From 01fae5d6a5d0112ec5cedbd514185b6e30a8c149 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Fri, 28 Aug 2026 02:57:16 -0700 Subject: [PATCH 01/27] Add .NET 11 RC 1 ASP.NET Core release notes Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a851ab96-8780-407d-97d0-50eed422ead5 --- release-notes/11.0/preview/rc1/aspnetcore.md | 226 +++++++++++++++++++ 1 file changed, 226 insertions(+) create mode 100644 release-notes/11.0/preview/rc1/aspnetcore.md diff --git a/release-notes/11.0/preview/rc1/aspnetcore.md b/release-notes/11.0/preview/rc1/aspnetcore.md new file mode 100644 index 0000000000..a2dc58d92d --- /dev/null +++ b/release-notes/11.0/preview/rc1/aspnetcore.md @@ -0,0 +1,226 @@ +# ASP.NET Core in .NET 11 RC 1 - Release Notes + +.NET 11 RC 1 includes new ASP.NET Core features and improvements: + +- [SignalR authentication refresh is finalized](#signalr-authentication-refresh-is-finalized) +- [OpenAPI reflects obsolete APIs](#openapi-reflects-obsolete-apis) +- [Validation localization uses message conventions](#validation-localization-uses-message-conventions) +- [Blazor browser options are finalized](#blazor-browser-options-are-finalized) +- [Select an environment for build-time OpenAPI](#select-an-environment-for-build-time-openapi) +- [Experimental authentication and transport work](#experimental-authentication-and-transport-work) +- [Breaking changes](#breaking-changes) +- [Bug fixes](#bug-fixes) +- [Community contributors](#community-contributors) + +ASP.NET Core updates in .NET 11: + +- [What's new in ASP.NET Core in .NET 11](https://learn.microsoft.com/aspnet/core/release-notes/aspnetcore-11) + +## SignalR authentication refresh is finalized + +.NET 11 Preview 6 introduced authentication refresh so a SignalR client can replace an expiring access token without dropping its connection. RC 1 finalizes the API shape, adds support to the TypeScript client, and updates Interactive Server circuits when the connection's principal changes ([dotnet/aspnetcore #67964](https://github.com/dotnet/aspnetcore/pull/67964), [dotnet/aspnetcore #68221](https://github.com/dotnet/aspnetcore/pull/68221), [dotnet/aspnetcore #68459](https://github.com/dotnet/aspnetcore/pull/68459), [dotnet/aspnetcore #68676](https://github.com/dotnet/aspnetcore/pull/68676)). + +The server opts in for each hub and can inspect or reject a refreshed identity: + +```csharp +app.MapHub("/clock", options => +{ + options.EnableAuthenticationRefresh = true; + options.CloseOnAuthenticationExpiration = true; + options.OnAuthenticationRefresh = context => + { + var previousSubject = context.PreviousUser.FindFirstValue("sub"); + var newSubject = context.NewUser.FindFirstValue("sub"); + + return Task.FromResult( + previousSubject is not null && + string.Equals(previousSubject, newSubject, StringComparison.Ordinal)); + }; +}); +``` + +The .NET client can refresh automatically before expiration or immediately after the app obtains new claims. Refresh notifications are events on `HubConnection`: + +```csharp +await using var connection = new HubConnectionBuilder() + .WithUrl(serverUrl, options => + options.AccessTokenProvider = GetAccessTokenAsync) + .WithAuthenticationRefresh(options => + { + options.EnableAutoRefresh = true; + options.RefreshBeforeExpiration = TimeSpan.FromMinutes(2); + }) + .Build(); + +connection.AuthenticationRefreshed += context => +{ + Console.WriteLine($"New token lifetime: {context.NewTokenLifetime}"); + return Task.CompletedTask; +}; + +connection.AuthenticationRefreshFailed += context => +{ + Console.WriteLine(context.Exception.Message); + return Task.CompletedTask; +}; + +await connection.StartAsync(); + +// Refresh immediately after acquiring a token with updated claims. +await connection.RefreshAuthenticationAsync(); +``` + +For a complete server and client that demonstrate automatic refresh, a manual claims update, and rejection of an identity change, see [danroth27/AspNetCore11Samples #5](https://github.com/danroth27/AspNetCore11Samples/pull/5). + +## OpenAPI reflects obsolete APIs + +ASP.NET Core OpenAPI generation now maps `[Obsolete]` to `deprecated: true` automatically for operations, schema types, and schema properties ([dotnet/aspnetcore #66355](https://github.com/dotnet/aspnetcore/pull/66355)). API clients and documentation tools can therefore surface the same deprecation information as .NET callers without a custom OpenAPI transformer. + +```csharp +app.MapGet("/catalog/{id}", GetCatalogItem); + +#pragma warning disable CS0618 +app.MapGet("/catalog/legacy/{id}", GetLegacyCatalogItem); +#pragma warning restore CS0618 + +[Obsolete("Use /catalog/{id}.")] +static LegacyCatalogItem GetLegacyCatalogItem(int id) => + new(id, $"Product {id}", $"SKU-{id:D4}"); + +[Obsolete("Use CatalogItem.")] +public sealed record LegacyCatalogItem( + int Id, + string Name, + [property: Obsolete("Use StockKeepingUnit.")] string Sku); +``` + +The legacy operation, its response schema, and the `Sku` property are marked deprecated in the generated document. An `IOpenApiOperationTransformer` or `IOpenApiSchemaTransformer` can override the generated value for a specific API. + +See [danroth27/AspNetCore11Samples #5](https://github.com/danroth27/AspNetCore11Samples/pull/5) for a runnable example and its generated OpenAPI document. + +## Validation localization uses message conventions + +Preview 7 integrated localization directly into `Microsoft.Extensions.Validation`. RC 1 replaces the preview-only `MessageKeyProvider` API with built-in resource-name conventions ([dotnet/aspnetcore #68202](https://github.com/dotnet/aspnetcore/pull/68202)). + +When a validation attribute doesn't specify `ErrorMessage`, localization tries these keys from most to least specific: + +1. `{DeclaringType}_{MemberName}_{AttributeType}_Error` +2. `{DeclaringType}_{AttributeType}_Error` +3. `{AttributeType}_Error` + +For example, this model can use `RegistrationModel_Username_RequiredAttribute_Error`, `RegistrationModel_RequiredAttribute_Error`, or the shared `RequiredAttribute_Error` resource: + +```csharp +builder.Services.AddLocalization(); +builder.Services.AddValidation(options => +{ + options.LocalizerProvider = (_, factory) => + factory.Create(typeof(ValidationMessages)); +}); + +[ValidatableType] +public sealed class RegistrationModel +{ + [Required] + [StringLength(20, MinimumLength = 4)] + [Display(Name = nameof(ValidationMessages.Username))] + public string Username { get; set; } = ""; +} +``` + +An explicit `ErrorMessage` remains the first resource key to try. If no resource resolves, validation falls back to the non-localized message. The same conventions apply to Blazor static SSR client validation. + +See [danroth27/AspNetCore11Samples #5](https://github.com/danroth27/AspNetCore11Samples/pull/5) for a localized Blazor form and its end-to-end tests. + +## Blazor browser options are finalized + +The server-to-client configuration API introduced in Preview 6 now uses its final RC 1 names ([dotnet/aspnetcore #67918](https://github.com/dotnet/aspnetcore/pull/67918)). Configure browser startup behavior in C# with `WithBrowserOptions`: + +```csharp +app.MapRazorComponents() + .AddInteractiveServerRenderMode() + .WithBrowserOptions(options => + { + options.LogLevel = LogLevel.Information; + options.InteractiveServer.ReconnectionMaxRetries = 10; + options.InteractiveServer.ReconnectionRetryInterval = + TimeSpan.FromSeconds(1.5); + options.StaticServer.PreserveDom = true; + options.InteractiveWebAssembly.EnvironmentVariables["OTEL_ENDPOINT"] = + "https://localhost:4318"; + }); +``` + +The finalized properties are `InteractiveServer`, `StaticServer`, and `InteractiveWebAssembly`. Server code can read the resolved configuration with `BrowserOptions.GetBrowserOptions(HttpContext)`. + +See [danroth27/AspNetCore11Samples #5](https://github.com/danroth27/AspNetCore11Samples/pull/5) for a Blazor app that configures and displays the resolved options. + +## Select an environment for build-time OpenAPI + +Build-time OpenAPI generation can now run the app under a specified hosting environment ([dotnet/aspnetcore #63856](https://github.com/dotnet/aspnetcore/pull/63856)). Set `OpenApiGenerateEnvironment` when environment-specific services, endpoints, or transformers affect the generated document: + +```xml + + true + Development + +``` + +The value is passed to the application host in the same role as `ASPNETCORE_ENVIRONMENT` or `DOTNET_ENVIRONMENT`. + +Thank you [@ldsenow](https://github.com/ldsenow) for this contribution! + +## Experimental authentication and transport work + +RC 1 includes two explicitly experimental areas for early evaluation: + +- **Device Bound Session Credentials (DBSC)** are available in the separate `Microsoft.AspNetCore.Authentication.DeviceBoundSessions` package ([dotnet/aspnetcore #67388](https://github.com/dotnet/aspnetcore/pull/67388)). The package implements a prototype of the W3C editor's draft for binding a browser session to a device-held private key. Its APIs are marked with the `ASP0030` experimental diagnostic, and the protocol and API shape are expected to change. +- **DirectTls** is an opt-in Kestrel transport for Linux that terminates TLS directly on the connection's socket by using the runtime's low-level TLS APIs ([dotnet/aspnetcore #67912](https://github.com/dotnet/aspnetcore/pull/67912)). The transport requires OpenSSL and is marked with the `ASPNETCORE_DIRECTTLS_001` experimental diagnostic. It doesn't replace the default sockets transport. + +## Breaking changes + +### Preview-only insecure chunked parsing switch removed + +The `Microsoft.AspNetCore.Server.Kestrel.InsecureChunkedParsing` AppContext switch has been removed ([dotnet/aspnetcore #68553](https://github.com/dotnet/aspnetcore/pull/68553)). The switch was introduced during .NET 11 previews but wasn't intended to be part of .NET 11. + +### Bootstrap 4 Identity UI is obsolete + +Projects that set `IdentityUIFrameworkVersion` to `Bootstrap4` now receive an MSBuild warning ([dotnet/aspnetcore #68477](https://github.com/dotnet/aspnetcore/pull/68477)). Bootstrap 5 remains the supported Identity UI framework selection. + + + +## Bug fixes + +- **Blazor** + - [Fixed persisted component state for re-executed endpoints (dotnet/aspnetcore #68032)](https://github.com/dotnet/aspnetcore/pull/68032) + - [Fixed persisted component state being dropped during enhanced navigation (dotnet/aspnetcore #68088)](https://github.com/dotnet/aspnetcore/pull/68088) + - [Fixed `InputNumber` validation for floating-point values in scientific notation (dotnet/aspnetcore #67988)](https://github.com/dotnet/aspnetcore/pull/67988) + - [Fixed `Virtualize` scroll jumps caused by competing native and JavaScript anchoring (dotnet/aspnetcore #67934)](https://github.com/dotnet/aspnetcore/pull/67934) + - [Fixed `QuickGrid` viewport drift when prepending asynchronously loaded items in end-anchor mode (dotnet/aspnetcore #67938)](https://github.com/dotnet/aspnetcore/pull/67938) +- **Data Protection** + - [Fixed thread-pool starvation when `KeyRingProvider` performs a forced refresh (dotnet/aspnetcore #67986)](https://github.com/dotnet/aspnetcore/pull/67986) +- **Hosting** + - [Fixed an IIS application shutdown hang when preload is enabled (dotnet/aspnetcore #65733)](https://github.com/dotnet/aspnetcore/pull/65733) +- **OpenAPI** + - [Fixed nullability for nullable get-only and constructor-bound properties (dotnet/aspnetcore #68116)](https://github.com/dotnet/aspnetcore/pull/68116) +- **SignalR** + - [Hardened parsing of the `negotiateVersion` query value (dotnet/aspnetcore #67908)](https://github.com/dotnet/aspnetcore/pull/67908) + - [Hardened stateful reconnect handling (dotnet/aspnetcore #67409)](https://github.com/dotnet/aspnetcore/pull/67409) + +## Community contributors + +Thank you contributors! ❤️ + +- [@akshay-zz](https://github.com/dotnet/aspnetcore/pulls?q=is%3Apr+is%3Amerged+author%3Aakshay-zz+milestone%3A11.0-rc1) +- [@aw0lid](https://github.com/dotnet/aspnetcore/pulls?q=is%3Apr+is%3Amerged+author%3Aaw0lid+milestone%3A11.0-rc1) +- [@GrantTotinov](https://github.com/dotnet/aspnetcore/pull/67539) +- [@hishamco](https://github.com/dotnet/aspnetcore/pulls?q=is%3Apr+is%3Amerged+author%3Ahishamco+milestone%3A11.0-rc1) +- [@khellang](https://github.com/dotnet/aspnetcore/pulls?q=is%3Apr+is%3Amerged+author%3Akhellang+milestone%3A11.0-rc1) +- [@ldsenow](https://github.com/dotnet/aspnetcore/pulls?q=is%3Apr+is%3Amerged+author%3Aldsenow+milestone%3A11.0-rc1) +- [@PreethikaSelvam](https://github.com/dotnet/aspnetcore/pulls?q=is%3Apr+is%3Amerged+author%3APreethikaSelvam+milestone%3A11.0-rc1) +- [@surya3655](https://github.com/dotnet/aspnetcore/pulls?q=is%3Apr+is%3Amerged+author%3Asurya3655+milestone%3A11.0-rc1) +- [@vendasankarsf3945](https://github.com/dotnet/aspnetcore/pulls?q=is%3Apr+is%3Amerged+author%3Avendasankarsf3945+milestone%3A11.0-rc1) +- [@Yuvan111](https://github.com/dotnet/aspnetcore/pulls?q=is%3Apr+is%3Amerged+author%3AYuvan111+milestone%3A11.0-rc1) From 047b4ef2d8e0e4045f33537856a07082d2fbbb65 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Fri, 28 Aug 2026 03:04:36 -0700 Subject: [PATCH 02/27] Tighten RC 1 ASP.NET Core availability claims Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a851ab96-8780-407d-97d0-50eed422ead5 --- release-notes/11.0/preview/rc1/aspnetcore.md | 21 ++++++++++---------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/release-notes/11.0/preview/rc1/aspnetcore.md b/release-notes/11.0/preview/rc1/aspnetcore.md index a2dc58d92d..9741fb06d0 100644 --- a/release-notes/11.0/preview/rc1/aspnetcore.md +++ b/release-notes/11.0/preview/rc1/aspnetcore.md @@ -7,7 +7,7 @@ - [Validation localization uses message conventions](#validation-localization-uses-message-conventions) - [Blazor browser options are finalized](#blazor-browser-options-are-finalized) - [Select an environment for build-time OpenAPI](#select-an-environment-for-build-time-openapi) -- [Experimental authentication and transport work](#experimental-authentication-and-transport-work) +- [Experimental DirectTls transport](#experimental-directtls-transport) - [Breaking changes](#breaking-changes) - [Bug fixes](#bug-fixes) - [Community contributors](#community-contributors) @@ -18,7 +18,7 @@ ASP.NET Core updates in .NET 11: ## SignalR authentication refresh is finalized -.NET 11 Preview 6 introduced authentication refresh so a SignalR client can replace an expiring access token without dropping its connection. RC 1 finalizes the API shape, adds support to the TypeScript client, and updates Interactive Server circuits when the connection's principal changes ([dotnet/aspnetcore #67964](https://github.com/dotnet/aspnetcore/pull/67964), [dotnet/aspnetcore #68221](https://github.com/dotnet/aspnetcore/pull/68221), [dotnet/aspnetcore #68459](https://github.com/dotnet/aspnetcore/pull/68459), [dotnet/aspnetcore #68676](https://github.com/dotnet/aspnetcore/pull/68676)). +.NET 11 Preview 6 introduced authentication refresh so a SignalR client can replace an expiring access token without dropping its connection. RC 1 finalizes the server and .NET client API shape and updates Interactive Server circuits when the connection's principal changes ([dotnet/aspnetcore #67964](https://github.com/dotnet/aspnetcore/pull/67964), [dotnet/aspnetcore #68221](https://github.com/dotnet/aspnetcore/pull/68221), [dotnet/aspnetcore #68459](https://github.com/dotnet/aspnetcore/pull/68459), [dotnet/aspnetcore #68676](https://github.com/dotnet/aspnetcore/pull/68676)). The server opts in for each hub and can inspect or reject a refreshed identity: @@ -70,7 +70,7 @@ await connection.StartAsync(); await connection.RefreshAuthenticationAsync(); ``` -For a complete server and client that demonstrate automatic refresh, a manual claims update, and rejection of an identity change, see [danroth27/AspNetCore11Samples #5](https://github.com/danroth27/AspNetCore11Samples/pull/5). +For a complete server and client that demonstrate automatic refresh, a manual claims update, and rejection of an identity change, see [danroth27/AspNetCore11Samples#5](https://github.com/danroth27/AspNetCore11Samples/pull/5). ## OpenAPI reflects obsolete APIs @@ -96,7 +96,7 @@ public sealed record LegacyCatalogItem( The legacy operation, its response schema, and the `Sku` property are marked deprecated in the generated document. An `IOpenApiOperationTransformer` or `IOpenApiSchemaTransformer` can override the generated value for a specific API. -See [danroth27/AspNetCore11Samples #5](https://github.com/danroth27/AspNetCore11Samples/pull/5) for a runnable example and its generated OpenAPI document. +See [danroth27/AspNetCore11Samples#5](https://github.com/danroth27/AspNetCore11Samples/pull/5) for a runnable example and its generated OpenAPI document. ## Validation localization uses message conventions @@ -130,7 +130,7 @@ public sealed class RegistrationModel An explicit `ErrorMessage` remains the first resource key to try. If no resource resolves, validation falls back to the non-localized message. The same conventions apply to Blazor static SSR client validation. -See [danroth27/AspNetCore11Samples #5](https://github.com/danroth27/AspNetCore11Samples/pull/5) for a localized Blazor form and its end-to-end tests. +See [danroth27/AspNetCore11Samples#5](https://github.com/danroth27/AspNetCore11Samples/pull/5) for a localized Blazor form and its end-to-end tests. ## Blazor browser options are finalized @@ -153,7 +153,7 @@ app.MapRazorComponents() The finalized properties are `InteractiveServer`, `StaticServer`, and `InteractiveWebAssembly`. Server code can read the resolved configuration with `BrowserOptions.GetBrowserOptions(HttpContext)`. -See [danroth27/AspNetCore11Samples #5](https://github.com/danroth27/AspNetCore11Samples/pull/5) for a Blazor app that configures and displays the resolved options. +See [danroth27/AspNetCore11Samples#5](https://github.com/danroth27/AspNetCore11Samples/pull/5) for a Blazor app that configures and displays the resolved options. ## Select an environment for build-time OpenAPI @@ -170,12 +170,9 @@ The value is passed to the application host in the same role as `ASPNETCORE_ENVI Thank you [@ldsenow](https://github.com/ldsenow) for this contribution! -## Experimental authentication and transport work +## Experimental DirectTls transport -RC 1 includes two explicitly experimental areas for early evaluation: - -- **Device Bound Session Credentials (DBSC)** are available in the separate `Microsoft.AspNetCore.Authentication.DeviceBoundSessions` package ([dotnet/aspnetcore #67388](https://github.com/dotnet/aspnetcore/pull/67388)). The package implements a prototype of the W3C editor's draft for binding a browser session to a device-held private key. Its APIs are marked with the `ASP0030` experimental diagnostic, and the protocol and API shape are expected to change. -- **DirectTls** is an opt-in Kestrel transport for Linux that terminates TLS directly on the connection's socket by using the runtime's low-level TLS APIs ([dotnet/aspnetcore #67912](https://github.com/dotnet/aspnetcore/pull/67912)). The transport requires OpenSSL and is marked with the `ASPNETCORE_DIRECTTLS_001` experimental diagnostic. It doesn't replace the default sockets transport. +**DirectTls** is an opt-in Kestrel transport for Linux that terminates TLS directly on the connection's socket by using the runtime's low-level TLS APIs ([dotnet/aspnetcore #67912](https://github.com/dotnet/aspnetcore/pull/67912)). The transport requires OpenSSL and is marked with the `ASPNETCORE_DIRECTTLS_001` experimental diagnostic. It doesn't replace the default sockets transport. ## Breaking changes @@ -189,6 +186,8 @@ Projects that set `IdentityUIFrameworkVersion` to `Bootstrap4` now receive an MS From d27400a3c71cc16a9125056f10d234cfd702bdba Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Fri, 28 Aug 2026 09:07:59 -0700 Subject: [PATCH 03/27] Mark DirectTls as experimental Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a851ab96-8780-407d-97d0-50eed422ead5 --- release-notes/11.0/preview/rc1/aspnetcore.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/release-notes/11.0/preview/rc1/aspnetcore.md b/release-notes/11.0/preview/rc1/aspnetcore.md index 9741fb06d0..eea5bd9511 100644 --- a/release-notes/11.0/preview/rc1/aspnetcore.md +++ b/release-notes/11.0/preview/rc1/aspnetcore.md @@ -172,6 +172,9 @@ Thank you [@ldsenow](https://github.com/ldsenow) for this contribution! ## Experimental DirectTls transport +> [!WARNING] +> DirectTls is experimental in .NET 11 and produces diagnostic `ASPNETCORE_DIRECTTLS_001`. + **DirectTls** is an opt-in Kestrel transport for Linux that terminates TLS directly on the connection's socket by using the runtime's low-level TLS APIs ([dotnet/aspnetcore #67912](https://github.com/dotnet/aspnetcore/pull/67912)). The transport requires OpenSSL and is marked with the `ASPNETCORE_DIRECTTLS_001` experimental diagnostic. It doesn't replace the default sockets transport. ## Breaking changes From 038bd91fed32f7bdea522757b26ff3fce2e7ff63 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Mon, 31 Aug 2026 14:59:53 -0700 Subject: [PATCH 04/27] Remove unofficial sample links from ASP.NET Core notes Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a851ab96-8780-407d-97d0-50eed422ead5 --- release-notes/11.0/preview/rc1/aspnetcore.md | 8 -------- 1 file changed, 8 deletions(-) diff --git a/release-notes/11.0/preview/rc1/aspnetcore.md b/release-notes/11.0/preview/rc1/aspnetcore.md index eea5bd9511..f4b7902818 100644 --- a/release-notes/11.0/preview/rc1/aspnetcore.md +++ b/release-notes/11.0/preview/rc1/aspnetcore.md @@ -70,8 +70,6 @@ await connection.StartAsync(); await connection.RefreshAuthenticationAsync(); ``` -For a complete server and client that demonstrate automatic refresh, a manual claims update, and rejection of an identity change, see [danroth27/AspNetCore11Samples#5](https://github.com/danroth27/AspNetCore11Samples/pull/5). - ## OpenAPI reflects obsolete APIs ASP.NET Core OpenAPI generation now maps `[Obsolete]` to `deprecated: true` automatically for operations, schema types, and schema properties ([dotnet/aspnetcore #66355](https://github.com/dotnet/aspnetcore/pull/66355)). API clients and documentation tools can therefore surface the same deprecation information as .NET callers without a custom OpenAPI transformer. @@ -96,8 +94,6 @@ public sealed record LegacyCatalogItem( The legacy operation, its response schema, and the `Sku` property are marked deprecated in the generated document. An `IOpenApiOperationTransformer` or `IOpenApiSchemaTransformer` can override the generated value for a specific API. -See [danroth27/AspNetCore11Samples#5](https://github.com/danroth27/AspNetCore11Samples/pull/5) for a runnable example and its generated OpenAPI document. - ## Validation localization uses message conventions Preview 7 integrated localization directly into `Microsoft.Extensions.Validation`. RC 1 replaces the preview-only `MessageKeyProvider` API with built-in resource-name conventions ([dotnet/aspnetcore #68202](https://github.com/dotnet/aspnetcore/pull/68202)). @@ -130,8 +126,6 @@ public sealed class RegistrationModel An explicit `ErrorMessage` remains the first resource key to try. If no resource resolves, validation falls back to the non-localized message. The same conventions apply to Blazor static SSR client validation. -See [danroth27/AspNetCore11Samples#5](https://github.com/danroth27/AspNetCore11Samples/pull/5) for a localized Blazor form and its end-to-end tests. - ## Blazor browser options are finalized The server-to-client configuration API introduced in Preview 6 now uses its final RC 1 names ([dotnet/aspnetcore #67918](https://github.com/dotnet/aspnetcore/pull/67918)). Configure browser startup behavior in C# with `WithBrowserOptions`: @@ -153,8 +147,6 @@ app.MapRazorComponents() The finalized properties are `InteractiveServer`, `StaticServer`, and `InteractiveWebAssembly`. Server code can read the resolved configuration with `BrowserOptions.GetBrowserOptions(HttpContext)`. -See [danroth27/AspNetCore11Samples#5](https://github.com/danroth27/AspNetCore11Samples/pull/5) for a Blazor app that configures and displays the resolved options. - ## Select an environment for build-time OpenAPI Build-time OpenAPI generation can now run the app under a specified hosting environment ([dotnet/aspnetcore #63856](https://github.com/dotnet/aspnetcore/pull/63856)). Set `OpenApiGenerateEnvironment` when environment-specific services, endpoints, or transformers affect the generated document: From dd7e00a5a44c115eb61e241eb9c2ea0a989dfe0c Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Mon, 31 Aug 2026 15:23:18 -0700 Subject: [PATCH 05/27] Document RC 1 preview API migrations Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a851ab96-8780-407d-97d0-50eed422ead5 --- release-notes/11.0/preview/rc1/aspnetcore.md | 31 ++++++++++++++++---- 1 file changed, 26 insertions(+), 5 deletions(-) diff --git a/release-notes/11.0/preview/rc1/aspnetcore.md b/release-notes/11.0/preview/rc1/aspnetcore.md index f4b7902818..826d02febf 100644 --- a/release-notes/11.0/preview/rc1/aspnetcore.md +++ b/release-notes/11.0/preview/rc1/aspnetcore.md @@ -18,7 +18,13 @@ ASP.NET Core updates in .NET 11: ## SignalR authentication refresh is finalized -.NET 11 Preview 6 introduced authentication refresh so a SignalR client can replace an expiring access token without dropping its connection. RC 1 finalizes the server and .NET client API shape and updates Interactive Server circuits when the connection's principal changes ([dotnet/aspnetcore #67964](https://github.com/dotnet/aspnetcore/pull/67964), [dotnet/aspnetcore #68221](https://github.com/dotnet/aspnetcore/pull/68221), [dotnet/aspnetcore #68459](https://github.com/dotnet/aspnetcore/pull/68459), [dotnet/aspnetcore #68676](https://github.com/dotnet/aspnetcore/pull/68676)). +[.NET 11 Preview 6 introduced authentication refresh](../preview6/aspnetcore.md#signalr-authentication-refresh) so a SignalR client can replace an expiring access token without dropping its connection. RC 1 finalizes the server and .NET client API shape and updates Interactive Server circuits when the connection's principal changes ([dotnet/aspnetcore #67964](https://github.com/dotnet/aspnetcore/pull/67964), [dotnet/aspnetcore #68221](https://github.com/dotnet/aspnetcore/pull/68221), [dotnet/aspnetcore #68459](https://github.com/dotnet/aspnetcore/pull/68459), [dotnet/aspnetcore #68676](https://github.com/dotnet/aspnetcore/pull/68676)). + +When upgrading from Preview 7: + +- Move the `OnAuthenticationRefreshed` and `OnAuthenticationRefreshFailed` callbacks from `AuthenticationRefreshOptions` to the `HubConnection.AuthenticationRefreshed` and `HubConnection.AuthenticationRefreshFailed` events. +- Update references to `Microsoft.AspNetCore.Http.Connections.AuthenticationRefreshContext` to use `Microsoft.AspNetCore.Connections.Features.AuthenticationRefreshContext`. +- Replace `IConnectionUserRefreshFeature` with `IConnectionAuthenticationRefreshFeature` if your transport integration uses the lower-level connection feature. The server opts in for each hub and can inspect or reject a refreshed identity: @@ -96,7 +102,9 @@ The legacy operation, its response schema, and the `Sku` property are marked dep ## Validation localization uses message conventions -Preview 7 integrated localization directly into `Microsoft.Extensions.Validation`. RC 1 replaces the preview-only `MessageKeyProvider` API