^6{QKu6qlt)Vt4%iP%!N**4$1*D=T1@#Z~1L)*v9~V+w>95QsRp z#BVGWN+|aau~Wq8yOu(PEA$8s^}x6h8#9s}MFd2^qE8Tt+9Jm_1W+HaZBNQ!T1nS^ zji}L_SFMwuvW7kKWgzdFfdsyIP+v5RhDP%`u?cM9dsic2X#2cIK*ezA(RX6FQY*Lq zD?}++Yl+(HfZ8s@EkiOP1zmM>7Pr?XI_?5@>0Zvt;XGMy;6~6)YsSB}KEIcBRb9Uj zw+F8ydAz+e$M%`^Mi-x0w<;KtQ05s9H5;D&8-<2MJOpXbXI;lASMS2iR=T%)!M6xCeZmxP06j%=f($Bi4Xa5wjE}WMH~x4Or#W)1@eFpLtppM% zlT7r~4iq=2b)|8h@jFW3N&@KW&|>o&txA`L>J9^&E-G@alXBLfER{LSnQ_Bb=M z&}pi3H@~iru1E@(bMqrv9F-GkY9ma|;gmJ&OAPbtoe^7QF;AKz7+g{6ZPJK~B@Dkm zw7@h<=oS$Z;T>)_sCr&n8YO~QlhEhY!dzFRE&RGH3OI7*HZbaQUYA(Pc@yK23J`7u zKFf_!VXrDK-5#^m5mJgjW}~SzW09N$J|sC^SX;t38Ax4bhKZ~CC#DYW!~JnOuY9!c zb&TyP8C<@Bl@^ulr`sT*53u+mYpHoUQgUPK$_Y~}{Y5T+FR4%J30yHCOp-+gs zq6&3FCZwUcF94gfu z^ol6)xIrEJaGw{C62htQYir6>=~MBjBo)-l0=9{YoHI2_w*SC^bL9{N!Ur6B!~7?1 zU8yEC996M>^*bCh0{y+Nj;I~zG6?s5G59MiSV9?$)Ht+cRNK>~QJ_ggEqY?h{iZ5! z5+Rm`Phf)6!b~x*-Dtr|dnTnvLmevq_*ak8B``0NjFqS7O79^_W zbS}?uFYCqYs$MvWhG*Wa?u@e%kN$2scBza>7;OgOvEt{;N#c>WS0~(PU)Ig6{4bK7 z;gc}F-x)F`zL3WuN3q~|BMP#bAeD*83B5&sdSyKH-}q&O-)h3EEOM%f5&j%Cz>JtHaAQyQ4Om+`nLhz_)U}H z^V)TCAO3lsE+-4);k$r9LeKl&Fu<=k#d;xT!+?naEpb$px#GuhyqmjRvRZeo&^B9o z9qn+&Ifc|pa${@$ z6A-_m!IP1)riSMvsDnF9Oi-7~uYayM5a%u=G&QofTo}IUY&?+-*?D#QSAkQE%dn z9y3f9bHB2yC716a2hnGaoe3ORkW+35CCzrLiICqCK{E>;mSW_zhff~C#wz2uL|9qB)7xcYmT8Ig}e`bVK1ku%6#IO5{81s-y;lEl0+r!tefpfo_I9*Rlz`hbNTvt!@?!v)j9**ZE zhE<}C7}Che<9k1j`}8~Xe7n7lct>k)R!1K84$_EN-l>3=@#9RCtpxb*%AXe4K3Fgw z>NN7}5fVZE*oJfbXxc7HXhoNMW}oD-ukw_cH4wGTnoPLHiz7i9J~jU#r!Ox7)X*t_ z4@j-$0|1bT88NFegzBxZ@EH5}Zo2aKV@)V?Kh=%2rc!LVx1&@93OHA<_1O4? z7b>WqkLVLVxC695rB8npi|;Ngr~V2;+c+Qe;WkqVeLRZ#iJ{IP!0FPxJFA6*_x@T> zNcAVpRDHy)xtx;a_ii8Ji^6bH{J=|mveP9|2Kr=x@+__wB_hM4GxAy$ z=o{WW>AS=Not`lLX6hPQj+ShGGAco?$T}WOq^8_2`b2T4^d`5zz83WSasF&k_dVOJ zt&%bE9zYr(Cu6Q0n3$re1^RY9LwDs^Acas^YwMr+lX~qGtw`0k&@W+Zln(vQW@?Q%r*ImM}ef1pdFIP zwz*i>=)uW>trHXvsn#f^N&N!Z(f4JZtPUA}^0T7muhzb)3u}`ohS!x5M7sg9!dm%E z`;{1~Dz+HPKYy4qk{6RO-cR*xDUsnNAAkFc`8q2e0zjST<>9e(b)@@y59Faq=D!{^ zt#B}?BWP5}#Hs+XB zsk9_qo>1{IO%Fwq7X=qCPF`Qx#6#p+6t%wPxb#;t z4P{$7$N@+(;C(V>{{%N=bVr$BAMywwVg1LXAnk_dmNf6zS0G=7bMKD5U zcp&MXmdVuxZRs2=L<-$f9_4Se5O;i?5C(t}GSa5x5;T0@Xo;TycL#3jVtt=D@ndzqQ?<%%B)`P78T1cqJ( zWGz!AXimNx>^ETIT*Qn6+6h4N)CUb#v|i#nSmXxI3VyF$s^Gq$-QvHkbAKj$0QDMy zfB61`IwbHnB-y05SVw2uUTArI zBeRpV*yVPa?+etfd)@q@_d%_TzfV6=jE&69WYAUeeQf{oDp3j~=bML60m&mT4U#Uo zldo!cG(Hqr_H)*_g|Rid>r~zW4=rB*+|7JWfj}upg^Cl2ByM0&VNlLEmm}i!$yPq4 zpijE%q*91nxYvU{Q+mNkbk&MyFpi@SFO4SNQOj>ur*h%Z?ryplLY)}69RZ04BjCTD zv^cPYqhCL5`dpCoyALey{hE~ttZj3yckFX&M>c!3&-*T!HNN7~lG%b&*sF*(D#s78 zR#pihT}M55qQ5diu*^7Rt*|)rWote>IpsU!%7sxlh_S$GD+3JzLx4D<$D4f6!llEE z_^hov_UXD9#{2nfw6DB%3Z7kCZ_{$WR&tXlp7*AQxkCxJrdF7`aL;aV+eOS_FK~{%hG8ZCIIob2BD+KyvB@o*hpj=LETug`wT_Xc(RR-Z z8qlwF?vg)D`P9L!IM9EAT-zdC`L!IR9tEiMm?GNUoFQYagNqPXFbbL=n*CbdKY|;3 zsB7os|Fv_p{!2kVMwnEzKKJsJu+K$+Q;FLb^b88SFSB;vhorZQgs(?y4ZQ_%3juHV z6bHV4FLre=IeZsYkLF9M^f`r*wRZ`0Hr~zTmy)0jzk!l>u*bM+W~(6qEi0_o72U9^ ziQ(1UIe&>KnJ7N9y%ce5sA)cth{$gjXQiL0G$ugS-)gb3Wa3r=V8k1D{^&#{2K3jX zac+Kf&`kfD6RCSi`RUEgME{1Pm*08IN z!!8|xND;iKLhqEMyn%kBf*jmIRJ!RhZ+2Og{~=IYSo9XkpI*~o+KDqRdOQ}CJ=mGP^=jE{NG4 zNsn{XbyQl7tv9x?G&0MV;>rJcKmav_H^$h=;4Ya37+O#M)(;PE`i*Y z-D{!-lyoen&R&y(1q{d_C#2Nc@gMR=CXIMjb{hi+~X#8=^#LorJde=mMq# zH!!lc%0pz~nkgNd-1LsNu=HDhn7-bctv|@NhTPXDf+}Mh>R4xE?iVb%jn2em_dVK|GDV&ZDI0_@LaiQn$yKCA!VCyG za^`JJZc?!&SA-`CVInoYeaofV@z&&~%N#O27ZE$eaD*)0B=3Pp^1h7zGR(28k980T zHIOd1l&9#RO?ePu&a-DD$wmat!`0iBg?hl!i8sW2U~OOa9qDi;N$az^x`L$J9M^o1gIVbMLK2ake7#+M^6C=RV=y;vM zBai8a<0{Do7axAgXzG+KF$7Whwo;EsE+Vum5+ZgkYZ=)Rymr`n1^yT*-!y~T=VvpZ zzU1+IrBkIgt~5Y)3(|0VeD<6&5aqtD&gZcIkQINvx1p_3@!lQnQ+eqdd?{NeQdDT?v}HlV%9v8sdTR@~(Cj88{06x=+m*;(m?%(*Yq3 z2w!`k=W=BbCNk(S;bc$S+%>)UeCjvRuE7) zWXdzWheFdKdT)N;^0?P;MFx5)sx++dxweme&lJQ`^>`mrZ3fZA;eHF|M`jA^vcg9tjF?DCsO z`?l=$)*232D+5de`w=Q8BHLFtm>-an3pkTKg(2=ErFO?7vZK6)Y^?^zOHRs<*@Yry zSPuknswk~-+rN+HB?^D~>;qaR9=p zKImg=-zqrw86sCk4U#}~Z|73W69#Wc_jm#@=v#67#QupbaQB^zN%-r2X015KFB+m? z*hejS%iLTA@8yJ=PrFW1(63m@&pWnqGSFA#qU(Z=kS_3PlkHi#b3u{^mBE`EHz|mn z(%N!I<$sQ8G8|76wcl~=C#xUlCP;q8jN+n>#}}#65KU0WgpP_o`)UWm=;f}IblyRl z4CgMJfzy-ebN|M83c_oZc(dtg;@VRZJidQWA0|=fBEv@it>uuc1=_2S9|)nbojvJH z&&}|O6r2_6J-s(>tCfP>%i*0ZGh>Qb>QU)CNQ20aj}O1>8h+ z?4sVrfGREF3t_)WfxA7|$0{XA0D#tK6=o$pm-wm=V!gmxC?tvxNtPs=lyb{T`5t@X zRa?oc^fb(zpublNBEnCFej*Mc^ot91lk#h4<|`V4JcZ&{kR8P#(y$AN#EnJ$fatiQ z>>yjNiUoq6`+fKH7Y_9Kxa4#8)RF6a*6!G~+%CgxHVkY^CJ?8}3jCsu-^BSvlMc=E z6zN4Q*8EJElxPV)b2Xa69%Fc@*a7N!XXq$msoEt=QciBp#GlR3!tLYPvhh#EHkZKS zGdJyAl0HRgO~`2udt`yU*%E<69>YSkIKFGX1~i59Nb#!hGb52igx)T2Vm+=1&df?j zW$?OuO1`*K;6_$Qm+9n)liHUJD~82OP1Bg)+hKQMIYL81KoXYsWGkH5;i*PSh7jtj z(NPU%T;el6sl98IF6Q_t;Daww(jFkE`MW^90&@(pRno(LkOVC+00n#AZu?ma#W-Od zg@`h4zwxXumi{IJ z{7=yyEPX-a_6YqyV4a(|oWry=xk01OhjV#;7~Y&a9O@o*^-=PI%?L`kH1n_^>cTd) zuX^>k&Z{TH1{$-zHQFj#k1x;CmS6wWh<-9q$l1w}JWLX5hk_BM*uQ8@;`;@qu;nhZ z(QoCpu*r=#EI2fd@_v)}PBdE=-rTqeDjm`|u<*48)|T|MG(KK3`8yFA-irh`p1yg~ z&T%*nECvY z{7hyU?!BMdB@ZIfOwk!ceXpi;;aO>3(A8#9K@maH#VQcLPovb#`2n5&`+h==Vm1`ciVhSpB5&&)psb{8)HcQN@`CZ!ouJhX*!kJrX4wEX_8XL4 z<#!c!_qG;N zEYumHGKsXc(_R+9a9-6d_OYK7JmbEiyRVK&A-(Q5u5r%hUfs=p!Hc(<+d?xk_cf6o zxShnn6Kvh|#-Vf$M<~9%!eW*K5ysyqTUW9umG&%XtIzjBHW>`I=%#&$IP71k^*MUQ z{8Q7u<-lIRaJU~?$4#CGUgAxg&^2}02cpaQl_n~Mz&p^T1%9qt;JVEeW8cL3Cw1#( z?s!(h;Ztn_=vjG&s5~2|mA^hM&OFZQiwo0!1~>(mI)ATI})!TE+3u4_e-CRNexnZDH2bM1*q)gkR8#QDFe zg4n(71peXyr~+!mctxBt2;vB@)x}62$f4{Y>#y8$bT-DDt5oov<^YJE8_DM{@6tmz z_k-uE(e{haQ-O~3oEKd06H|EN&0zU$14&|+Ut5yTE=n8vqHVPJtVZZFCI>ui&&T1kRE#{g$a7EGpf)(D;Y;0Gm6e#-^h0Z9m zNmN-aL05ud#66leqHgK4@ABkGM}x8>?+H8tI~HLRCXKlwf&^-HY~iH{W5syzyQv>K z4xq3Pxg$^rSc;*`83(^fZx99;0M7zP?5Z>r`9n|P8b`t-{yUo7sS{pH zn(~Y!RLpeOuv?QHrAu8or-2>YIr-6KV>!4R8*Pl;V{JRmP`I|L4sY;g_r0aW8$u^^ zovoun7RX{<4Xr<<7}P{e8=GzK5zkE4{_S8(5KZ%mr)9KEYo*uHkURk`()}gRs&A0p zxuA^saaw;?A1r}PGU`axzz;tB*{{tAN$8-&M{5#lam|xUOx_d05-hw!0ep5o_Fv#CX_;67FZa7lYdaO(N`Tc}Eg=4WLLDX_Nnfd^!sc7>A z78k1b?t!P_j%(U;8f5zlwrCOLkOQ21_NrvZa$H2y$e}A!XTdz{jb}%2Kt|Piy4Kb zv1BAsk-3PBDD=cUxed$|lEqfT4~;RAKU?bkHmU#6z1E!4Lt%<)5C&6@a z2Cw=jDKb_*E4aPDYqNyws=K{?H2sClD?9i)e$PK$MXTy4{6ZaPSuvH%ID(4&#F1~} zl?&XS1e&z1!Z9&&HX(65D2 z`v}yaTmrhjb%UoMajsx|2S?dEAQFSxSKK^VN#nSRL%Gwn6Y6(PllRqypw>UAM?2ox zba_t>gJYm*UJ*IorsXWjY%15zift4i%-{0YcW+DLinBRQG%Ex)=KByP2r<*n$oW)} zNKZ$~OA4#Ce_3I|5}$JVwr<~m(J7NK`6Q377%*3+g^ls59#%+r#7BP`i;2Zf$~(=S zf(p=FlcM@OIf`u`{oOfYtHpBMhDj9vAW*!9pg`sz-du7gqFhVC%&Ugj-`%J0C(ec6 zj(%={qmHNT^Ov|ZUlx0|$=SnLd9mU;GD%(<2UQT-T=IZe%_e70_dC7GN5 z(h_z+L$-s)inj-yOs1Nmx`yQb1a`EEiq3FB7zimRxf!h}pIk;j5%jHeaDBUCdf*Q}#@4WBwzwf%UNd((6Bklu2m|>SRCjc?<&bPLI~lBVF9Wu6 z0ge1mn}$KM`05U8EP~$Zws3C3a!q`fk4<$qa6Ly33+WYn08D}?e#n)tkt@7EJ%7KC zw}_{`XeVpLIo6V|^zy9Y^iCF)(KLwbRc=GiKtymmRh9WqH^^KfayrNUp^+rC!*J6S za2y-L=u`&&dDZ8Z^1PI;D#7Rxl>hX2!yNnB{0Y+Nvwg2@JuKJQ7OR(XCo9uxL3!Ne zX5R%U=XqD7W~QZ6w_065>f{gmi*5Tf5Syu|I_tYS<9q!i|2xgYiwJvy;=rTpXQ%k| zBSd1`^OU)Zw7N@i$BexR^{VhRj6_~MK~A-0XY~>mnM~YQ`G^t}cVW4$l3>LL4Zkqf_{hV{^_dW}M9iFn1) z;NysVemif56$!S-2I&^B450-HSZx6YTI4e?cCgPyXV*lE;R?Bxx3}^r73xjVjbw(u z-`hVMFZ0KQT}`?$Q`xofXO3$2<{ibs|A-2F3)>8YeBgt&68om3^U1wVZIxT-&ao5r zn4kg#U?%CY`NDHsk3XVLg~4;jiy|cf7v#h7?#{cUa6E-#~0ZJfE@d|(sl}I^SN&-dXSd zadLir$wwm_avqt)dgg*YAo`4Ci^sDo7Z9slgp9%Dc% zx_Mn+hnLJj#VZ{6_*LJx64xU`d=1ujc59DVQPj}Y0UH}2az$0x+yw(f(=IE~ETh~1 z!2hh%`UAir$7HXq7!)QQ2l;qTPYKwI%f0xZgO@gJ5AGK|NR>G#GWrM;F)=(c1P^ct zE3{;mWwk6-HI+Hc{E05!%6*vYsIi?xTjFrvy!n<~G$+y@I}XZbYxw&j^ir#6_FV-N zzBL&T?i^*=APKhds>o)I$eSumwvK5LW647D$bMZeRaHNy8+(O{Dr5HU?E}9A_^auD} zWLb3Wwh~DH2m!ui2Ma#_K}PLu2bfsTnhy3??8NUF>FHll_ zOnKZt=YA(%{)qyIfoys8URbIUtW1+u6}2TULMqQ!bV5xFWI>}+(^9m1p`}}&xpR3! zIeK2Bm};L{=4`<5lT$v@R>u3F{tvSUNps zRR*wM$$IE(*}XjGMy;EHX}3>^H7rgFq7o-})razBE?EYB_Fr{11O#ez5^=^J$AW!L z0wx>!a8TZaZPJD3!eFwf=4aP}dW3yXdsVhtFm^#K8kKL_!jn}v4+b>O8`93P>BnM? z9in)8#=~;V;xEwltZ2rSYm|=(R8F)GDxq06J~}|q?$9Kxw1jpw>RKim45Z}1v_
YI?T8lsebufv#Nhf(Rt$3pdWe7&*nb%REtGWo;ifWg*p#M7bof>aYC$pR|D zDuho5Y?&auLs^U?MR7?C?K2;jSFB+#lD!iaK9B zs1mOsPn#u$&Avh1_6QAWJ%>k|A#=ODUpxzajJz9t;&SmbF{I9*N8(S)`w0zL`k+6; zJVzr&cMq&Dt|pRf;WWA|f)JqVP&|mN8?_$+_}NR_JASh3#_EzmP^M2-O}|+$GS|5= zB^U4vPp62`P+a5)RTP`uaC$L~Hyl7o5Xjz~@O_s|ih>%N+iZm;dR|yF?~PDElAWF( zd>r-7%~~@%6m0Ry!frTjC~!G-Nhh_uz+6{4hjY&=k}D#>L!ZV@u@zR|k@U=t4?)ec zUR_N%2DU6|?eNq~Ym*X4Wcg)X)7DXYnPga~BWa!dNC7hAQk#+YaZW&O^c~TPqp5L? zvlbImeD;;|I}Geip>G+QWb8glC^3Ae$0xmekyjfGss@@rs)%khM;gnMxWvWUr?ncL z?a*dGe3}f$?I^TcQVW{enG7ipYHnb`gY~;QTpUbUrL@vG(61~^DvSLbaYU9#kx1!4 z7XfMDluQc@%>ZxSjRU5j##9JwyTo;#rCYBcEk!2c=`vxeM@Ujs8YpzPX0J%p$aES1 zr&5Ys2vF>GgP@n=lEz!rgA;(^-85_%>lt?Lh6I&~T%nsG)&xgHRA5y4Ng< zdccsxEcq0>AK{33{|=yV#*c7&PS;+3RMWFAWeS$y@**c+7XP4-@?GOIa#T|7@;$q6 zE<>l8Hent71)J#F5)jBu;hEf_H`IywU@NwXGp%u-w$PV>BaO^hpqy%kdY^jyr?te*9IuhJBUFNLy;D?8dKPH78W(3G)gwY z4#|wdsP@5BiGSXad$=j@ljmf!Mj#?7(C*~NSi4heJHt9>-=je>cG(SjzhG3VEHm;F zltI*2YmAf0+AKwg_RDf*ons)}&Em2XWpdVM(}6wgBxP!IaAK4UU6C05vbfh(KXKJX zf0*5|!kq0EM}y|4BmmH$JUR13Q;bqG{ot(G4^%bFQrLE2HTPnOys+V9BIzL4k0F#RH&zvFmGH|men z9h4Lze6f-(aT8?pS8}Z|6Z@AnLL4PlZ50-sf~GW?IO3zfW*j6Gi4na|N5(44a{2>! zLe$iE)}iH64cW&&(92~9;JIV%=;}_)9NF*f1Ba9}enX7=M%&BQ!)&;Mj3Q>(wU*-w zI&A}^?!<3rQ}^3yTlh<&6ZV;JIcItWAZtT>JRhAb#bHkYd#2NBN7Mj$pSGOoe*PHa zKgz%FT|A&MkQ|mqGV%!h3EP{O`)b&*gIInF79Bwhj4t|etj7lpa5`oH=PU263imEb z7&*}z{|43w9D_-}{Y7e;zjH&4vg=6h(;Qptok{%0>$kxEmg5S#-ODONKW---|Lm8B zDemua5*xKKIRyW^DBw%(1|ntO`i5#6x50ZL%C1Iz#8Fu8^d}w1_fr(Vg`|4wWZiA& z%YE?|{kJze-bL$Zs0kQ|Bbv8=0@=3lV=4%(Uzsp8OHRPUKJDjZ=%6PMVa77}EnR;R zwlz%{w>I1`nkLC3h)HZ?^xPb5gF(ylN~6kfkyGA?I74N+!Fa65o0-md3T|)`V%68P z53;p;P?EMiuVZ~ZCP<=x5Rm> zRkp;oE9M22CG2Qx5WvlOs1GbGeEIfrdt?rq5pE51rAoLq{hM#MLsZ~v_Yw!_HB$Tc zhbbV!G(DX%;yXn*+0$X{^4kki1Go1}itVI0c_#&Jd}>Ul+!qbEH*O|CL}^SEot$#E zqxtSr`OYV)&d$+^@9!SxHNR0}nq|n$rri~V!f9K?;}0MAJT>yGr_v}qe;qv59Df_t z-NZ5v3H(m2<#;L=I{Zw+z2h-}5 z)Vaq{JgmSLL~dVect(2KT$CEQwG#QqgynSDJ4q=hDl+p(x1rVWU?vtYyzBKnP$0yO za+aC7u!|DwtW4&WZUkt$N-eZ-zgGS)W)zpw166JjYtoNB1FE`K@ApeX!TGG%``I(f zu~(oDZ=_^~(#MQ2(qcURqe?YjPJvX1sR3cT*KkM$G#i(*NYH!sv)Z1J$r51e$uPOY zr9G$KlG=J9z^_o*f?oaT9Gy~DH%QPZy_JHK78M_+rFHjTNvE}#o~q4#Qe-({9O%XL zoer7j_hfhR7f;B5qd(SwHBUpyzhXF=@pl$T zTJ|?V;4TFGb*>(s!LXmW&E9p)*_yO+u(pIu)S&NcM@)%1aad}@bCvaV+;B(SA5^xw z-LK-A=~pvSIyo5W><=d>?lxnXNlV(S(&6Cso>Nu5kd{Kf5Pm{|0I!tHlC?7}e^70{ z3BX_=R|%y0!b#Pee$9mE1kg|nmi>5`<$yP;nIExZs^&E(BYSLvCz`_t1Qr;tEN=;zQ45`(Q78r1*xmJEJnGhT2Iw3(8Yf5 zqaIKx^uFm-*yYagMy!@B8zE=8OMoj?YmVvEdxGu62zcFWOa@#CsiH?DPhv=J-l4L@ z@`&FXG);T4E3U90P&(=H`yBQ%B;#*aa9|QNS%u*xrlW{3tg_-vEG+2-M9ABNz6ku; zBWXz{j@Vxb*`XVX7$*d@ocGPDtK!#GjTZvr+IlhcJIe}UE6p2kc}>Nt!#ZI)zb4ES zu+^fIrRAV2L3;v#l9z#G)Wa$;Hq=MQKis`!C+*bHD`xGzcWE~Z7}JKuLWP>lIs3P1 z6EGYvNWj|~AGDR*8-{R&0ZkFXQUf3du}SG|1wL}_k3U50{84)upYL1vayDsp_-E*`kQ&`*;sr__t5$InR7W@Z-8^#q zD_NeWr|5wgw)R+nwW@I}nW=$Qo~7kchG4BSf=JHu9m_?m|>tcZ#(y zIGX5JjxmYo?eo?E!I{4rP4`Nl!X0ON-WLs22it?&$QlYDw+ll`%=Ft^=b9LG8wxXw zGGEtyS<$uv;X}2H*6Kr1(5jL< zc?XRb-&7k6O0XBWlOct8L&^JU%)ny7k2#Y~RXb47mMrC%OxrgC7WJ!Y>x>-DJ@qtd zRIpTT*~(;#5gfdVGJZX-a~9qi@#zxC;HN6maV*pGrKRhCv{`D|1<#D{OX@OXUS}!RqCgpaJtxCtTp^7fR4+MK-(3d2&Vol%EO(1*fYUZ;Z#y<591jjpQqI<)9m|*O* zeuLx>K7MFsvpJtaQguy+5T61rt}OQ1CEDB&byn%vsy7>AWv?c(y8y&JTQeblt?1s{ zvfH7iz!3WES2HnM78E2efdj4V-IVV^IaMJA2hWZk>6F^|U~k|kV}bjDYcO%8=`pKN z$s`9|t3`>#OZ7vnkql^$qvAtt|GAF1!`m9%X>VjS@<)lhBMNX@!%@f_~R^15*T@j47DLf z@40}iu$yrbuJ`udkS2gL(*x0s!Z7Xv0-oG4uyAdvggcB}4=^-?!YUP`>uh+`s%zZD zidt|0!FQo03nlXajt1jlHY%3R#DWd>Aea%jlMjtD)C}+r*)CuLl+EjK zpIdAp166Se8=wl?OVh1zp@c006H>Lw-h>NlWmeFHlaaIx%xr-D3^>cqnLVF7J>1pa z{iz|_ST6`%T8lmcWRPhFH3|=KNO&hcX@a>XDF_KYv|wcQo!JRg#IJF;>k$IZhIsFRruD0WYHT! z>14|J-3zaxY{zQ|RfEn389#>M=antGWgsWzC?Aat|B!lHSH8kQ^Ls(a=e&$p4u;k) z68-lQ78v>8*UFz=5ZCb)D>bU*0|DAa7HgMy^f+Vo{gza(R<&`hxRgJ?8gGSG2?&y% z>oxcIJGX0r330^BAg2e`nXq%YxJLm$bdvhSGjHJ{U8~xz%rysW@cfqQ_4IqpW!1VD z2~hj2!cGn@e{9E1eGpxO>3FEv0GGD-U7I4ld(e>0wVCsyzcoO!5r2ks61P_kIh4BWb29!;{x}jv4oArVH7IL4lf3kJ%O=pU*2bIE=myq3re}{uFR2dHvoW~@N_C5 zEMEO`=Xk*q{@i@{q7h%1hPhItsUi)#{jLS7&)q7EHLiM|d9ZQZqQxXoJY&eA3+j$x zz~<{DR=uv|$UtL1TA8pa9Efct_oU?$l_+IWpam!`STy+9$!nds(7fOXq@`@-+ z*$$}vlMLOadJv04$z%3rTABHw%e%mz??FdpiQrq-5nYBFowM5H~0FdY@a*jt!8 zME9wJS)F!ur2jhMGq=xHB?m9Myo?a{)HQK`V17ME!hxnY4ahQ9M+7LJh19)a`1LFR z;{JFwyZd@ufF zb`NlGfe)$%vFa&^7N-Buk7P;1*@00POzvJBZh)xsUrRgHIOf?mfCzc>3(rfrHh(^A z1oUdBQW$RQYmMfFiF%zT&ZU3vKpXS@%8LD05q;I6>(!p zo>bVK_J~6Xsvg7Ifo4iwfxqe?2?WuY@BNHW*`>t6i%kjpH`##pT zt;x~n*BR3@)lA!2Fnj0tVn z$4T$BhK@PA_VunvE)6f>aY5Q;DC$GpoWQtdPbl-S#Fyy6-NT9kx8G-#EYeStDF`J8 zeQ~yWHpXN}@^#OJ4j2~z=Jf$87Cv!hFS^_RRGm}_L*G~0Jlh@> zOz?EWb+Li38az{{*-+OGb@*I?Eo|xJt!X0#YVw3c_jp5*uaF#JW5NRZ}7|n`sb6YvY6kX1$p%dp=5?kAS@^ds7f5JXUd@j=h{rtN-WcY z!TRIKB>b_SfTO`RyJ7iPAMQ*s${IDEZV`!MKlB0RqK%uZ$bD*aPqYDJJ}0AM!7uxll5Dq73eU)G-x&QOZRcdZg@lonH=pnX*e38e zlj(Zfz)j{NGAqEkV$CSnV>Z-XM%KUoW4C*Nzkjb(mg!j zkflgmII^UgpDGixQ~}DW#@n)haGlUx-mU#*s}k?LK`K}EP!I&p;*j%v-`ciJ@74Zh z#6D`2FUJ(dbw_X_T)3bPs4epAmMmD$!OE&x+rJ!Xa%&idkZpf~_H<$K#ggLBk$A-B z&@VLbC{BA3!0=>8?X<&4*Ejl#)(1@qXfA!sr`hvtU+|1_M-5WRGdQfSH(u#>WtPPI z!|ys*;kB>aQD-Bz$RTUD8ymcdQ}l;>1gLBI*mjU%XI~|wt+v8`cKBwYqfWI4Hw`78 z#Za~$>kpMRT(pkel^yic*6y4)f^Ifex2Jpbm+~cjLmABgIWMIaeKxtQb<2(}L~2%m zWab?xD)e&30g=}@l$g%Hr$(`zhc&cE6wMY6Mzv3H^Yw^143%$d(f0amX%G{CP?@FPm>2T(Rqpxf_1l2+UAHQ(dHBlAV)D|>RGcLrv zBo{a6`*h;sEL;P>mt{eX*{ZAzMB+0c{5pv~JiIYUWoscwWXs%J<%5J<#N*fx>SWW1 z2iFdER#kvqa@5-Kp4mCyf;Fh;pjA)L&;B zI7uxR54$-`>QkJgKSH<}fjR_aUHu&!#fiq#mvpPd#U-pA^9AK4EGcEnDbikRVDoH( zFRghJ{Nrp5$;K$HIxXsk3Y*xS+d(8_%cH!E#KURg$78WsV?<$eHl5<(;M>!Gf6OAk z?_v+{BYmD+YcapWGdF;h!#xlZLo3YuxeTG4a=v%M$vjO+Tsg2?(WYfa@Bn(?Qr7X# z(U9wv+@&}HCK?HlcDak=F85?`OzQrbtwW9YCHEjN8}7yF!TWp%hLGjvE3MLs%j_qB z{z+R`pi1>QS`Eo5T0cO5ka}!-1d!CKcEWopq=gmP+zu#6d z9k0UQz>86$SJN>QE49ByFtR26!NXxSQJp2aANC1ae#v4NNTVhcsN+)yKbaHh)61;= zBO%bx?}uA8_1w{hXzZlf1>N}uHGl8S7$U4#Vy#nHzUo#GfwB=)-4CB~PS7I<&K(89 zyE$5+PGB!o*y?bRY2$H#x5aQUwRLo7mg7gm>N8m?(!xjHDEV4#(H%Njo?sSQ?L$V5oXesp zPZSpFWh_?wFb6;od45M2j(5b!9}F->q6R3!;;;qU5bLD{xV%Aa`3>&aCV)>Ps25_(nu<2z zxVx%Pe3IZK4#W(ZWgAIoYfddmnrC@xD@$54uq4jB1*B$LmQ0H>cHAGhP`UuW5L`Hv z;wLcNX+MX#hW$&xxAu^8^dk`JsQBwshzYvVTV!FV>a9{Wx7Zt$b{fH8EXK;H7eN0V zzzfx8qhSxX8oE1j%QNmAZFZ_3kym7d+aO7Y2>fxO?kDKYX&$;1-OKMRma75UUb_4A z*ujN^cW&7!u=c!u@mwk)#88S`Ffq`mgN0Id%XNTDF6sqriyOiM1?G#ETs@pfHx*L`mMq71z%Mmstc@#e>~ZhQI7@6aE(>+mLKESH%{G_8#ej| zMn)luttjhNuPKD7*}BTZbS-{UiEmDXP4GkdI@S&*OY zoCLBYYV)eO7fzN2^}U3b8x=Rb5v@yD%E~8Q*&V6+^NVXQv&&uX-R9z?uAz@1fzhm+ zXT&A%x?`oLT&x`?UnnofLwS5Wd9R@UQ>qsvMXeL@>%=*eF~2|0J2IE?I8z<*OnU{ z7&u#LZG~3(PMAx>LB{_2Ik|mSgL7(aoJBz6FiOU_bb_%{gZq$d%}94VwSWVCdsFU{5_E^*NIb1J~F zX7i@8TL+^z;YdNccQ(D%K0kideYB;}`X%#XM#(fRc0l*^Wdbhnrepke$N<}{d^sFD z{tr+JGtasBe()n$I-I>VKmN7#)XisA0x9*%6R+37(E{$sljG^-eElMDUNy$h>sW$8 zSOg0enOvYw58%ssrup7X{8MkvsPrCvFZij)5%wnJJRrE;6u><8T=(+`D5gejtHT3- zZDM~b9t|`{1!iCEoC1@NMCld^35?~dgM5{oLoRj7^KCE5=@@XwB4HA@eXO|*j$vx@ z4(KY}Qx{(fiG?rthKx#ycGoRV=*(YVFRHkZh$2B#C!n7K^Wle?E{+UthQKE&$rssE z^VAHAs1fco&SA7eQm#A?)r>b{fep}Y3)ZduP*#%`j8TWk0IOf|P~KcAj%_7>UUEin zNWCn=f1~gEcREenfc&DOAyZNEo}#_`F>B+HG$0o4KrV()Sz$laJwQEU9QhQ}N8wc* zMUi~fr?mHuFKe|PP%HejO?B$ZTk~oDb?aoBLRNTNow-2pgLO~qUcq~VL57-u|8f5# zk-y-!;Pm$eJJ9lt+|TEb$I`<~#(<&Zi& zET3ed$o&$yRglo2k!Fkk0Rc!#-9`x%D{ppnH54AxIGBR7+j3wmsVuN%7~^quDaoq{ zt@p$IphQ+8CRhTZB&s?f0mWY!R>C9#$`>Oq>)9UO}zubH2I2?p-v+{LA5 zdaS^Raex%)bQn7vMq%g`PB>_ajCU zX8?0ogK{N%w~+gd2)HDoJ{N z1*M%9>-0V*tO+($Ez|fWSLsg6^&a62>Px6-td1Y$^DU6e&3o?*YhOM-T9#0(rzE(P zCDB{L#eF(bI83tCfpEA`8W3eZwD_IiRZ?S z?{bCjQjvFoT#nk5z#Jx0!DluZoXEtVR77Z+_anBjM7x}{cXWOiE^%ajeu5#^=MH_D z!9<#!S+#bntmSKq9>GY417RW~4=f5EB!ANhta0PuM84AsNv8f+m4QHbWfB<7#o8-! z;-_iDP}t-CF)jamw}qsEBCxTt(B=aVv?}g)t_mHQB?V6*gsr^I>!}n@vhxR_YGm_BSIk#HJXNOkouhYbpCp=6R9Cg+O-Bf-s&z3~1tKm_ z#@3jVtQcVe)OrniQS!j1O1jMWg`#4Mm?AnpKCnYIrLYJT{Y$mp=WDx-=cIO8&fhcD zdC>%7K&Yp`#A>VVFP2(JxNM~JW1$u?dtHcVk@w!#o>P~g2~R$A|9953eklK+@}JXbSQ7R4z{ zx?WV(8@p(<<&Qr<|7*$S{wOMDVx?Cz-ji8pBpO^b6WUSLZKo#-Q%wS@H$8 z9MmpQ{Y986vs~QzKFqoY5LD}e84FZ?@gPp9o%5G&DxZ17xBoHal>z`&q^Es$ag#K^PRKh&B2$TNX{ZJj}hY;0}_Tbg?Kt??w=<uCSG+VpjI$scxJzg$pleHY56{;yZYt0 zHSr3OfHHR35m7}mF%1U5$oBl`Fw#siXyh z4lgr;R|%vuI4H4~Lys{3F5(mwa?Kl-R{wB!P^z6j0V}fXXmQEt5$dDq`I%7@O-d#u zP#zR$kp#POi9pZt_{Jgyp80I^kd&}hnOM#qf9msyRe+wy9(cRp$huTx^ z%^Hqb;_Uv^=vWN!`k4 zvXJ%ob8z=e;{18CYs2Y^e6VWK5C_1LQVj{I-wd`|z}BTsMcV1^Wik_hRZ{+IR`mp^ z8NE41E2S_8iUJ>xStn6&x1M8C48}^T`_dh{VX-OvSv1b3I|PG;Jer=)=bwWfh}8HF z=P{pCA-Jd|fx31QKcdduM8@D0sHMXHAmRBR(VFyLe*_5P9DGK8kUbL#fC~?_qWFJt zhq5AuSBNaEEGxYVRi5W{DN(X zkI=vDA$<0nU*Jli>bbOSIg>`$bSEQ;aa!B9^Dl*Ou6DHhl6&kBd3=lBveXDs>^{8Kqsu3>251KO_wU z#{#dkjCFT^cVw?7$eJ6Ug#TL7$%9LEq*-~BkrQZ|s4wz7axOhNqA-Y!KPIO;Vk(fk zac&z$pW%04K#~ig<9{Rp08Ivo>3n!f0NWK`V8{{&#;yguMYwkUPF8b3X;=GfADX~#yy-QFaXu~R9^IgOI-KR#~kWXI1wb$3@2VgD=D_zL&x&N&hfqMWBNJ=pH$IQXp zVKU&LLX}e}-4oK3m5aYNBXfwdCp?mE{Bj((1nJO5V*~`aXPa6eg1xDL*Tta;9v_vN z+$u38CC%u-i#N|sIO7}Kt`w~wY1p;*id&GI=j&-N>+qUJO(mJA>1k8kF>a}W#IFUi ziYnK>=pHW6Y^dFPea0Aox&WO9ieuB9dKe=3MbpzD)v+iti5Pq^u0SE!a?2Xj6%{4M zK=(;}9t@DeNO={Jg@H%46*^OtTBvYL*PCj9o{3fwCe!W^Q}Nx=r*fH>E^TBW2+nde zD8|h2ytK*^HndzKM&DPe&zwt@Ga^+mMoQVkK4IqIPHNpi@QT;rN}Aw@^!Sw|%9@wK z9haS=Xde+ZkcDLKA$aW9HX%>z3g7}uC?fhGp{G#&o?v=D# zFTDfl(SSq`=jx+i7CTd20ar?Lh9Pb6Ach!frNle zDQ6EX$-CCsimjG|0*-Ov&hMi`UJ6RA{&Ttyar))&Td5AiJ0Q!#E6ntMyRTOh8JlSj z*B&1N$@5{OVyjm~Oj%5fVX23U7Rz9%)tLtD?(6kf`KTrFrETY^FtlBYn9{k|N{Z=C zIX?|t!IMgGO;zEq3~dG3);y$q`8!KXb4PoCECfw1P<4C3NIgTgVl|l5f7Gahy;ivp z_-AHSL3M7k@uX$i`E*H*Gw2J}B|X4bd%qNv1czW2Bg3Z3Fd;~Ll8Wx?%gYLqGg--G zGQG9tCy1k3a=NS}x(3;Ve6ZQu9pqSQ;kGh8lFNm>%@rBRLYf=XfAV}7u_86-d-9OT zb3NMPDA-)+Lsjr6gpANL)bpZ@tsPB^>ydtA4^(QEDltW}WhP&0mrl2viglIz$(1tBh>)g$5Xhf^Y8hDC8nXB~VAoj6533#H<7#S&OK}*#2bkkYEvm zdiJu@@hNVKhynLf%A1wNnU^6Io7(hjC$Rvkt*8Jci~F%SSU0ya^%O z=pYZCZ^Q26^4I8^_2@Q8EUDZuEp7bpn$;{h*0fhPQKl0+1TMditWAUY4r<>)qj>pT zAFZ{M89Mp=_>vDB2)_QPDA8-WKFE?P{S-mlXsy*;zxB#-3|~lUrnlt0`-op*#0540 zZ*?Q9gsryk^|~^T_h4Ts#+z&DG*Sna+%^SFASdaq-?b&J^>DeLhtxkc{f)@AsLokw zE(t~Oa~ytITh+xAAY$|}Cn|2&lCngtWurQE5Uis1qpB(V2z^D%n!r*T1T@Pvx`xL8_y;gFA6GK;?6pHtl8 zX5moG@O#ylBW$%_ShB0b*+0{uFZj|350k&B++dc0Or`rdp*_(tHB^}({lS7xJnk4S z6M{E9;Fs)HfiU)%=FA#%mn6`p_+m0sr@1q<7c!&HNK*Ud*Ty^Qm``tCzRNR!h`I;eX2+OTTA)Jt4`m%0!2 zC|kwaAI=q6Y9)^OaAT2HUk5xeDQAN_c$j4V+&G7AG~<@(+Abb%4y~6j2h9?7*W(_Y zcDU3>IPZ6GHYl#C#dH!Aa>5LFfYi9S1LgPkm^88FxrGBPf6SQ>I@m_KGM`ShpZp;lO0$?v`xrt#kT)ansi%H}ZMI(Z?AynZ?r- zX4p`ysdX#@P}oDW4-^}QZJI=JiJk^4%%D z&9SYw96W!>A3+mZfRdcOhR+_NM|%$I2U2c_`D>tNsyE^_>TiAyE%f16OrKE<{e~Xj zJSNi)YV_b(XK0W%^s6Mlo20kt00+Ee^oztk-CZuPbg5Vr(Y$p!!_e)z`$s3^b2SaP zokIVw*dG+a7}v}}z6Ml-wr0C-F1*12glBjvfU3~fk-B#*vy5t zms>l_yxNx*y!fc29_<#6+t2cNp6g~PqV_;oKGw_j;epCxcGuN>9PmfBD@`$N5p7tG zAJT3dKmFFP2ztX2m{*{nO}g#rAeZ>lE*NpR)-n}N&1z1`jY+zf+~YF!CumtkICRDB zzb|6W108M1mEo-mlkXH4pr7n*1r7xMyuk>a4poSBuk%3=Hi(h~ht+%D(Q#48olXFx zddT&o$vDeI4a=zvg^p}MXUQHy$7-Vez@}Q$08GaK6KUbD%oun!uS=gmxez`{7zH$u zlPsrulBC^>@|>(sr%bIFgA|hFBL;>k@S_W%r3^o~#Uc37Pft#E_OoPiF0)+rKqVcj zD#Wl-8S{4RUN!F%kZIwM_`>k2^7yfR>(`fxeW;}-&3bxnfbSBY`aScZafC}nG~gQ`$v*K zX0$@}<46rRPX4pk{I~%{rYpghJ7M4hvFi5tOKv&8+E1u}bo6F&E}0x14SdAa4?~_Y zCCcjXO?_}nWv&-aYn+T;nsD&M08uXb?B7Heb_9wh>oxabKew<{Ge7ybGc24`jH`DDlTC0VV%;?