with built-in resource-name conventions ([dotnet/aspnetcore #68202](https://github.com/dotnet/aspnetcore/pull/68202)). +[Preview 7 integrated localization directly into `Microsoft.Extensions.Validation`](../preview7/aspnetcore.md#validation-localization-is-built-in). RC 1 replaces the preview-only `MessageKeyProvider` API with built-in resource-name conventions ([dotnet/aspnetcore #68202](https://github.com/dotnet/aspnetcore/pull/68202)). + +When upgrading from Preview 7, remove assignments to `ValidationOptions.MessageKeyProvider` and rename the corresponding resource keys to match one of the built-in conventions below. The `ValidationMessageKeyContext` type was also removed because custom key providers are no longer used. When a validation attribute doesn't specify `ErrorMessage`, localization tries these keys from most to least specific: @@ -128,7 +136,20 @@ An explicit `ErrorMessage` remains the first resource key to try. If no resource ## Blazor browser options are finalized -The server-to-client configuration API introduced in Preview 6 now uses its final RC 1 names ([dotnet/aspnetcore #67918](https://github.com/dotnet/aspnetcore/pull/67918)). Configure browser startup behavior in C# with `WithBrowserOptions`: +The [server-to-client configuration API introduced in Preview 6](../preview6/aspnetcore.md#configure-blazor-client-behavior-from-the-server) now uses its final RC 1 names ([dotnet/aspnetcore #67918](https://github.com/dotnet/aspnetcore/pull/67918)). + +When upgrading from Preview 7, update the following APIs: + +| Preview 7 | RC 1 | +| --- | --- | +| `BrowserOptions.Server` | `BrowserOptions.InteractiveServer` | +| `BrowserOptions.Ssr` | `BrowserOptions.StaticServer` | +| `BrowserOptions.WebAssembly` | `BrowserOptions.InteractiveWebAssembly` | +| `SsrBrowserOptions` | `StaticServerBrowserOptions` | +| `WebAssemblyBrowserOptions` | `InteractiveWebAssemblyBrowserOptions` | +| `httpContext.GetBrowserOptions()` | `BrowserOptions.GetBrowserOptions(httpContext)` | + +Configure browser startup behavior in C# with `WithBrowserOptions`: ```csharp app.MapRazorComponents() @@ -173,11 +194,11 @@ Thank you [@ldsenow](https://github.com/ldsenow) for this contribution! ### Preview-only insecure chunked parsing switch removed -The `Microsoft.AspNetCore.Server.Kestrel.InsecureChunkedParsing` AppContext switch has been removed ([dotnet/aspnetcore #68553](https://github.com/dotnet/aspnetcore/pull/68553)). The switch was introduced during .NET 11 previews but wasn't intended to be part of .NET 11. +The `Microsoft.AspNetCore.Server.Kestrel.InsecureChunkedParsing` AppContext switch has been removed ([dotnet/aspnetcore #68553](https://github.com/dotnet/aspnetcore/pull/68553)). The switch was introduced during .NET 11 previews but wasn't intended to be part of .NET 11. Remove any call that enables the switch; there is no replacement, and Kestrel always uses secure chunked-request parsing. ### Bootstrap 4 Identity UI is obsolete -Projects that set `IdentityUIFrameworkVersion` to `Bootstrap4` now receive an MSBuild warning ([dotnet/aspnetcore #68477](https://github.com/dotnet/aspnetcore/pull/68477)). Bootstrap 5 remains the supported Identity UI framework selection. +Projects that set `IdentityUIFrameworkVersion` to `Bootstrap4` now receive an MSBuild warning ([dotnet/aspnetcore #68477](https://github.com/dotnet/aspnetcore/pull/68477)). Change the value to `Bootstrap5`, or remove the property to use the default. Bootstrap 5 remains the supported Identity UI framework selection. From afc9819a54db5d5919c75167ec9bf48f036501a5 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Mon, 31 Aug 2026 15:35:31 -0700 Subject: [PATCH 07/27] Split SignalR authentication refresh updates Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a851ab96-8780-407d-97d0-50eed422ead5 --- release-notes/11.0/preview/rc1/aspnetcore.md | 21 +++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/release-notes/11.0/preview/rc1/aspnetcore.md b/release-notes/11.0/preview/rc1/aspnetcore.md index e9b714d12a..296386823c 100644 --- a/release-notes/11.0/preview/rc1/aspnetcore.md +++ b/release-notes/11.0/preview/rc1/aspnetcore.md @@ -2,7 +2,9 @@ .NET 11 RC 1 includes new ASP.NET Core features and improvements: -- [SignalR authentication refresh is finalized](#signalr-authentication-refresh-is-finalized) +- [SignalR authentication refresh APIs are finalized](#signalr-authentication-refresh-apis-are-finalized) +- [SignalR TypeScript client supports authentication refresh](#signalr-typescript-client-supports-authentication-refresh) +- [Blazor Server circuits update after authentication refresh](#blazor-server-circuits-update-after-authentication-refresh) - [OpenAPI reflects obsolete APIs](#openapi-reflects-obsolete-apis) - [Validation localization uses message conventions](#validation-localization-uses-message-conventions) - [Blazor browser options are finalized](#blazor-browser-options-are-finalized) @@ -16,14 +18,13 @@ ASP.NET Core updates in .NET 11: - [What's new in ASP.NET Core in .NET 11](https://learn.microsoft.com/aspnet/core/release-notes/aspnetcore-11) -## SignalR authentication refresh is finalized +## SignalR authentication refresh APIs are finalized -[.NET 11 Preview 6 introduced authentication refresh](../preview6/aspnetcore.md#signalr-authentication-refresh) so a SignalR client can replace an expiring access token without dropping its connection. RC 1 adds support to the TypeScript client, finalizes the server and client API shapes, and updates Interactive Server circuits when the connection's principal changes ([dotnet/aspnetcore #67964](https://github.com/dotnet/aspnetcore/pull/67964), [dotnet/aspnetcore #68221](https://github.com/dotnet/aspnetcore/pull/68221), [dotnet/aspnetcore #68459](https://github.com/dotnet/aspnetcore/pull/68459), [dotnet/aspnetcore #68676](https://github.com/dotnet/aspnetcore/pull/68676)). +[.NET 11 Preview 6 introduced authentication refresh](../preview6/aspnetcore.md#signalr-authentication-refresh) so a SignalR client can replace an expiring access token without dropping its connection. RC 1 finalizes the server and .NET client API shapes ([dotnet/aspnetcore #68459](https://github.com/dotnet/aspnetcore/pull/68459), [dotnet/aspnetcore #68676](https://github.com/dotnet/aspnetcore/pull/68676)). When upgrading from Preview 7: - In the .NET client, move the `OnAuthenticationRefreshed` and `OnAuthenticationRefreshFailed` callbacks from `AuthenticationRefreshOptions` to the `HubConnection.AuthenticationRefreshed` and `HubConnection.AuthenticationRefreshFailed` events. -- In the TypeScript client, move the callbacks from the options passed to `withAuthenticationRefresh` to `HubConnection.onAuthenticationRefreshed` and `HubConnection.onAuthenticationRefreshFailed`. - Update references to `Microsoft.AspNetCore.Http.Connections.AuthenticationRefreshContext` to use `Microsoft.AspNetCore.Connections.Features.AuthenticationRefreshContext`. - Replace `IConnectionUserRefreshFeature` with `IConnectionAuthenticationRefreshFeature` if your transport integration uses the lower-level connection feature. @@ -77,7 +78,11 @@ await connection.StartAsync(); await connection.RefreshAuthenticationAsync(); ``` -The TypeScript client supports the same automatic and manual refresh workflows. Configure automatic refresh with `withAuthenticationRefresh`, register handlers on the built connection, and call `refreshAuthentication` when the application obtains updated claims: +## SignalR TypeScript client supports authentication refresh + +The SignalR TypeScript client now supports refreshing an access token without reconnecting ([dotnet/aspnetcore #67964](https://github.com/dotnet/aspnetcore/pull/67964), [dotnet/aspnetcore #68676](https://github.com/dotnet/aspnetcore/pull/68676)). It can schedule a refresh from the token lifetime reported by the server or refresh immediately after the application obtains updated claims. + +Configure automatic refresh with `withAuthenticationRefresh`, register success and failure handlers on the built connection, and call `refreshAuthentication` to request a manual refresh: ```typescript const connection = new signalR.HubConnectionBuilder() @@ -102,6 +107,12 @@ await connection.start(); await connection.refreshAuthentication(); ``` +If you used an earlier RC 1 build, move `onAuthenticationRefreshed` and `onAuthenticationRefreshFailed` out of the options passed to `withAuthenticationRefresh` and register them on the built `HubConnection` as shown above. + +## Blazor Server circuits update after authentication refresh + +Interactive Server components now receive the refreshed `ClaimsPrincipal` without reconnecting the circuit ([dotnet/aspnetcore #68221](https://github.com/dotnet/aspnetcore/pull/68221), [dotnet/aspnetcore #68459](https://github.com/dotnet/aspnetcore/pull/68459)). When authentication refresh is enabled for the SignalR connection, Blazor updates its authentication state and raises `AuthenticationStateChanged`. Components that consume `AuthenticationStateProvider`, including `AuthorizeView`, re-render using the refreshed identity and claims. + ## OpenAPI reflects obsolete APIs ASP.NET Core OpenAPI generation now maps `[Obsolete]` to `deprecated: true` automatically for operations, schema types, and schema properties ([dotnet/aspnetcore #66355](https://github.com/dotnet/aspnetcore/pull/66355)). API clients and documentation tools can therefore surface the same deprecation information as .NET callers without a custom OpenAPI transformer. From acac156862de5d76ca9d20ed605cdd4cc3f14a4f Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Mon, 31 Aug 2026 16:09:32 -0700 Subject: [PATCH 08/27] Remove SignalR hardening PR from feature references Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a851ab96-8780-407d-97d0-50eed422ead5 --- release-notes/11.0/preview/rc1/aspnetcore.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/release-notes/11.0/preview/rc1/aspnetcore.md b/release-notes/11.0/preview/rc1/aspnetcore.md index 296386823c..2015a17f05 100644 --- a/release-notes/11.0/preview/rc1/aspnetcore.md +++ b/release-notes/11.0/preview/rc1/aspnetcore.md @@ -20,7 +20,7 @@ ASP.NET Core updates in .NET 11: ## SignalR authentication refresh APIs are finalized -[.NET 11 Preview 6 introduced authentication refresh](../preview6/aspnetcore.md#signalr-authentication-refresh) so a SignalR client can replace an expiring access token without dropping its connection. RC 1 finalizes the server and .NET client API shapes ([dotnet/aspnetcore #68459](https://github.com/dotnet/aspnetcore/pull/68459), [dotnet/aspnetcore #68676](https://github.com/dotnet/aspnetcore/pull/68676)). +[.NET 11 Preview 6 introduced authentication refresh](../preview6/aspnetcore.md#signalr-authentication-refresh) so a SignalR client can replace an expiring access token without dropping its connection. RC 1 finalizes the server and .NET client API shapes ([dotnet/aspnetcore #68676](https://github.com/dotnet/aspnetcore/pull/68676)). When upgrading from Preview 7: @@ -111,7 +111,7 @@ If you used an earlier RC 1 build, move `onAuthenticationRefreshed` and `onAuthe ## Blazor Server circuits update after authentication refresh -Interactive Server components now receive the refreshed `ClaimsPrincipal` without reconnecting the circuit ([dotnet/aspnetcore #68221](https://github.com/dotnet/aspnetcore/pull/68221), [dotnet/aspnetcore #68459](https://github.com/dotnet/aspnetcore/pull/68459)). When authentication refresh is enabled for the SignalR connection, Blazor updates its authentication state and raises `AuthenticationStateChanged`. Components that consume `AuthenticationStateProvider`, including `AuthorizeView`, re-render using the refreshed identity and claims. +Interactive Server components now receive the refreshed `ClaimsPrincipal` without reconnecting the circuit ([dotnet/aspnetcore #68221](https://github.com/dotnet/aspnetcore/pull/68221)). When authentication refresh is enabled for the SignalR connection, Blazor updates its authentication state and raises `AuthenticationStateChanged`. Components that consume `AuthenticationStateProvider`, including `AuthorizeView`, re-render using the refreshed identity and claims. ## OpenAPI reflects obsolete APIs From 89f38441cc92ca574037d65fd2e6fe2c22e63321 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Mon, 31 Aug 2026 16:12:02 -0700 Subject: [PATCH 09/27] Link RC 1 ASP.NET Core backport PRs Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a851ab96-8780-407d-97d0-50eed422ead5 --- release-notes/11.0/preview/rc1/aspnetcore.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/release-notes/11.0/preview/rc1/aspnetcore.md b/release-notes/11.0/preview/rc1/aspnetcore.md index 2015a17f05..9714c68782 100644 --- a/release-notes/11.0/preview/rc1/aspnetcore.md +++ b/release-notes/11.0/preview/rc1/aspnetcore.md @@ -20,7 +20,7 @@ ASP.NET Core updates in .NET 11: ## SignalR authentication refresh APIs are finalized -[.NET 11 Preview 6 introduced authentication refresh](../preview6/aspnetcore.md#signalr-authentication-refresh) so a SignalR client can replace an expiring access token without dropping its connection. RC 1 finalizes the server and .NET client API shapes ([dotnet/aspnetcore #68676](https://github.com/dotnet/aspnetcore/pull/68676)). +[.NET 11 Preview 6 introduced authentication refresh](../preview6/aspnetcore.md#signalr-authentication-refresh) so a SignalR client can replace an expiring access token without dropping its connection. RC 1 finalizes the server and .NET client API shapes ([dotnet/aspnetcore #68702](https://github.com/dotnet/aspnetcore/pull/68702)). When upgrading from Preview 7: @@ -80,7 +80,7 @@ await connection.RefreshAuthenticationAsync(); ## SignalR TypeScript client supports authentication refresh -The SignalR TypeScript client now supports refreshing an access token without reconnecting ([dotnet/aspnetcore #67964](https://github.com/dotnet/aspnetcore/pull/67964), [dotnet/aspnetcore #68676](https://github.com/dotnet/aspnetcore/pull/68676)). It can schedule a refresh from the token lifetime reported by the server or refresh immediately after the application obtains updated claims. +The SignalR TypeScript client now supports refreshing an access token without reconnecting ([dotnet/aspnetcore #67964](https://github.com/dotnet/aspnetcore/pull/67964), [dotnet/aspnetcore #68702](https://github.com/dotnet/aspnetcore/pull/68702)). It can schedule a refresh from the token lifetime reported by the server or refresh immediately after the application obtains updated claims. Configure automatic refresh with `withAuthenticationRefresh`, register success and failure handlers on the built connection, and call `refreshAuthentication` to request a manual refresh: @@ -235,7 +235,7 @@ The `Microsoft.AspNetCore.Server.Kestrel.InsecureChunkedParsing` AppContext swit ### Bootstrap 4 Identity UI is obsolete -Projects that set `IdentityUIFrameworkVersion` to `Bootstrap4` now receive an MSBuild warning ([dotnet/aspnetcore #68477](https://github.com/dotnet/aspnetcore/pull/68477)). Change the value to `Bootstrap5`, or remove the property to use the default. Bootstrap 5 remains the supported Identity UI framework selection. +Projects that set `IdentityUIFrameworkVersion` to `Bootstrap4` now receive an MSBuild warning ([dotnet/aspnetcore #68575](https://github.com/dotnet/aspnetcore/pull/68575)). Change the value to `Bootstrap5`, or remove the property to use the default. Bootstrap 5 remains the supported Identity UI framework selection. From df9424298d2e4369f6c13ee845a0cd7114338cdd Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Mon, 31 Aug 2026 17:45:42 -0700 Subject: [PATCH 19/27] Correct Components.AI package availability Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a851ab96-8780-407d-97d0-50eed422ead5 --- release-notes/11.0/preview/rc1/aspnetcore.md | 1 - 1 file changed, 1 deletion(-) diff --git a/release-notes/11.0/preview/rc1/aspnetcore.md b/release-notes/11.0/preview/rc1/aspnetcore.md index b635993cb2..4477551440 100644 --- a/release-notes/11.0/preview/rc1/aspnetcore.md +++ b/release-notes/11.0/preview/rc1/aspnetcore.md @@ -287,7 +287,6 @@ The `Microsoft.AspNetCore.Server.Kestrel.InsecureChunkedParsing` AppContext swit Projects that set `IdentityUIFrameworkVersion` to `Bootstrap4` now receive an MSBuild warning ([dotnet/aspnetcore #68575](https://github.com/dotnet/aspnetcore/pull/68575)). Change the value to `Bootstrap5`, or remove the property to use the default. Bootstrap 5 remains the supported Identity UI framework selection. From 17c2d8004990028076d3f1342e7f88202a75daec Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Mon, 31 Aug 2026 18:55:39 -0700 Subject: [PATCH 20/27] Add prerelease ASP.NET Core package updates Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a851ab96-8780-407d-97d0-50eed422ead5 --- release-notes/11.0/preview/rc1/aspnetcore.md | 133 +++++++++++++++---- 1 file changed, 106 insertions(+), 27 deletions(-) diff --git a/release-notes/11.0/preview/rc1/aspnetcore.md b/release-notes/11.0/preview/rc1/aspnetcore.md index 4477551440..65bde53cb7 100644 --- a/release-notes/11.0/preview/rc1/aspnetcore.md +++ b/release-notes/11.0/preview/rc1/aspnetcore.md @@ -5,6 +5,8 @@ - [SignalR authentication refresh APIs are finalized](#signalr-authentication-refresh-apis-are-finalized) - [SignalR TypeScript client supports authentication refresh](#signalr-typescript-client-supports-authentication-refresh) - [Blazor Server circuits update after authentication refresh](#blazor-server-circuits-update-after-authentication-refresh) +- [Experimental device-bound sessions limit stolen-cookie reuse](#experimental-device-bound-sessions-limit-stolen-cookie-reuse) +- [Experimental Components.AI adds streaming chat UI](#experimental-componentsai-adds-streaming-chat-ui) - [OpenAPI reflects obsolete APIs](#openapi-reflects-obsolete-apis) - [Validation localization uses message conventions](#validation-localization-uses-message-conventions) - [Blazor browser options are finalized](#blazor-browser-options-are-finalized) @@ -31,14 +33,18 @@ When upgrading from Preview 7: The server opts in for each hub and can inspect or reject a refreshed identity: ```csharp +using System.Security.Claims; + app.MapHub("/clock", options => { options.EnableAuthenticationRefresh = true; options.CloseOnAuthenticationExpiration = true; options.OnAuthenticationRefresh = context => { - var previousSubject = context.PreviousUser.FindFirstValue("sub"); - var newSubject = context.NewUser.FindFirstValue("sub"); + var previousSubject = context.PreviousUser.FindFirstValue("sub") + ?? context.PreviousUser.FindFirstValue(ClaimTypes.NameIdentifier); + var newSubject = context.NewUser.FindFirstValue("sub") + ?? context.NewUser.FindFirstValue(ClaimTypes.NameIdentifier); return Task.FromResult( previousSubject is not null && @@ -86,19 +92,19 @@ Configure automatic refresh with `withAuthenticationRefresh`, register success a ```typescript const connection = new signalR.HubConnectionBuilder() - .withUrl("/clock", { accessTokenFactory: getAccessToken }) - .withAuthenticationRefresh({ - enableAutoRefresh: true, - refreshBeforeExpirationInMilliseconds: 120_000, - }) - .build(); - -connection.onAuthenticationRefreshed(context => { - console.log(`New token lifetime: ${context.newTokenLifetimeInSeconds}`); + .withUrl("/clock", { accessTokenFactory: getAccessToken }) + .withAuthenticationRefresh({ + enableAutoRefresh: true, + refreshBeforeExpirationInMilliseconds: 120_000, + }) + .build(); + +connection.onAuthenticationRefreshed((context) => { + console.log(`New token lifetime: ${context.newTokenLifetimeInSeconds}`); }); -connection.onAuthenticationRefreshFailed(context => { - console.error(context.error); +connection.onAuthenticationRefreshFailed((context) => { + console.error(context.error); }); await connection.start(); @@ -113,6 +119,59 @@ Interactive Server components can now receive the refreshed `ClaimsPrincipal` wi After the connection refreshes its authentication, Blazor updates the authentication state and raises `AuthenticationStateChanged`. Components that consume `AuthenticationStateProvider`, including `AuthorizeView`, re-render using the refreshed identity and claims. This behavior is useful when a user's roles or permissions change during an active circuit, or when a component needs to reload user-specific content after claims are refreshed. The UI can reflect the new authentication state without forcing the user to reconnect or reload the page. +## Experimental device-bound sessions limit stolen-cookie reuse + +> [!WARNING] +> Device Bound Session Credentials (DBSC) and the `Microsoft.AspNetCore.Authentication.DeviceBoundSessions` package remain prerelease in .NET 11. The APIs are annotated as experimental, and referencing DBSC types by name produces diagnostic `ASP0031`. The underlying web specification and browser support are also experimental. + +DBSC adds an experimental hardening layer for cookie authentication ([dotnet/aspnetcore #67388](https://github.com/dotnet/aspnetcore/pull/67388)). It binds session refresh to a private key held by the browser. The app issues a short-lived session cookie, and the browser must provide a signed proof of possession to refresh it. A copied session cookie might remain usable until it expires, but an attacker without the device key can't use it to extend the session. + +After adding the `Microsoft.AspNetCore.Authentication.DeviceBoundSessions` package, configure DBSC over an existing cookie authentication scheme: + +```csharp +builder.Services + .AddAuthentication("Application") + .AddCookie("Application") + .AddDeviceBoundSession("Application", options => + { + options.ShortLivedCookieExpiration = TimeSpan.FromMinutes(10); + }); +``` + +DBSC manages the registration and refresh endpoints, a path-scoped refresh cookie, and the short-lived session cookie. Browser support currently requires an experimental DBSC implementation, such as the feature available behind a flag in Chromium. + +## Experimental Components.AI adds streaming chat UI + +> [!WARNING] +> The `Microsoft.AspNetCore.Components.AI` package remains prerelease throughout .NET 11. RC 1 packages therefore retain a `preview.7` version prefix. + +`Microsoft.AspNetCore.Components.AI` adds a provider- and protocol-neutral Blazor component model for streaming AI conversations ([dotnet/aspnetcore #68323](https://github.com/dotnet/aspnetcore/pull/68323)). Apps supply an `IChatClient` from `Microsoft.Extensions.AI`. `UIAgent` turns its streaming responses into observable conversation state, while components such as `ChatPage`, `MessageList`, and `MessageInput` render the conversation and respond to streaming, cancellation, error, and retry updates. + +The following component creates a `UIAgent` over an app-provided `IChatClient` and renders a complete chat UI: + +```razor +@using Microsoft.AspNetCore.Components.AI +@using Microsoft.Extensions.AI +@rendermode InteractiveServer +@implements IDisposable +@inject IChatClient ChatClient + + + +@code { + private UIAgent _agent = default!; + + protected override void OnInitialized() + { + _agent = new UIAgent(ChatClient); + } + + public void Dispose() => _agent.Dispose(); +} +``` + +RC 1 also adds structured rich-text content and rendering ([dotnet/aspnetcore #68324](https://github.com/dotnet/aspnetcore/pull/68324)). Apps can map Markdown or another source format into `RichTextNode` values for headings, paragraphs, emphasis, links, lists, code blocks, tables, and other presentation elements. Parsing remains an application concern, so Components.AI doesn't require or prescribe a Markdown library. + ## OpenAPI reflects obsolete APIs ASP.NET Core OpenAPI generation now maps `[Obsolete]` to `deprecated: true` automatically for operations, schema types, and schema properties ([dotnet/aspnetcore #66355](https://github.com/dotnet/aspnetcore/pull/66355)). API clients and documentation tools can therefore surface the same deprecation information as .NET callers without a custom OpenAPI transformer. @@ -120,19 +179,28 @@ ASP.NET Core OpenAPI generation now maps `[Obsolete]` to `deprecated: true` auto ```csharp app.MapGet("/catalog/{id}", GetCatalogItem); -#pragma warning disable CS0618 // This endpoint intentionally uses an obsolete handler. +#pragma warning disable CS0618 // This example intentionally declares and maps obsolete APIs. app.MapGet("/catalog/legacy/{id}", GetLegacyCatalogItem); -#pragma warning restore CS0618 [Obsolete("Use /catalog/{id}.")] static LegacyCatalogItem GetLegacyCatalogItem(int id) => new(id, $"Product {id}", $"SKU-{id:D4}"); +static CatalogItem GetCatalogItem(int id) => + new(id, $"Product {id}", $"SKU-{id:D4}"); + +public sealed record CatalogItem( + int Id, + string Name, + string StockKeepingUnit); + [Obsolete("Use CatalogItem.")] public sealed record LegacyCatalogItem( int Id, string Name, [property: Obsolete("Use StockKeepingUnit.")] string Sku); + +#pragma warning restore CS0618 ``` The legacy operation, its response schema, and the `Sku` property are marked deprecated in the generated document: @@ -180,11 +248,14 @@ When a validation attribute doesn't specify `ErrorMessage`, localization tries t For example, this model can use `RegistrationModel_Username_RequiredAttribute_Error`, `RegistrationModel_RequiredAttribute_Error`, or the shared `RequiredAttribute_Error` resource: ```csharp +using System.ComponentModel.DataAnnotations; +using Microsoft.Extensions.Validation; + builder.Services.AddLocalization(); builder.Services.AddValidation(options => { options.LocalizerProvider = (_, factory) => - factory.Create(typeof(ValidationMessages)); + factory.Create(typeof(MyApp.Resources.ValidationMessages)); }); [ValidatableType] @@ -192,9 +263,17 @@ public sealed class RegistrationModel { [Required] [StringLength(20, MinimumLength = 4)] - [Display(Name = nameof(ValidationMessages.Username))] + [Display(Name = "Username")] public string Username { get; set; } = ""; } + +namespace MyApp.Resources +{ + // Resources/ValidationMessages.resx uses this type's namespace and name. + public sealed class ValidationMessages + { + } +} ``` An explicit `ErrorMessage` remains the first resource key to try. If no resource resolves, validation falls back to the non-localized message. The same conventions apply to Blazor static SSR client validation. @@ -205,13 +284,13 @@ The [server-to-client configuration API introduced in Preview 6](../preview6/asp When upgrading from Preview 7, update the following APIs: -| Preview 7 | RC 1 | -| --- | --- | -| `BrowserOptions.Server` | `BrowserOptions.InteractiveServer` | -| `BrowserOptions.Ssr` | `BrowserOptions.StaticServer` | -| `BrowserOptions.WebAssembly` | `BrowserOptions.InteractiveWebAssembly` | -| `SsrBrowserOptions` | `StaticServerBrowserOptions` | -| `WebAssemblyBrowserOptions` | `InteractiveWebAssemblyBrowserOptions` | +| Preview 7 | RC 1 | +| --------------------------------- | ----------------------------------------------- | +| `BrowserOptions.Server` | `BrowserOptions.InteractiveServer` | +| `BrowserOptions.Ssr` | `BrowserOptions.StaticServer` | +| `BrowserOptions.WebAssembly` | `BrowserOptions.InteractiveWebAssembly` | +| `SsrBrowserOptions` | `StaticServerBrowserOptions` | +| `WebAssemblyBrowserOptions` | `InteractiveWebAssemblyBrowserOptions` | | `httpContext.GetBrowserOptions()` | `BrowserOptions.GetBrowserOptions(httpContext)` | Configure browser startup behavior in C# with `WithBrowserOptions`: @@ -235,12 +314,12 @@ The finalized properties are `InteractiveServer`, `StaticServer`, and `Interacti ## Select an environment for build-time OpenAPI -Build-time OpenAPI generation can now run the app under a specified hosting environment ([dotnet/aspnetcore #63856](https://github.com/dotnet/aspnetcore/pull/63856)). Set `OpenApiGenerateEnvironment` when environment-specific services, endpoints, or transformers affect the generated document: +Build-time OpenAPI generation can now run the app under a specified hosting environment ([dotnet/aspnetcore #63856](https://github.com/dotnet/aspnetcore/pull/63856)). For projects that use the `Microsoft.Extensions.ApiDescription.Server` package to generate OpenAPI documents at build time, set `OpenApiGenerationEnvironment` when environment-specific services, endpoints, or transformers affect the generated document: ```xml true - Development + Development ``` @@ -255,7 +334,7 @@ Thank you [@ldsenow](https://github.com/ldsenow) for this contribution! **DirectTls** is an opt-in Kestrel transport for Linux that terminates TLS directly on the connection's socket by using the runtime's low-level TLS APIs ([dotnet/aspnetcore #67912](https://github.com/dotnet/aspnetcore/pull/67912)). It binds OpenSSL to the socket file descriptor instead of using `SslStream`, avoiding an intermediate managed copy on the TLS data path. The transport is being explored for connection-dense and handshake-heavy workloads where those copies and allocations can be significant. -DirectTls ships as the standalone `Microsoft.AspNetCore.Server.Kestrel.Transport.DirectTls` package and requires OpenSSL on the host. After adding a reference to the package, register the transport after the default Kestrel transport and select it for a specific endpoint. The following example assumes that `certificate` is an `X509Certificate2` loaded from the app's secure certificate configuration: +DirectTls ships as the standalone `Microsoft.AspNetCore.Server.Kestrel.Transport.DirectTls` package and requires OpenSSL on the host. After adding a reference to the package, call `UseDirectTls()` to register the transport and select it for a specific endpoint. The following example assumes that `certificate` is an `X509Certificate2` loaded from the app's secure certificate configuration: ```csharp using System.Net; From 13d927be1bd75d5ab60bf7a5d029eb8e02600b3b Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Mon, 31 Aug 2026 19:42:23 -0700 Subject: [PATCH 21/27] Clarify experimental DBSC support Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a851ab96-8780-407d-97d0-50eed422ead5 --- release-notes/11.0/preview/rc1/aspnetcore.