`tCEksJ^K+ zmBuVUq{@~XtXA-VoO0QX*=f*{ zvc$GI1vviE=r>Lk?y<4Aw!u`ajn=6IW{$R6{Eip6p#6Y_bzTEgt=A%Ui8xI#imSN& zjAC{j&zR4mpPCfPuMi6DtJwBohuwkOEz8w|f>IZ}gC)_Lay7fy;|fYpZyGJ$VipEa1?t zYfLlYa2CS(puu1dGi#a&fV3GGskJbD*N1A8z`a6`;8=*Vh|k8Pg6(R6HWfWk%bmr- z_KFtd>Srh+>BDp_KGE$ZUo9F)1N(|U^p$qt_~*m&`PwLT4pj@1sGcc_S3AQXi}8Fx zlS+rwJhmN?CUE7=TLYakbh5wJYSeB?yXjvbckzE8L-r!vduj57Elo6ZGE1{U3vw)+ z7zR9uTSoQ#{4((X=#Gf0V-s(MN9KE$K#<7P0@4LE5r?$z?`s?Ag1AO$(YLdUmRlYI1ZVzv!?7Cm+hI817HqICvWB zMbLLtMU#I;D9YLX`2z>jh1t$YPlBwc%b26$wvL()_#TXOu@20%5uM}_d$TPRXYhu4 zf}_SxwtZ*ouMHYX#W`!6)WhI9JfA9@wN+59;IDCu{SEG@wzeK+Q20g!CWfe>^U zlZw^g+CB3hh#|>85~I2*FTF1meycHBGBr?x(s7#e(m;p*WP;abl3FlwV_cbsa{^KV zm^=VyFh$n_dTnatkYI+!gBUv|wO5uZTNb>bp8%ER|R$nO`t1K8~jW4-Spo-^m*SRTfTHtMo9slzqTa+5D<$}E@wP76_RDBj$-|1U6UX-G+jo#~Dec|o6bNi=_-RvV~k)0P0st+;* zTn?=PTHxZ85YztI^E>eafF<}o$F}VYFxdh0+o(6}XPoL>DD~cVOai{_U?F%)ihm5? zzjJ-J5dS6n<}dnN{%=vqe-!0@_e9Ele#2e-t%!&({r2DB{>OZD`2B+{2j+i8mP7R)gZ{PI@c?sZ{-Y@OTSUZ{ z!T7gizTZLuz8v}g9hu$V2K^>;_*>C8nd{$@{VQk5e?zwWJ%I0^P5&|IzjD^{x1w*d z&c7x5SI*Y|hHUSjWH0|QXzo8nZ~syB7ydWd?%$IAGiTY@e?zwWkD%FH|1oIpKSezM zQS?u;bi%(S^ZoAa+c^0DhU}j?`#<*hKh7rlf06yYJATj2e{;wGa*BWN_Fr@J+tU75 zuJQkorG1nAyQTd*(Es_}@vofyUq1u*$0q;3e)j+F2K-~`|2Dn9_cQwc$}K zn-&1VgZTccbsOGzeYVkmLqn2KI>(vJQrJj92bm$V{aM6*_9y5>ZNnj)MN1)N`G|{o zjam`O-DR9(CNRvizDED2cb4M9-3N#3oRMgf$Tm3IFb!Il;j0rQ$yBTFy=Fb zzA>JF{l)ARd`^N`+2x5L8t)=NNKw6UWgX?CEPJ*NoSuLVzZTAPr4#f%CE{Zav4u|O z_V2MNaD!DH?z)g^B>nk@vtLtWAIi2DSH+^9i6u3%Ro6~2?1|CX-kZ6XcWA!V2P*0Y6cEly0I+4JzQutV0dySA7s8e}Ql zf9%Sk&o79ywvw$T2gAZKa(AX6Z4*Gs9A;WescF%zsVSppYbU_XQ4DN%X7`=D@Y3m|^_ zC{HT29bhcT;9CvK&MPU8LDn2%TQwc7Thbi8EQzt;GrToV9;}i}u@sky8qaN(80nNg zjY^23d0lvJHqg){USA%P1Zg*os$OeG`HU5#e7%~qer?K)U`LC&pLa)E(uE$CMmbF{ z8(++^DPrGUdDYxO$Inp{PYNfzvuTug+EEMOrkmQ;V5SnBeklx*#OWqmJUic^)NZ$% zuXT18-;oAVN(lSCVZ+@V^#WW{ns$yR1TLNz>pA@ctW%C>#3PM4&;KlAq{eqj=&uj2 zGVcB0)^Jd!Kqns!OgTaZ!9u;Rv_d;SSgEL^{ozS&i(W`9vvos=Ni5>%bOH+Kj`dqp zPCld-A)E#vBUq&aobH!!b$;ogrpykJ|KdYNk1MSUV|XPH_Vq_-TDssg3K8PAk^dxd zKr0TE-TO=QPP;tSWBiCzcpczV(iQ`Gcgk?W#xA0{DlrgvEd`)7YV`T1}9 zQz!W$04K$F^|%p>jEJ(Vm{z;nBU;r^~XU=Qggc|N38Vds1f#;BIjsuP2#F%s`C zj8kAR16qwjl|a%`&QD}2VNev&#v6m;EIDuP`XE%T01pVp4QJQ><2wT`LMr`byYejV ze=wFr8gO^q2l~7<(&CFuerjp_kmO4&4x0wh8k0M`N1JC)Z@@%CAoMx_hl7HY2Rv5! z37n9oJ(TRKiKL+ebFut9;BHQYU)ufXoqtY(Lr0q2DCQEb)rCYs+c zY=@WNjpf)wF^R2At`o94ra|b=Wl8-qn(c_ugY=t|a_zk^AZYJ5n>-$itHP;z_UXfZ zaxjXxG;o-Sk0^vo>_k4DrFds;5qTMD8hDS(473Ixi~W(C{Y-BPwICj?Q%5`S9&A%C zccJ2!x<6zdspi1(!0W5_>n^_DY9l2oavf4w3QCN^CARH)l-{C|=APE@d3pUFJ9dPr z$`kmfv;wmZgNU)4M{(`?pnt4liDY98c9YRY6#~1sp-w=Ez=W*|vzD|4AA?)eq_ZaV z2B(TW&l}~8EJqtFicO*m5AQp809#9#T~Gowr;ICQ7^fSX#FlNLra1SGUBBQDGV+Kl z7XnGU^1%?G7G4mT6$c!o=}&?T*gR>an5c{2~_uti12|8w3}V$ z-_15ayunZ9Grx)FJo~Q7k}I#F^*FHKN!+zEN!`6>tXXG_9aq0my2GV@5=gWkbX^A zaSR?_klLxB2&RO_&?{5SBiljZWo9&K&(Hn7`-4$SYi|B&dO7gsM+QzvghnjtffYew z%(g*wAJX3Qd$>4oe3Ey0OE~}M0fr=V^S)7gvZiiSa3viaOl)tSK!hzf1i~ea`B~?6 zw|H!prxx!Uyu8^6v|UE?SLQGl`Q=GE+EzuMV0z2hFHQr(KrcNRi{+OB>ry{(J!mi3 zVg+&FI@t+b+!ar~#M6jI7b9x3yTm={vfUQ4NSybsLB*vg`0w4}%O1%cx}E$R7RcdDLJ8B20?rBE3FbH$?hyO=s9FNoY#ec$ z;`EAQCCOoR?94OO@CY*&&4vWmy1KJBHD$Kukq?Gzh_r$@L%jljS{#^DAZU8qYRa+~ z1!M@>!L?_2-;3U^RB-374>LlKiKmfApIyyrg-%V6q#pi^;-<6w6@7q5XM%ZXu!kb0 zOz%%5Vzap)%d6XQ+Ss<|)i49nMHeA@qx18D_kCQ?puRkE>_qOh?=OE;{kbl#;>ji+ zvIjH&mu~l%tS;DxlCn)78@@;~^>N%1_C{*$AGCdVaN}R4_SCRfQO;ZhA0#iG&aX+z z)%?a^Taj-*CGZLj9R>mskmzfq3&_G_JgBS)meLECL$m=a;U9`|g;r86vMl*}p@KJ`&816J zB`p3D#S-{Am{~Fs!=cx%8zl0E`PlVc6~DC-o$%o((-&cb)N?T@sbD#^DES-zJWIj> zPau~hSLPZ2^(Pz&wR1HiSNl!;>nZ;@0b`TCh>u`A%Gsuwmy~f>P~ zTE||zo`Aj{4WPDXGqQd>Z$f>$oRF+jDQ*IJCATc7#ksfyJ_a6LVlj7OIa*aT-HRPg zqGrn8pC`0BVXK@BNl;Zx{sPma)tBbA2*K%q`0aD|PM3VVt7fT^Ib?lFoYL&1@ zzhZ*DapTh0&ouee`bv+~{`Ma|vwI-3=l2<1M(y;>46?kxbH=n6fQ@9;?e1#T<~ty% zCWhyvB*AYPh%LPiqjnBbysF4#Fmf&>_%ME60hv3vzmhDxZQJz22hd)O+@23*V>{}~ zp)mU}G0|BEn6f`_ltzZM9Gu3>MS}AK$7j2N2o2(8XPpcL2)TuNxl~WFvPi+{xBocN zq$8FvrJ|}V;(EAsizV$Liam*;CDG`7sM`FJE%6R3#dMZb0$`R`o@yX5UH$C9*aO2_ z6x56mIZ;apUBb2?+I%HeD>TKPg{!5Qt6O;J&I(L@M!@EzC44qO#vaJPM&$+e!!m49 z*)gW;kJ;+IdccVZ+^{Dzj6aeV966*zLV|=8W?Z}9`(D9*antaZ-R~=c>-3;YqBIf+ zne*JzL??oPHQ>)+0bqx&gh-f{%VttQ2l8Nj`c`~q(L;!6D!ja)04u*RRidSI%q|rN%t(Nco3&keTr^e z%)y>_G&-Y$*V~8}!GquhDi0=x$}}mL@8>7vhKKNF@>pI@+^sD6lOw*$(BaG*(VFw8 z#f5;$-eip&#+M9Y*C?3wggZm@{=%(u z*t+EnGSm6+<)9zutkaDOuV6$Ar+mMluW0aTrF{h?X-DYr9}t=#YElI5y#lbaa*9lv zE@AW;@mQ}(rf2V8yi~45J7;y3E8B0ctyu^m&aLXN!2VrS_=<+5_8wu!XVe2A>2^L= z$$!7MP;=_!+Ve^*p;4A>eG=cr)vZ@o8tpS_IIc=@e*%sY*v^%q>P3Jztm$!=oa2;R z0YtS?NdZ-`#`Q-pe%uy%E=$x5V#Z9Gwt)@0J+7pUG;X(V{qWmxapMhEWd~M|=a?{7 zHuevP9(|e>^v7++4!6{E{4yV(j51&RQt)64NT~W-&nofMq72<+n?e_A!Q(&scYgQQ zpi`MGG>C9-!H%9wP1hdO}euB3$5EM zst)YgMVJO;|1i~Ek;R`7<)G>q#1ecar^rJQSodio$!;Qf6kP%%)nB~?7*-CZ8zQE2 z;D8rkxzBEuRkRDPr)4o{nwGD@^N)1}@&;yDUE|+6vHRn7S z?WEN^s5b$4a&r}q=Ww5>mKIm1Cv_3WxE=@dFdPMD71tpfPv){7^a?8kqez5;k(Q70e&D zgcw_j3xmUAZ$l+lW~UEx%0S#Z!=$aAFbsZh>$AwX%6^k*Xn!2YT%wrvCm)H!sl_IBex*ykt^40L8OD6hD4B`$D~ z@+2BngG75fgRnq_px7+n=?K0=0B53sbz~UBuK?+xUfN?Y;>)%1T%?wfs^{dV|6E#u zV3)wGwdvNfjIFwhNUVMi27+xCCpZ?sg~;9lT4Pc*;sbLX^N{bfGBH2P``PU4ru1a2 zJ01$`T-3!&m-n=FEeoEX>GfgfZ`m)o(~hay#&4nJr+~DqwD&R+gdMJTy)woaT_znK z7OQ;Xc=DxnQpf4pCQ(+)viKMH`874)PAw~isy^3rV}nd{^X zeLbm&DR(Ya=?*)hxPKzLq5+SHHeWl)P8M^J!_SF;*! zd+pcmu?-3DpEQhi3h9=%d`iufFqVi*T;pwu98%Dk4zdIH)XrTrd-y;7n2)`&YWG1) z+Sm!~bEf#6flSJpR(Du>rdcQv6CcEE{4a8KKrxv$Hly3ozu)*No54VB#H$SMEry2@ zMyJf1?%jUA{$XopH3LWaG~31ny@nxUg}Do2K-};fLZG%|8rudJ-42X&@5c!OUIH6a zl2`ZTBlb@=h!gWY@0gilS33N2_J4w04bZHhlJ5czsn3w(cf(?PQa&1jb zwq;`xrW}wP(K=Jj#U6jKsYs3$B@vugV8*6f(SrXb!<;IMa;_p{T*a3EN@HLXEP2~o zOM_!!L~EuVG|=*M`S$$RIz^pOu5$187sd(HzheZso_RHf*??3Iy)%6xt<1Bj*V>b%Ur_w)f&Y2fo2zWp1NBr-=lZ@ zTXP^<4Pn&LSvZ#GZ!^K5TVxKp z!)|%3kTbuCSkFoD0(|HadXrh^u4EBJtWGKJTpJQh6<3o9aBB?YpP83BWy%MAds(yB zDHdsxR!C2ZdIeEAz6G;QoAQd%T#>}%fn)d;HnNk&k@3ixl)QfRf;g)cWT`0g0 z8yM^vy8ux;R_Yl$=r+eob~mw%Eh^-T5}?mQ_)QmISaIEPi8RK-<9Uu;VNRTN^RQpE zN1%x`V5I(&8gk@s-w)6jfk|^p#Liv$-^~{9cF_`|SP}~xBDCAwTOanVugaR$h>*`y zL7U+xH?P)7na;02A*Td~Iv;lUNmP-9zhhQzNhW^gBF&iIJAl?;l476dCjSIJk0*ta z5R7)`K=+$Jn#w`1B4618roiO%3G)wA!KfuceNDu3;qJz7ka~bPy7sTbu==y%q?7uj zwlg`oj3^Y$TW*kPLb%HI_xI87zSAA>jFP9_pB^(n;7V_Z522s~OCrZvQEh?5+(}! z^52*r^=e8dqB3yRv^6Sn52pq?7iyNF-5OsS~( zkmI91g7!xIdiFcr!gxF8P@C0|3w;~*I7-&`hfkX$JY}Ze>-F{xRKV)vX>4i$D`uBt zq2gC)Yd2i1Lss_v8>Qzg3}=qAUd(!-aBaz5E(gEzWrCE6$N1(({gA8WyhZO-!wmz- z%0-w%-ND}c!E||Hw2d1d+HkQ#oxQUgn-Qk@!qIKOL-+_fz^A{AzlR&kez4B$=YFw( z!D|BqcWZ`qpK?pF071~wemI5_ncd+FvQNOi-t`K?t*jZM`lw1t1MCv`X(1;}?K?9?=) z^BOe*-`g}|01e*2lX#_DCyk}x7{%KK)7GVdx?cwJZwFg0ecw>9+#@sfDW>gw=R^)a zl<%7cnG^?K&cBqIsC6Q)a{x|5tf^PmF9Yin8WheSm5@kwM^z^oQK&Z~cwW3TN6Jg) zzcJGzjuprCx;hqYaiulJ9|tiHE_laru$ok#F~?1PDbrMS6`x!g{yd>4f9>AkQViQX z^~Ty~%=HWPb~7*4xpdkT76ftT5ou4xAA}te%R;j)^xUtnXpTJ6GBe^TN(b7g>jA-d zWAJbRIVo*lb$&Nl+C3=0MIEA=bRUkJsGQXv+{@7+7HgZ2wgg zOZ%vzSz&On)yQCY=pDv?JfL~3ZJFLxo53`{6S=4zU>vXV)V*S&nX(A|vyloZQl{xN z8wrk{1C@sQ&@i&cdIpuL{iktQ-3F%HoMsRM+{`so#sOv|vSmaNCx>?wN#9ONczSqO zD*Un6*jZy`HXJ9HEZUuNN}V{YsiwyU@O&Bfy{??j&RfK->DP#8>89Hum=+QP#CEOG zxtRWaGb8{0X8SFyCWuX!@VjORK-GOI(*)O+I9q3!O48-?ye6I@<~S>_5Eex5!W~5k zFG{11p6!+W-NUj#(max!(_nYNoPCFys#5`9?w!3PhppZ>j6vpJpU zb-{+_5+jz?qJ0wKoz&8aoY`7Frz|Z2l$>%I&?@OWG+8Rj|Vkrt&8Ig3hv|ZEKcsN^} zP0gR@Y-EP01r`7|Ovq$MhgXuyHFo&Wx?5^yMNXyq|Z%hfe@! zoUk>x{JEKyY|=G6SZ^~j+^RT=)XGk0fbdvZUA|kB#J=$>+iSki?*li?k*@PzjpQj4 zA@J}>$bC^`&J&TWg5fKFr}1Y(wc@ZNi;n9uk0oxW_5m?v(=i1X(ah+3xdS8>{+jzr z1a8dB=(7G2!+~lA|2w6LANg|SuZc!kc|g@7Wl)aj?htwibGU-p}Xa3Uh<|E0}+Q-W-#Psgvx#$=;adJ)>^nyXdrafOQSIWI_uoXmpnb+SV5|q@|EiSe(d?zsvRAj0x17?_g+r${{et_ z=C^D%*dDIsd^DufrbF$+IE7G^M&YwsyxR6)xbON4G|9PZyxVx_lmW=q3jx0P+5SKv z_3@rQpv*FYkl!PIL%9FF719IF{m)iNK7)aU295!y3R=McWM^(psw>_P?tsR}@nfWC zvFJJgx)5V*52eu;shuW`ZbRNduG+@{RffLbNA2mybzB6BS+t%K5D>(lDlaI=D1Rfn zZ?~%W?Nn0h^~Ap+f%NqKrJJ^_}XTbr4voN#q~y&mJoIQ2#>AZlrp zU@S)O7C%g?Y7z7-C*n0xHHKjAKW6h=ZRx9s+hqU<-I~jNN+1M!uwaSK(WvA$n-HcVRaQiL%r*`fPHoa{KI+0 z1g$Vs?oLMM;HSo4JFiwSH8?<7J^4PNJBd#^1VxM4+C!`1?M(_-_b`m$CQ@-Fq-T+M z7&6M8_GI46Zh$P&qWW>tVo7ILMavlGeqOGMc62-{n!B2*DWo)rPxDnSKrxK_kKl!a zzXnA*&WraqR0V@HFaQFg-uwP;{|`_WurKOAVC%O_`EmO_*7tGpzeiay{~gLQyl4i( z`w?~*jPBfN$+VJXVyCisXE>Y&VO}TElld69b?EoRt%&|BFsoglw$*dRCoXmm1$A_p zQ&=xq^GfLJ&{t0bzZ;E5cf}uw2NeDhb+zP>DXi&dVSXi%uApnU(B=l>{Z#X|V6pq1=!ZapVjA|8l*0EmS=vNUL% zz$6M4Hg<5lUVPzlVY~s^b`(b!V!GK8A{2*fMrS>_`*eu^gE+3}!L+B!xPGq^kz&lE z&tp?#OB&fDH?dGgnOH1iVc>{|U(mRu5lizTIAp@!zYr9{$&BK>>4GOM0O4~M5%lo0 z{4ENmt)12B{yXicyA(;)-6D?Ni74F2e#e-|&enxss_X`atj@J~iMd^6#Rd3SdbZ!8 zmwz(s>SE`}iF=w*lrk6QW%qz4Irrypu}ll*wIS?M2Y*1kht_C^!L5@#A6qt!{io?) zg~T?Olg7FaQ(<@~8eKZxQ$p!-S8#Qt;GbVEE$2izTcj1B!XuSNOnGxgpu`nMpsiDW zSq5AuFnYp<`bS>RA*mD-+$rRZVB&>102#r%uXt~;RyS8wxWq$WzIw%*P;2RYH+1Rj zOZimN*=hM{mbH_js~<#yYv;r2vCu!f9nv3T*!kNWJvUMM7av1zA*vFa=VR&xKB$as zArH{kV|RQNiLY^%9>r4F!VNO7yF9+rX4s3*T|#dw+H%*iOn@DQ0|VTAq+oPk3gh7l zJHycCanib>7rGnLT@r|;$0J9Eyw0sUwFDJM?TeS8W&vV^`PR(U2kBw&R^|&jbqGwH zGQbn1lTEN_QSHn9{)9xM=K{o@;8vX5>W9HpH3QRgU~HypOJJ^TmW8sU7*&0~K)_Xa zp?VPZVYRKG?yB9Oyq0vp^yuo1h+&}o$ z*dTPZxezDvDTyGj;}9UDj9niNM1NG|_1pw(cg;bWN&U^^p_s%e z7CkvbstIp{z114VEP~%FCTi{;@7Jn{(QT@P2_Y>c$~#gpNdtn4yImX@4y%3pN9H$A zY7Mhmpvo|>)7KaA3#>9zzK*S|&FX*~v$y|gl4Ph`0G>#bVy=9Gd{|+n-G&etHtofL z{f-E4Kx3~F=^#9qOqWf6$q0Us5R6s!2&CD*Wb}!C zj>EYm962k?+6vdcYlg7ftZ=w~;09Sq1p44;gighRoSzx!W*UVTNqqI(v$gen0%q7( zqMy~{*j4iyG?KR$kxiST_l0LvDy>R*^aZC6jU&5G*5urD~v}(dN(-D9@>AE$RBe zz)*yjhS#p+n`cMtm8cE zEuPyek+7`=y*Kt=G4NhHCPuljoWJ}WhA_LCc%~(<+navLke!yu1 z@Cr)Eau4{12$M83WkH}dFbo^+4P9nJI8G=pk8;|0s1@jIqvM##^Su4%RUBM(vgd`7 z5+HYS;T7KL!=Q{x$~#QFe^M4@%6e^ySC>K^X{`n=(`{dcxLe@+xz*Ji4i_W%mb~EIp%C*=Q-_R zJ+#>HWpCt-zXFP@=WU!(96#*gwhIEU#0dQ`RF30OeQj}kDyBLq!n&|eiV|wl?moNa zvHZ|DAJ`|AY- zf|l}g!PD{5L@7o6TKn@*o1I~}`p$2iX#Qqma2tkP2*ZnoJys$KuNQ(d1A`2Cv{o=d zM@OyaYiL;fCp@WGj3ygSx87O0W2}X4nWFE34ipvsq6z|;z;{TokPPm_AXX29LVbN! zvRnOL7e$dWFcb91eOrROZt^?W`zavUdTK#Hbdw zAP%PiFG1ywVbG&0 z%8{QtS?lO?^sfqR^n&nstgad}^nJ6q;^@%!9R#kKwI~}9($-Hioi-HSprwVrCuxdP z7i6&p``#!xbAWm7v_@|I&}=W16vA+Q!b*STCqvkN|0E{dW6ocA?vZm~O{9CFfX6=I zgF%qITnd4ZY|R$a;PMaHbGScB8J7X2h(sD}A&Nop^ZsQA`@Onl5qj}g@pXk@xs;dG zUu25_9g{gTQ{&~>$0gl}7_ z(~XBOFPa7|Oj`|gWLcWrO^vl~59_x!vR6OUO1IA00$xhQcGwBmz7`(*3p6-wD~Iu; zj*&2vjJ_twwZ~Q__wi-Fvb1Iq)Y2Ft0=n?@?<@Hd^M^^m@gPkxKX0iBCQcHv1{mr= zuq3!&wirI4!nxqWg^R5S9Gen7pL?RLdXMpc0Sceh2CFiO&(46xJFx=*3WZR*!7r64 zN(TEP4Qt1@GW=%<*iF*0L$U-b_H-%{fMG-Ti$X*~lh^)5 zHhHfUP*3DP1SFW%;NdBaMb3%3YyNu12GU*>_pb=4! zlbf|EwM`r|LLp6-d!_!kcAB6zgH0z~Bg1lqCe4-Q%;_W6ukQ!=M8#b*IN5ojOnV2P zN~B>3Np2K1!1)aFeGBl#7=x_nNo5WlRbw1jz~(%0L;+q#@W1sWR|QO{h$}TjAAdh2 z%UO3&8ON1`d6rZ)RxIz@w&G%w%`Pouo-I>pb6W^wqu+ik`I(Jzb-rzuv;-buVsBfsInezF5;?tTC88<2UM4{w#Xl( zhgf2)xgiS=if#&S>noxVUFF+s#eVihL7!zWLXy3^dG#5d`6O)w4G~N;iGG(}uF0tV zOS!e<%%W$_%)faaFL1NNik60_v0|ZDeH0<;06hp&qo`0wt6;N?C?J$$stb4`YzWwt z<<88*#_2VKWft;~V)N`{tZX^hve#A{ikzu_suQ2p`Wx+WNC~)N-cyV_;cC3#YOA<> zgfL{1z!z)Z(DsTS_KDmD-{HRGh*0FddXES~o(Wv?q_~4kCp6|OSZ@3FxW^BLb0jeuUN>N%o_8FTL|#~{h61bn67}^tsFNX9i5^ zaIKc<$3Rbu(EW-d1edtcG9u-$JG*pBd;wVj{!Ofc=wr{Ro4uAa(KHmzwq=Q7-TCn7lk zujcPe(DpWH z7^~ii3}k z+v9lpHfp2A_YpKlpg?zAKV)RkG^=Q&T3B5|6P^`9PFW&~e*#?q9JLXJ zH2OufTtn>r`0#{4Q)Nd0lPkyPLyZ-N1%GaevSfK#5WN2|vR8rm^}LN?lHbghnD@Hp zMEE^7)X){Jj9G37JsdO~2`<@Zvrf3BPuP{)D;xml&FLbDY zVZCn%2x;ed*-~+IsdE^CE^y+dOhY?t|MY#~Y1hK~Yh7&h*GyCSAk~&OMoeTGzryCv zrbYkn)9WTG)IFNG2;RWRWK!?Be#}0^e$8U*2Zbv_W9<01c9te8Bq*B;xzOIfP2DJ> z6eCZaEVybnORmkRpQhwuajm6)EHOK-`t0Ulrt0#wXi7d?G6iugv%mJ1{@P3gVPguR zIa$`iZ&ZW)>63@cee5B=n)R};Gw)Lx6fRWRWi_79#G0r_Aw#gM;X(VuA#kPzr#-HY z#ivV^<*jV7PRd6jVhS^uEcIw1XQ1761&k50m6hAnbNT_ItKk9i@DBW=mv##nr|CLH z#irBnGa#l6a?{gt#G|;eH<2mNV>vT*5uwUUzBj!tqJ_F}5=BbM5$Z0RJT85>7@v67M^^~t_DnBr>O9?c-WK##Y;g-j~90T-;&IFZ%Y z#vWzgaL*XxAsn7?(`9bHIFmrd67_>>95a%wEk0++#(VIWauZ&i-k0Nm5}%U#wW@il zXg|J;ft~mdl<=vjW5UPZQkEM6icC*Hg=);E=g}r%t3Q69EF;+g>%f%JUQ|zGx@8~Pjc?yOPm?o&B|j98t}^r zlDz1kkyL2)*sYqZm6T|Zck8;@(%v!{5i#e}IWK^7L}O}6+()>bEz^nzc=J$t z5z?CyCj-c$h|PHQ0RX#4sYZ0*Uk{rv1rwjlTM}BQ5=(&^5(AQmhO*M5tG`%NkK?lX zB7AxHMWpe@SFIe zJEk4nvYuAWkk^ltjZkv{VXymX9#{V~8PMXuR*nCZ!zl?eX^I#uOj40JbHdYOi3F9C z8Ql@`n$@?@qYMh`P~8c|IG!60s&+yQQM)C%W2sU}QjahR5`qMM$Xw7tG|&~p-($6u$U@CV9*YKXxDx2pWIa0M1P zF`qNs`Jj#af5noF&GE*%6KZqAp?$^5@*I|q*vT%?Av$}7b#Nx{Y zB@r^&&}DbZid4TGJ^J8H1eAr<1E65|!y@6!pz;vpw2g~iT}2t}4Z>^cZaf(@N~!K= z@Kp5)wLnC3=SW)6M*1-kYQ=3;X6^C;z}+ch^EbANGVkle$LGQ^46a>(< zN|i9dULkI*a+Iuy)%vTi7_ncw>rsO{$hn{0#;klCMk~Qc7_M!*xsJTMWqY)jY>#%W zI*d8&sJCgQaavF+{v&&uFehtC(fWUNh2Jub0$as+Fxf55=f+SSmaTJi{X)}N^1hP(x+7){o;~B(uE9;TC-b<|gL@|iou?1;&_H#fzmCBc zS(h8gk(hPnZl)(LFo)Nh6*xMF1QUQNrl!JH3X_+YFWf8Vu2Eikq-w3d!(>_os1ksJ z>{UOVq#ZF*WYb4Fs$p6|y`V%a)4Ar0;%xwvPN#ftcW(R^^Jlxj0Ah_ua*Wf#P* zV7Lg%C<7s1_l&uZLsAYKdMWTo?$=!ls5Dp&2U~vBv`2disp$P7OAZ0_D&T=3v$V8y zQT!eoLTp!*%~A4zmFuE@p27odRq|0kkgzx&CpXV@ji==xKS)(6yAWgk1umCO)M;5! z{hB?=Ak=p{T@Ji7Zn-qtBjdUyAh%QeyLp%s7|wgP^~BbL8E?wi_$INKY?3)#P!nK+ zRr+((hS|Y5NBz>VfyKoXb`P>OLB1E?H(HxFaA@I+dSsPehOf?_H~lQsNk_|IKjR@| zfmsD5iSO+XqF0v>dNOEJunp&}uv$A<0xbL`o7CD%M8q$n~-rJMdpw-i22*g_!j}qi1MO zr$|H`==SydH=)o27en4ly%{igL%X$?d|d#(X@Fc0GMR|q)_XlVXm*gye%{%(k&5~A zBuOqeDupKK@2IS00Mf zUte8PbfBey8jcz7fgje_tIGs4QGq* zl;LdlRS4DdW=_ru6zMXwQsUqZahv} z^`NLZG1rfRIaWp(dn(+%*BURg1@a5k)s3X;W~YOc#=S8lYyubrMoy;Pyx!TO&$r+({Qz>=szq@D z6-V1@6IZ}2PXm*yqi_MySb8{^Q;AY<*3nqW1m&c9MhB6SN7 z0Tsl$3vqSFcQcOM8Wb`p2na5;t3VATR}O;a zdoYRr6(q?w=W0Xu8&ykN4zj4@FXiPyCL4_kr&II;0aJp+%oQbO=128t^8-V^zRuf|LA*vzy51a@AALUqwjZ6_NnGUqsK8oNTt|p zsIi{uB+EY*YqVEy5#z*hOc{Oq&fOBCC{VaZWUgC5%$b5&&cTkhw6 zG|JUGc^4Su8S^)=yIr_sXF?zbv)p9GW&5|!_rN?;+KvmZ;I{P(3~XY7Cr}`1F;BVM z?`d!_bwQe|o&98%-q0lt5U#SfZ1lk!Kdtn5jMsRzr%vzdJ3j}8KiTJjel0Ey2d+)bj!Of7l?ka1{U#s zN2E8G`GQ8aw>`Hu`Z%z0pxO)L1U59Fa(E>07ZR%QEPNLlVvU>d9`jxYK1iQdH`O8| zfB6?W?GL^j=O2s-IFyE zg<|5z`>Gc`f8pLnen^(rNw`l*{G{{)?q!9Xaqv%T@Kkg6vi*KgO?B1lgymzR!N8ZH zvt<#!MaKRYUJn!Hw0NeOUEoAxMTHC`8whf_8=0C@wwDeY_iK8aML7%VoOAhCWxo{m zEdR3&6?h)UvtP3>ujKG=MsAGGc$W3EqIC8f*}xL#xB7lwYZYr&MhV!QqjK&S$v*sF z-jf&Mt8Q5;dJ&60q~Cd9`z3#obN~UwX$tZQ(8h>)r6yS1r-Db!?>dq>{PwcdPiy3_ zvyk$vTf$s`EchR%X^C)_+AqypT zGmj(xplMmDzUv}lf3S}lCCD*z6HOH^GLyf+pE;9nZ_FSDhPzA?@m}ecO_uo1+htUV z5S&V@HZkeog{AsYBM)ac?;em8ftIaFbwo=W%*E2;@{{P{gP37ZJ>0wDOX0rth@|+I z(;Y==gH*h+J57FAtfCYrt|9O#=$k}whWa|^ZMO|+<>MSP9{b`Y9?6gL^p@&k*qkXA zHWkKx)bp7ZlMykuvJVl@m7b|yW@&d4(^2C1hu)ZtrQYjG^ncw1s2OrfPe8$X!u5&i zG^C|YIZdH-6NVx3Co*=?QG3J3lMAqPNS0lXEsi0E?>c z>Y&Zo<>#r9rZ+Md(rD*oAY)?5iqkH(2xP_XSkaiy((u#g%0&!k$)ZElhp~5n8RGr+ z8qE9}40BY`9jk;&vW2R-Y)(F_Y?w5&Zp~)`bEP9jJal)j53a912BpVD2#lx&Bme_V zj||O;xa&bPJAIX9<||pIwEc@i=$+NxJRB`9notgc7S)0RqsXA&n?;&Y%RU9Vi*0jD zB#C#APz-eaeww=cZ%Wq*{{O|^JH`4IMC+daW!vUnwrz7S>}A`wZF4W%wr$(CZTCLs zQ*4i`Sn@2thXY-UzM&Z; zZ{#XLonW2SAD?r9RQtnyyg#m2V7de-QRyzFhof(C|DZ}StJTzSHVhH>vOvzLD1S0h zAPSa>V0gv+%!06Gm88EGYlj?8b)GF`8Zi>k*l`~?K|M`Q#= z*zr++1Va88XwQ*`XpOM2Qy6{fIWZl`MX*9td?q9!z$615=c9I!%D+s#lBTdX&$IVs3)HJT3bFXMRizW%v{QcXgK#;r zIPQZ*qJ-0b@799{`GLkE8->iOf#qk;?Mj=<1m?3O{3Hv>pI|I(qtOjK`J;KNAV%n0d%Uv%`kI!EPa{-Tl=Z?BZr-_fDUfq&p#^4qTlNA_z1u;AgLh z3O1>Kb*b??hB>EK0&O`wLTIq<6xH(Xg}TD?J=KAqX~)b{QB*k7>00RV>U7HwJkrk4 z(+p1$s1SF(=chCzt~qX3+rssSr$rMYnciz%q_WLHfgvC0vND{(Bk3MCa#VtwfR1Sk z1aT(!_QmXBl7kh~l&vjs!`03DbwC}EFA^dO{UOJAh|-a!?((oYV_wy@;?4CDvDR(z zi~VFe2Ve?#R3Q2%Y*QPgJ6(Tzi~21-{}E*ao~ObAcdHFBD#d-oTX-gD zeTszHo$~hS5)f}XLTX=HCpt>C@o)Y9B+N8#*NEVkdY)>0{0{%*yv5w2xc4cnX3pGL zss_W>>qnnm*X8UU`6PAa6Gh#LD6Yq)=<+DdM2ZD$Al&j5kASe$V|d2yZSIB&h4kA> z7GUoFB2h~6byG&+7UQFFpub#%Xe-1aQ=$9;kT)_0p)W_XQRETU8V_4lAJ2v9Q{j|N z8ac30bq!pj=p-I^X{>#_xzjwx1-W6cJ?EpGKetb}L2Y}dHoh1L_{zdsVR(2S$;2|G zl-?PM6)cZ!*zSaUmd^b1lf(QmzhC`laIo&|pBeR7a>3Kgr`qTr@jlPzv$|U2LA7=R zg=c6$#s$`}_8NXd&;z~5PovEMC@e(HnpwjcmAS*>Qwmipoq;ZOE-=mu0G#55@lr6wjk_afbNp0DMk<%(SgUn9?r>Kf09oSP}eGiqKWo~GDOhaGZ zDd^4)Mr;*X&Js@3vEX}{%4iDdVR2dTY;Qfkn1ub%-g7SKRMaY*m?b?&R*;fhDrH_Z znZBc#20p+4>M*2|HlP2rDCDdq6&9o*>H525$4>ZFBtiPGEaFV^FUMRD30IP) z<#E+^!N?0<(Jz5^`Z@s_mX?ZP-%G{dFx_I>(8)LSxKpfgvxd)0;c*RsBsft>pVyxy zbJ}egRg)kLhW*?4RiU*%Be6K@p8Kt|colIX`=Z8l(xH71$YG8zKge;rx*PT+NLUiD zydd!DS{Or^JmFO>-svg8G(5wK#H=F{4nKu}o=$eI0N=we;=IDiJ4$QQLJ?@I9U{e? zz%5*s*>Mh*-8eKv{<7fxVpQ!!op+{P7hO%G^?1ULyKEiA8ma!u>`@?`W;*@uD>=Uh z%^9UpnP!*Nh4t4;RFA6I&EqDz+RosnZ(P`|%8|%VuYAcN0$n26A-){bHtK@=)HkV^=@LLM$(1^THQ>xm` z4Fd+6@1*SO#GK@6II%zeAr;{KM7jCJj$+T{CUxCNXnzsvZz~rg<*KkbOoQF7eoa^K_a+Zd& z;f%Ecb?@bF#yH3sXp_ll@zx`P;WehybN@3t&he}9-7A-7HYWX@g37$MB>?qvHh#i& z(<$qJL}uv_`qL(us+H3}4wCsf#7ezNoe{zycqNyQHsJ$ziO6AB$a^;S(47fWZ(l5h-Vjt~WXm?}6vV+#Q%si*%x4R-2Gm8B zVyC5uFss$N{_JIhi?g#y#|&~njxg_{ePJt~?1qW~*>Ce(A8ArxjxQsYm_n3@^;k3~ z*d3(^$93rhpyPlFJd~cx;eP)eTVo;N0E9@HFBXZ0ngDS{Z&gMGi|xCa*9N92aZ)YU zBxcA#$#LKsQ5hM75FJ-Ih$`JR{gpM8%!|q9!-R7|4&K&+X?WV?>|{saXK3iw&ua$=w>N>xQVyD;k<_nRLdiS2TLi7HCIm*n z=1Bfw%UM9owhQfz`V#U$aI@{I%9iNXs5c~;d)=Jn%%C)b#hY6nmkcxW@W>I2(U4FR zO;te=6I`T7<^mXfg(4KvdiL79?yGhzotgL53-o~^r`Qia;50aLwckm1`Q;eUURTw# z2=@%eh3F;3_TDb}w00DeSjYuRSuxFSG#@PWNaX0OOH%u?I>TmA%RTn~v~5Xi*HQM> z&CqdtS&=eKax$fe{;S(a2uSuB==Q0vA$045`<*{)@fSANTEKRAiLfC!QZQ*kbCPKF z;W?P(4t251?!lUO@YCx(xpbM^Fw%(5TOaZb{q}VLuBjpIOLL&vCxXDj(pKVo)|9v? zUtaX0t==TIb*jpT`{jMj%W}jQE1=|&EkV59X2NCsq$GPToi@Dj{NVY=V5su||nYvta z6G}CNQ$wDKo-p=7RNJM)0IgP6iJPZh{|GTRL>?t27Auc-4HkMzI^K_&l=a2+%*uE> zx~~}CcEdBC^|ZX6@cYhV&m$}Tg{QngGkSj&-+g}rcDRMVdrQc>+Tld^Dgyo<5|}1- zW``A=ZmF(s4rc=p{!woFC{7v8;$-ELV)eZ@k$k~EI)AU+3{?g$^{oxnvcKv|hwEG6FVt2A!f?Jr74ee~V{qAT`MK zWO8BjJHk6c>dV?$-kov}!5{3w?8)skFutW_MQ3<;?3|7d{1gR$uz%3?)O8ul%{fLd znUnwODzw?;q9jD#@o(xmoBZ{ z!-^kLq0i95fENDtCol&mA;Jczr;$e}TDDJeD^rhxy;@+BXGY@KbvAQ_lD+nQNr!;) z2|L_9x)FS+db2gcfjCCB}P;=qGy&i&iQy(&{T@Gbyw4i9e^8P z0Chi*&7;6kN2_FIFmq#hulrbBF_zr9fpoWZ=Rfq$)y^|W6CFZ`}9mV3OCK#l#JPS!WG??7(~&NSGpw34JOl#y8i>gx5YIE<*l0UOiOa?$-zAVA)1l zF*$Squc5Q)T1x0wN=4wMvc{aCrU)VU@Au{9p%WV*)vcTb4{5k|;Ik6Oks*R_tU+7L z`1hCl-x{h+x9a6&*jzgogBKjf1Mch6)E=!sEZgl~FTqd`5tG>w;VpAxg=bo2cznW2 zzTYGm{vrWDeTKj|zlC*^3)pv6TS1O8b5l+X6iIMTpJ$%jn)u$v=r-qt>fOD;ZeiXJ ziVU6KGx5kdY3Ego%deF=(&sgUU3Ttc^m8a0KgwDnA)W|;J1w~&c7{uD*=Gm&l3w9P z>dqv+C#9M=#&!_X1Mrz~DDbzz2Nofa-y^%lSG3471=Zm=6#nw;#e|cg_5Z62cO=(8 zr}Iw);yDHyBd)jIa0jHDSHkf%7T;X>#-L7AJf9M`ddb{_j*4rE{I+Wtd}vc60Mzhz zzf@~aXB}#7dh4mUK?_nzDE7gb!c-g2ROckm3hbxD{*k^JhYx|)W2<&=Nj5~;@;(H& z+>A5PeuMNh+23^8hzTVTr6%6isOKqg(_w*xY!5RiH(e&vTEf_Jgt|imJ7&i5D-5{5 z&|^UmzZ8DO0cxl~lS(?tlD2`wm%l`r_m5@h%k|9g7ldK+A4{Jgbs8X9A`=kKtWf;h znOTbiCGawRSucaJwICl&dpQNL@SzVPw88l}B&O=1;>^yTJI(_t9ZZy`!)$5a5<~_2 z)bnMq!N^i0o~gIVp~};w^mCmYim2aJ6p7TcjW#P~TX1U=1Eim>99wqI>(TAfylQ7e z=~n*D{`nVLmpw{JezG5zREb(#gjjS$KL$a3iMaWq^h*>cZ4s+H(egi!Wa_{)vHP!t zC`vyxia{ob ziK-u0p^pdET1}X`W6VAvwRYL}ivn7CJD_Y2kiK6~1M&lQDYi|#V%g z3b7Et4wF>6M4Z#b&U45hfFT~`k93>3ss>FR`;Alg9!POV+O}dOiDfuZE{r4tIBo{Q zeLiA?pfg8bhn!PyXW4|iX!TLcHI_n^%WA5jl**HE#hB&*r)elZibbJxkaBWxpwO;2}=2MtC$Wlb7* zCC=pGo`XpVX$y_L8ohL$?Byhbv6{7x*mHY9MhrlX_~+YwaBD5mfxfQr+>BgT^>dIW zyX4l)LT?8|F#UG~t~lqJ`YdtA3iW)vXN{;-k2<`!e5K(DB2B3Q1Uzs!mk_d+{1$4y z6S6`)uW>XGQ-fO2HnUTt*O-Eb%$APP`6v>7LI%6qC##b~d&a&&)iq+3p)t6waSZ6nz(B!I!YdB>d9^TjRNFVFVqkE@#PhX2el2Sw7$7^_zG zggdh5>Q|c(<$j^+9;zE9kfIJGC%8_9mGUXE={P7z0v6|$C;3%)v*R9gtIW*ZC4Lx2 zyd6HO*8xiwa$=M$w2Z zjHelufxjvxA)BJ*xkMt66fVub)APNY)h<}iI8mYr9wD?KtRFY@pl?