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/release-notes/11.0/preview/rc1/aspnetcore.md b/release-notes/11.0/preview/rc1/aspnetcore.md index 65bde53cb7..dda00eaabe 100644 --- a/release-notes/11.0/preview/rc1/aspnetcore.md +++ b/release-notes/11.0/preview/rc1/aspnetcore.md @@ -124,7 +124,9 @@ After the connection refreshes its authentication, Blazor updates the authentica > [!WARNING] > Device Bound Session Credentials (DBSC) and the `Microsoft.AspNetCore.Authentication.DeviceBoundSessions` package remain prerelease in .NET 11. The APIs are annotated as experimental, and referencing DBSC types by name produces diagnostic `ASP0031`. The underlying web specification and browser support are also experimental. -DBSC adds an experimental hardening layer for cookie authentication ([dotnet/aspnetcore #67388](https://github.com/dotnet/aspnetcore/pull/67388)). It binds session refresh to a private key held by the browser. The app issues a short-lived session cookie, and the browser must provide a signed proof of possession to refresh it. A copied session cookie might remain usable until it expires, but an attacker without the device key can't use it to extend the session. +The [DBSC specification](https://w3c.github.io/webappsec-dbsc/) defines a protocol that binds session refresh to a private key held by the browser. The app issues a short-lived session cookie, and the browser must provide a signed proof of possession to refresh it. A copied session cookie might remain usable until it expires, but an attacker without the device key can't use it to extend the session. + +ASP.NET Core RC 1 adds an experimental server-side DBSC implementation in the `Microsoft.AspNetCore.Authentication.DeviceBoundSessions` package ([dotnet/aspnetcore #67388](https://github.com/dotnet/aspnetcore/pull/67388)). The authentication component layers over an existing cookie authentication scheme and manages the registration and refresh endpoints, a path-scoped refresh cookie, and the short-lived session cookie. After adding the `Microsoft.AspNetCore.Authentication.DeviceBoundSessions` package, configure DBSC over an existing cookie authentication scheme: @@ -138,7 +140,7 @@ builder.Services }); ``` -DBSC manages the registration and refresh endpoints, a path-scoped refresh cookie, and the short-lived session cookie. Browser support currently requires an experimental DBSC implementation, such as the feature available behind a flag in Chromium. +Browser support currently requires an experimental DBSC implementation, such as the feature available behind a flag in Chromium. ## Experimental Components.AI adds streaming chat UI From f1bbf418f2fb2c9bcef4e6a1eb1dcbb9cdaba86b Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Mon, 31 Aug 2026 19:47:30 -0700 Subject: [PATCH 22/27] Refine DBSC release note terminology Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a851ab96-8780-407d-97d0-50eed422ead5 --- release-notes/11.0/preview/rc1/aspnetcore.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/release-notes/11.0/preview/rc1/aspnetcore.md b/release-notes/11.0/preview/rc1/aspnetcore.md index dda00eaabe..c6d463bc8f 100644 --- a/release-notes/11.0/preview/rc1/aspnetcore.md +++ b/release-notes/11.0/preview/rc1/aspnetcore.md @@ -5,7 +5,7 @@ - [SignalR authentication refresh APIs are finalized](#signalr-authentication-refresh-apis-are-finalized) - [SignalR TypeScript client supports authentication refresh](#signalr-typescript-client-supports-authentication-refresh) - [Blazor Server circuits update after authentication refresh](#blazor-server-circuits-update-after-authentication-refresh) -- [Experimental device-bound sessions limit stolen-cookie reuse](#experimental-device-bound-sessions-limit-stolen-cookie-reuse) +- [Experimental Device Bound Session Credentials support](#experimental-device-bound-session-credentials-support) - [Experimental Components.AI adds streaming chat UI](#experimental-componentsai-adds-streaming-chat-ui) - [OpenAPI reflects obsolete APIs](#openapi-reflects-obsolete-apis) - [Validation localization uses message conventions](#validation-localization-uses-message-conventions) @@ -119,14 +119,14 @@ Interactive Server components can now receive the refreshed `ClaimsPrincipal` wi After the connection refreshes its authentication, Blazor updates the authentication state and raises `AuthenticationStateChanged`. Components that consume `AuthenticationStateProvider`, including `AuthorizeView`, re-render using the refreshed identity and claims. This behavior is useful when a user's roles or permissions change during an active circuit, or when a component needs to reload user-specific content after claims are refreshed. The UI can reflect the new authentication state without forcing the user to reconnect or reload the page. -## Experimental device-bound sessions limit stolen-cookie reuse +## Experimental Device Bound Session Credentials support > [!WARNING] > Device Bound Session Credentials (DBSC) and the `Microsoft.AspNetCore.Authentication.DeviceBoundSessions` package remain prerelease in .NET 11. The APIs are annotated as experimental, and referencing DBSC types by name produces diagnostic `ASP0031`. The underlying web specification and browser support are also experimental. The [DBSC specification](https://w3c.github.io/webappsec-dbsc/) defines a protocol that binds session refresh to a private key held by the browser. The app issues a short-lived session cookie, and the browser must provide a signed proof of possession to refresh it. A copied session cookie might remain usable until it expires, but an attacker without the device key can't use it to extend the session. -ASP.NET Core RC 1 adds an experimental server-side DBSC implementation in the `Microsoft.AspNetCore.Authentication.DeviceBoundSessions` package ([dotnet/aspnetcore #67388](https://github.com/dotnet/aspnetcore/pull/67388)). The authentication component layers over an existing cookie authentication scheme and manages the registration and refresh endpoints, a path-scoped refresh cookie, and the short-lived session cookie. +ASP.NET Core in .NET 11 RC1 adds an experimental server-side DBSC implementation in the `Microsoft.AspNetCore.Authentication.DeviceBoundSessions` package ([dotnet/aspnetcore #67388](https://github.com/dotnet/aspnetcore/pull/67388)). The authentication component layers over an existing cookie authentication scheme and manages the registration and refresh endpoints, a path-scoped refresh cookie, and the short-lived session cookie. After adding the `Microsoft.AspNetCore.Authentication.DeviceBoundSessions` package, configure DBSC over an existing cookie authentication scheme: From d773795ba0fcdd0f2fdd78a9367bfeff21170546 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Mon, 31 Aug 2026 19:52:02 -0700 Subject: [PATCH 23/27] Clarify experimental package versions Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a851ab96-8780-407d-97d0-50eed422ead5 --- release-notes/11.0/preview/rc1/aspnetcore.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/release-notes/11.0/preview/rc1/aspnetcore.md b/release-notes/11.0/preview/rc1/aspnetcore.md index c6d463bc8f..98a9629b19 100644 --- a/release-notes/11.0/preview/rc1/aspnetcore.md +++ b/release-notes/11.0/preview/rc1/aspnetcore.md @@ -121,8 +121,8 @@ After the connection refreshes its authentication, Blazor updates the authentica ## Experimental Device Bound Session Credentials support -> [!WARNING] -> Device Bound Session Credentials (DBSC) and the `Microsoft.AspNetCore.Authentication.DeviceBoundSessions` package remain prerelease in .NET 11. The APIs are annotated as experimental, and referencing DBSC types by name produces diagnostic `ASP0031`. The underlying web specification and browser support are also experimental. +> [!IMPORTANT] +> The `Microsoft.AspNetCore.Authentication.DeviceBoundSessions` package is experimental and will remain prerelease throughout .NET 11 and until the specification stabilizes. For .NET 11 RC1, use version `0.11.0-rc.1.26427.112` of the package. The [DBSC specification](https://w3c.github.io/webappsec-dbsc/) defines a protocol that binds session refresh to a private key held by the browser. The app issues a short-lived session cookie, and the browser must provide a signed proof of possession to refresh it. A copied session cookie might remain usable until it expires, but an attacker without the device key can't use it to extend the session. @@ -144,8 +144,8 @@ Browser support currently requires an experimental DBSC implementation, such as ## Experimental Components.AI adds streaming chat UI -> [!WARNING] -> The `Microsoft.AspNetCore.Components.AI` package remains prerelease throughout .NET 11. RC 1 packages therefore retain a `preview.7` version prefix. +> [!IMPORTANT] +> The `Microsoft.AspNetCore.Components.AI` package is experimental and will remain prerelease throughout .NET 11. For .NET 11 RC1, use version `11.0.0-preview.7.26427.112` of the package. `Microsoft.AspNetCore.Components.AI` adds a provider- and protocol-neutral Blazor component model for streaming AI conversations ([dotnet/aspnetcore #68323](https://github.com/dotnet/aspnetcore/pull/68323)). Apps supply an `IChatClient` from `Microsoft.Extensions.AI`. `UIAgent` turns its streaming responses into observable conversation state, while components such as `ChatPage`, `MessageList`, and `MessageInput` render the conversation and respond to streaming, cancellation, error, and retry updates. From 5cbbba911a11bd755ce432f7fcc18264e1a73e3f Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Mon, 31 Aug 2026 19:54:42 -0700 Subject: [PATCH 24/27] Link DBSC browser implementation details Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a851ab96-8780-407d-97d0-50eed422ead5 --- release-notes/11.0/preview/rc1/aspnetcore.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/release-notes/11.0/preview/rc1/aspnetcore.md b/release-notes/11.0/preview/rc1/aspnetcore.md index 98a9629b19..80c3b6c579 100644 --- a/release-notes/11.0/preview/rc1/aspnetcore.md +++ b/release-notes/11.0/preview/rc1/aspnetcore.md @@ -140,7 +140,7 @@ builder.Services }); ``` -Browser support currently requires an experimental DBSC implementation, such as the feature available behind a flag in Chromium. +Browser support currently requires an experimental DBSC implementation. See [Chrome's DBSC documentation](https://developer.chrome.com/docs/web-platform/device-bound-session-credentials) for implementation and enablement details. ## Experimental Components.AI adds streaming chat UI From cfa72a799a4794ce69cb32a958f96dcb00367057 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Mon, 31 Aug 2026 20:25:38 -0700 Subject: [PATCH 25/27] Group experimental ASP.NET Core features Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a851ab96-8780-407d-97d0-50eed422ead5 --- release-notes/11.0/preview/rc1/aspnetcore.md | 114 +++++++++---------- 1 file changed, 57 insertions(+), 57 deletions(-) diff --git a/release-notes/11.0/preview/rc1/aspnetcore.md b/release-notes/11.0/preview/rc1/aspnetcore.md index 80c3b6c579..9532e6df0c 100644 --- a/release-notes/11.0/preview/rc1/aspnetcore.md +++ b/release-notes/11.0/preview/rc1/aspnetcore.md @@ -5,12 +5,12 @@ - [SignalR authentication refresh APIs are finalized](#signalr-authentication-refresh-apis-are-finalized) - [SignalR TypeScript client supports authentication refresh](#signalr-typescript-client-supports-authentication-refresh) - [Blazor Server circuits update after authentication refresh](#blazor-server-circuits-update-after-authentication-refresh) -- [Experimental Device Bound Session Credentials support](#experimental-device-bound-session-credentials-support) -- [Experimental Components.AI adds streaming chat UI](#experimental-componentsai-adds-streaming-chat-ui) - [OpenAPI reflects obsolete APIs](#openapi-reflects-obsolete-apis) - [Validation localization uses message conventions](#validation-localization-uses-message-conventions) - [Blazor browser options are finalized](#blazor-browser-options-are-finalized) - [Select an environment for build-time OpenAPI](#select-an-environment-for-build-time-openapi) +- [Experimental Device Bound Session Credentials support](#experimental-device-bound-session-credentials-support) +- [Experimental Components.AI adds streaming chat UI](#experimental-componentsai-adds-streaming-chat-ui) - [Experimental DirectTls transport](#experimental-directtls-transport) - [Breaking changes](#breaking-changes) - [Bug fixes](#bug-fixes) @@ -119,61 +119,6 @@ Interactive Server components can now receive the refreshed `ClaimsPrincipal` wi After the connection refreshes its authentication, Blazor updates the authentication state and raises `AuthenticationStateChanged`. Components that consume `AuthenticationStateProvider`, including `AuthorizeView`, re-render using the refreshed identity and claims. This behavior is useful when a user's roles or permissions change during an active circuit, or when a component needs to reload user-specific content after claims are refreshed. The UI can reflect the new authentication state without forcing the user to reconnect or reload the page. -## Experimental Device Bound Session Credentials support - -> [!IMPORTANT] -> The `Microsoft.AspNetCore.Authentication.DeviceBoundSessions` package is experimental and will remain prerelease throughout .NET 11 and until the specification stabilizes. For .NET 11 RC1, use version `0.11.0-rc.1.26427.112` of the package. - -The [DBSC specification](https://w3c.github.io/webappsec-dbsc/) defines a protocol that binds session refresh to a private key held by the browser. The app issues a short-lived session cookie, and the browser must provide a signed proof of possession to refresh it. A copied session cookie might remain usable until it expires, but an attacker without the device key can't use it to extend the session. - -ASP.NET Core in .NET 11 RC1 adds an experimental server-side DBSC implementation in the `Microsoft.AspNetCore.Authentication.DeviceBoundSessions` package ([dotnet/aspnetcore #67388](https://github.com/dotnet/aspnetcore/pull/67388)). The authentication component layers over an existing cookie authentication scheme and manages the registration and refresh endpoints, a path-scoped refresh cookie, and the short-lived session cookie. - -After adding the `Microsoft.AspNetCore.Authentication.DeviceBoundSessions` package, configure DBSC over an existing cookie authentication scheme: - -```csharp -builder.Services - .AddAuthentication("Application") - .AddCookie("Application") - .AddDeviceBoundSession("Application", options => - { - options.ShortLivedCookieExpiration = TimeSpan.FromMinutes(10); - }); -``` - -Browser support currently requires an experimental DBSC implementation. See [Chrome's DBSC documentation](https://developer.chrome.com/docs/web-platform/device-bound-session-credentials) for implementation and enablement details. - -## Experimental Components.AI adds streaming chat UI - -> [!IMPORTANT] -> The `Microsoft.AspNetCore.Components.AI` package is experimental and will remain prerelease throughout .NET 11. For .NET 11 RC1, use version `11.0.0-preview.7.26427.112` of the package. - -`Microsoft.AspNetCore.Components.AI` adds a provider- and protocol-neutral Blazor component model for streaming AI conversations ([dotnet/aspnetcore #68323](https://github.com/dotnet/aspnetcore/pull/68323)). Apps supply an `IChatClient` from `Microsoft.Extensions.AI`. `UIAgent` turns its streaming responses into observable conversation state, while components such as `ChatPage`, `MessageList`, and `MessageInput` render the conversation and respond to streaming, cancellation, error, and retry updates. - -The following component creates a `UIAgent` over an app-provided `IChatClient` and renders a complete chat UI: - -```razor -@using Microsoft.AspNetCore.Components.AI -@using Microsoft.Extensions.AI -@rendermode InteractiveServer -@implements IDisposable -@inject IChatClient ChatClient - - - -@code { - private UIAgent _agent = default!; - - protected override void OnInitialized() - { - _agent = new UIAgent(ChatClient); - } - - public void Dispose() => _agent.Dispose(); -} -``` - -RC 1 also adds structured rich-text content and rendering ([dotnet/aspnetcore #68324](https://github.com/dotnet/aspnetcore/pull/68324)). Apps can map Markdown or another source format into `RichTextNode` values for headings, paragraphs, emphasis, links, lists, code blocks, tables, and other presentation elements. Parsing remains an application concern, so Components.AI doesn't require or prescribe a Markdown library. - ## OpenAPI reflects obsolete APIs ASP.NET Core OpenAPI generation now maps `[Obsolete]` to `deprecated: true` automatically for operations, schema types, and schema properties ([dotnet/aspnetcore #66355](https://github.com/dotnet/aspnetcore/pull/66355)). API clients and documentation tools can therefore surface the same deprecation information as .NET callers without a custom OpenAPI transformer. @@ -329,6 +274,61 @@ The value is passed to the application host in the same role as `ASPNETCORE_ENVI Thank you [@ldsenow](https://github.com/ldsenow) for this contribution! +## Experimental Device Bound Session Credentials support + +> [!IMPORTANT] +> The `Microsoft.AspNetCore.Authentication.DeviceBoundSessions` package is experimental and will remain prerelease throughout .NET 11 and until the specification stabilizes. For .NET 11 RC1, use version `0.11.0-rc.1.26427.112` of the package. + +The [DBSC specification](https://w3c.github.io/webappsec-dbsc/) defines a protocol that binds session refresh to a private key held by the browser. The app issues a short-lived session cookie, and the browser must provide a signed proof of possession to refresh it. A copied session cookie might remain usable until it expires, but an attacker without the device key can't use it to extend the session. + +ASP.NET Core in .NET 11 RC1 adds an experimental server-side DBSC implementation in the `Microsoft.AspNetCore.Authentication.DeviceBoundSessions` package ([dotnet/aspnetcore #67388](https://github.com/dotnet/aspnetcore/pull/67388)). The authentication component layers over an existing cookie authentication scheme and manages the registration and refresh endpoints, a path-scoped refresh cookie, and the short-lived session cookie. + +After adding the `Microsoft.AspNetCore.Authentication.DeviceBoundSessions` package, configure DBSC over an existing cookie authentication scheme: + +```csharp +builder.Services + .AddAuthentication("Application") + .AddCookie("Application") + .AddDeviceBoundSession("Application", options => + { + options.ShortLivedCookieExpiration = TimeSpan.FromMinutes(10); + }); +``` + +Browser support currently requires an experimental DBSC implementation. See [Chrome's DBSC documentation](https://developer.chrome.com/docs/web-platform/device-bound-session-credentials) for implementation and enablement details. + +## Experimental Components.AI adds streaming chat UI + +> [!IMPORTANT] +> The `Microsoft.AspNetCore.Components.AI` package is experimental and will remain prerelease throughout .NET 11. For .NET 11 RC1, use version `11.0.0-preview.7.26427.112` of the package. + +`Microsoft.AspNetCore.Components.AI` adds a provider- and protocol-neutral Blazor component model for streaming AI conversations ([dotnet/aspnetcore #68323](https://github.com/dotnet/aspnetcore/pull/68323)). Apps supply an `IChatClient` from `Microsoft.Extensions.AI`. `UIAgent` turns its streaming responses into observable conversation state, while components such as `ChatPage`, `MessageList`, and `MessageInput` render the conversation and respond to streaming, cancellation, error, and retry updates. + +The following component creates a `UIAgent` over an app-provided `IChatClient` and renders a complete chat UI: + +```razor +@using Microsoft.AspNetCore.Components.AI +@using Microsoft.Extensions.AI +@rendermode InteractiveServer +@implements IDisposable +@inject IChatClient ChatClient + + + +@code { + private UIAgent _agent = default!; + + protected override void OnInitialized() + { + _agent = new UIAgent(ChatClient); + } + + public void Dispose() => _agent.Dispose(); +} +``` + +RC 1 also adds structured rich-text content and rendering ([dotnet/aspnetcore #68324](https://github.com/dotnet/aspnetcore/pull/68324)). Apps can map Markdown or another source format into `RichTextNode` values for headings, paragraphs, emphasis, links, lists, code blocks, tables, and other presentation elements. Parsing remains an application concern, so Components.AI doesn't require or prescribe a Markdown library. + ## Experimental DirectTls transport > [!WARNING] From 908e4d96e31efc9c8cc0b347afc8a57804e271f3 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Mon, 31 Aug 2026 20:37:13 -0700 Subject: [PATCH 26/27] Expand experimental Blazor AI components Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a851ab96-8780-407d-97d0-50eed422ead5 --- release-notes/11.0/preview/rc1/aspnetcore.md | 97 ++++++++++++++++++-- 1 file changed, 91 insertions(+), 6 deletions(-) diff --git a/release-notes/11.0/preview/rc1/aspnetcore.md b/release-notes/11.0/preview/rc1/aspnetcore.md index 9532e6df0c..1e72ad68cc 100644 --- a/release-notes/11.0/preview/rc1/aspnetcore.md +++ b/release-notes/11.0/preview/rc1/aspnetcore.md @@ -10,7 +10,7 @@ - [Blazor browser options are finalized](#blazor-browser-options-are-finalized) - [Select an environment for build-time OpenAPI](#select-an-environment-for-build-time-openapi) - [Experimental Device Bound Session Credentials support](#experimental-device-bound-session-credentials-support) -- [Experimental Components.AI adds streaming chat UI](#experimental-componentsai-adds-streaming-chat-ui) +- [Experimental Blazor AI components for agentic user interfaces](#experimental-blazor-ai-components-for-agentic-user-interfaces) - [Experimental DirectTls transport](#experimental-directtls-transport) - [Breaking changes](#breaking-changes) - [Bug fixes](#bug-fixes) @@ -297,14 +297,26 @@ builder.Services Browser support currently requires an experimental DBSC implementation. See [Chrome's DBSC documentation](https://developer.chrome.com/docs/web-platform/device-bound-session-credentials) for implementation and enablement details. -## Experimental Components.AI adds streaming chat UI +## Experimental Blazor AI components for agentic user interfaces + +Modern AI apps increasingly provide rich interactions with agents. A complete agentic user interface may need to stream ongoing work, visualize agent reasoning and progress, request approval before tools act, accept multimodal input, and synchronize state between the app and the agent. The Blazor AI components are designed to provide building blocks for creating these experiences using Blazor's component model. + +.NET 11 RC1 includes an initial set of Blazor AI components focused on streaming chat and rich-text rendering. > [!IMPORTANT] > The `Microsoft.AspNetCore.Components.AI` package is experimental and will remain prerelease throughout .NET 11. For .NET 11 RC1, use version `11.0.0-preview.7.26427.112` of the package. -`Microsoft.AspNetCore.Components.AI` adds a provider- and protocol-neutral Blazor component model for streaming AI conversations ([dotnet/aspnetcore #68323](https://github.com/dotnet/aspnetcore/pull/68323)). Apps supply an `IChatClient` from `Microsoft.Extensions.AI`. `UIAgent` turns its streaming responses into observable conversation state, while components such as `ChatPage`, `MessageList`, and `MessageInput` render the conversation and respond to streaming, cancellation, error, and retry updates. +### Stream conversations into Blazor components + +The initial streaming chat support ([dotnet/aspnetcore #68323](https://github.com/dotnet/aspnetcore/pull/68323)) is provider- and protocol-neutral. Apps supply an `IChatClient` from `Microsoft.Extensions.AI`, and `UIAgent` converts its streaming responses into observable content blocks that the UI can render as they arrive. `UIAgent` also retains the message history for subsequent turns. + +`ChatPage` is a complete chat shell that combines three lower-level components: + +- `AgentBoundary` creates and cascades the conversation state. +- `MessageList` renders each turn as it streams and provides default typing, error, and retry UI. +- `MessageInput` sends messages from a text area and disables input while a response is streaming. -The following component creates a `UIAgent` over an app-provided `IChatClient` and renders a complete chat UI: +The following component creates a `UIAgent` over an app-provided `IChatClient` and renders the conversation with `ChatPage`: ```razor @using Microsoft.AspNetCore.Components.AI @@ -313,7 +325,11 @@ The following component creates a `UIAgent` over an app-provided `IChatClient` a @implements IDisposable @inject IChatClient ChatClient - + + +

Ask the agent a question.