&{& zQrWOWmHrlx1~a|G4Ix$FTej)7HGH6p$MMf0BAvfB=QEt03Xu%ry(wlt#98NCGii0( z2_)9CBKSC#Sog9&F%&lTBiE zKvFmIZ7uUAf;V6Bia2Pi1J4R~2D6VUnUO_Ux(=%{LU8GezQh^q=@Y#nStl5@IMyUP z*WZrXZfTByR0dx>+$f3uCGOPz*T7e2S$C$x1bdLgy}e4!CmBLv7aBh$c$XOfOx=jR zwzdtIfAbYcjgspmfb=_)m5&)=7WO~l6@KJ(1`k@;2f+Q0q@dvciU0b~T2uPwt!YJx z;{at~^Bs|7b+=)HxOxYU~Lh*ZZ%L|3~1L)BhFxA}tTv z1t!N*Z-d+jKXOQesnTtj`2unNX*8e-l6WA8n;oeMr0x`)lt%LhrZvWB9(v~FY0-^q(0|H6+lVuv`F8^1sggzfNHJ{I3Ws zVA>A}>X?S{F+O|%N^y^K{-IOTn|6Mbeg!NVhsTxTD8iVWT;XirAV9(p-F%l<;pB!@ zNXBk`+Km?HmZcX$ZmM+OKLH76g*1Ktu1B3>iO~O;+;QPj$`QxlKZXnei2*yM1^^ff z{@0NI8{_(KjO+iv>HM1^|6PaaKevYe5tRSNxc)~Z{>_d5#<>0k;lHl`#<>2cW%Bi23OdTcY%?_Q6LSw%i@A{Cb9(aAgxQvwdUtyfx|NeNr1VUCTm9W-8RL{x@oq3 z^#m^675X3K{=G%AeA&h2QhpO1wo?6(0z!MtWZZeD8tLIeD>CjaQ?1xnkjM(Ls@7et zewgX5@i?W+AF%|RPmcdsZ-k?+H}^|*i$RTkA%iX#hmM{88`4U(f(ip-#`x(Q!)5i{ zO|9suYxh?foTWL0VUJ~ozNVkz-|zUYqo;QW5BS~=5BY$RpLUA2i2qdU?k)MI-B{War`Z3(>Hn?p$AP9>1!8b>>&ZF3(9jGZt*{ zQA+1FPj(gKhRXhd#$L$}ma@W_LI4yWj`6nAdH8k0jNFWgm5n`R76jqvC`?!m`w6!)+Fs+dcWs$ANUHeEw%)oWxrRmYTOvdVjGoO;5 z5~X@lx)OXWntz2-ydVBDN-&cGZvj{xw@uzAod-yf$1g2Syr{z~5#%$g;eF9?Gj?cs z9GsEuCb|yka!r1vD^)Rpez|yOXuW(dq)=6vVQb}Vlw^3U7f%@bfb6pXU<+T}&IN6I zM>J|TK`PC?LxbiEa=xAtL%6)U_yKe2oEio~=s)e~BGWR_;0hsma{HENe^)rxV4}4P zBZf=S=#~krmO5J}IJ2<=sIeKena>2G5*GPPAda(@i-bkBn2oeaLV+&^lJodNaN2J3 zwV)^OLK!dz9;8y=!Xx)?C55wj_acw=#Dt@_8e@V1GS^e)J0gGCfz3tQS%p@v?VO_& ze!kZhFE=!Qhb30w7WUbMtq^V%JU=K{|B2@rU7HA~-G@k#&U3IvI6=p=@U^&aTw^Xl zzWMa)$&hWrXgI;_WTqwIMz=y{<-OQjDwx%d0mC-Wyw71=b!D7sOX!>I(&+l&SJx9L zk13Gj^gJ|7o_E2xkv%GQ<+kUFzE{s`FaJVC-%`~>C25YCm%9%hx0p2H&~*% zK{C+pdW&6ZqBZ{oORqy!IwBV3Ydd7zpnL8_14^b<{Rlxe;z{F;1jVMae3o-kx`g3G9=W6SE83-YV^sW#K$M=Z;miHKz^GN(- zk+95?iGhlWbNu`n)U0%W-Tc9;&aS|0=4D?Q)wC}0HXU0FXh!Zj;SIR}n++Oa`vTOb z;*>3aBX4;)qDihq#2J=dMfsI}?@!y#4nzHP?!G{GpQoBf-fd7t>oLe~m21#1{~aUm^`36Xy_}JMJZ<=T0ItI`WCC^mWFanRqcCKm2k7cvyc@VN3_J2Y zlv;Jm_jL=q+a~CAqg-E?c5Gj?owvEFAXd?b%N}gH?(h5@x#jD1C@U z)$>ouPaU>rM`CSvbwY(Z)bsK%u67c+2p?s2BC-Wtaf(GUWjTTbM%DbKf|e|cSeTLY zR2@n)w8JvDzUNrAT{g5hNCH^rU-#@8VxE|Ac+;==!Pj2Dz1ZSQzWwDE{He(NjlnSS z)j`%6bycd6S9m~~?vgO$b^{_KD_$WE_Wt#%kJCtJQ+6~L%}-yKs<^?2>|8p^`tE*Q zg2S0>4`+Q%iGfw8(n|UG*cB0ETCSOTAHfLm3#1_n#*8R5ApGa*l^oPqA5a4~n*GZ# zj0Lecs&6OHf3a_zEvTx-Yw9O&#Iz1?O*)^FXvQYIXNltvfOVyLk2rL zY-D7z{*kH4uryM@2EQpYGkA@>&A1UxG}l}Lio9e3$02JNKI!AtOf?oHk4AKpGYbS{ z&R2s0ZG90{Rl5)+@&`IfPN>3mu<79*rRwFJ=S%%>2NIEj`zQKLTE+cOJxq1d4a-T7 zERAXF)!~^cH*hp)-{1$N;;kN47SmP;>N_J1GU$+I z-ci~Ft6Kr9JM(EqT9zT}a!Xr?O2uqANz>;G*HTMeU{RtaAqT`cKAj;7L?ivo@N#-q-5#m8Jxd0+FQy9cQ%DHhEJS8l-y^q zNUwTvDIuzQvPHijZkR^-IDJkHOdS^98oR=AR9ms;>cI(YDp_Wb(h0}!LW7b)7U6^&1}VWjT$w}Oi^^KHt8Fpt)( z;EJUVN$JvDPA#OuNiHxXTuudN>6Di8iLKXCS^QPQPuK2T$vPJ%-8KV}7RVj7)eOys zKG}0pBC~01OA8SM4Ke#V!Co1N%yhet;dp!=#>G}qD(HLa|e9j`{4l7=KKGr1%?xi^#1=HLtl(bZoY~yt{SHy)Tld0fu3}Q0!1iPbR3U?`8)R zarVwuA5&)$^@xwAWw>27Z-6Q( zB+{5Y1MP{>wxe1R!hR7%wj7_f9aSE-SqllL>nt9;Pb61k2ZtPP?d2yb8SS)0ae|O6 zoi{Po=)~63HSSLu*x9!TuD@p}DdHA{?p+uTw9jUk5K;&Ph@P)?%e^4`a`2OXUJK#8`&-5--yr8y`-9#U1p0kgZr|z5ZzIfr|n*EWV9N=E0?p$p{u813K62@RKnw>L<@%e%no#opO3a5Z_a^X2QQklrf13&q)Y z_}SM6tAgD;?G>YR(3+EEA3U43RXwR^I9j(K7bNDRRTmk#g)Dg8%`bPDr_4kE37^5k zf#+_ezgb&2u zOo-8?^38)AkMQX!4Tvz6^}f)Zxb4WBlkrA3KnjUZ0U@-GdwR4%|g>QLn$ql zAcje{MeOKK_JDilIofp_<<__d}a58 zpL;=H8z!ztY!Z`q94E}tz}t?tsmwPI0Ci@x+C(I1=?(TfR8F?Z0Rlc8qd0ZE$h=Bc zI>fw04^%B}<1~Cyzcc*C-c=s!d??HjIE~hXhZBkw@DTe{zTOB%>)iJ>T1Lnp_Za&q zPOvsL?CrHcyS zg~1(aP)09$+N)=N%vOVpfBd&H-vW7mPe%u#@=QJ9uIH=>n>V>iQ0ny8kyux6#~m2R z&uHc;N`aWhG`pBLn3%y6*3Y+sl9X?4l}}anNb<0H*=Z^+{Muo-*DLA6`Pxk%7_H+k zN{}2pbVXfGoDs@_@T%5ihZ;Dd^2nA!oxG|_wTU~nKSbOL(9pL*aX#E^|jDl|4%(A(A-^d%Wy`qleM zErgjN-A=AZw=M}9-3kUs_es~m$6R|K;-A{M(sa|7Ioka2@xA7R`KXDUH;1X?4FLaE z?nY}52j?_UgKPSErSPPin&5&U?j>rcTvyF6WTGnwOv6OPfLAqk-gWn$_db}zE_&!3 z>n=Wk!96~(P-w#S%aJ!kXLAp!ib6BcGj@sk#lbqat%qOaC7s}u5a7F%f@FkM(i{%S zM$f(r3{R>Sp$fhipZu}sDIyZ8tc@n+Aa&G(g6@|@TM1pwR-u(`y0m$9-g(a`Cjauu zl;;2h&B^ZoTp1;YW zJ|xqFjZ&w>RD9-pJ}VE?W1^tO>%oJ8Ip6QG2opB?^RTT+;K-5iXPUJlir3k_WH!$0RwzHnhnoC$0dwLLF|KP@n54Bs z881c2$WY=@DaNA!0luWO3Ih>MxgSrNNNhZo5)0x5+5v(P!s5LxRqoD{#_8?an+1ii zm)~w6YjM}Iwr=5*`RpWQBZ1&8BYqN@bb*Bl$AZii@k;3#(9#SkhlvlJ2^l!s3-GFT zaMT;f7qkVN;!uT-3OjUWygEpk))3eR7x`F!Yr$BcClfJAn}ZqmBJO$Oe^-CV0|5NA zN8}bie)J7JG;9rBh66obJr$8@Dd?!^!5MaFm4`R)3)#X~z4@6%#ok?8h;_^I8p)hE z5FZi?4Oi@ZW*#ofnzSB-O+%h$voo( zQx3XToAfp6WDcM5L)IO@VLA1egmaKgy0o9RcD*-XAnu0|U5tJ%i7feeGSAQJ(yIoO zA5`$Lh`r`<(5d2L)TIy~MQU_ikfc{70>9U!KLcrD=Qei^QB0^cTHk^_i=o`#Cm(nM zW_BTdrZ0o~bv$#fj&1QUHALfM9^wr*bQ}dAT8uuQ0rz;jVW z+fS!xv2-#d$dWnCzx>;+{W!Hi;iA>EL3d-C3d(@LI}*@%coUC~cCRe{(=0@<9bjMNO%YZBFTX>FiI19gesq@i`*on z^rb-03Jp4CnO^QTLkpfk83XniU7Be>P%rjzi^oWw4H%M?pkdlFATK!_jh`=q^+^8a z>>8|j7LT}5RsS`2jqn@@4PZ&5tx7{+3~ao1-awK`Y@7+~M ziv?I4a7S2{IXXWXfO-wtWmt!ka^x*SZnn$cEz98F>d)`X9l60Srv^bJ`olxWFcqtw$i-NbEQebqinTHzYvM|XW_YbE$(p#dPM{i=A*tqJrvQtE#F&sia6tPeZ@ zZ62meWigEt6%H2RKKIDgAEpTd8E@U<$JW0vQ;!qFB{)-2AGN~GS1!8j(J#4@^^eI$ z<)?Uk?$gJN;!$x@F`><+eu)^SNAz%hsA|SpCk8hY>2Rmg*(0_s6js)4M_X3?Gp|ZwPB6lfaQ{Zc2kd5HM5UlX;eH=> zcWimz{5QhPJI`&d(Qtg^mJnf@A!AyC!l?{qwP4uX!mlv_@+MdfY72()cQ+^D=oW5& zi{P3{D^c-(Wu`8omn65Y3SB!z*Bj>qsS5p%C*R~Hz|wRD0^&$6+6|cKs<|zif<@_> zfl;1f1yrwtRrK8yQjadoxatoSANKJWj2oG}WNy$WzBlO;55NhN7Y2$ZZxyKKUid92 zd!wzvTnp_+Cu$MwCwqK8d6x2wjN?g>{ZN=2>*E&d?lv1#2$%>Bj6F;Ck^404JhA;y zY@N|BcxIO15bW6~KMTu)e0lG=!_=)2#cv2iQC`--iq0MMU)6+l&6kfT*3hJX zSEi>eYCuD1{{e6n2~XR_{w@$__tv`_#$;EMYd&k@P)9@DZ$BqA8x>nyO z*hOCSZuS-~wld3Yx5gqRB%E94p7TX48)eDhfX?ASI*F z&u_HImby<|(_O-*a>cRU8e`T602n`#DfW)grcJm{>usM^1TmWy9rsQIk6H7aeP~8^ zR(hP`(Dx-7QN$&9HxI}{;;zNm*C~8u;{A4v z%>^#V%C{nDxSg&bb9b+!eU`iF8a0Xk=hfz0eJ^yOeZs zqSPUR>efF-nalJh5RpB8Hvr;4L6Fu(-e0e1(43upbe4IS{WI=EknPPulj>~hoRFs$M2am*%pB>T= zqQj`y{NQb)EFO_dL-N&xAVuT<-z^vQtOY z&Ee4>w25_Y-H6hVet<`nDjL`a+|xYOZ7+tcln60G&>7+*!vxZOe!Xj34vz_2Q_sG2 zT=#D)0%_hitBsTv4vSuVjaOg=RD)@xxzZ;nO%)e$04vpgZWe2i_F{$xJr5 zZA@#D(v>^H?Ym-cdK}fKNJ_z|f~^Y@`~+zpD~$P43hZHAng?5Zq_Wg!K@ibUm5hu) zLcJhX#<=s#)}HeRgnFkXI#8yrJQFf9Sc8F z5IAi!#jgvtTuLwG@N^@ryBN>;tfkHbGh*f7P=Xr!p2Q!ba&#>MJj9%BHv`B67$K%N z)tHmkj{EC;XP6sTVHgpHZYlAAacJX%lbrsB3W|G6c`WNhGTg+OR{)nk!BkP~r4y6e zO2@f$CPKIx-8m^9y{Ni>9B>x^WmE0u^29>K;(&OG@I|BWO@KHvtQuF*e^1;W4c(;x zC=3B!Eyz~AAy*JwtMuKHIkh%fa1MtW40Z&l2i6-26gu{{-zr zmx_wC?pCgv;-y-s&2<+Gr}Njp!?>781B%ixud%*(657A8W&#yf1-PZAwd;+hs*!io zN3b56eO+MxGCG7kaJE7?JGPHv#L5E6tA7tD6WjKHnlDZ#Ut6AtqOF8c3Rkj9b;7vj ztq~t~f)9sr>XbaVT(oUja+O&}<)KiXD@X-(5tEkG#cT%_x|d2U>o_;a5mcL7A;mBB zy39|C#EeSa3EDqMfzuy|gMc0tzpWFVWXCxI+fkmwq?CWHoLG+R!Tb5jZ#vtX-14%% ze7C4NAWnDm8xh6h@7rYdhYl|<@jL9(pcEGlFnjlxh{O-1M$-Nwo8UAXPq>OMjsjD& zB-C}YZ5%#*;*fT%vBoW&5#NnEEZY=4B=MlF@&o5YzXc>~k-2R5)^OgZT&5zOUN5E} z_+_xdy@l;E!LB3OX=ggoXG5lEPJ`0?b74`r7sP8Up=x}L$f;J`9$-fZCy1j6#&?(a z3a*C`IC&Rpq9}GJrF%MN_3*0I7RxQ9^)FYll=;D&2L=(p6)?hXnAoi}7FjmYJSzK$ zs|2g=0cI*JiJW8XYH1-xi=HZXo@xF7L;7|Z zmVMlfkbME%zL3uuR7ULVhA=CO&l0 za3zvdkm>ZWiAu~V7uRNN2U?|@bhDFiySie`t7MGy*kOJZKP|rBiR&o@aYWH9T9r*X zpr8(bN37kF9e=^JFd9#u?=#&}^-rruMiE(oa{N=z_kDw=8XWG)KaA^3tkssk^4ACE z`=QF$Gaoazl0u=PKs=-OeNjg#|*_0u3=YK{^0jbdKq-+r?h zBnhcCajz{Vb_sZb68GUoKC4uo9T8}1Vz@>tw4DY*>NHUTOI2xI(i)TlvM*uK#T2<+ zlh{cBF_oppT_bujMP?EeEC3nE3E*~l+Z&0`Ah#lyikK52&tR9%U7~q#NOsRSoIL3VG#0p-B zQkM6zx82ne>@l;>+V6SyYH3g~lrC2&_dBuI`BIT5mR^GT;$&lxl|_z{wN~*qf}>b} z#F>COZhvx>uSqfss5$udM%mv5<+Hvr#>T)hxJ8G&+@Hn$g_%fqjWif3M0q$-N%JVy z+-h`+geyU;W~1yD^D+VoVsS-1LapafBsT$BfA=`AJF5&;5f9!7fr*|$8PfgG>x_?? z>1#C=I(7BwJjza=U-xZmZqbDj5^z`jdSg(ZBBs4*(6u%>O90Lw`e$y8?;e9C%6=9I zaYL_>T=f|O*X5&(jz-Z!SuMnLNXrrK$-!+q#NKp{lw6}x#0kfNIL1TO`PMu|Z|PSE zK9mX*&GAA{((B(6X>7>;{@s_=--SGWN07mJ2l5(+6AtDa5lu#LZYG1;&3mLcE89`wdx9nwys?h^fdV*)nJwN1GoYmJ zE2bg4-)9?;Rb>Y_u_Ju7!KfRH@wn?t4`lU~)oXWhRr$cq+QPCx6u>ByNi2LC9iAn^e;OS^NfzDC{~3khM^ z8ynOY8asCV{^lLj!fhEzB05pamo4Rrd#AEjG+zP8n5!xp0c)fPGPR6a;{^wOT0uc_ z2>^83zVO>FxI(hsYpo0h8JmR`qY9#gQ2Yq~>c&=9+9Su_zij&6XK#rB7b02Oa&Vj< z1{2E%IRULp4koV~_8S^XlqKw`LCHu&^UtWSudkV7bqf zAn16+CTRYpjRQm8GcL3x(8;R&ULSM8P@!DO)Pv@9EhWG&nM-C}aY*ICh>xNa6bT^E!Aa zz5?0Wy-6XfRWONle*{V7kBW@G;dm`ZG=9v5=yWs1GCge4a5+C#@maVozWipk&+?>w zw=s}yraQq#Atx%T92r$r-00}!VJET09w@IUB#yYK#{g6S2o=N&l(Hg(2=T6RXq}KO z=&;#-6_~h4$oQu-4E+~4L5DCkcuwMe2e&gKl&V67pb~X$zC=mj()U4yn&BS~-YbtX z&WXmfF#6ft_rV#dXHDHL^cP$?T$xCL!H$P#Ixu!sY`Nv}@)YfWTdM(priDNl!p$*X zI>?t3Ctu-%!9-c+*b9GaS)gi^I09wfH5Cn7&Y+?ETO6SLe*;25y}!+HF*=wWpa1kK zvTnPGa`|XdH$x0An=P2I`-<~JYzsO|0f4cV2n%>W-gOQhBunZrOK;lE{e20&{f?U% zz1Z{kZvn^7L>=*r2!oy`Q(<-|OWDB}$Uc%i-SD6xbs(+f_qVGsQri4OXxYv_B6z09ov@rpD8H=Op6O--C6(uKwMm)D5g_cD{IuAHDk~9}R?~I3H&pwO5AX1ujRe?gcWGzAjjt$}lNc#p}=V85#|^Y#r3h&1}S zit=^^%N@oTM43aLFI@(D8M&W;)u52g$MWzvtvKKSH)bY{BVJBt*P z@0;wNv+@czF6T7@;*8T3a?@9*iQr%5sULX<8)EFgn$ z_=~M(I8ErFU34ocuv<1fNmvU{35hveM=Gs-_m$>rNxKyV{@oy3_Z5Zj;ZcFjS3opG zG(GVDy|PeG4%^+e8R|uP-2q+)%3H7+(Wh{fJedg}ZrbqJk5vmCNw8M{iv=h1BE+wW ze(Xzqf=u9Yo`&~Oi16a0FCv%}t=W?&(gv{-!HRE&#!L83au^zuY9a%d(Lay7+B*+Q zQKW`1n6alLe7u*C?u@{S&fwh|rA_-gZ4^X*A~g5DU9_p zr?dhVKwXBaE$oW_>zCd;WQ`qWVc5VyX|(xX*9D;`NgUp;PGTZ)ReIPoSE3;oR$Q-h z1_y#6=*9)wsZbq4In9lb&f&`z@5@I~O)5pLAtway`8t`&5X>fj-CG>mxt$rAXkMQ!w;b;ag%IF3G(CA`}nIQS*z#ZWY#gEcd%y?Gc0#rGD z5(d-(DMS!=*i3}qu*TwVPfi+Clr##~C4~#D*rye-&9raC3$@)NC&F{i?i#B18&M^F zR?c2VR7j_k1zUnZ37yJ~)aDF=NzWFk=chbmfi8WL#{qd<)4D3A(Va9LtD1e1?fiu( z@z$~lXL=AK7=EWBg#bGEVbviU*No=l>Z-PoO|qdP;yFr#QMwiJaIH57ej<}fsWSyD zo?abgXBDHE<@}Xe%#Z(I%i{9>(o|72FSl(+z{fLIXoBC_g{5|(Id7wJ$13KO*+HZL z%ckJd0W%F?N+CN245-mF#YkS3_hQCDI2YLkpo3rBxMXH`cZPxdq+}why@7CY+fom@ zVi8-v-yCl}4^gHxJEA7~RDXCkcQo(og?K5F^#MkxDFPJ9~^CT z#I(~^$R3+#s1P^f(L3r|jmBucKfMPMI5;~Tmy_MVRR_KUzMZw>eM88VQmH@oP_aq? zt`tY`L#5(#A_Piyne)@zaL-H*Va!r<_9xVS(nEO0* z%eOP=c8skxh5&+Mq~}cDiUL6Ss7CR=E)%5p&V5c0{6RxUxq3Wv2SiPL!ZWo-<DyKl$U6+zAT^D6sGqNsQjvZ=$$SuPe4v_^F(IqT%#qZywl{i~3m zSD@e;r$usUqf}hP!ry;NCGHm*23d^lu)5-MZ?_O!>ijOXwkzf$>!GV(mWo)7gffTa z&1~A{51+2_*Ex#oVB)(MF+8jtJ{b>@u%^uC#9|A6wOVPXJhJ3Q1@);mc$$Lq1((Ij z4Imj&x6_;PgzIz`gMsc=S$SN_YZ1noWKZm^`X+a@4c=Ind7?F48_E}FU51@0`8e{W zSMDE4f{uP^PcTCPfI^{$msxcY)Lt2=xg{1ZPzXpl&-czL@@`$ccvg&~tevTUiR{&? zk_wN<2B~tyDH2?bo2jSLHeYYAUgv0T$E}um+%*0zJT%kiFnZm0a`n-y#mRpxr1kCf zguH%wwH3sFgP}}7#3sNEzDBW(SJXV2L9MPK z>Li7QtA}QD6lFpF2F`hlOTL}1)I|W#?XELob{XlgcSpMh0^fvk;(EK zcl|O@D?twwoYy^s?kh3Gd%qX6?M^SYX^5pD(<~7?=JHDh5~~5)hVL?-DoYyqr2YOv zr%K6fq%5Z;t)io zXJQ$C(WSOpNu{K92p#}YAo@OJw%&}rKT@L71)~_LU0nx_qw1C~Y_f9p={nDzOXjO` zVY{AC3B5DgW%8swK4D0LtXZa1YS}3eu27Z=3zII7k(wmt=3nN`@st_GDWLcWyn4C* z_g|?oP=7m$kHa7mHPt(qDa6J(W83Mnc(-2?rmcfj0#YIC3|WM2VxrD+0P6Z`vQYqj zhu9cTnJ#%X1A!Ch$IpJ(tPUiC!C!)0doaopzV}uQd4ds8PZKiXHOz|YsMt8lPVibKRoJ-m!2y)0&{aJ z2QuT(klgXqxkFy0;7l3=!d`U&IZ-3&m2>SGTONe|NfI1tpF%s~Xpa^v zrT&qQRD?mmtuB^vw8!9RuGlgXDQ5K0d4kX)Z`q zE&J`nx{YY$-F(AyBz21RS_%jxEu48tO@V0fkef+-Op{Ya!}|%&W%as3OeNsQy6sKu zvad#Zf&}>XP3&kUq}Kir0}JvW1!@YekPeiP5B$Nb>{)aLIVyTxB`6@ zbKfO*BFUT+4z-K z4uy%=%oJ|=JZG{kc`PbxvrVDIW1&%W$lU7lqmajVlhe&0?;U0XYZu%}0mZ_!zpSUt zAB>>*0#PpjMgG&qr(pP^9_siX&wFFlLYO)Kl* z9rl`)X5UnooAhV2Kef=ulD_amRp`cbe z7&r!(^N;zYq}n{?tRjUgvC{ z?JVX)wPo_Nne+q=(p4~Et~$3=A$#Um9KV>PMWQGX*+y`IcbUnPhpgS%^1ArJRMM}~ zh&=4s^;Y@8N`geAuZ*ong`-n$TA_iYBvmwh{>AZuG65c5O}nyOv^w~GKC>rzld=GL z#$|^fN{ke?O_fDvL{QTHv?FVyF{g-zVWi}U$I<<~V=eZKNc3&>Z6$iuTL3Cj)O;g! zY=RvHR2A#uN$uRBAct2k?z0AXl!d< zP*$B#XG7PBy2K#8-si$#{lWJY4!_}hmQzz}Q%J5=lz~_M1|BVvm9jFZ!A=$xkh7D8 z6>IpmS$sKf>&E&-<%}=#-^op!0By>#J@raV8(v23HC{_ z?~$Az4@@;$`4+^XXd5Cq99LCx_X8{orzICuN_Wz{4Z=-nV$rqpVEdO8za!NdyBV-L zSL4?~YlLC_Z|zjnjk}XbZ5gh$UV9=aT$>8-aKOMc9wZ@tv~Au zxn#u==;!onYa1etOyxgAzEJ!IB5z}-L{0OsY*R)gL_IEnK;9its3yk12Zf`fy6(^= z!S@**z4h`f#UmTvJQPwgF&k;oGM*GZ+QE$bRAr}Y*Cn{r7OmLGeU7e+{{XTRiw9*0 zAZ6c^S}g1?24nFG6wl_0+-GYbk)#AnyZ}Z%i&CTe0wbZnNW?3yqe9x$A~9%!&(47^ zjSGKJs0=n$D%im7I1*@kWj6^(0o7#fmNh__Ab`RXL#*SnD36Nq2PvgUSbUU8WY#7Y zt{Jk8c-^)nFta?lkAxvd_qjUhkP{Jg55pMcxT=_;&(*T_@955LPVBIM0gwJA&f9I> zv>44B3maSUOI&h@##6ec8jaB4m>tHHK>}|0$Sq)vQYoNE)T9&l2a*E3+w@b zHR_8?5ZNE%qgF{Q!aJ7mR4i_mD9_3#vP*9Jz(!<6`}lN3h4wK#DYxwsZ`%0IXQjyS zXat5WkIckAP;JX2&_JD1)r&J;-y!$&3`{8F)jSUm7zQZE2Ig1Dpi zTl)Alp7@WIV5wEu|**q=Q!#Oy69smr3d$;35(Lwv+y;akf!w?T3B)W6$V} ztpZgvb2WFdk)&0ms^2+43%?;)`g8#1mtr}Q10lsTMmlW7^v{RU*3o=rS@%53K1i-u zK4iyH7df64Qzqhp9>@ekSLROeQX(T%JZ!6Y>@K?!AiVuLVn6dDR|F7CcX$(%Bzb26 zJfZBF*gPFMLwX6KnB{a_D5Q-+CwLU%L4w%?M51DEB*!TN05{wZp<^kHt>WC=*ro}t zJApnyOVJ~=E5$mmu^vQikd?&t4fhS?7cH(57YpL@7HKVYYbn= zI}OwH6_q|T2bv?&(lg2r#`WEA^v?5w@;U(3Eec@dY0vpFk4(x;CZ_#3;I#;A>wILO zC+z$;A;4e$rXwXP_t_VYoyNkmbnE@&scAQlXwc9XI<`vNJ9Y@d9PaKuqIrUCGlV5} zSnxSCVSyA^@KlKPvQRLOfYSf-K2JE$ZfT>dRp=~`JlrffbraVI&&84HRA3fOciYmH zvA9O=kB1`HYke83BtEalFu=E$PM-)$N&22h4aFd4+`+NtXWK+Oyr4+Ob%R&~W@`E=pSaPqEvNzWa0CK_PA@7K zHcw*>t`t5v(hk4*Jvz>@R1h<#PBp*)!`Z9NI`hQG>w{NL9Cs?vV^WDGM@MSF@;5M| z)k_uY&%WIW-wo~Xvm=SP+Q{C}z4(BK5*jZZ5z$x=Dt=b{@<3>!#m^~znoHVQq5IUa zKOAk=R^nGb_I856wBR$NId`UzjxMetL%}-gr@KZ7aE?98`*=y>W~GNn^saCeYg_8uqg%M>RBg$>|;GY>33i? zEKUq9lFT|Y(Y=0k@Fomr+FB-I$6G4srvU}|{CZIIj>$d3-N*gT(k+QsiY6d3$D^{@ zeqYPtdfH{+a(}7VaxQ{%%zG!TpXoidj}`VnH^rjzbOhPLP#I}Az&ta%AbMhrmlS@g%0FOs>dH)WGA~+toZqJLd{P;FpBeTn5cRMPdFC1+eLbp;EI!J^qay6 zBwDt)0cx_1S7-q{{||Cf`x{322Cgs=tKAG8EzEQ=jn_ovjmYC}2#x+lnl|;8X0aXA zBQ=&z2DyV?k>ShpO@0DCA1blinOw}a|BAfvCB|)nB}VKLqb+_TnfC8RtE`54nl~PX zri28rOEB3a)x^IqBGucI*YiLjeNb@&lOR|qjN>-8wDa#uZB7m3LmBRp z{Q#OFHiVo~0iVftGH661{hH0p~)j$oCtcW4h{lXFFVsind(f%F}{#{hS;QqKm5och@AdrSj@Eh(N7iNQdt>Ug;PyKuiL z#r3|6#^jA|Avw)Ifoc9oyW2JdBp?FBnrfLLhFa)!+Rdc|rENjiV{QelEn5F=R@A66 zqT0-zl&`9Z6Pgl7yr;|}mCu&fU%C2LBB{@tSO`Kb7_*7+6FHT`ZT@q;Kd-mid#qJk z-p9BmTgaXFBjlj*pU?4d9sN>V^dY6^*wKLF8=CPjmi_ON)#0W-<1I<7|NoQFfljOK zwQo)u?@i(Kaz(|2z`A+4vM3(QNB*Dtqs>QOE-)eyeE8*`LfrU;=U3zQ0K(v~f-Z>J zS7u${tlV93f;`zaDMMhx?#u}5M!AA)34 z&{(l*DKqyv`Y~Oogc&JMxckonZ~Aftv!eO`v?hKyfl+ifBxb^*6ouRRxSF0n*idJF z2S05geWxv0XD5jG*I5k{M}_4UBp29PqT>eI&Wa4vJ*HZ~nHc3Taj+2su}3Vs4sEFA zsI4W14u3+o9;0*UZ_o{Ta!~D7E^-k`DQuSfTmuGvy1evIGcZIG$kY`2z+7(3?g^TC zvs3IBLJ0Ar!SpcQP|D2tM#KPQMcoLKoabbXE|aC#Z+r0cY#e_VvMJy!P?NVN2#vt8 z!5$PvTgV6>C2DIm4BPx(w_m$;k*5jfGt6@a6od(BO90|%QM#BqoMxYs^KTijn?Zy3 zKbjV*tjAQQn}I;^SUShO?tSK4v}40K*WikB90whV@T3lk#3 zgF!!@_sXIC{(5JjR&H-i<}T>s>=x61Wt4-l$>OYOE-qVfI5$MGQ0`Vmhm~&F-KoRA zD%RTNzU*QnHH1W?r4wB3xJh*rYU+%_gm8m_nHY6Ittbf${Tb~Vj3JHaa&AV-7Gjxa z)0b`xNiYA~NG_zR3_5j#Becllw2hGR8#M~VpVPjT9hE(zZbAtB=}3s9)u0PKG~Gg|7&?GrVJUcQ15iDSXNNT9CgpRWVo?T z&DH(BC2JNZ5TxzSXm238WCqQG8sH>f^9xpqB*ridj5{<2kDJ7*5uVE?0`er(QjsFk zfN@t$I?Zm104FMkj5+v+#WEi)DE?SEcql9N~GN=vkQ`e<6vK zNEdD4bw4q=x1?mzW zE$bb@g3rbzbx?j7j}c;^y4k+NdA2YNckhzzp2L|5^*WU`NK18sy*v8v$36=V&9T^q z1#Xw}{V&pmV%iS5GVvb!(!^!MRdr}_)Ozt+XODn5!_2%>->a~D3JCmJ(pUeCb-~g1f-ITS z%8)cKK2p{mo~GT>u(H4RKO9AsFU1~P<-9mB#BJ@e6XB+=>~p@~V- zt06ii2mf1|5qhIFYm?4lVncu*iikP&#DcGvMs&vRw5C`|UJb8mw{?elNr9%o5p43D z(qBi)#UKC7-{+vp06@~<=DiAQm!vn?b8d^}>=p6kv4<)4sZ^I4|4fAX%Bnfm(OO9> zrDPCE8@uki5UK);GY&=P44Nj6jN>DON(+1!WUbC!G5)Hwzh(A#-rEcvzIejx3L~nq zAGcXJIw6loaCZ0NiqoZg)##<836U{yHtHwW&Bo5rUcd*QU{OMGC=jPu%Y75nAe9Va z11Jh)33gt0q6AU)zWAX|NfyLu5Jdd&^C^F19Z=7FHNZ{lNQ2*cakEBHMfFZP zot_aDF2pVqEIQ)jWq(*ED5RcGJ_WSZeq9L_2znyf>5VZ#!8D`Ej2jWu2o@y-gz5qo>Q%-j4g#7%2_F?Cb%p zxqv=HL)68*M0-v5MqW*&4)nGL&%$6LSM`OE&lfQE17{1L{sJ#4^9MG59Agn4{ox$> z{8)S6`TOJD+nfRR3WO>@Iv3#ZLTwxlKrQLxr}{_qq+t)yB1my%oMi+cH(Z{D`CrlF zyQ>jI*FAr$AhwUL8*F;3h^A`BuL=6#s#|&H9uf~pKkzEU&65VgiOrD`9Vvv4Thm%0 z2M;f~TJ{EPVYT(S6(MTiK z<0sADKyuspLN7~C)tC~+I; zx!f>N^~YSa3VR00;4;(r#O^j4w5|<2u#KPSy^XtdmG<^^c!!x5cW^gFxMgMJXC5ti z=}cqkI~RK&lJApMPnCfuhZ*02>-O1PQI3s)b`!zTk~#-+{^T1wna;@l{uZ21FcS8@ zAa@9`AUL*9@Iy>VOu-PfMR1vc)-L6_|NF)%CZ2JqXjq`$F*e4D?j-3CpHwM{m zB&$ITJk7y9*W0_&`rMZ7eTTa$6;e>!`iFQ8XUFoN2WI*dHx(8Vkp5wr=yZPtg?T$j zd7`|kmXJ>@l};3SGAE_=6e7Z7QujShZMOM0P#Kf|Tcy|)snSq9@*J`>K)lb|+_89) zrv238Y8ky>0rOVIlBg(vF2CU7w&;w+?<5Vl0S?efm9PSg0>NwppPO<%Fxgj$tFY8& z1?KjYuI(TxuQbu^^Tf`5VDHE@Phon_2!n7AY8IEyw zzoROE3boboD8MULdX>;hX%nn8Et*-A1OWNAOHX-36`!%ldU;6rECm|U2tZ}lZF z`@Hp!X?8>-!JaTP5^kZwBhV8Ha5m^6lgIOcmDLix@($ZhIE~G}GYWzaPhI>YlPdN;;w zHh?BNT7oZ+t)J=EcoR=oTmUGK7qNI=FG&esB`*2*INWBxnUQLALrPlb>UR-9)Y)6k z|79q);-dl=)u1$f!>=2Sd*Dolp;wtM(3{mv6h{J^p7wkVDE0?CWgh9^U?n38pcLs= zI;GKaWL+c;{vyJbt@T*SkK(vvbS$#iJo{`V$3#M5Rbq+k{iZFoZeo|0AOG-96H$!3 z4A98U3Z~4fY&fC$sO2=vFdkEE&#wKbOsbENJ@tT~R zZ0wil&cUTuV`N*I)g_7Lnu?3~QLVS0T|F6mZk*%f>?JfAlFQ%d9uURks=*JC!D(28 zaS(kIncNX_SOWx{8c%&Oh--p7>TVd7n?fN_fzqPUW)h*C8u&ZLjFqh%-5+)7;m6~N zw|JvawwbyldJauy27n%}z+;J79LQiK#d2*hvE>6k78lgTj9AJfO!#vb&Zr>A>zfe7y5kX@z_eC|yCI6kpT+`Qw3isWx2gB0mc87d) zOKQQfTJ;usCUq6-P;58cR8t0iOpj$wyzE)0AtyJsI{`d?^XxOpRs>i8=}YgpnSgu( zkF0YBy|ql*X+aPu`3t?=>y?hjZ6XhT-?6_8jIbP3V6;m$&I*mVH+%J5Uk&6ALi`Bk zzOZ%Q$p)Sl5i#51x!5-Sl&S)hNn(QyGrQ`No2zCh3&(2{bY3B#V%{dO#^kKM!GN}s zxMub!EZm8pxR$bSYVkpO%m(sPFEV1X0-J^map&H={R8r?U~Y&26IfQG5`eC!m>>Z1 z6ut$4gby#3H5U8p@2wZmy-g4Npc!4@?SgCFk)Ms|vPb>r!2x-?&H%y?cR| zH26b2(xGUJ63^+F1{=*fWjO}P&(}P8&!q!n8*XtPqKN)fojt(dx-=USxQHB;Z5-h8 zcgKyD))s1~_yYp9`nG%p0|eYXgi+|6I0O1O*w&wA@}(&=afE6y7Q`6IBGwup3>^>g zisB}QJVqdc8ducS#(0AP{4GKfrHMEBwxvf1%x^4Wd|z!fy{{pYaP`5YJ);WH>NF{G46e(7weS8n*wC1y~GVHF@G_)FVe{t+@GXI$xvidimI+P5h4g zu3}sA`m21C&%ru9GZiBIQC%G`Yltf?8vXb}PPieE`Budp+gpkZTtn07>bk*{Nag76 zn-5=4Zs;AsZI#&?x=_uiY&!}A(HVRZU{%h!Zs94~y~8Wm7Ao^Gso^+Gb#@Us<@M~@ zIU%<>vABSbf%U`R{sy1Kxye8~y@ktf8rvRNqg zr(CVWUifd3W_5;WwHk}X1I)7+uBy1KVV#`dGHV?H{GmKmx94B@RHMxWCRIzPI|P8D zey4=-lJ1j72kb1L0!64}g6{3bQxZo6IBaH9`j@vy%n^;JHVIk%bL;@kU12u+WQSYk z^*M>oMX33zNuSnUnd4|3)}~NbeiXgS`{WAg(mNi@#E2#E@kSll%gG=dhF)nl5F+fp z8aeI|+k{H4Wl?yaA#Z;s=j7+ugopnOJ|_i3(`1XVjEmHw`wGDnNKN@(5B2gdGK#YY z{B4WEVd7PGScO7E*`>xLr`^ZvAAfI!Cs98GKKrH)UWG~LNGaWux6v`5DK4~fl!uLT zESztBiA{APhAt86%I3O7Vd%2*$WrDxV&nRA{pyd+Ole09hg_Qyb((i+s|~ZV1imp~ z-jE2V&;qUkB*BM4sRrq=Lst@qCXo!EkDIT^pTF8Tgu+oj+)G>O`cffF4+4ZjDcvyW zHtOHztCA?5H(?ruSSnnjpE=s|+FaUCVQi+KkLl?ofq8UvSbNta${?nj<9q)n#^ZPmtCB7^X5aqRVFJG< zJC$f8*`ln~bs(5vi!35nxqLgkbc+^-V7f1F6@XwqZ z?;QF4`eem{Z4{X${eFokrwTOECS0rG)^lnGxdfNH&d#y#d#1D!M z!PfzoIXxBT<0OhOgjTr3E%j86ghz5myC~QFKJ4z4M6SZL5gk;31}dUTspJTv;elA1 z56%BruR1smC;h|HFGZWO+^Ii;CIsVn9sOHghkk6Etq(&Z%1-RNOgmFc4wCtd5LhsZ z=J)8vL6|lV9OkMS2BjnB<{bC_1HEu2YCInQ0Ue8OjE;HX|H~190Wb;*DtTW#2aV`J z-5?;y=mLJ4Bq4a{xZn_y^A^S~SWPm_@ZE+-IoFbxB-t)(SZvdp$D`zF6R}1TvJ}YS zJfFz&{Ga(_#(;-I2r1gFt;!^4@L@`pZC;8e(jjFO8)!A7V?M-jH1kXrL6r1UfP*_^ z%7|>%6Iq~%$eB{nDl~vlOj+tt7ymq_AgqFj>y^eO*_;X5VjPRZ=2TGU&0#hO;;QZh z-6-yg!m~E-I0M2^bV8J>z9hZL090olN|u=rH~YPezmN>Y5p zILa2f8VE)a8fArmW3suH5nZvSklosH0^^3gl5s$|OIi$DP7gki?m{ zk3s=wjg$l8C$nRz$v=769CNQf-}i9gck0D@%_M741?vmL7a)`O#D2%`X;cuAjAhv= zmMUB0(W$vdGbN7YBj$UafoGMaRGJ67soek7u#6YSb<==(UfUWA*dU7B_5gVQz&?*jN=d!20TLBQ-PtZ@^@Iazm83=odJ_h0JT`U;1=_J2Gs$WqFuYg0=5Cm^#CQ?4ho&d$zn z)%Es{VvUKQ1=77*m|()z-2yZEEUg*GeEqdQp5zjqr6wGD4gppYMKl z_8-Gn&|aVM?_jZS*cByeyfktY!>m$T6aU1m`#=Bw`x{4;?M7sgb;h^jP$KsxRV468 z&ze!^VsBE(0i6x}ZxxiKeZ7YM!jk}*j23(d#-CTbuR|i(NBK(gw^H2H??<%c|d_>M>Y5v*wcZphj*5N zX)xnecAl~xRdC~T;XN#_09&wt zwYW2t*W$d!vr9E>-x1^rb_=B)FcTESXzUMj0SJHNadjTdmK%`EG`B~jK}UZStCIAD zpp=g&Lc-4!DmL%X6zh(5SunDP0&U?tcpwk2a{vGaZ+Kz2Qn!^00Bw>DP-{g00ROURO|WcFFq3ZeNn})dBzp>^iZt0^L()?*##a8AJKQm zGkQn!n)KjF0uau$&$<}D6~fQmw872Rv(sm)arLwD$6%96%G?Z!C@~8ts>Yo}Omn4T z%-mgI@{vV#hC^~@0009304<`o$O&vsIT$^p|JO-()Z&eyG?3y+INjjz-uU|HsK@*p zSy)r@9>7F;_*lir-4<~j8wc^J;2If`s&cM zycQU|R_YeR80{{RO$MiMZ55pii<)z;Q1XHrhT^@s3o>kZP z`wXaPN-ZUc*<&^{_W7w=z3WSRCMr~d6cf9tD~S7I{!l9-m#Zg_W--RhlQ}CULo;5V zh7gcqAy}1}#*R28r>-tOL?w_va6{Vz`aaP;@it~hNJ4U~s^RtB$ziSvhRS0oAtC@) z%PNGYau5x{4Wh`4csyA)fR-7}ek)E&ddWCP0E$8%1f%9k3>D#z#ykvqMD*z;`rS)6 zaw~l46;p!BNyAg6^0CS#4+*^HrsAPB6)o;w!