+ + @code { private UIAgent _agent = default!; @@ -327,7 +343,76 @@ The following component creates a `UIAgent` over an app-provided `IChatClient` a } ``` -RC 1 also adds structured rich-text content and rendering ([dotnet/aspnetcore #68324](https://github.com/dotnet/aspnetcore/pull/68324)). Apps can map Markdown or another source format into `RichTextNode` values for headings, paragraphs, emphasis, links, lists, code blocks, tables, and other presentation elements. Parsing remains an application concern, so Components.AI doesn't require or prescribe a Markdown library. +Include the component styles in `App.razor`: + +```razor + +``` + +Because `UIAgent` accepts any `IChatClient`, it can also use an [`AGUIChatClient`](https://docs.ag-ui.com/sdk/dotnet/client/chat-client) to connect the Blazor UI to a remote agent over the Agent User Interaction Protocol (AG-UI): + +```csharp +using AGUI.Client; +using Microsoft.Extensions.AI; + +builder.Services.AddHttpClient(httpClient => + new AGUIChatClient(new(httpClient, "https://api.example.com/agent"))); +``` + +`AGUIChatClient` streams AG-UI events as `ChatResponseUpdate` values. The RC1 components render the conversational content from these updates, while apps can use the additional AG-UI event information to build richer agentic interactions. + +### Render rich text + +The rich-text support ([dotnet/aspnetcore #68324](https://github.com/dotnet/aspnetcore/pull/68324)) lets an `IChatClient` provide complete structured snapshots using `RichTextContent` and `RichTextNode` values. The built-in renderer supports headings, paragraphs, emphasis, links, lists, code blocks, tables, and other presentation elements. Plain `TextContent` continues to render as paragraphs. + +Components.AI doesn't prescribe a source format or parser. Apps can map a parser's syntax tree into `RichTextNode` values to use the built-in renderer, or register a custom `BlockRenderer`. The following example composes `MessageList` and `MessageInput` directly and uses the community [Markdig](https://www.nuget.org/packages/Markdig) library to render Markdown. Because the generated HTML is rendered as markup, the example also sanitizes it with [HtmlSanitizer](https://www.nuget.org/packages/HtmlSanitizer): + +```razor +@using Ganss.Xss +@using Markdig +@using Microsoft.AspNetCore.Components.AI +@using Microsoft.Extensions.AI +@rendermode InteractiveServer +@implements IDisposable +@inject IChatClient ChatClient + + + + +

Ask the agent a question.

+ + + + @RenderMarkdown(block.RawText) + + + + + + +@code { + private static readonly MarkdownPipeline MarkdownPipeline = + new MarkdownPipelineBuilder() + .UseAdvancedExtensions() + .DisableHtml() + .Build(); + private static readonly HtmlSanitizer HtmlSanitizer = new(); + private UIAgent _agent = default!; + + protected override void OnInitialized() + { + _agent = new UIAgent(ChatClient); + } + + private static MarkupString RenderMarkdown(string markdown) + { + var html = Markdown.ToHtml(markdown, MarkdownPipeline); + return new MarkupString(HtmlSanitizer.Sanitize(html)); + } + + public void Dispose() => _agent.Dispose(); +} +``` ## Experimental DirectTls transport From bdc17a36b6143b59ed87b334455721d4d509484f Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Mon, 31 Aug 2026 20:58:06 -0700 Subject: [PATCH 27/27] Add Blazor AI component screenshots Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a851ab96-8780-407d-97d0-50eed422ead5 --- release-notes/11.0/preview/rc1/aspnetcore.md | 4 ++++ .../11.0/preview/rc1/media/blazor-ai-chat.png | Bin 0 -> 37964 bytes .../preview/rc1/media/blazor-ai-rich-text.png | Bin 0 -> 48882 bytes 3 files changed, 4 insertions(+) create mode 100644 release-notes/11.0/preview/rc1/media/blazor-ai-chat.png create mode 100644 release-notes/11.0/preview/rc1/media/blazor-ai-rich-text.png diff --git a/release-notes/11.0/preview/rc1/aspnetcore.md b/release-notes/11.0/preview/rc1/aspnetcore.md index 1e72ad68cc..9ce3df72f8 100644 --- a/release-notes/11.0/preview/rc1/aspnetcore.md +++ b/release-notes/11.0/preview/rc1/aspnetcore.md @@ -349,6 +349,8 @@ Include the component styles in `App.razor`: ``` +![Blazor AI chat interface showing a conversation with a travel planning agent](media/blazor-ai-chat.png) + Because `UIAgent` accepts any `IChatClient`, it can also use an [`AGUIChatClient`](https://docs.ag-ui.com/sdk/dotnet/client/chat-client) to connect the Blazor UI to a remote agent over the Agent User Interaction Protocol (AG-UI): ```csharp @@ -365,6 +367,8 @@ builder.Services.AddHttpClient(httpClient => The rich-text support ([dotnet/aspnetcore #68324](https://github.com/dotnet/aspnetcore/pull/68324)) lets an `IChatClient` provide complete structured snapshots using `RichTextContent` and `RichTextNode` values. The built-in renderer supports headings, paragraphs, emphasis, links, lists, code blocks, tables, and other presentation elements. Plain `TextContent` continues to render as paragraphs. +![Blazor AI chat interface rendering a heading, emphasized text, a list, a quote, a code block, and a table](media/blazor-ai-rich-text.png) + Components.AI doesn't prescribe a source format or parser. Apps can map a parser's syntax tree into `RichTextNode` values to use the built-in renderer, or register a custom `BlockRenderer`. The following example composes `MessageList` and `MessageInput` directly and uses the community [Markdig](https://www.nuget.org/packages/Markdig) library to render Markdown. Because the generated HTML is rendered as markup, the example also sanitizes it with [HtmlSanitizer](https://www.nuget.org/packages/HtmlSanitizer): ```razor diff --git a/release-notes/11.0/preview/rc1/media/blazor-ai-chat.png b/release-notes/11.0/preview/rc1/media/blazor-ai-chat.png new file mode 100644 index 0000000000000000000000000000000000000000..6fcd86c35c862b5d96d509ebb1de916de6cad071 GIT binary patch literal 37964 zcmc$Gby!qi+b*I=iGY;kAV`BqcZh_vv;u;JAUSjnARr-)bW4|Xw}5nacQ?#P3=A`8 zzwa=*ZJ$5>-@v!nwdR&@3q!*KlgJ#_nL2SRpjt+C~(lw(D3BnNUNiv-T#G# zhCYgg4!kl-60w1XMt~+S{Yuj<^>7IfLM4~BdTR;iIPq<^ep7Bwhk?--81%u7)cV&G zGaIJ5%D906j_2$jv+3u5R=f_YrcI}ReEEv~$?$x40+G-f!DI9$0{+UHgjrpxImt(! z58h4J8Z)S`&!!|e8`!Ns_x`q|s^vPO)TTP4H1hd5s#PguyxB=dOUD(})MzFOA7zvK zYKk?%EAz!Dw`av|WA}`RDPjPXCTb7Oap&Gl18(_Oy@@7yOi@vuQc*JRr}1i*m^`I) z_KZh(E_j{ghKYw?hkae=GGSI_ATftSyiVesbjR)Ls(ei?txpClm=iVJB8GO!C9z46 zPlZ40%R9PAs(*HIRts(f9^M45^@%vw!GsH!l+@r)Y%VLf@7=un7Kx^!>bT`tc=AJ~1|(W?swu+ou!;O{lGsOUX5_MzK5kpiE8~Zx?zg=aI))N1+vF3=PSZ(w zVS_CPIP(7Oa;=g%#`v!-gcu&1vmB|mpVEm=z9Dd#Wo=nf=Qi_V&pk?4pDO;l_k`IB1PnfBj@@-igEU6QspwH2h#<%1+vkau z2hyH0j4eCzEt!3;UPf)nO4O;zbisJhrRGO0D;1f+ z=ZJR;DsxG8CZjzHlY5Ge4+?@wDT6{pp$VJpAB&sA?G^r1T(vBx&4@w|(lF?TvG`rR z{aCX46ssu1``*)rXIT+nY@WR?Yi2k3Y_7Gh_?5HG40Q%f?}+e5^+ZV$<;ENNIvFI1 z+}1$+LtN?)NyMS#wO80Oo-l`dEDlFRaT#yLIC6_fDJ5sYJLC3B*Y6;pH@S8epnD39 z^Vp1C^ggHTZ?}&OR0>^D{b${0^y72pDpe>a^j&(nNRWs(G;-J{hJc~oXzgcFmVkRK zag(17d$Dc&iQNd^!KT6}V$4Qs{m3Al`o~WW{^bUWP;AA%-1_WU*4#!0arD?fy%N5c z6T|`mLo3=0%f|sHXcpi}buz^0fRCV!<&?$5q!J#}7wb#qQfl4AW03U%Y<)mP30%jT@s5ldIGFR@Y?U8?sQqLMjoyu35br zy^_W$sO+?0;;~)NP*z~ zQzgU{hKIKnS$b~(cU zlgi4VHXTFa>T)NXyUQn}b$&>9rJm9)*gSe2REpE@4&}B8qOMG=*{+s-U<`Ba4!_HBLFO3XE~meGoZw8tEPELfxq-( z%7%*ufKDyJy`h5#MnOlhY1je}y?#okwere+3He-MU(ieMBR`B@+rRKMUm6s;aQb#l+U!z5aRQjkMy5#PV4E5Rs4)^&-7>dP(_61d*GBvc1ME;%|su zJ&wAN<*;aneHXi4g<*!bWRDC(4rH>}|1U?(mM}V^r+tS}?nMKy0Q;b%`16`j;zM*cf?!+!6V6nV*<%x5ruzOPyvUzWqNkzt5Ty3M9 z|5{3!8lg9?i)m>GXr%)?8kBPq;Knh)Xiq@gRI`-Lqb1(26`7vWJz(m_mh!rp{e zrcERsn=@j##4ekvleT8o1`>P|B2YQ!3uX&q35dlrD}{~T6P1|1S@G-Sudo5K_`7cn zRH?mp7mSsi`E_s4%fu9Ck(z8@yseXc(5c)rl~ASlvF zSlKA^^;lQZufYmj>V6jjdBu>XfD-N^AOwo?-1gpGjagGEoP9P^oVPt&5Q{^Pt3+q8 zsl#Tkq*mZ@dgm9RCr;EHNzypeB>N)<19K}0+x#IkAh$iY>ums^7+jwrq}6il#piXL zO>nVP89h;+Ody6yjg?Go3V8~C4qa5Fyrb98U3+%DH6vdY3W>%j2$fnr1%0CGyKkD~ z_2*riMEPdc;?GGc;K5SgW<56Nl_hB396cG+z9;9+(^@jv+g#{KTCSt9`u@i%j&zM4 z1%0r4B;puRF9;1Ct%c^Ed48guns2pldGmXls5T{OKH6}X1|E}vfwMHbr`5agJ&Rw2N_$N=|?UWz)rwFfgybE}2Qu?nzet8c)xRT`+EV7f{hr-;KIF!HL zZN8|!O7au{`4M!6BNG#iB?szz>WTMD7FxQOs6K1W?*4nNP;`y7RY%q2jltJDaEA!3 z@=HPzvCSJ{-!yW!cK+Lf1{#opbe@ zY(jJ2QHo7yp2W!Uf}Xq9C7m%QG?I5oJb9P*n0=6szOo6}<_ z)#JSkzL&cA$)ELtL~&!?n-VlamR7VIyp+t#TxEYKA4r6M`K4W{Y?~JwB5Clu zPJV1d3uD+Vl+(%jQwV(c=XAl^gL)(Cm4au5qTp9y>N&;& zf^V=9OeA(u!(r(d3LcxBb`l&?S>k5h+xIPY{RYv8(Ft3Ix533Z)WT_+8@*-jq`hoi zMPKVo?Yy|$!Jibk(bLwaofOD5)}SuglaZJVtlpVj`+?3-7oJ=9 zi8R&JkXcApcevHAoeZ!0Gq1sx_4+1KnMfTHgIx$ouvNv?Emzb$n}WFC(?d%4?t%`o z7&eHIOs!sKU6Jz$y2X$)|LX(Nm>JcfKM{!bVH(cx^&n1Q?O0I3mn_EVeO{USMo}c% z!#l=T(@U2|`}ie8hQJeoCXEhVi%p~z@b77jQbih#4a4rkSV`QPpNeU}I&$sw1?9?8 z6e31min^~205C`kx+FM84D0QS+a;aXZ)GkP2cGW4!y-kmsR)*f5*78fUzES#Rh9H0u+a~h9%kl>Y5ACpd`xdV4KT3kw zD?So>v#m=1xUK!QYcxJ#TsJ8_FNsA?U~#*@d&y+*P!DkFRIE*0;E6K|(1jycBQlss zqTM^S-01t#Q|1gXhJ5*ElUc;8O!qWiZ>MK)!7MvI*_Vcu>v9*>r#0OGoSwP9lmbF0k~ucG zM6R^!k6diHv8_>$>%=VHTOevIibchS!Uk_H+ckTN#|tGjn{v7Q5-)pCh9g7i+puid z3@O@l9;%ldQO<-)TZKK$ygdy%rlQh2kUk|Q1qh{WC zZQ!_*C%MYz(?wlM04GIJv^Lj?2CD4;>^c3Z;iedUnfV^Et9dK1Gf_9xVE3IMX4ncb z&gU4AUn!GkpRf%~eH4W+CQSqnlM7=bIwTEv1QNJ;I z-r++5hy(v<0UV#NI)jIp6l6@7-_QeN`~sMNNmg_?ojWO|VGhKiypp2uvKM^CFFj^) z_4@br{X)W&8HKcS=}oaFqe?lyb-DaNCQb-EYhv{kHzJA>$j>|K0!# zpN|{UnQPU@yBTO*)vSjFN`UlsbMWb-@Z|vlz|J@RCZO0sen(PI)g5|fkyZSd=R&yq zrdxF2Ti;GoAXe*2E1lC$=ftlXlig&Q)v3`bQf zMKtWR71{h}6HK#sjgM;f8qiBPY4B1x7W3770QCreQ7vqB{2_q9L869Se&&$16*;SA z>G?zFLM^IW59l-_6DP-V1G z!N|f6xH9+mE#(&aHj%P~c~H0@?$>GB1c6)kk@Tl20PLuR)977Er7UL5e+NnXWAMtD zm4)>)i9l7Gg+|XTYMW!Kv(A<9teeP!m_(9wNGl;y8}j{2LiDbTRC zU;e7)a&wU1AYd}!eqrpuFdHjhNWS5V5gJ>%-`>)&?RZrCSf6jZcoI0}LcdlOEoIyI`x?*f^z2w#SJan_*E`Xt62xsjn-mq=r5$jhypOI6DIw@S!%HG~xv@ zznOI#=cVQ0l>Ba7NZHFg+e{NS6AENAc`~QRq+Q3L8|++|a3XYYw)vpM>|-bsMcFu2 zPsqRbMf$l-n=F= zCAA|B-gV~p(PKCo-OHhn^B$^_44W(_S^nM*;7Lr*vC!zV!e}PWu*D2I@geQLbA)fW z;*sI6`om< z51eh$H@&MXf}C2YA(gXkTs?5x9?HG$d?$;<%7v0ydAOI8uGzY>tpZ*e;gnkx2b zF4zORwnBg7lTLg6$TMg`O}8)RIf1o11#3~}5?AvfDa)5@GW%)gpaOT)dLHNE<-+Uq z2%}U%#6p`6Zo)|+d_yL*t(3I2z<@(ve6z#xc7L?=#A_|@vTemz22YP>fbeq&+UX*H1tNeSr(?Fg9 z&*$ksVCbiDvo_pA%8Tj*VkVc48=MmjB$EUn#A)$dBBkoZK~zaF;@3=g+S>Ht;vjGMU zNpPSZ3d%3tHQ0Kc?vr;}CE#_Qk)bw6zn^=1>2-wb`dAb(%Tq>GvtoA`*F&?{vUP3c zkr7*FaFvlPeh9I<$~0_=YG4$+IE|1?%`a=d*vI`Uh?H8{DNS=7z^Cy(EQcW!RmCBy zJ9PcBl#|Kz3xp@Rt5;jOg?x<2&-g;0%1L}ZG%%L3Rh;qA!Eip!Fr z`^v@EO7Me-TeDl`884F?@1~cW_?OO$S9?Bg?JT8&qF1?*A6##KrAts%;dr=>h-DZ; zdfK)uHycl(+n|PxJiHcE^TDcPlB_qpODyHM-u7(2J)z2r1+tb`+@f?~zw7GC=XIL5 zz<=bRtHcNWWh3yy^75S^u|IO$dXw&B^u-tX~05wXW6~&1wg7};oZdE6{vPo?jbg^dF>Cs$;%+3 zB^W_(0MgS2BaTh>{afz%@}AJ=uJ8Q50};cw6ryh1szayEd-H!X@kbWW;eHbzWvVHK z=N`VPfDg?!lTY-lkD$}l!pxTm<2bc2(D5~{U_cc|SHk0Wx)~tA>CkrH=4%eXDtq<$ zwzY{N-dC+BNY!kK1J@&2uNgYt`+b-1YrO0hSm|F^g@BURfdFz2A3MRioNrPOQzMZ~# zj4Uvj%OmqDJ4WqY^i+j%J1G9y8cFgxI$D7vPrPqK$1)AWkhT*jeTQ_9HMsA>F?sC@ z91+<`Cce&EU|FhD>wUa&`Hll}X1Ls7@p+f*brR_UEPQ0;te`F$gj+bQ@}8PLhq}^= z5Z?XLkA$6@Z_#SxWxXF)b|Z+AovK1nE^@IPaLWJL>i32xZ5Lg@!ymrS$J@7)jf&Njv92rPg|e zK&t1kd|9_;JDYV)8amc+4%yGF<8SbE{4s&32dJl~w385FFIg%8G*dX6{JFt%zXMUd zpf~~j0D>3Z-j7V#9<8$PT(ffWr*sOO0ZgLr37)chEr-FCl1{nw+bkxn2Nx(+iL~U?R zI#g5Z3Se@_1#0exefbbz1uS^;WC=Imhg_qsOIB_dIAu{MOT}j9=~VN@S??ULnp%?D zZ*VoK07#qRx$1{M_W{oo&+*KA)Q|D>U7PYv(4cGV;JmtvV!c@*iY-c ztS4J8BNd01`>a9Fu3V2Ps%uxPBfagNH{cq|T<3_uHspZf5vk{?xvB@nT+uMt2Ng>A zKJ9(!exmVpWfO3@f(_~X}oLz!0IcZA`*twx;@i1aGS z%t8ZIB71jL^WlW<6K)D%ae0F1qFmJhh7o^Px$xbG>jM~b-=h3}>>8m~qNo;@Vt@)o z9rn6_K9GgJAU+iQ;GNBd<(s(~Jb+?@&YE1*3hkW3KDO>^nx+gRpBSYV2aQfH50)wx z*Ppy?68}z(ekQ(hy3*Eo1?Aa-X>c~%6?v@hPUsz9Er6}B>v{~K;k6<3Oj^P=?d#j} z3pb|C&c-{dCtX1(>BBi>xmcmm{PzIIe5|t@xrb?E>mTa)yjS^G)PJ|$j$oMtUJB8# z-%OH&kRAJx+In3g#TRYf$a$3Wtr+GMXham{_j1@tKxv!xAiT2;ekOp_8yOax+ruO8 zSw3wxgjbD}-i{=sGU{#n1&-)D+OK>VF(o5`q)-_Oy!d=oR$7O#Oy;&-l5yDRd?BR0 zrYAmCz71P&{9^ zaMGOPjbv0W!x76X4P*u;9Ec%g0A)9BB%-@;U<_1R0M9%nCyy>Ou)HcV!7))d%1`hp zGBItVC4n$bm8mw|1gbf)qPyeM0~9b6@wi50NJ~uZl?IFVJIh9okF=a2DnmHP>!0~u z&7K(&8MHt-W-Fi!h$^3%V2&pP?GRc%W0;3U-g!2(ky7y0S++)J%m_(l`O(ui{$8Ci zciaLvMD4s1K{VEHCC}}P1sRC58YlT?8~$<5IZEZp!-;lB zrdEv%c@4W`jqn74uE%>yTf8J?Mq)HMUSu?VJYImD*b8kOS|phd3-4H8E=aH1T)@nm zmg851%rny7PxBVj36;?x@tJf)TrVaUbvav~i_{*p@(O&|%d{z$aN3~uLKS80Sde{y ztSzimnI3n|WffmGyIeIKcB}~Tc?vPVXvi_Znh}X?b$GKGXBA#GBF?4}W|8k%v_UQt z%-lSx3{;l#zUMQ0ibIm(+iUQ8@|2MTAdYHqHjBgd?u2J{Jes`kVQh)MD#x+BtasVj z@L@C_$S|Oscb2wQ^SK1HXY>Bwnip5WpISte1P*I=u+Yj~1&TFqvvr6y5RK>R6H{gA z?kleo*TA?hSiuyA(ODE?9`}jIHjw}C#ahsFpFnOFsI-T(IS>OTOJbfSj7}>Cz`2^^Ii129EgEsk&9>$>#ZQEnu0b`SXAy7pp@F@iipf zJgbz@aRmQ_hQ!!xJE_GJG~CKCD)7^({_@~{SwY(iTR5_X+JymA8|-mKelv8ehEsD& zXk^OyjAp56LhH++8HpuM&voX)GX1)u<>vgNtMZ}sJMalNyk$p8kGvIFpS)WsxLg4^G*TFXYRK_ zFCEQsJwMQ`z(%Nhl@tZ9)_r;t&#x+ayd7rhXkg76Vo0Yo!`aSp)gy|C zHsLJ=uC3;!ux}sgINA=@%p>POqR_?Dl`@0drTm|lSol2a3Jk^IBWiqVQN|1*?#hO9 z7=V6@JI%1jm3Vg_7d7bF;DpN8+kP18EE%#r>x0-YJ;(Q0+2Hi;)gHd(H+2Ib4S*AJi=`PiO1Z&ZoCLCr3b${{#^bC}9m z)?cl`(QEM0fzX`}ms|no7WFHBEWc4q8Xp2gTMm38IQ(;Cd|I1l;$D77g20Eah><%I z-6QG;V&TSfxsL*rCtQUpOs%y+-(lG+!Wqo;gE(}li(kfRr(#ad&;XVs#OMdyWv_&o zjGR`1c+Y&@--p`_=3bYcK>=>2x2}h?RxU6E4DUc|!%qga)!*hd`}m#flB3CnSZUmp zw?*M)nh~4 zs?(Hg(iguyOB-CeFOMrqg$)*=xs-K~KCRyjD=!xvzgK4ThcRCjTcrC$Q|;IK%x{e~ zks>P&WooGPex49M6#0CtVdSp1NMdJA(LtcgrsCe6a=Ll@X*9NANePAZ3Q?T3JNdJ^ zVYt)`r-db9z$%X}YUVh(6teG_c6+ofeu@F}t%f+Joii|dJMB}KjMQiuEpSC`lgj`~ z^CIRay0VGegGB?3N1hr{m9iONU!JjA@QbJ;N}_ zXLXyN9a2*=EAXyRhF;5a>ovaCfVK^u6=a7sp_YqhZo4@h#n~;$LRjPw9tFtWFpbu3=J}3#xZ`M5eWC8uv}qNxFq19$38vXa17r!~aPd?OHo5wd6?;DW5Zv z1W>~}ffII4L@{#PBdF8w()iHLo5Cw0d#}N;A+o#T4+*ftlu~8T^=UIl6sI7bwsccw z4B#Y6SphNzmlr#doz_^yXPa6LuC7IUu|_-+#^$0_7Ua13 z?sS~mcDuuIxm5cDnKh_7tSoZSfiiDTIKJLzT8?jOwI`v|_-L4He;ilrb3J60R>sr1 zH!hQbnr=g`nt(It77qsF?E4SPtdZS@3o8XFPSar$P0p*Hb8fskk&=WCKnfEYN$GPU_fhYMNoc0z~y)#jvj*G8X z(*rPzOeB1CJIOGo4fRlYg{}MfF9pfsJ#gZ^x|mJfWr60(%MMsa9oPe?tb&K+NQK{j z3R~A$b4ovjtOIj?*F+){I)+61g$`+i?Xo^#)01Rfk3&!Z))oda_B5yUri|KV2$WJOf-B85ZyZr2GoC`Bo#iu)*oyjhtni?MXH1^ zQoM%B!@K~(+wB}`axyUAyJUiI6(I3Ih6>zW50X37oBf(M^A%*j>A(mEODYG zEZstaXC~Mx08-uQ`7%&;{?<3}@sFSQ#-C6D{)&75y2t->hl2824*39oBe-Q&0}lE2;vplxBIQPrDarG%IW&*bafQubM{V(QKV^l{DX9@5rP z#>@O#Q_SI0^klj!9oelIYB(-%zBX;GrF;aUFpco5M26jCr%conBie98t}1;%2?0|U zDi1|%<5^)eFu3B}9EVNXu*zHK*7>1dQe2+Gay-`uegrnl=aYMk7JLf1(2yPMu#yf7 z9->@g?CS`Ap6Rbmfk3vd4IF?&5{I4)pZl(IdU;%Eq)isaGWV5vQ*`CGw=5UdE|aqJ ze<@#~A>@6E9chLwUHkelJrOdhB7k>M%}oto0#ve62$#iGv_$JaY_ao1?0_1M=Y7)f zW3o`wLk{^oZuE_EzS~^0-43n-ES>Nx54w#Rj`||kvJwkWas{shtjiHT(NEiKP`4+e zcmJRJ3@`V>>R{W5b0!yLB!?%c4mEWqZ~oz(S65Jq#59!5(Q>$2JDLUjZ0Wb|RUn6_ zTnDM`ww^vDJ21!0dih*?WxCok80Zzr{`u9bOFjnY9q%2(@D%$;>)j)5lRU#vPVJ5~ z*^&=9&;U3VZwxu2p%lX8nH{XQDLO;sd&i!5BqY}RsguJHGZ z(Gn-`Y4@Tf5;?U5SQP$`UHjl@kD3lW?)vFO$SVs3`708Oliezw6%V!jsbRzat#`kP zO>ezXmD%G3c&3aN;j!c29}*C~3!!Y^2G>x-K^CJxI}_ zDc=ytvn-wcOo_eW`nx6j#I|}1jDMmf-YqGp`O!=M({2ash}(6!KBUa`l3T@+`dZxu zv;i^qsxPQ^xl+#Je>4$`%m`U_>y`iLV~tWEJIfEW!f1!ASN|dh(}{w#Qahyo+FFfn zp9u_bAO+-YtTXQYT~=T!YPjmPh(Ar#R=yL zz+<~H&w=a(`z+Q41dIA-g9jJW>S=`Na^6}G`Ov-kWK@iZs2+DKSO#SdO0njKoaF~)P5dwR z*BQ1{q%4QpnJQsA=>$HOdXsdu*2Qs}v1*l;g0mvz!6*)f${Br|9)Mp6g_~hGRr!= z(tma<>rT4jIPMKuZVBN&Zz0QxNwygA)mEf9as0s-*&U!$p`N3;mLpI`^p%=_L-Rjg zzAGGQojhr_RKRVVIjT2{@sK>g_ROIuxTSJ({nEqL0M=XPN*XLkKf4IW&I@Mb9J1vN zH239YeVgSMtFh+zBMm1_AH5WcoKrm|7-M7Bf37N;hL{dv3ks93)TBxp=!D220e@C6FY>YM|JEi2tS4t(Gb;Z9EnFdbQy146s@?vm&twYm^I>%O zb9>s1tcFgyeF8t(l(7MKO$p$x8ECkl^A5oqqEVvte2hu&R&nr zj6}}@hAw3zSe+JN_*|pZ+@t-s79b+&LCJT{uhjGpgnm&*c#oxz8SD)~v^xH@n}Yv^`3G zQj^kh$Lm|MA?r&|B(Dnkj;!1<=jE8sD*Oi&066yZ2;h;NgFU(WT0C;lo(Iw=GvNzoZL& zbNcHr0ufB%D~s%2M@8Wf;ZzI$(Zn&)+voV49k0UylW58K0tbW1bdUP{@g5n#3j52U z*o+SJWFEzhztr|M4tqgAZF8C12?1Pf`%(4lL5wkMVI1&q=>LFf(U!8BXh!|%8uF#7 zA_rqPDkf)79&bIsP5y~q=tSsaS+7k1EGK{mnzDAl)Vf%dOq;@ub_u3I4poceDQBcC z>-SkARi$@K`lE8VWfcmmcy-9esAJyz3wI>T)v_j`tcZ0GFrz5vk8+oy76N z>j}lsGRgAZyN4dFl6+Oz4Op5(PMezqyF#slq(;zX@&NmaQ;H$r?U8}dny#?(I$0nRKI4A_y3%)Od;J!TPY^lGbC4?DIdGS02(fJDV7 zJHFs5fYdzotUB@E7T^@|u5`11eD`ndH4?l3W8|8cBWFDfd)b;A;`pQIXVcSCx(6_s z{D5!f_%TkX9!jIImRpxf+kodCmw31ri?PRri>-hY)yHINsI(5f%n-P1p{ z0eKzSBzaxfN3}~klx=T`$7`luWH+8NgWd5s#lC3xE2Y1t7BHq6+uyh3D_@Y#9Ng z?MonTzQJ%UVqx27=x}L$5LN`W$HjzkHaZ>k6`d#_3zw;EvcQD`;#VDTSE z|1dS}UsJcjmSvtodby^Ba>jo)W&kz`)bGXD94xjtDQ$Ofgu8NYe4&5=+<7K%^0=C# zbUt~Bc}Q(jX{`g+_nCAhMK*Fe)Vhg0N#EWgz2d!ojtUVbmRtEK2! z>L`3CtUm!Pv94J;95Ix>FC63<-cGKu=RRZ=8k$gr{@ttt@yz-!aH6356`SQhaI&fA za~S(MsDS;y-4@V_^IPjv7>>Gl1L0>qhCyc+PTnCk%S#783}tO!&BkB}K7BT!REPh=TUnU>0GRH00GQ6D@|GPa$@HSjGYn@Ct)xLYe`1;-}%Y@+Ce%tGR6{LWl z9mqx$O#j|^rD|>t%nLe^`{O@}&SafhUx8*;b$P|t0vW&-tJ8ZZ(A0_zrj6%zVul|I z5S~fhbw;Rk?D89m$STzMLQj;B#JK1{Ou_)KQZ4H-`$qwN`4My$o3D!$9VjfI_13@QE&sRWl04P#Ncz(F^0s3H zaCI_>LYYnk<@E~3w8qSQ1PybXralT$>BlwUssUrgH ztdh*EE607rjkC1ArAg@dsj%zh{J42L+VF&(z+Sez0Y;=msBDnD^!X8BLDl>rjZtVi zjP(a(ApRWK7l-!z2l{TEzFX)|L{qhhv@DlvLJnikCk_MXORw6qZTEX)?3mTt|-;_{$ zDd9q->vt@Q{8ZM?f@DoT_wk&*7+|AcJR^DFv$y1TPY@?1JJ=J^V*h9MYy;fN z{Di2*2l;uQ{-+-ElPntf{gNKvf4!pz9wJOks28%iTahidH44MNM=NQd)!(z39ix)M zuO(ho^fa7C5g3gxTrP*RXEPBrF@l@)_RqlZ6_2SYd>~Nd0>E{r*T< ztBZ7mBraMXl^Em6RI2DkbxeK+zw$@+yMgK+w33Txy_k=VLG(ZTvG{q+~Z*g?Impkh+1U$ z60<)Xn3A`)OsdHavxg5P>hBRNAIp`2gu21G3FN?}{a7@R@c6^r)^IOJ`dC>mf`*8h z9{4uN_bvA8zsItH>m-|^4S@?1i0(f8GlJUFpGPd}#f{+^F*DiS2jPi%eVcech&R)_ z>Kq0F@2)1^vm$7Z!0Yb&@~2Nsae0xD8TaoeKWD7sFW&SCIj&@QLDrY^)5y|WFNqu_ z;J5iQTUYS?%aQlD<;-|fkFiM&#<_ocTwSPxBhn1xsaG%3vZypq`Y#&QClB^ceEO%7 zG&-j&=I#cpKmW(v2=2)&{FJk#hnkPFl;zbdS9;;wlK}}bB7Yn<`q!I6hS6TDwL)|? z7_!mP*UoyRw^s=&WqLfYGp{T(sB!m%&X%!+^T|Cmb#SU6%UjaBxrDMn>oRthYt7b7 z^e`2v0#;)$U>tf~9VxcW&taFTWuIk_OoGdH;_>c=1u}lMLlX${8b?ib)|rFrcOJr1 zn>H=A{lV8kIv03q0tZL#gcl2`Yf3X5$kVRI9W+5lR?TNs;M%-AQ`rdm`1q7oXrX7u zBen*QPUiy~#EIz9w+2z-&&@oAk4pU$OXF z9aj90LNRqdiEpu0d5%XU51(yi?96jmcVdw3ayV)py(nps5`~*y$>?6icB|o4S{6Sw@VQ+a72+>tAm+Qj^PGNkOA3fx<_sdHP?2_!n{h^gS5I!MxvMzy z^sK<5Po@6P6T7Y-+6@IlrZ7r|ZQD-{h%ybEi^uq@NgNL=|giaw% z{D*j?me+WfhlsO~y3l}qo0SG5kGulvb*p_1D1-S_Z3|^9gD}rY?6VJgrRz8I`fAR* zuy&Uwuj3N>0UzTw7`>jY*UMV@e1R7pH>dGOsyqC1{xzW#FYGx^zEifc2^f~ttK0N@ za^L@z&V9o#uNQRwoo~Rn)7kf_aJ?i6ayfaARr{#Jcy~`=(J42?={~27&1KZFz-4Wa z&s@vf<|RweoVj?t?zyB|)4Ckgrg-O}9(UbWCNPKb_i=gefNcFcblK>dxOB0e_1seS zeaGq=bNf9oKu44xVS1b!;3~*DWbwhENx+)>U~z%_UO34nMo=9`4V!pcLnI2;G#$ES zI3VrjDA9rl!K}NI!^>YejXR_iuY4OOdRF~m_&7lCr15g^{-yUp``~lm;M_he&yzT- zpICZY2Z6&|I>BEpb)1&%zTFm%uoE9wZY3Y@d7jKSmW$}wlW^;f*-XOj72(X0V3X4> z+kZOlDraoTu~$1<=I|e`^ltrhut3JILIw}8w(TJq5aHo`PbtuJ%3N6p8o0pJYAWL> zTe_Y|YZsVbEA!EpaA@jrYJ2c=IErJ6L16j!^IUtQN+1j9Giqt=;Y)#AoQJhVT)Utk z6tr7WYS}n^#;p4@*><{*=TYu)U7@6l$|}s#)c)3_9lz;=hXrGpr^iandPT|1;M}T5 zjrQ`{B_5mZ>ju55E<0`zVlbqsv}xOe&rDRn)ssI5-NpBYriRhm z+PMvq+t?WF=Dm_I_2|JuhsfsB{g_VAu3P~b*M6*NKw(F+xN-Zze#T^Lmc?A+#L}#OtIvoeeW|PqwL|XM|y}EvE)q+ z=rqC=d@A=rb-Qvu58=Px^IEgw({nGKi#Wv>C4}o0&5EAa2H-F6aJYj8X{#u=| zbt!b;J3>^9iX@nY3IMVsUW@N<<|h300?Ax_b^`rm57U=hoq-i|+@MDPQ@u0Z-FBiF zyOqtGnDoglq$XLwT6Hs6FFB-2tO|Eh@KcCc>&B7sN^3rm1jx?fh$KDfp{j(?_dXec zy~RlO*tp8&a^@vBH9Y(s+z2fVPo{2t&+lcc>hO0qLiH%!_8mOgLrVksy-(Ei5O2YTq@+VZhS=~2uDf331JI>%*J(JLF<%HON!Ev9d z>vJx|U#8_{MaFDd`ki>(sJ<_!G|9lX_zDVD)xY#+LpB@3BTwp~jo?r5R7*LIrOgg; zRQ@R4-w3>Ol19AZ(xj?29KNG>zx8HYcH4ywsT3 zfbLt#J@``16_EYt?zN})^Ho#2r5~ehko{#eMMYr~dCDB^V5$3(LVros7b;)zjq1Wc zv@d5toP_9T-QB%fD^EjNf7a|^NJIC7Ctf59vHS(3>@$aFLd}AX4xb^=(-u>UO ze4Wzv+Uu?sOzFL&la|^>`0;I@M0rU|W3AWQoOMaCV^UGlY=oZW0eFs4;q{b2dxxTK zpx~!nX9tqK^9;A5nqsRoIhOt0mJ>8I#s}!1e>{2q=w}ZmiFWN#ut!aW=g6*|PWBrc zU&2k9-j3ETJ-MLEcaiDIE!kNF4ni{*$D!9mXm+g0>}Vg?=ce1_d2Otd(&3)V^S1ZU zBw3&O(j-iN(ckW_=CN)#Iqpg_*Eey#Q2MeMept_?!pGI=k+KtCeZc58TVlCG>T*#< zShr2oI@H(zmT>TgAV*}ExJEcc*UehQV86XnCZydhchc^!#?DzHtl?U?=GtU6)r+uD z&(4RhrfT(Og`V@*c(5KLKe}|zm2iD_Ml){#_**R)NWBeam*LQdDViixJV=T}XlDQ7 zDBtsIU7n0e^S#6J{Vef=W#aoEcTE$EEdU`oorP9 zsl#alE?bzSur~nh+q(VegI~S99BK%D=}H7Kv2lI9Yx8H(e2Z1~f3WwSQB8f{x-b@O z6bmBKMO36qjg$ydReJBe1PB4Cp#?+)1*8i|Z_+yZNkm&R7K=RCXRynHMaJtHhY?~>H?DXLg;xn#Mh6o`Zg1DXeTYVL0geNdX(^< zAEZ>PT%ui^{wb;7xZc|fs+guf!anC_)~mewyNe1m)~HYtH(0#a6I~{v_cumYZ;9^6 zuVQv;J&~#wRy*gdb5_+f@g%J-v(Bl&d0yHnZVw~E{}peD+f8_(V?I2y_+_XH4NcQY zG~TMJ!e}FT>hE2#T${hBbAaX<)hU?@ZXXg#EOXF}ahlI9;H4cuS%DYwajc79DY55h zk_zHYGWyvixT0|BN1Hqu7{94M`dIvmAO|5y$!MkcEMs^i{<_MF$t;h8f}2KH$-c+F zl8~V;Uno-?bgIDe&E8*~Ee|y4W`WyT&0bpe)_^kQ*!KpQuGyLS3}j1ZcdnV&pH{;; z4m2s`tUn|SwX=Iv8b>2!tAhB|=Ueot*OmO0#MW!HTr+-TEC z`4oF|YWkD$(l5w{`4`pZs38e0(X6c&kOUpS?JNa z_&9%>#hF+$)XMD~)TK4qx#am?gC@(FjAkc2Y+i}y7244r9VJ?NrD%`iRlNiMN_XX^ zB|FZJF0o>xX7B>D{1-5>IF=V<&B28uWY1m-T=i+t5R!nFQHRTqk?GqWyw&x^A0|5x z$+Bp#kV~2B>Ct#OovnSkzwTV%p~hSq_ZMz811W}JLroqk$JTD4egD44&knGv+|HoY zeIVf+a@IPo?`-P_551=2=ADO+LG6e{GW2W>-fQhHh_3cGfSr}>mqH;Oyrl{+%&^+* zH+}&_CWjbVxhIPJwTdHQY&|?~|2ZB}Hj&`eP$}YLsVC?m%rl(}>@j`Ok*dRunzUKNs z(y|7cUaQjFplfYg#j<7+(-@cjNupqC4qYYmIy$-8Q;@P>l^N%vrrIPOcG)7NrTmrQI`;++i zbt5?P^YiksCR?|a@YO_;|F?Rc+jXzkH7IsPJjU{CQ0V5U=ijrYuM=Bqwf%@YDup*w zEC|yA%Q90Xe)Di8GBO%6t>+yX9e6O~^tw>o^W|H=H8*^m8q zjk)CzJs1>46VvN4OSfHCU!!AbD z`U2#XulTwljqymLPwVj7nLA{!|01 z6(oMMkb6qzD4F4?a>o75z--klyGq`5-KN1s`5fH$_IKUGj?~-Rj0wG8Kp9 zXu@j71+wSC0KR$EcY2lINO5;1iHz)7<+I>(vhh_I5W@g8BMX4G{)@q#|4lAbuNpu} z>r;I>u#fjCNWSHzWsNm(vo@uEIAIX^?owlanc??)HkdMmx($3r(1irwL}fStqq7kM(1%CW4sNo(}XI4f|C z=ckyHq}4sOxZn(9Nc9Xz+z;^98#n3W@45S#jUYPw$Q#=~2c6pA> zw}y*Hc|(_#W_RT13*Px#Kw$f~sv!Ur3G!5birzSfctRAv3nwL#2`4sq9C?_OpSNkm zh7jktUTxupyTN4jnp=!(j71yz>0m8Y=ijQF7w;SGphZP*?ooZQv$OW;J*qK4oCIYr zB?yDIaFX*9oYXIdq>9T_GqcCWl|L}&&rt7{t=-!)nr*44ya5s=@{iU_&z?iaQip#* z$8EW@{0GSlPx&vdy%9m?DNt@P{C!~`b)70yrL<0>q0FA8E{2k%JD-`1&}jbd3;Uy0 zM!pjAWh}dj{qba?pc~s*ap{TWt4JAd=Z6pujYlj=(=e(Cxta26CrwBOynpDGB$?Ru z_W-$01Y}g`!@Y5zGEnE(T2bC(*;(j}{1lv++?1!o4c#uqreCzs8I?+3O=DW9&nL`8 z=#&oEzozuyyVm@YX_S8dqjR3|bvj~5gkG?R*xXg{^kaWt?~sL($KUg3Civ?hf)nK- ziENHSlL!o->@@Wx1C@zvb~(mgnot~g&y9A%A5!*6RZ9_nF@5ERCkrG&)zd_rIF4v+ z2mRu3-3i{keD*DG;w8f40wJ=4DWZ3od|ezG*v+M*1>&|2=u6;GBkEGXQONb~febbY zjk2C56&hTQq~g!-oUEswZh6nVsm%hNG7utVgK}E~hn|=}i<;J2)8wA;_)GXO%eEc; ze{%tPA64k9Z1IOg3T%p!umtsewQHH&;|&1R614ooG!EgLm25!e45Z(-nEN&B5@4I$ zx$ik#_tV2X{#TklN5Jpt*ZR) zB>ouY>1d9StI3-ZA%d9=Vgc5fjiqgDMla>;&af) z_e2s&z!ql4iTFC?Zx)%j)k~|VrxiLP`DAs|nd|8uOI|6cK$f>@vsaJcAdtut{qpKU z)Y-bl8Si{cO>mk_LZ^>r`Xb#f=%zKk!;@D#zw*$eC{5m^Q+jP{@%zB7nj~!-Byo*! zcSB|+{$r4)oJNh<@xH1ky3g?JHf2J&u_$ruU;j`h)whP(RIaQ z24RB5+GWxZIQA#0+|_3aUlwl&-;(uJ+FYU7xL);F-V*|sSt?#tED@|ANsQfQhg)Pc zYyN|$FIYa)Wc7Q1)%kETDLHG@CL9hiYbpvbFvG(vz;7@=Jy;z(PY@pc6nP)ZJFrf! znYCrGc=YU2*_8N*!2Fm^4RO>3@ua$G810b0sOhdnfu)ABDhuYv|6vdLoX%M9P-WCv z7US@1CPgtp=QQ!gyF2Xf%8VVhE5%VfpPBvoXY*4kGwpRnk9B0OL|@D^Gv!Wws-CVc zKN_nnS!&D9V;Vh=gO4iYlW}EI4mkXo1aO7h(<*b-%fEU4{0luN?Sy&wbb*LgoxG(d z$SFPHqxAGTcbIKNgr11l%M=mw1_22X&r?m>B$yFD#aqaJfA8Xx4}Eq9b#3$!TE(WL zkBzmQva!(X_cZ&*J>ns6gBk*x_-HDQg7&Vtq_rTEHoIdSIz0Ei4bnWAL-RBGdcLTL zyr(gJG---KA_K!I<&u$qcmF|Y#v+4;=6W^bdZ6%_;R;@s+NAYkqn6gaqS~XXA8;Rr zx-zTAM&7*Il3hpiwW1@WYl^ahD!8neoNe&{Jt9X}-I$Io>^Qo_>FgE*x8W zhaJ>Q)93g1;H}Bd_U}Wf3`gGWuT9?AQiS@-3p;2+j9I4k z`o3LlT71x#6j?R%A}SKn=AI{+26l2lcvm_(Se~SS%FlskjxZO4Nok5lOZ?5T z*1m;5a_^J~Y(Hq%6zaO@UI!@ge-DVh{Vp}F&+qmuk zao%G6Vzr|heOE%!