$pEZcGo=})^Y-$VBPp{o5L6fq3W-S zih$c(=(kR7e3mU${PRU|H2Bdk;BXUkLJg+;KyhKI5n zWPU6)|I8)5Zn`SN3<3P#oyb>mEBH4BF2)G{Ugg!Ai*O(@!m{6rq@;lH5#tTXziH5a zYZ#)41w}_*=+Z*nR>JyZ;rXrDZ3GtSueH#Vgy;$)n@9!}r6Xc11Sd49=@TO7L!M^4 zkGvVmd>zzNpjH2;QMD0_AjZHp&pV6{iMp4El-d^C1Iem6Xy**T(&rxk-+^ymo*QGJ zpl?rf1Db}pE)O?IN}(&F0Eo-lB;^0r^hh$L{}c6AA8q+uuwO8A$a##8Hri3qk<((# zrrhxzemheW{$8OWt5g^++eqMp9RJ|}{x_M=z=Uvt2QCCmy1hvV@9%%^j08hHnM;bV z>=iuQgaA!llJ0B>q2LVfdp%J-UE4(@EZ@_H6VFwy?!!Z_Qf@j=n6F3u9T7NyK)wvW zXkw5->-^n9dYW%a>bay##Jxq9uun)XH4D&hB^kW&nh8u@c{jN`k8Snph+OtZY*0Kn zQ^T^dtIwt($EraCJRHd1A2d~>;P5N~(wKwyL|tz$U1O?eCn6cGUBk!Rm^+O^zI0Jt zKaB!y7;v!p_Oahafc1HHQ{`j3w*mSB*;n}$0;DMc4OD${q{TBZ000C?#u=-eSKvon z>~XJk0RtTY{MtUT_#y;eJWCWo(aCqgKeKsum(<+VaFV8lVhmS7PPeu}g|SyxDk!j# zY`y;m@!c0P7By*$iN%Vt>&YU@K9mG;F~XeIeKu!|g^L3%627M!9$p-FXCmtAZVj?P zodZl?B#=w)H(iV|Hi2yGBz{i|GnxN#j3?x8?W(Y|8JO>fkb$LjOReQWt`0CJmym<; z1Hao)>QS|me?pI_XY90rMEzjkK70>!d#DPaO8U(utYpD#q}cpFqR$z*LP+YkSG-R!TTDQio2A@u zL5Lp5{N}f&Dm(cGT7!)cedwE5Tdi)q{Bcu7->BIWhRCzNz{idP{>cV_iWp1wJ!SQM zrN;BoWtS1QhM3=Kd+V2?{ghHVqT*iK~$3cIH zJ?r0^LZx?f4}rI-?&Hhbss3*<=oa{>p1;vODhHdkwB;~(a<{$@vqje!HA&x2;LAY^wtXQL@pMD`Aibts zLsL*KPO4v|Rw*7Y&T}XEeKnF##Q}T3N&Jgl?SoUV)x--~r;EivfjAYGo2sBQk+OY! zo?D!Ww4s-efg zifp|nZr6Wd^=QC;uz==-_B{Erm%smcaRg)h_VfJ$VL_-d+ZUC=<&Y?)X~M#E6odvL z&2#6797YlUfhxT8Ad8DkK?CjLB!XYPuCZI<-*XkkXIV5jpXJUQM5ZQzl|tviwNb^l zMug~YL1N+OPbpxjfOY~$z8>MZ7S-+Qgb5`;SYXm5L~>;5+q0|!{{W1*GL6$D{vBG{ z>{j}jw0S1DhzouSklGW6Ng7~#pB_wDMQLmCz-B{gz{b!l(n@z?>G*Ha0SV^z6(0<%?B~;1 zhdi=^hd@ufg^r``wHH4UMhrhL!bxG6&D2!@tUkvG%+pV5yJu3x!`qv=b4S6ePemwi zUW9b^WBEuHqljtpA|AIbD8fbM^8Ztf;DepLgUrTbImv;=(7I!1{}syp7f2j%c25={ zA8OOxQdjxEnoSs~1ozZFXtJ9m(OA0oflu&@ry>gm`k$)})0r9BNBOdDmCfiN6vzNL z$V%A49helVwuO2-06T1{Dbaab%&B*w*-pSMPZA>jqy6#PKvGZV)Q#CC-fdZ z2SbQBlF0h|Pzay@{S@pv|FK+PBY<1OkSp|+fYig&Xwgt* zR~_N;pyZH9{CKc=+`li(z|du1{gg#ZaZII4QtRGRhIsQ_fu8wD?L;BPjMlA?>8~Vj z;Fe2GBJRlZE3TmyvJIPGeJ;pEJ_oz2zwLnWobMYLq4!C1xvklFo2F~Ndh0%u3sDw->vCrb5?RN7--If8{T@3|7vR$>~J%21g*$_?WesG&`lNtG> zU0^eO>=zD?`8rS@S2i9qAD=CeOH5=hVdsCZK{j14WIW;%~2(*Qo>H1XNcv|J12IgK(1ogC3>W7D5QCS&_+C zjL~zNGDg~Mq_4Z#sm8P9!>9HD&we@mP9RI2N!6&Z0tDBYx&h(k(EJ{i433c15YJ(K z2DPM~e`(6x+ED?QJrbbuzW`CN>$UD( zp%5ydE|4L-4(8=#jkElfr&Wbvoa~f;0_RFs3w$EJ899|0VZC6sxQ3+&LS?xHHFqQk71P)VhmC{->nSBwutd1mV;IIYjXyyC$#z00RLh2!bEqF#rGn literal 0 HcmV?d00001 diff --git a/enterprise-integration-secret-rotation/demo.svg b/enterprise-integration-secret-rotation/demo.svg new file mode 100644 index 0000000..05d456f --- /dev/null +++ b/enterprise-integration-secret-rotation/demo.svg @@ -0,0 +1,43 @@ + + Enterprise Integration Secret Rotation Dashboard + Static preview of enterprise API and webhook governance metrics. + + + Enterprise Integration Secret Rotation + Admin risk queue for institutional API clients and webhook destinations + + + Compliance score + 50 + + + + Critical findings + 2 + + + + Systems watched + 5 + + + + Evidence digests + 3 + + + + api-dspace-prod + Suspend and rotate immediately: expired credential, unauthorized admin scope, unjustified break-glass access. + + + + hook-eln-publication + Pause delivery and rotate secret: overdue signing secret, long overlap window, weak retry controls. + + + + hook-funder-report + Monitor: HTTPS, HMAC-SHA256, idempotency, dead-letter queue, and verified recipient are in place. + + diff --git a/enterprise-integration-secret-rotation/index.js b/enterprise-integration-secret-rotation/index.js new file mode 100644 index 0000000..32a1094 --- /dev/null +++ b/enterprise-integration-secret-rotation/index.js @@ -0,0 +1,319 @@ +"use strict"; + +const crypto = require("node:crypto"); + +const DAY_MS = 24 * 60 * 60 * 1000; + +const DEFAULT_POLICY = { + apiCredentialMaxAgeDays: 90, + apiCredentialWarnDays: 14, + inactiveCredentialMaxDays: 60, + webhookSecretMaxAgeDays: 45, + webhookSecretWarnDays: 7, + maximumSecretOverlapHours: 48, + requiredWebhookTransport: "https", + minimumComplianceScore: 80, +}; + +function parseDate(value, fieldName) { + const date = new Date(value); + if (Number.isNaN(date.getTime())) { + throw new Error(`Invalid date for ${fieldName}: ${value}`); + } + return date; +} + +function wholeDaysBetween(start, end) { + return Math.floor((parseDate(end, "end") - parseDate(start, "start")) / DAY_MS); +} + +function hoursBetween(start, end) { + return Math.floor((parseDate(end, "end") - parseDate(start, "start")) / (60 * 60 * 1000)); +} + +function canonicalize(value) { + if (Array.isArray(value)) { + return value.map(canonicalize); + } + if (value && typeof value === "object") { + return Object.keys(value) + .sort() + .reduce((result, key) => { + result[key] = canonicalize(value[key]); + return result; + }, {}); + } + return value; +} + +function stableDigest(value) { + return crypto + .createHash("sha256") + .update(JSON.stringify(canonicalize(value))) + .digest("hex"); +} + +function normalizeList(value) { + if (!Array.isArray(value)) { + return []; + } + return value.filter(Boolean).map(String).sort(); +} + +function compareScopes(grantedScopes, allowedScopes) { + const granted = normalizeList(grantedScopes); + const allowed = new Set(normalizeList(allowedScopes)); + return granted.filter((scope) => scope === "*" || !allowed.has(scope)); +} + +function severityFromScore(score) { + if (score >= 80) { + return "critical"; + } + if (score >= 50) { + return "high"; + } + if (score >= 25) { + return "medium"; + } + return "low"; +} + +function sortByRisk(a, b) { + if (b.riskScore !== a.riskScore) { + return b.riskScore - a.riskScore; + } + return a.id.localeCompare(b.id); +} + +function evaluateApiClient(client, now, policy) { + const issues = []; + const rotatedAgeDays = wholeDaysBetween(client.credentialLastRotatedAt, now); + const inactiveDays = wholeDaysBetween(client.credentialLastUsedAt, now); + const expiresInDays = wholeDaysBetween(now, client.expiresAt); + const unauthorizedScopes = compareScopes(client.scopes, client.allowedScopes); + + let riskScore = 0; + + if (!client.owner || !client.owner.email) { + issues.push("missing accountable owner"); + riskScore += 20; + } + + if (rotatedAgeDays > policy.apiCredentialMaxAgeDays) { + issues.push(`credential rotation overdue by ${rotatedAgeDays - policy.apiCredentialMaxAgeDays} days`); + riskScore += 35; + } else if (policy.apiCredentialMaxAgeDays - rotatedAgeDays <= policy.apiCredentialWarnDays) { + issues.push("credential rotation due soon"); + riskScore += 12; + } + + if (expiresInDays < 0) { + issues.push(`credential expired ${Math.abs(expiresInDays)} days ago`); + riskScore += 45; + } else if (expiresInDays <= policy.apiCredentialWarnDays) { + issues.push("credential expires within warning window"); + riskScore += 20; + } + + if (inactiveDays > policy.inactiveCredentialMaxDays) { + issues.push(`credential inactive for ${inactiveDays} days`); + riskScore += 25; + } + + if (unauthorizedScopes.length > 0) { + issues.push(`unauthorized scopes: ${unauthorizedScopes.join(", ")}`); + riskScore += unauthorizedScopes.includes("*") ? 45 : 30; + } + + if (client.environment === "production" && client.hasBreakGlassAccess && !client.breakGlassJustification) { + issues.push("production break-glass credential lacks justification"); + riskScore += 30; + } + + const action = + riskScore >= 80 + ? "suspend and rotate immediately" + : riskScore >= 50 + ? "rotate before next export window" + : riskScore >= 25 + ? "queue owner review" + : "monitor"; + + return { + id: client.id, + name: client.name, + kind: "api-client", + systems: normalizeList(client.systems), + owner: client.owner || null, + rotatedAgeDays, + inactiveDays, + expiresInDays, + unauthorizedScopes, + issues, + riskScore, + severity: severityFromScore(riskScore), + action, + }; +} + +function evaluateWebhook(webhook, now, policy) { + const issues = []; + const secretAgeDays = wholeDaysBetween(webhook.signingSecretLastRotatedAt, now); + const overlapHours = webhook.activeSecretWindowStartedAt + ? hoursBetween(webhook.activeSecretWindowStartedAt, now) + : 0; + + let riskScore = 0; + + if (webhook.transport !== policy.requiredWebhookTransport) { + issues.push(`non-compliant transport: ${webhook.transport || "missing"}`); + riskScore += 40; + } + + if (secretAgeDays > policy.webhookSecretMaxAgeDays) { + issues.push(`webhook signing secret overdue by ${secretAgeDays - policy.webhookSecretMaxAgeDays} days`); + riskScore += 35; + } else if (policy.webhookSecretMaxAgeDays - secretAgeDays <= policy.webhookSecretWarnDays) { + issues.push("webhook signing secret rotation due soon"); + riskScore += 12; + } + + if (webhook.activeSecretCount > 1 && overlapHours > policy.maximumSecretOverlapHours) { + issues.push(`secret overlap window exceeds ${policy.maximumSecretOverlapHours} hours`); + riskScore += 35; + } + + if (webhook.signatureAlgorithm !== "hmac-sha256") { + issues.push("missing hmac-sha256 signature policy"); + riskScore += 30; + } + + if (webhook.idempotencyKeyPolicy !