^Lapkk}juj0ZJ(X%2z;u&L!6|nnz?p6#5gd!Rl-)@e-wBID89B z?m{~s{l%VM+l`;jHhRh`vs-x`MOPanHmk&mKwaV zPa~38zv3_#t3%OSjP@tQsm@(dRk=L07%2IKdW_e!q6~g0IY+ls>I>VJ`wrPrCaD*k zG2Ys~VzW`tOS<=|Kim6cm!4e&jiuT&dvFx8p!%xb+88a`{i81$@n-bcJWXPg+9K@* zhQKI%gFD+K(VNZvGwNkelAE$8Z8TmRx4nV3tyoo{6YeTZ;nJ7cf<7xd|7okoq0_N(=!-fPV2U&9V=;2 z>u)uRKJf|T(Qjk+13L^og)0imQng-o3M%3N3$boja>NirR5_^3oC^%Xu`petDH3Fg z8B3n^X_m>IrN78)uJVS@xN0lcXS-{0T0x!7n{7Pe-2) z+T9!ZC8Waq<@f6CleW39lezMK^mm`@+?Lkk5@VS^JUSF7@-!-cT}WPsl4= z2CbJJ<&BT4sIEOwqdn<0ByC+UWDBDzpUA zCDe+CpJVArHM1~8L^tW1UqCwRmS*tG*yGNT_egE_aYh^eM30l`!x%@A{z}XV`c|3u zpDY@MJ@Fuv!roSaW3=$Zcs=J)>R5_=vF);{2yFK==f1c;GbbSHD&;eyZm2Fu$idSxyM2;V~I+cAEb zu$kKaO&xu>cC|kf%m@v+o^&wHd}1^g{x;wVwz0IfbR%Nzrr0>oy5rKifw^*2EY(CU zex+~8x1Cfh=j0ktJ;l2TO)NtQ3ARN^I6nD$miDbxQ5eNbRGBlDidy5?PrR+SqO-Cp8Vrg7_0TBkO#A?J~ik4cDA0LH?xBn zmuj#Cxo$*@tm?c-f@vP=gCv~gau>c1mCGxXf@05~GRsL{Zb};Al0lS*M-sYkU=VpZ z;5C;Eq$}3ScAfihp9|mY0BuXWwkRH@2+UR6FJX>k`2!0NeO(Hgx)Tk4UQ#J5e}CAM z*_07qA0(^2>Pk<(kwODo|U*Vn`3ab|CBO&Ur0k2H8& z>_4?WxfZmda-3Y>$2Sk7*#k?hGRA?zi#P-F31bZ4i~`rb(L;*J;v{ z?;zyyDOX&dnO>RW^t)YARbVim{gIdYoBcuP>ixhg@3ewXBx3bwl&Bs7s>8e0O2p7uDPrA9QZ*7{{Jqf;l`R9 zAw0HFjiiP_Cuq4-lW+5@K;zQ|+$CL4VD;Rqb)>PW0+?>pR?x3OtX}Qbr-N5D)r+4| z%o~@Cwxperdks6+9M>!hVaZ1RcEvsvLV5j0I2L`jrKZ$r1q)xfmT;BDTb0ekDQyZ} zW7eH&o%hQHM2W|Gw46mRwYyuzA!9q@#>+ez1?gWHQz<^ zHa}AmTBu)iRBD-n4BU5gri;q=BiBiVZBdzs=>ENN25;8FwRw#De*@Yup-`*q>!C!1wwoaS*pBEhIyq{7RHQp4 zz`{w9#%xre>)w#6!Jc7{s!X(N)FA=U1vzPs_cWn~K5dENjfQ@NR1uV+Tab>V`0 zuu(-#zC9e<(^dHzo2EjH{wxH0@b;=G(XX#78XW%+uUqJQ^wRTifOl$>OEROMcV`NB z`}X2`u{8pFvpyYwp-x&mJvu17eBD*(^6c4WMwvH7-HrM;DRprh&BZC`4H(uE*r7Zg zi;Q4Gus?Tep4M`iy!%h6h7zAVj+^yWJVCvMy~yvY<7M%u(Tx}fl~YD^WJA+(iwK-< z?$Bu^#%eD77+=6(sDAjyp*e(lW2rJt<+~EMlx1!HtT9{KOD|EgvMLLS7__hPG)Z>u z1df&a@`+i<>S!4?*}s*gyFLXn3HrYOb4N6$R_}YwD_gO^!n=V^<`I#^@GN}DO#V#i zFGCdgQi~~iHTn)JRK96ZcEp|qSym8PW+jaE>@I!!?OvUy>5K%IaByw>!W1g#Dort& zYT@>7h9+~M$zwHyCjGPFThe-xP{%4a*@@7XEY?VP;CY~xCYvsKjgJPLWYo&uE2!wO zcl>rmbWP`^_voiCM--CcDCMf9b3C4L0_9cQcpTAx(re67I%`5fXzodmn-3#l1kun` zdh(67`iaB)J9_S8dvh5^g$%_;t{BOf49S4%$ZBVgC%ncn2v-ZUnrhT6)pa~40dL4L zK8<2rH&!=mEE{mBPA@=T;8MrUEHyPdX4EsFZAjQqTNJNot#XvfD!`1Eew9vJbw%=z zt+;)Z6U_6@=Q1=Yy`3*(YbnVKAZ+JShbd|yX1fCj%(|vbV@3X5@Lj{3t zvVGH;lWdGyi(({-Hq2~^-A?dwin+Go&W|6!orQ!dfLKVf3Bd@A%wMY8dMJtLFrmPx zi9^$laGc{F)S+#bQ*RUoCoheqM}#+KXn`V+5_hdVb2qOr+odoYzb=gYA%P#<^LFX! zXSpnVTRQ4e#B3Hv$fd@Or3)Y-S(lX&oqeWv2zdE#=+sxSq<$c9vMvbdePIDM!&bg< z<2GwwX4{BeOw2}@*dDv$xV+P;aa?IY1V+wk5%q5_U}Y2Ir4x7Gv%egMcd?}|c+zdX{?0?!(}>TTHUB=jZd%JZHC9o`e< z9=*7J@^IR&NJK_~3PHuaQkZh3jO=mfNh7z!M{VVK7k&m4JKRp2xi>!f^Il34=j~DYs!`e%ejS@nQ=zGQwpS0pZr254>>QJj zwtTZCD|x;O-aFf(!=FT8hNVsk#miXRvI`#|wx77xy9&5EK9j2;T`?LvImvWwrkvfL zj6J9jp2M{C2qSEzc-&-vZ1w5{`@;6{x&!W$xPtxWfKwuQfBK8XqTt%5@fS~H z!<@J`R1MYk4YMoT!Nm@pycE{#jvgxLqB_4k*vjjl$bMB@^^c&a#_19>PDQOZ|#ue;ybaHQU;_XTZ_{>$z#dQYlt zby;Xy)yt(WgB3apdVnmfb_3=ixH%O1ObAl-lszz{v=BK6_ReQs70qDSGAgp< z4=^h9JwX)Fm+s_33?241#Vfh33&#zRk~9u(%dcnLvTgYMXC8{zsjJ)_pUmsz5iJrD zE;=3O%1B%cP>mM2Q%Pe`x^7y2!_1I$6}>7l6|?rv7#sOX@M>>fh`musV7CK(ImbbL zdTrXBwDaP(bI>iQrUmsgyMEXmC z=ymo_rD*h~KXOLx=*!wQ#|RxrM}ErXcXmMJ6~sUe>qDp{3=^Wd0)ObVzLqL>0@v!(a5JS_n za>ac6ZQ``SQM=AX&>mC8V5iAzu3JVBkdZGuu$0bY@MZ8y%GjeDw01owmJvG*_1&X~ z@9Gn?R}@Q?pZTXQg;&TAZHcYpTQ08FKhBP{C|OevDat{NZoTr+8wcth=)xh>e=jnPH|Aidb!RY>HR`mH6vf^E~dT*a#^MYBqxUvQ>QC| zH{xaRdOg3?R&h@A-b9!kbe`jTLIFXvt{|o+GH^-CDL3JF9Y=8paa$d9i*)4sFRty# zG{s;s^xl5N!IgYQ^w#yr^^{Kz2OOIU-+XZL5sb8ba}~Pe6qJRRU^cM4PjO~zj#RXa zhfTprIR_ePmkih%B?ibkP03x(;pu)yv z))#zKm6!xz>76dQ#}a zUc4MO(NU0~q2WwqKsx}jQC;z;%6kDp#W!p%IbluvdMVvt@|iu}juug|Klk>bj1Hc@ zXM%%?YeI+z-lc9xt{g)NwQeN1bC0msR`U3b90$L$9ONypked!YiY7RQmM%rF$LO)% zpqigEbqxH~hsgJBGU{-l_Z&tU-fqK8*_Y0G&u9F&$zk|`mG}q-n}n7y-$>MkXk-0pp_y$!O&!FS^s3eLwlk1wo^D4`q4vgO zjZ-kVnI!qb77uLx(kZIM`I{9Y_W6X{+Mh3?YAvy_h2u`9@S{5xwx>RBwin$UnNK!r zP{{~gUo}M&Xxm+CvE6Aal??R&p5K#G0!(6)twNKtTsqc9hn}!Q+qpNGz)FZvJ$>KIn~Q|hm0#FIqQ2Jr{fLh$I~uKurrMO zG1T)Ztq8ovslkJTtl(O!nq=o)YO=>jXX{7Zk1l*ksgEL%4k2XHu7I>mU2wa`qgMK{ zi+^XSoK(_9vixi3!ZI?l*8=|}7Kdd2-|tb_Z4;Q#H8Yuh@paWi!l|&d*~X~rpVZxX z(Dk$<5V!J=>?za{8pV~xrEMaMS>@c@Zzkfky{6;C_~3W)Rgm< zB!_O%$<9*gs+@Qb^`802*F6F9jgK5viXN4ww5hLNBtly03T{Mme%5-ms^)tm;)K&S z6v)5w0Yp#rKhWA?aP3d}aC+XX33u8xoe-aM6kf9W(boYG+pG%rk~vMjo!+J zR_0;~z;+J;b(y_?VhQPv1|&YeSinE9QWUjs22M4&Mn-nu8Au%&xeZPo>e`-$Mb>AT zjCZZghd2#4@d;7Eaa{D5r7Bu?3eQ1m@rHi0d&tS^aalxvIu>H{;zf?l@}1#;0KQWv zKEcdHw*sU=DQlRv?y!+<@7rv;|Y$KJu-9L1aLZN`XMxLiM&uM&U=#?BBBEV2P zsc}%Pxj|Gf?NcHEUFGRSex45Bp7UFy$B5{X?Bdx%zml(H8F7-4scRhE`So467_qT( zFW}ZnXx8Y7rU`>mcql`TSy76~k1#0I)~>wZM`nWheX@62x7ddkBNVaP38N|R33Awho1B1MjKCjU3dC&i<3W!>sbfP{gbj$(&bBI6F%rE341i9+aDER zf0W(sfkuztoZ{a^lUB+uW7KKNNr^TA7i1A{+<7t*^C|U2LYq92%x-JYel`shq5=B{ z>M~^*%-49%B|bNKcxJ)~JfcbfjZgzpwK_;aJ<31s1Y$Dn8Q>?{nCo0@XR2>feEJpB zqzBj)3h^p$4QztG+?h_EX##Y*=oE(~aq^_M~2K z$uUbFcAfKdfyu%ecl^|}TI(C2+hZmLto>cbXbu6JuX7?(qo$3SOz8&F zWldF+nTAdFi*NO;HZOuivHVE7i5X-g;+sV|ut?AZ{d=YS+C{x9%0GkBlv*bT9xnC| z&7eTA)dDi_t+0v8E+xP+UCDc^{K}zA3`8(EVQ2TzN&qI`t>Ax@71EmLI$Scc-E)EI zf3?kB{|_S5|8*zpWvFT}0N?dTYSfQ-IzfC?vzRb-WKC<6b|vTJF%RSRuMKnwcoPDIsqpx80OQDY8I(H@J-akSn8w7BG)^*^&88Y4j$Ht z8h9nLP}Ie?H3*Lf?`m}B%0$^O2A4;UXN;c~BNsazXWB+2$BMW0(V7SciRbEnfkjAr zQAZ`aJm49z4WJK#@2}5Q4es>C7O#X}w>VdMwGsi!iB>l4PT2JUVXr~!h*^L}L^H$% z_^piexB3Fa16}*mjbN?6o-d z{M+z;1IpFSU7}N%c1G=o`IL#GceFjT{hatY^B{5hb=xrwamg}wihkM3%I&P`y8rdd z&w)$ZHbZsX3P ztc+hVTKlJLs+^aH;vH7ruhav)+v<~l1ZVx+dYCYko7Q~z^US*luWLwTD(PL5gk6&u zOANdCdWX;EEa)r^PF!HAFG(OaF|K_8D230?Q_+{&kRST^u)t-FJ4-l8BCs5n@#F@@r1gL=`InS8g6c!@3llGT=p*V+DcREJ;k z;VQ!sid~&Xzb8bOC>-nDEli%q`Xo%wIamuCWavd-4Ks z8bHc+p&noZx1<#Isr&1*rw}d~5~>D&KdianGhxoG26-YBDlD2tisDx`qd>F#IboTH zDoS!^CzCV{498COKK{eSs_Hc%d~Ch8vw4Y%TfvC%T5-?~D4Ovn`}V2LP2oZ!Wp%%1 zCoveUJ7rTmJ(kRw!n6PW)Hc88oOwN|3{SpWiONys(a=FUz2zveKc2S!ZkyP@7hCT< zJ^E;Uss`<3iiQC*&JZD&kRM*Uc9XM5mPQ+tHYCn~(xT25Rhi)9 z$%YHi)2yzq&9%8Y@3B}n>=^=7IJm)u$%j#|jd>khj6PRP?8gtCfL%Abj*6Du)uKa# zr6n(}^@!xuKM|tx`40_6vGjP-m9!Kx@b@fVxSN{ileNzY9)ctFQoomG0mAJFf-3K2 zYFaI&lF}bU*NcG;U{oJLBKOeieq&-K0k73o#;Rb5d^@y|TZNM`Uk*Ky=`Rn5!xxM3 zB3m}W_LSi&*VndhKJ(PP)$xx1{DGy*4gXqy)X%y1OFyStc8%ePRmN$4ZHePH#>rZk z>%){wxP$mc5D9NOx@uAmd4l-7nXgR)=&Ld<-+wd8DziG#gxqyF4Wq_3ekq~nHJMa- zi>l?Dr2dU_h|wlDDMlVuXc+ty}*NRT}-xKa>o`O zT)YSvW+(BUph3gDiWDHKc4UoAb-h(@|I_nVmx*I1gU3n6G~OFjS!}ApNUHKxms?zO zocS)>SWdqRhdB=TJ^g*^)Lds`(q|n`rR*L@&XvGGgf#}FNS^KkT!~>WwI2qVriEs> zWNH)9+w;n2e8B_3AEJr<-NZbcJl(mh>xUE-s`%$@8g(sgJu0hUf*>#7xIBBNC$ zh7N+2rYy}z&$_eAqL=SGloC7MZ_0Qt##eYe#@$Gom(_^4r7>`{sgEu3#C`-LWlE`8 zwG4Gyl6CN)v9ZbF>Ce%?*T8~c+X?ls*KH|3eY8y-_~YQ~pt=kw3oWmpCLtlkR+lvX zXzqfCo}7sZ$2@20kzu>~uJ5u=eZlYH88<{)8$&B@>v;I?VT}b89@kkrt~;5SuzUAN zWyn&rks%Tgau1%Z_kB{Ksi#ofvSdF=k?Y4C(Oq%)kX^<}xH3NZ{UKhR)v?3zwQywp zxXwZkUp6FF9B@2I3`s^pKIYAm_pzb|SD%QK=j;SBL(3Vaw#2{C5k|yH1@C&6~YLU&6`zp2U_FK>tKbclJZ|;WnWD28m4ZyP%sY#77 zqG0Lo8xB7)w!S^1@3Z_e)P*9)i{RsWbTjf4Q@i8wDaMQG3KsGs8}FTy%IfTY_B5A% zN;inLZyTNl<)!{+_6WQl0)%h?S>&DLd6L{OJDE|8T=kgQmOd+Kr`U`>awUQ&Xho?iiP7!Py_L9TbUs&B>nL+xw`*;5E4Y z^sf0M5p8<#oI-ny!^od25v*sLq(WM&!;tJ8;#@=jg4A6*@d|mCJfGe23ni=;GZQn- zdGE|b_}-2d)4S9q(Yh>vRBY)Yr`q4QD|Lu?^H(~yL&m)b*FRf}%k5_2%v3ixw2+Tq z*Ebg{Mg9!Xx^w>{VAo`k_=9s}5{ zu^-lNsmAqa&#`;J);V_1`ug)zKR5PU&3eO1sgBudk019dsz7uz9=Vtx69602b2Mlu zV3qE=0u~U7FsM3%)s-(yB6)OIvLoEfs8YKb(?`FGEROF*lmR5!?Pg-?H_F$wGI;PW z*zyYq-2_8 z0RjwK+W1Be^MOAtd~s(xp+Y6+1OBH5`YYiO0Vh5=_W$I}KkW%$D}O8JXsm-)ZX@7s z4S)23js)yKY#BXUB*F_F2wy)7HXN$du1260AbCkxju~FR?6b@&@qvC%GxU zAw@=Xx`ZwIt#s@N7Fk?_nz~*yhS1Tt52;KND=eC50Tp^>BSm~Kf$H;`9(OjB0_r_| z0~3ia-kd_GMFW}?7^a?;^kK^@HfgVfr{z>HFraHah57qbt&K<62`X0~@wV<-8)exq z>YMv@D?UXriXa-DD>z?CW=qQss%JOJu!=H`+fgk>iZqz;J$);X=NS;t!L>k z?e<^|d?K$68x5IXR2vWFW#FosN}U5wct7PufK^i7D>fuYtK`USo?EWg%N1h4btlGm zQg^taV(M`Fo#R$CNZ!#H?U_U+Fod)Y)M{LlZG?EZYA~kIm37BI@(Un3rX^IS*IxNd zZUvOULnWF#dUsq>m&IMDrgu$5cK7aKSp7~MY;k2yyZDhSoe}5wRSuZ~&c*E2vDv*P zyc<#3PXAlVyB_rz6C8YXsMdC!&mZ^9NOqi<7-zdQN=dr_JHw%dQX?KXbTb>{!g1^nN_RQ>mx{@-uu|kma_ngT=Z_cvk$U?-u_G^ze5B^=@!#;ye#P`VQ7^3Uz8XxDJf;#{$^eP2ZWwY4 zqD(`V{@6C11Lsot7tnazGk zR?%d5C$FDZFnj#?>ZU0;`wAi5t7T@V+UsrY!GctJ!{$YoepW`%aiI$?>0;r7cdCI* zuBOfX4bYF?i=@wIgu#eIy<5DOfTCXyWTTO)T2Z}x(HBB@W@;K&qF8SydZZrrNm{l0 zUHPWaj{CHwe_qsOp-R3wbK29`h@V($ISCp*qvQL1HEW zPU<%bux{FtT&#H_i(>+YTJTm)lHZ8{%J3O(SoB$(6}rF2-F8m(Uo^>NJvBrAVq7t6 zYF?Mfc<2LEU0V$Lr^!qA={vg26*3?61@g6peC#``o1O6q|J&4inG7g;QRQA%&^)2< z8FhGUQF+|@Sr%$_*)ZjEdNWB08Q_f}@#VB$AbaQXIz&M5YYbZirQ^BMYa<3Eu{5zW zcZTK4g8}IV7nLhQg5P2SsocceZ%acDX8m{a2uX}m-QOTU8u4~lw89lp!G@TZkN@wfnR)Q>tB3WA3 zX`!Vwiw!d_~QjH^3Xp^^wxo`cIG-aEq@pcSQpik8cKe z?&;7K%^;;r5S@v>a!*3|80kx#>kgCxc4BHjG#=p85Wz#h13tK~3;ZK6T^eiszU{R- z<4(|X6hL1-2Yi-J>~*`E5nowNq8AZtJRz4b3z!8-?eTFFN$LBn;fyaN5WS#U{qp6! z057J^v-+JYY%;c%)+^DJ0Vo6-^(TCp6mU|ufg_PvozK5d9aKj3#@8S~?i&Lnj$7dY4Cr2sVWfbxQS;gWwadunn`CHfTL$_r!c>0c8msFGN- zkp8b_RWP@J%bwo6xF)cTo+G?y{-s1dAar_CPHgZVE`3b8z6#0k{&gIle{Rta=G43Q zy?fhNoBxo^riBtQkL=S1!@~13&PK`upo2-L2sO`#ibE8GOt(TC{tOY1((K0^0+II& z%)oy8`Nh*`13spai2-%1@O2xpgOf?ZpEy6jY-8=$cJFIQQJ;{?aer+@4zo||)y8jb zDF6Ci@jH&Hxv4eX%7oO-=m7ty`pb)$EpOE1twu^DRQh-D`G>9s9I!8>^9SscOPoz& zY)(ODKu0@n{(D`#^(!@=!^{*^+4(zdE-*5!60jFn`yZiB|0Cz})AhgDkkgZiK)R^r z?W5O+OOyF}DpJmGW{vWj2-`w0wg-fu{OMdbJZ@Z;lBWlPX$7FT4_U`Y!pY_kSb}iM|e&meQ6*K|AjLH>VcBG3E+`&eJNj`(l?`i0HWZIRN{r#ufD-n|hx z?h_~_P*1t+M6inM*)C;B`R=0J)XIIZeWM>lVwv|i>u%I#Ple~-xclLs6m*xLN43 zwyA_)n>_WL$KnH;=4sjZ|D!+LcaPDAI{gm~m()WiSvbO*ebG7g8ZzbvFAPLZX`X+l%=t z&c0ZUY!5c_{XactU~j}$>pvogWvjEDrvTDQeY@{= z{L|)tx?un=e&4)U3F8+4Z1Xg3g_z!0@>eDM@{;B9&m7bEbA0eGZ+d95)7b&QJ7DZK zNdMnPHx5KCBCcc6IC72cY`Fn1PzIMWL(`k9VRBy8f{XY}G>!24?6 z$7o%^eu;&C|Jsr)S=yX8By6xx2tPBxLk(E|1zofK_6bZ#lm24@MND`s#b@s*N)PKF zZt433^^CAAv)Lxcq@ZV$ciX7XQb|F(H&<5V2hr|muTtBx-#WM_ypgv`S4x2;9hxZ8&e7Oz(70Y zwgM!)cN$k}8kIi-&C<$U;SiLI2@IpuvmSaVOBcBCN653#`>&1*q4}%SVd)WFGowQU zap3M=;-}sL5TB${s&{f`@kO$CnsKdO0*jWEJH{OB(}Im@2>_ z6`m*kHzdO=l1v;yGP~34HRHF$`FBldrHM|5!+)#5+!$E%za%qNNLVFD2f>8~X$apZ zyauP+uJWz2uBj&7$o!b$wZD~k=N~fW5WK(SrlS*Aq#XB419)Z+ZqkeP&eu6qY3y|{ zascl$**kqf$AlInQ=q7+l&djtfb7%bR$F>WJ(VQwy^*Zef8t7>^ZzpFUwCdGM#J&7 z9hgL9a170Ipc~=eGWy=4?lQM`PF8EXEPx5?bMg8KI>mzbEu{I9mcbtpLiEe8EaF(bIF!8 z$kqC6bH-kaqxsLr*5hx?z{%*xtyc7pdetXSwXO{6Ok$T}rBa64nDewQ7AgPXX|<)5JnP)~NNMpk z&t3`&iDdH4anQuH)1^z;YsLeuk*PlBP)+q)na_&jP@NJ2Rkillkr|%Egk~XQc85W@ z=ldPqZiC_{{i~@j?*m@@omL=anwifbO7^2!hIpOB)Y41?BqlUnr-M$KLXVPn&Smo; z6r}p~f2`=rud_x|>~c>%IT`xyr##T20~P9v?*k3|`D@~1eOarTOCpoiC4uJ(PI|cU z@2dPCk*WV4w@z;rHDpiD_$_;=>q!56le3ebbxwYEa0)}IgYEoi>D`OM${K-vHQgC70?E;wXh17%QVhMs$$%IgGW%Yh;cp00i_>zopr E0Mp82LI3~& literal 0 HcmV?d00001 diff --git a/release-notes/11.0/preview/rc1/media/blazor-ai-rich-text.png b/release-notes/11.0/preview/rc1/media/blazor-ai-rich-text.png new file mode 100644 index 0000000000000000000000000000000000000000..9d0f84f9f07940464afd374cd15bd4e46a480222 GIT binary patch literal 48882 zcmd43cRbtu+cvJ%R$Fbg6dgv3)@7I4f-Y6NHEXvN)gp)$#3-t&_9mpmXsA76Q+r44 z8AK!qLV}3-`?$W}>;B#M^SbZn^*sMQ`A7Qc=aun(pXYHN=W!nIggw_*y?Fk{c{)0} zi)zoF=+e>AH`39a>_2-FxYExWIZsD-nNID=Lwzs!$^p|W4ud+GLxiJ7&|9Li;K{H+ zE#t9FY89)mlfYYMtk(HTwH=ejb}V;nn$QdHG48 zl+rkrLT;b%v%Y*>Q7kNo>!))%dfr? z?AV^BOy2=ywXO@5k@DtuCu<+_E5u~~O?aGCa0Q97L?%~jKr{4n@7DOHR_yt9{+3R} z^9D=}B-bXYgC`es>gr+_UTjT{nx>)@ECY2Xe{!+Sgk#@GQeqIj{OQ&5<^f~+_p^fROSuZq-p!n zE^3~n#7lyapq^%*dbYYtp7s7#{r-T@n(48H+?`8yT&p_x^(Oft=PMr1BKq8*!)M)#mypZH?CYUqw9!u;vXiAqE zoZ1JHzOl#pOivt=;aJyey*Rt|utg|?#1^aRV9%AG8=4e3{sPRkvHte1iz&Eoayss0 z7UcAR30SVDf~(*CEtXbrDH zqoLK_^Gs(!HBaK#!PF|;TqI9t{IC|~3f<%6*!ln1uDKo+O~?B_<&Q|U2O~GZhg)?d z=;(*jO447lPn3B%XC7VsPEh8CQ66)9k?eEQpGpLTn(AT8MDWGeQyAN4-hzbd*;_kr zu>F|H+;WG~Z|I-rd};4^Na5{Or8{+bE$iEE>3RpL)wr?w`@%JI^DGaxd)%}??