== "required") { + issues.push("idempotency key is not required"); + riskScore += 25; + } + + if (!webhook.deadLetterQueue) { + issues.push("missing dead-letter queue"); + riskScore += 20; + } + + if (!webhook.recipientVerification) { + issues.push("recipient endpoint is not verified"); + riskScore += 20; + } + + const unsupportedEvents = compareScopes(webhook.eventTypes, webhook.allowedEventTypes); + if (unsupportedEvents.length > 0) { + issues.push(`unsupported event types: ${unsupportedEvents.join(", ")}`); + riskScore += 25; + } + + const action = + riskScore >= 80 + ? "pause delivery and rotate secret" + : riskScore >= 50 + ? "rotate secret and replay failed deliveries" + : riskScore >= 25 + ? "queue integration owner review" + : "monitor"; + + return { + id: webhook.id, + name: webhook.name, + kind: "webhook", + systems: [webhook.destinationSystem].filter(Boolean), + secretAgeDays, + overlapHours, + unsupportedEvents, + issues, + riskScore, + severity: severityFromScore(riskScore), + action, + }; +} + +function buildDashboard(apiFindings, webhookFindings, policy) { + const findings = [...apiFindings, ...webhookFindings].sort(sortByRisk); + const highRiskCount = findings.filter((item) => item.riskScore >= 50).length; + const criticalCount = findings.filter((item) => item.riskScore >= 80).length; + const monitoredSystems = new Set(findings.flatMap((item) => item.systems)); + const maximumPenalty = findings.length * 100 || 1; + const actualPenalty = findings.reduce((sum, item) => sum + Math.min(100, item.riskScore), 0); + const complianceScore = Math.max(0, Math.round(100 - (actualPenalty / maximumPenalty) * 100)); + + return { + monitoredSystems: monitoredSystems.size, + apiClients: apiFindings.length, + webhookDestinations: webhookFindings.length, + highRiskCount, + criticalCount, + complianceScore, + belowPolicyFloor: complianceScore < policy.minimumComplianceScore, + nextActions: findings.slice(0, 5).map((item) => ({ + id: item.id, + severity: item.severity, + action: item.action, + issues: item.issues, + })), + }; +} + +function buildEvidencePacket(input, dashboard, findings, now) { + const packet = { + generatedAt: new Date(now).toISOString(), + scope: "enterprise-api-webhook-secret-rotation", + integrationCount: findings.length, + complianceScore: dashboard.complianceScore, + criticalCount: dashboard.criticalCount, + highRiskCount: dashboard.highRiskCount, + requirementCoverage: [ + "admin-dashboard-risk-queue", + "secure-api-credential-governance", + "webhook-secret-rotation", + "institutional-integration-audit-export", + ], + findingDigest: stableDigest(findings.map((item) => ({ + id: item.id, + issues: item.issues, + riskScore: item.riskScore, + }))), + sourceDigest: stableDigest({ + apiClients: input.apiClients || [], + webhooks: input.webhooks || [], + }), + }; + + return { + ...packet, + packetDigest: stableDigest(packet), + }; +} + +function evaluateEnterpriseIntegrationGovernance(input, options = {}) { + const policy = { ...DEFAULT_POLICY, ...(input.policy || {}), ...(options.policy || {}) }; + const now = options.now || input.generatedAt || new Date().toISOString(); + parseDate(now, "now"); + + const apiFindings = (input.apiClients || []).map((client) => evaluateApiClient(client, now, policy)); + const webhookFindings = (input.webhooks || []).map((webhook) => evaluateWebhook(webhook, now, policy)); + const findings = [...apiFindings, ...webhookFindings].sort(sortByRisk); + const dashboard = buildDashboard(apiFindings, webhookFindings, policy); + const evidencePacket = buildEvidencePacket(input, dashboard, findings, now); + + return { + generatedAt: new Date(now).toISOString(), + policy, + dashboard, + findings, + evidencePacket, + }; +} + +module.exports = { + DEFAULT_POLICY, + evaluateEnterpriseIntegrationGovernance, + evaluateApiClient, + evaluateWebhook, +}; diff --git a/enterprise-integration-secret-rotation/requirements-map.md b/enterprise-integration-secret-rotation/requirements-map.md new file mode 100644 index 0000000..2746060 --- /dev/null +++ b/enterprise-integration-secret-rotation/requirements-map.md @@ -0,0 +1,19 @@ +# Requirements Map + +Issue #19 asks for Enterprise Tooling around admin dashboards, APIs and webhooks, and export pipelines. This slice focuses on a concrete institutional security control needed before those integrations can safely run at scale. + +| Issue area | Implementation | +| --- | --- | +| Admin dashboards | `dashboard` summarizes monitored systems, API clients, webhook destinations, high-risk items, critical items, compliance score, and top next actions. | +| API integrations | API client findings check DSpace, Canvas, HRIS, ORCID, and repository-style clients for owner accountability, least-privilege scopes, expiry, inactivity, and rotation age. | +| Webhook support | Webhook findings validate HMAC signing, HTTPS transport, secret rotation age, overlap windows, idempotency policy, dead-letter queues, recipient verification, and allowed event types. | +| Compliance tracking | The evidence packet emits stable digests, requirement coverage, high-risk counts, and source/finding hashes for audit export. | +| Export readiness | The module produces deterministic JSON output that can be attached to institutional compliance exports or admin review packets. | + +## Acceptance Coverage + +- Flags expired API credentials and unauthorized enterprise scopes. +- Identifies unsafe webhook secret overlap windows. +- Produces actionable risk ordering for admins. +- Keeps low-risk integrations in monitor state. +- Emits stable SHA-256 evidence digests for compliance packets. diff --git a/enterprise-integration-secret-rotation/test.js b/enterprise-integration-secret-rotation/test.js new file mode 100644 index 0000000..f0c9dab --- /dev/null +++ b/enterprise-integration-secret-rotation/test.js @@ -0,0 +1,105 @@ +"use strict"; + +const assert = require("node:assert/strict"); +const { evaluateEnterpriseIntegrationGovernance } = require("./index"); + +const now = "2026-05-17T01:25:00.000Z"; + +const sampleInput = { + generatedAt: now, + apiClients: [ + { + id: "api-dspace-prod", + name: "DSpace institutional archive sync", + systems: ["DSpace", "ORCID"], + environment: "production", + scopes: ["repository:read", "publication:write", "admin:*"], + allowedScopes: ["repository:read", "publication:write"], + owner: { name: "Research IT", email: "research-it@example.edu" }, + credentialLastRotatedAt: "2026-01-01T00:00:00.000Z", + credentialLastUsedAt: "2026-05-16T10:00:00.000Z", + expiresAt: "2026-05-10T00:00:00.000Z", + hasBreakGlassAccess: true, + }, + { + id: "api-canvas-stage", + name: "Canvas course roster import", + systems: ["Canvas"], + environment: "staging", + scopes: ["course:read", "user:read"], + allowedScopes: ["course:read", "user:read"], + owner: { name: "Learning Systems", email: "canvas@example.edu" }, + credentialLastRotatedAt: "2026-05-01T00:00:00.000Z", + credentialLastUsedAt: "2026-05-16T00:00:00.000Z", + expiresAt: "2026-09-01T00:00:00.000Z", + hasBreakGlassAccess: false, + }, + ], + webhooks: [ + { + id: "hook-eln-publication", + name: "ELN publication webhook", + destinationSystem: "Benchling ELN", + eventTypes: ["project.published", "review.completed"], + allowedEventTypes: ["project.published", "review.completed"], + transport: "https", + signatureAlgorithm: "hmac-sha256", + signingSecretLastRotatedAt: "2026-03-01T00:00:00.000Z", + activeSecretCount: 2, + activeSecretWindowStartedAt: "2026-05-13T00:00:00.000Z", + idempotencyKeyPolicy: "optional", + deadLetterQueue: false, + recipientVerification: true, + }, + { + id: "hook-funder-report", + name: "Funder compliance report webhook", + destinationSystem: "NIH RePORTER", + eventTypes: ["export.ready"], + allowedEventTypes: ["export.ready"], + transport: "https", + signatureAlgorithm: "hmac-sha256", + signingSecretLastRotatedAt: "2026-05-05T00:00:00.000Z", + activeSecretCount: 1, + idempotencyKeyPolicy: "required", + deadLetterQueue: true, + recipientVerification: true, + }, + ], +}; + +const result = evaluateEnterpriseIntegrationGovernance(sampleInput, { now }); + +assert.equal(result.dashboard.apiClients, 2); +assert.equal(result.dashboard.webhookDestinations, 2); +assert.equal(result.dashboard.monitoredSystems, 5); +assert.equal(result.dashboard.criticalCount, 2); +assert.equal(result.dashboard.highRiskCount, 2); +assert.equal(result.dashboard.belowPolicyFloor, true); + +const dspace = result.findings.find((item) => item.id === "api-dspace-prod"); +assert.ok(dspace.riskScore >= 80); +assert.equal(dspace.severity, "critical"); +assert.deepEqual(dspace.unauthorizedScopes, ["admin:*"]); +assert.ok(dspace.issues.some((issue) => issue.includes("expired"))); +assert.ok(dspace.issues.some((issue) => issue.includes("break-glass"))); + +const canvas = result.findings.find((item) => item.id === "api-canvas-stage"); +assert.equal(canvas.severity, "low"); +assert.equal(canvas.action, "monitor"); + +const eln = result.findings.find((item) => item.id === "hook-eln-publication"); +assert.equal(eln.severity, "critical"); +assert.ok(eln.issues.some((issue) => issue.includes("overlap"))); +assert.ok(eln.issues.some((issue) => issue.includes("dead-letter"))); +assert.ok(eln.issues.some((issue) => issue.includes("idempotency"))); + +const reporter = result.findings.find((item) => item.id === "hook-funder-report"); +assert.equal(reporter.severity, "low"); +assert.equal(reporter.action, "monitor"); + +assert.equal(result.evidencePacket.scope, "enterprise-api-webhook-secret-rotation"); +assert.match(result.evidencePacket.packetDigest, /^[a-f0-9]{64}$/); +assert.match(result.evidencePacket.sourceDigest, /^[a-f0-9]{64}$/); + +console.log("enterprise integration secret rotation tests passed");