#Wt? zJ=0fi`H@$Z8xD8(k}`@PaQqPt{<9f38g-xrJN$TA5kafZ!Y_^+BvcVm&yY}?$E6UI zNJ#}U1zOgmJ$KqJsvH;3c}|AOQCKTNNl`W6%gIDww$1Lq;AZ<$| zW>u#*F=bBSEsPc2XybRHWd~heFE#VV30K#8!x^7_AC59t$}ve*%}aepcN@l;6iFFq zgHHzVhfsFUMvt`OuQ36kR@%sMyzo#8ngdwe#8<%HX8L!X*fcE#bNlb%LX~!u9t}7* zKeEt&3U*cCl0Mz(Tj1@xc8OZ~de!1a?o55bK2Sd$Tx5Y;cQc*r+g@DnUQq!mX4;C%8Eo)~tLGrqfFMYM#>$XHI66q;h zJrQLxoP-c)$?Q;Kve$ckads57oPx;xwaEu~M>-}?_Rjsn0@b{-062)8qYPVzk+Ow&PWAiy5FKYu z&g>-$yGZFw72W$gJ*Dd3IK9-cEUtN-KDULBfxfrqa`Xi2LjJ58@#af;2v(H6iQ4Ca zpXQT;;baP(vY$0yXI&FU^R(oc5@}`n2**ph<-=h%0 zhYMqAb_kjuwtG=k$)}S1KjkCW8e43SqxHY@QQt>^@;~My^k&=}b&b*)BD=6GEl2r? z2Gi(U=cEl5%N)x4jD#vJPF?jyPBrya*#7PsZ;pn|ufIX*hzoa2d20m8Ia=Fe)*z(~ zImlT#9V77mi9oxgPq96iI>o6Md?_W>_DUyToz-&%<@)V;1DT4LNx!Wngqz(`Zm7U1 zLhIQrY2DXz2)(3c8ITz?Y_JP$eP4n-vSG>VrLWlMI4R+$4QfOp`3x3$RlaCoVxORz z8bx>Z)|AHMExWmxneftpP?c`+>T2~>;a5uJAH;iUhNFYLjSAof_x+t;;N{lQ#JZz8 zMmAA51s%@=HUX(ZhqoRXPT>x+a3H0ez!o)U75H*io>fBMTHC+dT#`Ha=1GLjx2sY6 z_HvBRB*4~iX2%|Ap&bRT>Q`SH(0l!16CR>@-XJ4m`mIIZNsFt~lXdPV>5T!$AZ}$>5D!xU(nRquci>a*);4?WGTY%(7K+AHGXD$zn zx-2a&U5fX;4HAQoss@yaO1FD?;bah}@m@9PJ4|W*+4u98Pg?GGyf37+A$%5i3Buv+ zFs`Yh=r`MUQS(r}WVAsPdU}pa=GQc^D3hZ=V(d+=&_PVB$0L!#7hbxen>kft1@hAH zybnyG_T_33-jxD;ZPn@kZ2B>*d;iETpFMX@WOqHLxjraPj6K7LErrD%EZ=ur7LhVP z-VonKE{k+$Nx3~+Iw?`Q@CpFjD|AVbof|)QSBWCMlj(&IkdFFH;UpCoiBwt#8Xu=^ z&Pkg_1@=tRajl8Q(k!Q|3?qLh z5<1%3O~jg_d##WblK+uGtMwRcn=ib#Mmx+JW3V7^P*#357nCC1CMvsjA3y&tgI|iY zG!-JvKJ6z3f7b)`m&_XASs~+xrlf@@(&WJEVFJnw4n&c0US*Q;tt#GzJnwJ?JZ-Sj zQ`N7g&8a>7?{`$Q;Gm5U{hfmWtv6cI$(>nv#q^r*(?IIySz_1Lkz(-_pQQ1tlg4>eJ@XH~Lt!b<+%n&F&JYO!-p zw>!TKmtg{GK%Ff0QG+-T|qlClaDP)7v;HYyvJllUF~>7K9r9 zleHIQ$?fSxL8r7R3jB0tD<72YnfK|H<=$|vmS9ysX#}gPpOvxE$02B;WR}_FD3bL` zdu_LOxQ_>pzgE?cY8UuMrovMwv#_($@A}8u1HaGW{r1m#L*~Jv{~|{hX+?dwdC**w zZ^$KzXnwE1UncErH2sMdxY~c4&V+U2TltO-euka}k#t;N0`ZO(#xiG8*+!JW>CEl5 zMEruv2Ft&~MJZ?fLutE7LEhD;O|9d##Q0>geV*Gis&-=L&KlEelMUKlLF`()tEt=G zuyd|B;oy%7(|5=_C;l~``1G6I97Xwlhg|Pv>`oL$?&G~nEo4GL{x_(&4sOpuI7^|r zD-!C&ra`XiZl^`=J7kC@+%1=5d|42f7YHSL@AS4FiuPQ;n!ZKC71Rin0ME0bQO9A_|Q)9gXtIKZI(h1g)O z{CBx0f;YD^MLA1No^tg5tHgR6sS&LpUqV&=D8{cMQF~_OBASK-Dq>@0%azH^Y+qUR z!7a7PyHP&z%z7EJqiS6T25OOB5Ye*vu1s>8ae+lM2T)hds}R|Z1~-BH(n2nL!K%SeJD8-myfkvU zStcXU9)q9=M@NU|S((S-7vykTLUD;)Z<$cpX6m7=8I!g++Qu!dR-Fo2W8VC4kJZ_u zQ$!dhUjlG1=e#5<_D=yJ2t9vybGRAn^8)_GR*76n%hWRhV$bmwMLHm~Cj8Bzk!MCE z-M|%#S2yTar!O)VKCQi?hpFb`B<~A|RQ^ZcxNqbWY>V~9ZdiiCZjKBXtvJ1`DMVF@ zbK6l0^svdE236Xujv^s~I@uA$j2_kRV_f|W$RXNgC$**UwaTfw_7B&5F84a}KIBf= zawuy;-Rm)j6O6JR~IQiM3K z6gwN#TXT${RN<@7$S9<*#}7VnWeBf}_qe27I6l>(ls^(W`H0`-1f?(Ije7Fk*L{B@ z@iAV1e@zjPKubRqUorY!TcVcvWLhWzB#txBX%Pqe#j-)+l)sff| zk9gRbBdr=9^aeYGUw^OUmb1g-fwUGE*2AhSTMJIX3F@#&Xikz=9B;PofPnadc|IMw zyLO)cS(qcH{VIlFi#DiWzxZ{&Co5SF9nlu)-wa_8606?dpIsnWy3yKH6Q~Qh zeoM+qB7S_eCfn-Z`t`VKN*0L$>_4Rc&Z^5a6F^pjE^XxlfB*e(_Q=8gQYOqaH5GbY zJBf4*x)Et)d+#eX(s(n6*mp-yrs7fB=`wIF`g`?QpsWE%YntOi1igMY374tGM$)e8 z5!qdO{_{Fsa*LA{<9YGU;!5ODm6iEg!oGl|2Cp{M+*&(co+QBmyads*B|d4e(i$Up z4DrX`LUJuxCJTS&9)nm-6W`0zdGYI++G&l@<`i8B{j;gySoK~ld6yfgJ{G+Uq74SA z`0U)^y&f80uEzPVSplih@q5=c56){ImQT;|hb^~ctY^%Nih+_JhW(=j+~`TV(FT0b zG+oL9#$HpDtTDy?PL@h~7#<*`^M(j2>d6TZg)=6;8cCko?(^0boQd;xw*?g+9_=lz z&5h^fkuz2HK6%g3of$B?-g+kA=r0nxIW_30T02eE zm3Pi8G3GCJli-}$MEj=G*OTU~$r@tzt3G83e3+7V@_PgVg5%oMmFfG=YrA8dd0|FB zW|H?e8bC)l-XI0P$L!*Fg`0}bxL7Oo;eq6e*D=i^)-Mba;tkL76-enX5bMbKANDD#nyz+*JIDuZmKcLHuNP{84Gt3L`lhQ zaXVY#;rBlT_nQ8Xo~C8iIK@GfTBv8l(G$B_L%dUY3YZ`N4m5i7jaW$Zxg>0D=b4nN_gm=&NhtJ zuvdLx>j8* z1oMsp#MstwSe_88N87H>{O%o-tC%tg7lb%BswZda{o>X0msjISgY5ELp2NPCOYFau zV^lCa5eoQ}!c^3cyhFi0KjF!8@;IUHnWGPT=EB&5762SMKX#_zjLY)wYwhaM%(jA% zjKy3vj8KX%=uamm>5-W0htJwjs`j@omNLmlpC&n5RV+&+iMZXLv1TViyEIojq6mtA zBcMPz`~@hiG(ama?i#VnF=+elf-D)5ahk)c-eg3|-XixgMyo3_u;Ll)9JwXuAZ{!R z{lxFCJ5OwhkfFJ&Rd_!5OX7x`4XeR#t+M@J~?L*bRab1yL|J2 zr4;+9l@#AOjsEbqt};FsQOoBmzwe%!1KDY_a8GGEifY}RJY4!{kcZO=T9BFEU3{;( z;VzbFB1utgIph>E5KRa^>EMKUz7_R;-|ECZx4GVy&g2;j*){8W#l5DC-kVO$=au!>7t3ZX$@OSH5U(1@Z6UF<4ywoD@jeHQ2Q!!=e2GvC zRg7wBQkVUjaP9VeMfXE2aU$cz=Siy6uD#2&PIicWBzk}Qcf~~+bMMw0b6WPf%itB? zUH5$C**Fbu)_j`6@RCq4zaPuBl}Egg_rzNOON z^dC?)H?1g=P#@+%S@+}Qb zJ@b7sKEFcFj+ez(=`PtM$*@Y&lAu&iC=R93n}>L!o}4=(9j7yTDjw(td@z)6i?d~A zU;Kp|$QNR%QSZrq^?GNmI_nqxxe5+@QcM>8H~&m3A0{k{(=6MgR{e_(?~9qos7ekP zSzdRj-Hr_8U9M@5Qrvq(H7eX|{h_=w-B4hW+kj0zXpS27JID!b2^@X2BgL+5y1MF$sXj8(>lA|fegB0^mGYhj@Ed;Zh?(p|o8*obDd5^bm( zM`1Tkn5|-XEH&AteGklaF!-(gXkE~Fj|*FLSI4Q|-jw@~mehzRwLI!*j=!P);B!`) zxjpfw^5M`(TK(=1LIOB4)D-NswOWs`r2ejK=E0uZJqO=o;_!}-08+SSey+T{g-~*} z&r?Kqtx&zbA0%WA&w> zr$gakMtcqWV!ItW>rEM|h&v_`jD;-oX$`kj(4?xB5scj>(DqbZou%nRW#tiSd1Bx^ zdGyV^^79{d!}XRSIbkdaQ4-5w3gR&QwzsrzyWJY0s0rugM0|6@`)Zqj}M)OG!gztCL4#kYZIT^?En{yL)f|O_W$`Sm%AG^)l4tH9COAYc#fIsn zH5bzQ)3M=WS&^+pnqlk!m3M|@2my(kZXvA|nM_s#hy&H_beWbKhjcO83y137OKt*` zqAEjy7dbWv`ra5o6j&iLH7i&|-{|`+mBpQDbdOQ2>btI!hRzlfH(SHq+M^XQzuiiX zCBIi%ll18Qhi5M{c=!oC(8rG2{-8R>*?MgxRrubH=5N8;opL&i1+@n*S}eU!on`l2 zgE^3yq7HZSmVdP|aqw(J`AXmLaX^m_$q4xbM@w#x%_^t=NHa4jMvbvj?LP4167j%$j$sEMVaGQW#`~BZ~-ZqfEKO4kV8|MEXOSh&~w$pJy+v( znf_;VkR(->63@8MR` zzsAp@Ni}7xKJ|fZPN26GXATNK1187N82m1g6N{xlT3%uVFn##EieC#P{UuV zyUXv0dD$Uvik+lgmj}^)(69YP51OeLmp0h9%cQ2(sX}7ZLbK9kmeCNW@UCGWE5rS# zvje)&OM}W)0$xiO5qsM~&1lY~Y_XlOI~q7KQkDA_tN+pXNbiy7{<@3pn!^cSg4sS3 zcl6N)!ZUw=EOq&!@?q=Z`}TxxvF6mGn+Icq3JtsC%h-mR+C~3@s<)VB`O= z?b(V^t{U1^;h5t0e&3kzd7_nL1tN#WSZoWE58fgF5L=GN^|xJ=e@vz6pz*pkc- zvO9rICOivM!TeZ8Iq|jG+5%mXRTqCcvoz^Go|7?sX93bv10qjmDT(Pe>6aUFE19!I zhdLL%F29Xva_Cf4!Z|@hx^i$Ovbj z#7nrk6LweILV5R$3!B|hF%G7Y;Mw=GWN1CT@~}p8E`n6+=Vo|F{oH++Vf@fhyTxnO zYYoc&7sczKcYe39Ze#aFvsJ!PQ?jw?i4vfChR{r*gq zW3O>nL!{Etju>j#fBCb4qAWeHBP%U~YsDPl{=_7F^Ff5^PWElU;R`_tZN819bAfPT&#tP~)v4`^|D_V5Ez zGim%hpUL&d4IlIXMTI+iYE$TC88;Sa(_7*Z^cAe6+Vh6Usz(%BT`OR|m^j^85v$|q5sO{f(Y{p$UNIGv;S>+HMF{;VK5 z-5T@Q&@8Tt;{tfB^?sw@0zEe*pSKd1c;t;QCR`{y+8aN4Fjb~@0nEJM9m2!6#P*LC zu!y0i)TM1d>~JYi-7%>mP)D4fQXj%KFUh^f=Ficd4K16aST1AK;LCQN13k zKp*GBy<0dlHAxX$IQD=nOT!n5P9QVqUxys7gJ`%`dlYWiCINv1>oA$l#kTXfW|b{_Nh$M+UBl zi^^q%U}D2TA?u0>ZR{O&N&el;jSfaaj&qFx3PCxqEK2w@1xDD_^UG=RyTx06w4 zPK!+@J6X2KlYphwhGo~P04<=Q%J!`-@r#c;S-NYj0a1dI)pL8)u8V(z=imR2dx1re!b(xH*{?#t*0{?!(7N zGA17NmyHUvhr+PC-FIya2Na+hNq>QXxv>w(iPG!k+-gH^INE7W10RhCj$)WG{)C-8 z9necE*vGNpRi9A9qa`Q|x9x6<@O4l0+Z@4VfE{*``@C%-Hc1wmV;T~+#rXG69G{an z=XlHf4tMv(DwNzh%5)#uIsI1t<#^CZUpzB2>0Gcsm*=0FK-j8pOx>O2_2Gt@95nl> zM%ETI{N(9rJs1e@I$SF7IohMrdkO|Ujy#|xzs!T0BpvSTd_!d-Ez%MhUUU0w8JHlz zoPJ~m>eKP@w)wWx#paCUNwPwl%GkC}GWmFx!IEyzT`LJjISNvD(3$O(deSt9{t> z7nuu)oI?N3*3#}{ePMLsJyT1iS zKI<;9sKH0_GqiZN`PI&G`}JIvtvs~--Y}sjR)lRch{GK98>@fOXptKCmrBKHakhboiOIR`Gr620ygQLoSUn5Rg1*_#B3u%PlA`qw z)Gi@r{HQCbX`>b;W{Z9qFvrc1Q5-r^6jrE{5?DP_59m9)QFhAi^IJ)9)aLY?Z7~LZ z+@F!n+{X_0xIskT;1!k`Z+yD}H*3X{ukN!Nq*&DGO_-%QuX2ymZ3WZS-8fk2J;%p~ z!AcI@u2(iagO&P}S?3^rw~`E(454|`O?g8fqMSu!TN`e4WKZNyCIrR-bHDd{zeK?l z0X4aZ917FZ%$Hg~4Q|KF0b)8tMr+WxF)re3pQ#aeIsXGBZi=%fk_-J`~D+AVB1;re+o!()5d*2tNI~4 z?M^hIOw`{giH&6fGgt|`Q(2m#QTy)(owu%D0<`5E7m*{wGUZ>V>fd*X-ToLJ72fqe zzVFXc$NKHLUjLog{o4C&v8h`ZyC4#8!Nu$4o=N3LK5xe#SqV99Xiu%zo6Kr-DMPa7 zIdH@;tqU`U)Far2l~w73?W{V8;g;gIin)jR0}Z<`+nUn z5Hoi$_%Lqw!%=3sh-{7hrBwXQ)cbHVB|&*NiFH6_EDLc#L|nUkw;H`HgKc_1G!iOj zZY$T2S>jyf8Mw#4(QO$1T&Y|K5Ozyk)5&YeIok4oett=eSq6Vjtqd^%B%2Phf6cJX zcQG1p447mA3cLAHpvvCu$-T00`(V}Xs0Rs=&1{*Dneot*I9_y_j7(ifbH(wT zIR36LRNps3?|2jiR96Oci~W>5x1Ds|f(BLUZv}&AigneA-s|OoOS|vXw+K1J=}*@4 zM)j|gbVkq1*5k0P>7Q4lT@lBH^w|gAhU#x|-seLN)P2c2%;Nt0F@cI*JY5BX=9(Ai z^?U>Kl(RMu>+e+(ug|4Z&HfzD7CPk#`!!t4!KcH<*(VQ6S7SjoSKWV)b6;kEnrJw+ zYuQjkjhtZZ9@^U@Dc4kbz;p-`C!sc%GQ~ z2H189W4sul&W>jDO=099eIhT{;8UzWiPh>wA&UZR9Jxl^TlMV1)O^~}WPB6;>RA$? zK)*G$DJ~l!nf`Gm1$kN&KT+;w5IbmR?e5c6uUuE`7Ol+umhX8KgfREJA$RaWL$qer z!BLX3*C$$FJafN@GE?9cWpIw1Xz9^Oh76|~*W#vF%PseQXUt4l)a$SD$=0om%s80m zUCd$YcHS7}UZHi}>2Arw(Yn`m8mQ7cDa;b)eXd&)Vylh|oZTurJ&)5rS!Z}n%h@F? z8>%0)B=zk3X4ejOXVb1U*CWx8W3V=T>nSv^p?F6#?jGUqSrX9yg8mfIuBO@(ucvh|IiSRKbmHipg?Wba&( zqL~l*e?MzdG(R!lJ^V0e3=h+sgE?)ReMhJtB|k6&ue5IDMcNE|f(Xdl=!>rs?-))d|&xD``wUP`y-arJeM! zp<+lxm$5HQa5c<>7-(qw2QIvi;PwTHVnWAv40w)c2 z$u2Nn4>Fld;8iv?LZ+Y2{H#GVZu}APRpj?BH!y11+8GsFL!X4-OoNoi54qtyx#-iE zuRj!s>*j5kkbFzW$sfjUedx2uCJ=+la?e02bT|Lm*jS`C{~?*e^!JCwhU?Q7ZR7un zU|Bf(HUV{<;kIZAAh)M;`XHq*bJ0rZ;p9zP3$p4rE&jLN$682TYXmU=1Nvz_CC7w< zJ;M@%49%POg;W3XDRvtw?c-PP^{KWKdetD&cD;pjrg$8Zm9l5XG<_e%GWiGWk^{8p zewW4!LH<$YlEskdx#5_Ze+DV@8632EryH(V12s`8zv+%4R8(JECn{DaY31EW={rf;>otK5~GQQX---kh;h9jU_Q4>?q8x>EhWa% zJm-mGe}P`Jd#O7{yj*X+DxXOjZnx($Rej(+uKe1)b$4iXAvG4(RC#3Eb_HTg@t3iNb<3nPZ6o1Dq68MTgjiDm6U4#A{H09e~IA*3XVRhiP__Ap!|Crl40?< z{kZqkK6js6FC*!1H^QyfA=;&n;h#r=)Fqw2AJ|%-;viTU54dY&gnq}gEntz*CIEw3 zGOnCrJjz;n5BNH{s%}lSi!d#Sz|b3E1Pkx2t%mf=;W3^g(7b}fDNfF#-SmkMpro4U z8hxzBMs)i5wC1`bp(V(b^Y?Om!)wF6yT$E)`t2QCm=N8Zjm=nsM0Toft-pn# zPcW0`RkiG2PJnd)@FWn{G0St=(btHAy_1SG&c>REW!gKa`2%n*4R5&=b(RsGaI_1V zNV_Ctofe~DFX&eSSUc@6axw>BiCy`%_zP^^r*I*S`d4d~wJT`qEVFf8Z|4XijW^(b zGztRmy$0uIz;;HuSLAgzhg!P$o>%p7V2B7ceHaV%iL>h!O}ROOKVt`plV>6J@=`|H zKoe^i_KE4Pp5IN7FRM?rw++h~Q2BTMclN-k{D8sS9=(UL1gro@wj1VYZPi=Rr5i*C z(VsP}>zQHK^temuAQ<;l+$R~Ubd->`s{_%I>oG&#_PreIbjQ2*qQJHk`|CtaGlCX4 zCtjkLC*g$?mxcUptWs*#Y-yfiyW$^Fz*<#n54gs(xA4BWq`NXJ-!NIo!hos{0WKOW z(JnAkHdygK;h8qwkYL+MC&X`OdzZ3{fc_%M60*68)$Znzwq zuZsNy_#O6<*11>pULMzUZ2|0C^!0uwr}bY9g}x#4Ge7MG4+Q}5`A?QY2m60JK`S2x z>g{)+$^W*XO{b;bw(dKdGPNAf_14DRaqn8~J9**0-R+X7hXQahmelYlfe&&B*Hkmh z57WY70%)Op>#ut6zB>4cKn$VziAoh(PAP+XvPgh3nD}|Om=t5RG_5ds~KX0h-q;6~0 zmhkMKr~Qeq4wxXA_-rrBKdLJ}Nn4I+q=Tq)f#HYJfJvW+Ap0qzc)y$WxYC(a%3Jup zpzZl6!?D%g_w27jTRd|kgVRE#6SJQpc7goUOl3=Mb|Bs!Hyu+ubG_4PqbmN2k4^Re zmVdN>nGeZiVCb2=cgcOvUhse= zBQlthm61yIhL+PRUge%R<#PUpFNU+rk@(w1M^i&gYVbQB#2aS^kgVid>al64$ntvB zB@n3YVs^DrJMj{`L<)_>81*USMY}JRbbB+MW!D-5=Mt5CE(+eXRuTdDo30 z&})iXRwv+%nNGh>pMKqJ_0gJcm{{xM3Y3s_l8#(2?&e6!-HXFuOQU0FY8Aloj-8~) z?{WRm(-EKn9u@5C3N$KJ@xPk&~i?7!mOHwDXQdCeHNy;{=h>#lbF`5?k; zq5kMbI-b^d64aihZKb~BX^V{3T@vl3o#nd|!AVr+gp*mWI8O`KNXhP~{aS_##~sIU zchTW;0-1=pOS+$aMOQ6M0P*#a7V_9;sRttO)haMvt{+x+dwOq`gha4oEu!4F#}QXJ z+8?ClY-f2nZ9G*Ez2A2}RR*5JO`QvI|2fCA68*-z4*CW&k*qp7z4xfbG)3;ES7h;Y zM<*s%yCiA%sscI9NJcMn?(FP#2V%(hRy#nFnMvrAYV2><3>)nY@W@*j$PIc$FfYbT zl3mOPIZjJvTy{DQvgc_VY8P&Vd!_>#M}ZIGoAEm-B1~DHI}3_TFq!mCm4O^ zt7gHz%)lA88r(<o>fjSQ6}6-?RZ9 zl4MmL$G*949v7j8u2K# z^F(k#8=U%t{Wzr3kd7qRcSxze$2sWc(g5APB?U(3|4XLD3_s00a~i8Ne~sR;4Jx_) z>jOSQRcK`!Umjlc7^`5Q+SL2_riR`R9oXp=qq|y+J+CXaqE|##_=3K?LG74zeX5g~ zhEu(z(NG*gfpH9eh0j5$J@fg((s%@ZLwL6Jd?xZ%%B_uSZ=t7axy}(xmj_Spi7qa~A;9&ShKgks@HMA=jyNbG%T`Sac z3Sa+t+Amf8C^(0A?(gW(9V^$pcq(}H!_9oPRby!ayL!55m%>7 zRwxVr&MLUg&Mir~X#x(iwfK7!U=5*v`>6kpi^`u~dGpCy|9e15E)77tJ^i|nQYhYE z;Bng%S$kK2tEA5SdW~$aZc%OGMk zM6~*o9su(GG1Uf+De#@;1w;kO=M;JG1e5hE1*d&LSgje%7n@mJE+(@Mt%9j-uzN)p zV+xDppR{)a?_d9;hn^EYEq>)CE;P4E@J{*|W3Mag_o3 z8sIo;O5a)Jal8HeTlUcLiHGB|j!8d#cIKT6fF$@YU*kI$VrF2xuBP`*nA|=?)Pv%I z(?cg80 z_~}nFrqV24Q_8Oqo___UC2T+wBqDgLuAu+nF|P{rYwC28P-?wC^5E2w;=cb%WFF{7 z3@vq#N#u}3%F^ux$=0G<5TeLMd|5;mw1&bO>Hi}exzowU z-@W+mi}J1Y73LSQ;|8SH8gc)Q8JEY&CBdpd(E=%C}J~l?QP!=mkFW2RzW7O zQ8I<*!JN!9NO@)_u8EhaH(<-heO88;G+}(?K?$lT?t(<@G!`PjyWQmm!4Stmgct-# z_!Z=7bP*VlVyc$>$4CC?W=~%Hs$9ELck1tdG0W|? znKGXJ`+4O@x*Nw&0_ab^{rkeDvtLgfKasr^aOU{$Y{36xHw0*2jRFW&hh{kN4SG;s zpu=qie#{jM{!{!*N7_6e&d6qotkc+p&5GX6HK{PN!z-Q@^%E#pIxZZ4Gkn}-acrsfSg?U;2=f&MH*g-Ziwv$UCr|>s{^$4Kdc9Uq3^6~XBT=Z6Y zNJqzUZgi~a{hyVlK?)mV;c3SHn~I3b59sN7g67+2{2<$v(adyoqrt>g8O(m#Wwi$4 zW^1^PLPR6zA>Bo~d!xaTgob)rVn4kW9oBRyV z%-J3{Pq=pcO{>;XKi!21oToc+4-gjN*{ zyw$DMNN#@yf;8PT?j>+4bF$F!+71YDMOm+(q03BjhW`e~6D}OT@TT`(It#cVDC0KW zGqE{Y-l=7td;G_1mT9D$Qv;I$AAm#S0)>HAt8wmjorE^-m`5Q zMl+SLwhczhv5Z%*?@u;VPL%RM@7~vt(&1`&{I(dSytZ6pxJvUxz3&a^wc`)971P(3 zpSVykOt^5!e4Flp_ePW-+sSY(JtDU^){f9|RBQb?8q&dW`B5S_gWp!EdxqEw{N|bu z_DpQ_`+OVMm)cVM5@ghDrvP= zsU4LGirhh1BZ2JM$CvDhY-J7kTE#GO=Biw;odr(}E9S6@3>~ir#(ilnvurtom>q z3w7FX94Kp{ux6=iBY)HwvBHpMsx~>VvjW>UBGL!-_R#jKe@iuFk{AnX!Yg1V7pz40 z-VFZ^d@Yv>_1nL7TTgGG!NS|`!&SEBHrf6(5~l&~!&U>ct?T5wrQV>)0vIk1>!6T( z$?1IpJ>%`6el}E<^JKa7pUGK~qbmG4TPF#5T1C?(dvd6>un~qGdv9saN5)98W_6^6 z_Xz{o{*I^m{i;{%Y~p{37lvF;oq8m#Aw|jCLeDe>dj|E=8x2sw4Vph=6z7+37$}y6 z)eThIJc6gaJcny0`l++4=DwwoOp^-5VtPLUM>g6?l^*Y7%xY^!U;fH8|NY6_y5C@H z{r-EdSUbNgGnKZ4U0kC`)LV_o!;tq3Lu$d~_un$|CTy?g^$8`ew%cljrI`%mr#~N} zR9LhJ@1dP)lFH7Jj`S-9o&>FEJ+UYogJ*hC=ildc%f-Wb6*>J z0!?qxlf|Du&Z{rHt#>rJbMQ@Dj=KFGeHUc}2rEeyM_$iimTPkpkh^gm38u-ZA#<1OwFkhxw3rmmONw^#p_a zyY>fcy4cZGa~|#y1+}_W1JQSlLiPN8)5Wbuif1k}!)%l&wYpyxLdaBb(KVE#`Ms)r z2kRo>h)BblLf6Y%bMMp(c&c^Z4WA3CI#?4*ARVo>n|AIh467a5AB03*`0Gke_=N3- z0Ve}-+qx?IdrSF~V%G0c?k|S5y5J!y-1;&+>95nAMQ*PJxefmG2`nl!ugo?>32-h? z6^A`)Yr1xfMkbZ7PI&T5e#?3J%}&2EXn%<)dh_K`zfOW)<+sU~l3P8cnd=%Wdm-#< z8{_TWqh>`Bwq&Xj`PndF>5CqwZ))hf;{Bu043ZMA`?HucXxoC@7dN4S5+|A8Y7xrQ zx}!h>g(s{1bxvTVXg6@?bRgv{`@uef(;u^Msxd)|mwf^GM+;E$>Rx_$koG8~|LBHb zoX07_gAeQlIZGNoXP7LWyK}j8`aS*>eqaCY#Smq`$jhtK1H$^Y!_!u(m3JV&aaF{w zLXl^xi&w#hhDRUhwCvO2o^b}Udjmrh-1u*uLR%Tf2cKkHKUDp6^f2@_AY{Py#0!xf z1|mx%YjDcvWSufwHB%r$$0D9J$bEHC9RRKGIOd7{xO3qbEvr6w+kI{7$!+V~00npk zlsR9uD2>bptk~7258TRr&8v|cPP5-BzwDmZ-!0lwruv0mxL{F*SIAt4PQ3O|xZ>TB z=pU9j`{-^q!Omzx(&e)j>t-i^kkNV6pM@9P)Lg{XbaZLPeqOePz`1Wp&*|nLoZb6S zb?YgnX<1p@2%#kUnASLFvhZPxjp-gVgOB&&@Hr!P-1XQ~;p!FUdWFX3zdtYj73s6o z+D4%dV%L{SZMMuIK9hx>KK+lAHa_zHm6}Hjx8~tZl;Fwn zC>=%1tC=!~zPL{g2d;qv7a#vVV&R)W#Mhd;%-mJ;THW204*ch6rx1JvXP-XhqGU;RB5_RJVv z#s6}=erbPh%_*h;%(|dUb-ScG3AIp54A-vcOP6fz5cX z^7b$Bg%qe$7wos$YwO;+8N*N+TvB1xD_^1xF2Q>#a3missCR87NhxTmb)?wg{ys!_sJg-ByaFS?RKbO{&^XBUoM)jAU`RsFohgSUI zt3QLPNdY02pO%vu0RfHZfA4m z*tI8ogTE3?K{zV&;!(1?B$;(qoN8&~)v@Gi@x-2scr!*A{_de!AGVdIWWjyp}| z%axei$aWF7q=vP=tsq3=XSW4>O(BQ=Q+0UhnjKS&n3)gKEWIh;gQwNmbV-`oTXBmC z>pXEeu}?0_L9fd;HBImLl&qck(Oer|`(mm`pOuRlQ`C<_ zS#=(6j)wBtJ-zL}7)0WYww*`UeYnj*N4K;VztQ2@SAM-lk(Rc#L z(BlWgss6wJ{=a@h^d0RUE?686p0YM!<^RBUcw0NJO2TJl@z+xCH?}IiKy1Y0;AVYr zxx{OC>X$qlo7g#98)UF@bs`vm;`G2S{ZF6Z7JQXS`XcU?rv2PvKguwF zXR#}xHSdNem;A%p_TYd+{FNN=M7!qT^m~F7+?Dv8^#3vUmO*hv-Mc3V2?V#`79h9= zcL?t8(6~e6PLL4X-5Ln)?lhL*?u|4S+}$C-bl(5GcfL;DnyI?yV>eXoeR`k0f9qM# zS_k}Ry-M%Fle`M-x~`gN=-S2v3o7}3!11^DkwvfxeWT59zcu&R%i+0obXfA%i3VX{ z_*Fc8c{?o7an&qv7Zqc9tK#?+i!VzwzEcmo-Mg4?_bV^AC!R{&98m=c_!L}vK+;m4 zcm4$|ZsKRrTX(73ouEMJR2G23?uY>k3T$z9!p5G|`TRWNcfM0p^nONP`S{zmMdD4d zPla}>7LWU}m;GgF|A&|qQ1hxzeR6z=yxd{412|apGPSC6%Qxk{ckuR3&BIztwUN|} zHA~uiI5@U2Jggx++FK!PKAPRsN(Y_0M>DEf&iNH`GXBd4cdNv#=Ifc%m-QCR^PbBi zfja}`-GToM#&{wZk>73%-J#p)Fu+jHZ|9Y%ljd{x>m2Lj1^hSI{Qh%q^vBReuu~ee zldBD7Mrzb3_ZNQ%nEoe7-$i)4&*aQ|*|6%;yj!mJ_*0&7fhl<{{lJ&^>pLM|ul48k z$_l+3)dLDUM)?KcO4rX=ZV&&Untf~gy^i6v)F!1q3|I_u?6xn>^N(d|qiD|T?LX!`hC z=4{|dUK^pm>0ZZ16Y%saxvg26n_t9p^48gxUQqCU@+qc@?&}SdbyTBcsVw1i*PZcI zX~|=uW#x7I%QE34*;4znK2NaLdw3USz;efPnFvk|SqxL-Lo+zuAiY~(bJu`?wqaJ; zzQs0`DhyjV@N#^3!@-0!B{lchM_^zzd3({xwM?(KB2#+N>ca$C?8&}8_!hb7cE7mL z^%NwCOLhPc_XjQd`viJefxw+yTS%VWNZ%M?(Sk<8n=j=#{!V-9pf2ya@y0L@&b9M# ztXmUOX`{7u&nIx#&nn+P)vgggmWH1|4jsV#@Y7C_NkQDsyU}Uiw1BR=JjW_MTb`5Y zXON@8T`&A`aFVYtXvCxDB;s4kibs862T5mD-p-5j^TBIhUGLVDMR>E!R@UN^+*KBi`c>F#9lo8<%P-HpLn3yZktRT@tm0gF;0;H->8 z*vC(r-r3D-F!Zrj?JHv@d8<70ZC$6Qe{|x(Se-d+LizZeK-fZi%(}%SIuXpa_|mF|Vg|ctr6;}Rk=G_2T9!(n-R-@Yfn6O}p~?pZdm-|va_;V?moGQ# zXeGCIdgwO{(^oyzqi!Ks9z{}52#)Maz9%V<`%ATo$|Qs@mZebBP_ey>l4{_>LUWza zXC1d^;M4ZsjJ%wu!&F9rKY6Fbj#K%29YuS{0`5Egd%LVxw?TMte?A7n@e}uv?fa`u zRF~-#b!BVgsYyALpor8@n)VbVI98OXxmbG3pLK~uE57)zzbxu7K_O1EYtuSor`&hy zK%QpV=RuSoJR+^E&8(NdR@a}WV}Cz)lXo03JmirVoUC`OUsCwgo!p6hm2=3CS{7li z7rDL85nzObrIU7bwbQbWF{?=rugw4xef8k16AXi#f zd0m_%os&a?j|XPu7RDo9@?HSvS4I>Lo&lGg&2??A;NygZ9>V;d{6)CiL|n9G{JKUG zx*R=(xmbHuW2L(M8y;Jo{TO{J?<@zkwx!memoa|odM{A9Roxx?`nas$f?&?_?8UoY z#KjHS!N;zrs!r%G-VsByW4DTS0Ku`14*f?9&LWWoY#X~ctXC+xkeF4wGTj)t6j`fx z5j0qe2lUoQ-ZA!@xLvCE=z=@?DS1*$8C!4aj0F@G)PAGvfp2P1b>)@!`Y7Nz15GVi zUa^w3rCv<%e;-UV;cp$|_R+4H>Wo=vY+!OJzO&bSyU_m*3X%z1|tRf(*( z(aThJc66TjA24+lS|0gZhqPzCzmFUpU%$;quYW467lHy>^j2l8?rXZA7W9*s zQMY9RyhJj5m8z_l$`wV{m%u@V<{Rbh{t)j@@WxuV%d8O8tMFhjXDa_nXVP*ftp9z0pPH4tsF0Ne*_s64CC$}8xu#aUT_hfC%n{^G56 zZe|7b(pkD!y-!4oSd{8GheejMH{huC8W88Ck)Eq;tOyzo+%NGDxg18v2>`ixJzNHn zAJ23(9coB5OfQvpV`~%^J+6)&y@IK3d9S<0n04%=OApC{8{mLy1Jl3v(Q$?sB0ImCGG8yX3!Xv^h$gaS~iKl`a<9J^)WnY(F{gS10p!pQ`%Z+p3>?#Ml1z z_rxOrszlF=sykrW)LGlZgQT2Cqt(%`pRk4X8SRbRfUoJ^^9bO8E2Sv(4U#u*%3+z` zCv1o$Gfni%f3<)qT2sWiiOR_GC}#MmeB+4z_6B8kHdPTWB|aPu55lkp|zd4%=k0Irs?ZXUk9HT z7O%A#4w>>5$l}ah`NhR_!Q~%D%lGiVDXUR>@O``1Si(-cwcUlMjF&vKwfzVEs?zA% zcO%RSrhU6F4rcxg&W~U;!4PZVoS=Qo!*m48vNSl$A@N#y2j+J@=keWay?Hknt0#1G zbX{aS^mn6NalPG!Z&)U((ZQk4j5oya%tCTB4cl9E==-yBw=8m{FJ+wIO*%iaH>98b z)pR_iHw^NG{GMD%d9XsDxoW@fqKyo}xV_J;rsS4DfLOX166U+j`V@cVnGsc2P_u0K z%uc=&AhTL-TXQvC@a?FM^V;zh@A0stZ_hC+yveWH;(_Xfd)mqHtIcd&zG4IGU{B|X z$V!*;%d!;fS*208%lhQ}gcS-r+z=T-Pr|SzBIThtqSoro;^KDe&XLW@SG41wH!MtQ z0UU1D_ed2#9}{|C9e+XsCpglKa#xJV)*BYaUE6mhopx-g1!@H{_5OV9knj~Wz7}a- zMm5P;@$TloZ+EhYXsMHmMmV*Umd^K0`F0Uv+im*t{?K?`=Q!S`e7Z!)$5`4VfxmU7 z8CR%o4>JS)VHBd-Y?sO^(#caaxOft98Mw3jqgU>V;hffoZL@weDn*2e<9X;$=}nsD zZ7dy-sr9np5~BCgPp)~}jvw$m^rnY;(&+9NhPX?TAa+@Iy~Uz)TJB_NTa)MH85L+Q ztW>a0C`;|+4P2HOEWW5s^L$Z=`N@g~Fd?qqscMsp$+db!fP4Vo*UP6ICuOh4W%BpN zN_7XcxTm{2TQtr1HU+r)ax!Q8aFg(#M5m?zydx6h{O^|A)gJ_?yzRtnNfW2X6+w5P z3cJ_c8u#)Gm9M1?DMk~z5if(!#bNd&qz|{2JFM=kl^w-mXltn~Pl1V~U77c>jQ)>?&W&6jTg^HJQ(vM#z{0?VDY^#;L z)+xLsQ`nLv9cjMrq4g%dfFJwK^;uW%lU5gXFe72AwSb zx>47K_7mFb>Y^o_H$mo~-|{k2EZjbIKhrd3)||;e>~lvp|8s0zkR5#G3t1%(>cPvy7DteM6Uknwk{$@6c+9XziTPfcgD>rcJehNNjngBs!aG$wuR z7AayKm)%3PCb+t0P!~_70=EFQfjalhx=2hYRqAA- zEZn2|9%O2d$5t3;M-KOMX;ft|by87FYlXtZN{g%xk3mu6{ukrSwtUjd3p18wYx?Oz z^)2mnE>jthmY&T+m{^|j~i#19b0Qkw2;;@+*ZzG zuz*_~4}C!G;I2B3;-}6(5oYl1cXY2hhrb=^-oPoL5x{5HS@v|R2;6EJ>K@+D{^DQ= z5#E1O)}HyId**1!loNVY{WuT6klK-+$mX5#v@1Q+dbFyxG7_ed(zlv#45opeHGoG+ zR@@w~&P%pMY&^UQw?an+F4um(Qe6CfoUhC1ov~?aPWBS}rmz?|N9+0daz_)(L|0yU ztkQveS#5)NgL?g2?#=(_9sMwtlOb+2SSW zWpaI0?bN%}*`d~)`*sfFNb5QNL&eX#-7(eM%$>2OSFr5ec5~1a7y?QW8Rco~e7QU^ zKgbvz!m^pIEMp=K_i^z-0VC&v>15~j7?#KF+*I#~YQab(g*faF0- zb6dYhk2PC}5(24*?m{nOPYGnTYRx6>H8QI7GU`Kq&!2&bDLXi?YeY!A%T*t*V&obO zd@O(Wn9T;{K*rDa)*(EF95w6nH}@$cnzN%+KqERJl?0SDIr~&?(1Mk|`>0ECi{jv{ zjs%@&&B>(D=vgwa_Q3(rz6I(*S980NzM{#=@w(ZevK8z+egx}9!_+M&M4_n+hUP1O zF7(#VZbet?XApOs`hfYTv7=Y2e4$o3H;vewevu{>n}D9{1)+~GmV7uZlP}(ukCKmS z1(6+|zBi3vSd&>Xd(~hIQjdk2whoi0KPN?_i&p;GydFBSIefAe#|98`mQJdUt62HA zoav*9nW^sQjtA2^sSwD5?X<@=JqbTT8pACI+yD#PuVMYPfh>u!hGvlKftAtJ70NR&XrbkXbVs4OGT{mEE7-sb|01N@w^7|^A2DDNMREjW<;^^Yze4y)#;Q6Ns}8i!JKSd zjFScoekKPQ_}XjN1^YPH%FJxa9CQqv!g749wbgqqPmgCGi^q*d{t9gbxoTIJ*`0cC zA1t0!giH4YZh^RLDP-4XewE8lcyQRPUAhCFa-y#rD*>b`wD@3|=ZYG~7uEYNgdC9_ zMeT>_62x{8F@rWGsz0w$X`_HYUW5?z=0OzP6D>#)M84!NeKKO9cFpKkgs8=} z(&qYFunxHLk2*t1;l@6(Z(XVJ3$WOaMZ81vd66dE(Q+%$>h+dSHS#Z5iQLu5aT;zE zfqJ`AtIIPoI-ZiOyc(}wh72~n!H|4-AG|&@)1LoBq+GwrVC~UceiEQNJJYmxw@l32 z@-&m8i1F;-*ZRaH7lJ|T7w@79nAA078xZT?uITIVh+Dyyiw_4k^WH4i zb$RTWXTh()cYErmdv_VgkFR;_cB&jiHL~8%dv&FFk76GGzWB@$yaDR$-5Ru9vZ{-~ z(5z$t&X7IaJro~J!`ud+fG|;F%hKxhB>Z%FTIot&BLA>4jK=EEu;JSLfP4Jta=k;i)liFe+hUFW(7)s^)gnpt11{WMbP za8WEhMalca9{n+diQU)StyF|00zF#M`cCaK_2WmpfJXM~$s;l9e|PeK)O?sQ4!eFa zQv?pgeSk?U{|7s6{tfQ`Q(Mr)H!5QIewc>LF3pR_v)VaNuCpv8Ib+`1w#fRixY;w) zybLB`Zyuf!R>bXkHB69tS9rJEiZi?ATtnCu)IQID%k|pAd=9fJ%08?rZcudgbh5_1 zrYalbQ&=R?dXl$1W#Vf`fe$2x1)ggvg{%ZjNYbIQ;3-}m0kmWXLUPbCojZrg*WQWY zi)^$IgR4C{&1bJGvOKm8@Y_UR-a|elHG_1ji&RVyx6}~**9C^eW#_Su%(!qvoC)uC zm$rrvSU{qhJz3;1Ik+LAs1N4N8>ql`mk)GEnQc~>L^OSm*wMIGYd z4B=@srUlm`c{vxiE--Xrdxb6DjbIr%H$};p%tK?N5|hvHC&-DXcG{kC`{0o6_Td@n z%V!m+r`obW)f#fzpyX6Wa?_wptLj6&$=vsE-OE07@3TSQH;2(y!*F;w@aB zjSrM<>!0klZ;y?XXN!-eWeB`L+2Gn)I4e>t_9o{78@qblFr)M)54Q&#*s28e?r_y7 z)wpa?W@6N84e__MjJw45W*2GwXBOy`xtLSb>1#V4kArQ0FWy+JY47C%O&=4Q=^+dj zh>|)A{mqn?#!@Yhil*iKZBKk^H7Q{>VqmD!Uw`+zU<+m?M$nAUEFvn;QAV-p^ii3A z`MP<}qb(yHo@{o>-vlTFlP8I(?gn?%Ja@dmFqjm$$jjb0^}BMN$~r`&slU)eazStH zh*?WTF9EBrQSN#1I8e(s?2WHVBC>rsBEM_i(jb%}!?r~yzs=YlG!0~}lBJV(^DQ;s zHFGt77g!kv$6ui6>3ItY9YLZmMNR3Wga-%amNQRr(XWV;khh1qAzN`}I3-p@&q)pT z#epNC6^*W%l?C>mGCtij^B1^2`;(3z;!bRk67~2iUP8Y;UxuiQZApygHYVpBO7y#P z1?XKmHL*{MN)x)yAKOJ6h_5@orlI$0P_>75)cfkmEF;kLl^xR^CTe-q-iSTsI0;uT zbP1}mX4mbr1x9F<>E(|zGRZkM)uTykto~OE=&@0*P^fD>eqe=xnA=PoSghbg^F?$I z`2r-=^rb2|_yhR~SdM9R4wOzZgNs=fh@ zoduJEqfTZSdV%RPG$-XjZ4z}7p8AhQ>S^ARrBcgLv=|>yNPfn1?_X~RzxYSp#4ar? zN;J#GP*`hjh@q7Nb)cljyHsb^JAL16;^-=mN=}mIri5577OSRjmFgNdc@B1Igtjix zd8bPqGEKb;Q_sN+YGW%&pYLXG?RHglSCbxzK9LWUI`rv zF7Pz;w#(~rC+knPxkZ8Nuk|QtZYU!e1zIJ^mJ-*eR2Z^`xx6^$WU+t#O>!^QRZH&G?gZb(`|9WhruKW?r7b^bfhvK(zfpOz)RGGMgcK;NKAu zn<=X8en9W3pI!_U%;?HtTq37}D^@{lLGxw8DgTbql*w?`0$ur;ajw&gj?#dbkvMs2 zmb45Q&5eM)WC1|}Y^OnMTLl&;1|6hl&(B_HniNO6#Fs%@6d~>)Sig{h=5Kl%F3+_2 zHHf33Rt*wnzxSo}=iEEwmTrcIc0Fc@AT*9nB*N05;AW6KqPfS>IjPs1PmIQ>ZU~^r zP_sNmx#Ol{{zaOs?*3T_)a%}ZE);#sS2!m>zO1zC4rW<8(f`E%ofO6x++Su$?W z81e>kp}3dP2SP>ClRire8*&p>oF@w+I8w}AOURw2_I)Bs#uDCp`EU#E3hWj6zWerH z4uEt=y!#M_xM>y^y`l&yBt%fk?q`pH$j&VV^$bj&cPE~WCx&RD^HW7AH=>WGg@xdH zQNyyK(pi_HvOaE-s0g%PR!)uYf`}LOdE)?W@VD{Y8bS)X44U~foNmG3MNP+CbKod0!TQ+T7k@1mq7VplwI=~*#7Re4$erwZHcmY&V*N1)tX60n%HdxyoQ zL1L3O6p*;@82YZCk#FNN^dn%a*|<@5|A-;LJ205mN=CAaQ#l8o70w)%_0F*4XLv{b zMf@)(nk~6mVI0h!pgeHX2GXk|} zoS(79r1He)HW3;jBYG17EYy(^Hmo)>5m&*B&OI)W=wg~eWA*)H$e_0yY9RmL+;FY- zrvzMs?GJ`kuGCCQ_M5r9MP;~XJUn_`tk;E+XBA(gJFG!%6}{ZYMRR4;99LX8sC>8K`P!PXb+ z?gEF;fkZe{IT&#cSTnj`dPO?E%1@v>I!TrzyBZ9wU}{gVsf5+NyB=0|`*_3M>!Vv; z>HQ)mRD!35a*^?b;~M0y8WA^}7^WHC>5PPnCu=d~pTQ4lPe30}CQ?%YdozcX+kAbh z&3HSdc~R*AeLeQn=sGR21WNu+-NRj95jkVmXMzC5+|Dz+ zl@4ywFG9JEyJU@F<3RikSC zkY`Oyz(`-A&2i0C&yC1Qyw6>yaf1Za28)&oak+^;o7FBjpD`$&=u-M7ZOp zp<^WrAC?>Ie#jJjKxVX)mG%=Tt7=4QuJlmw9a}TMe_wd=tuI@?E!KrMv9`S%FMUQ- zy^TF15ivlYrN5R@(X(Z$<9-(X#?}MeUd9ZO=e~J6V;LcJEXlqqw9|stzNX>W0;UI$ zFdRf;y0<2yJ+}8=3pWwL%^<&V3(XfY8EI9BA>fJXR>a~bJ;32E6g64U9CNHiK6-2y zvqjxFLv@hjY*zd0P84Gn9RRP8j{AHA#*QUXxGWoceAwd&Zny1|{u)s;fqR7W>Jj7mGhq`*FtrtkGz9 zwWpstb?+|1uMtWm&{6aEFkx+e;W87-a{!6vHLmyo$; zPk)yZo-t4}Lf}lbOgfty(BE2bHI1k;L|QR%g%v==*z#p7q0jU#?d>eX1EEuh``y%@ zarpX@=xN={_hJp&lk17Ndd3t|)L}F(CgDt}Z&!?kvpaDgfZ^R4TC7A>Y1X25A1TRY zs213E@O>^0)IGOHM?YY-LjhzAqmSagE?1KxZvqEAVJ!)MJy>B4IZzQFaLjpJdc?jp zf4765Uxu*^GkeIi{0nj8KDfT=ydbh)3*INJ5AVmREHZS0*) zQ|t;#&W%Xk3!h-)7Yv1aOxBuV=j9Wo>G}u8nDt{}Ozmswr-nz4WE8N;max5>`b57v zhfN~HEBl|>W4*PmWryek$)FT5EK|a!(nM1Z8aq#+bOujDM#}=@6OqOJ#iwHlF>msu zQ?oasU#K$6bO9N5h% zn*xT9{{ln3*@%^l>bRS}R<>|eX_{0)5=Xg2t<>hps5Ydo(#iAep#qzN5XoBdC41H= z<_gxf>*DJW(+bOfzmzAY=w8spg;mY#@m_GLm`sSEY>&p7HdOZLQH|aRKv))ID=v^; z%c|D>eMNko+#XHpunDda7BNuAAhf~41+2Uv|BuzFh>_Rt_(vLBY1O&~B-YR9xbRDA z>LTo$$n<9x2--rs)(u&tEG?e%gzySfNFvR38r_k?KuyEGmc}cLEN@Qn(qHc3 zl$=a4vHTe$S)85|qEbeTBGEDC?GCu4r=ThnTYCYrEMuxx_%8(4v(Q(N?5&&P!i`;)F9hm_OaTC_mF_y(66k$4 zYPCD`f$u98R0)khREQ|!v088O)I}4ZUiL(zK z8KQ7)Zj>(mY~bcw;PJeTmz z7fk?)nh~BVU^)`OIz>pbPxO@shnysBorqyr>*l7%>g4*>xxtCUlZG-%Wc{8m<=+&O z>RwUOD=>QwQTxmslO)52i$RmwLc>&47Z+QTi&cv$>!>ACSA#YR6jDt5gwWb9-5f7t z1hhuEAV-$+Kx;}`O-MxH88UKSG^FWqmqE&NrPBtVpb&W|affe-z9n5z{0Li!01Wf&dC5ds(BA6-s3!jU%ppJe9YfaGjZM}xt>e4#yp`E$EK0U)( zZo#nZ)4a()^+x31Mk4wrh!o@Ho69$ae;Ww`se=G??ejavP2N9JCxhnV%t$$E23X}3 zYUheDjJ>rX2O0+;NVm(Z3JK=bsCs{de>#%-(F0a&`ts1?Gc)!NcubAz#S>1Q#j^gZ z1w@CmFl{J!Hn1<3A@Oxs9-3_C@{yJNE@cn&D)#-s9#8dKV?;VBBIg&-K({!Ufm@8! zRu$2OcMjpMIaS7NeLVPmKmXzKF!C2VmQvJ&+W~HDJ$36gJ;DeYpSWwnG_8H9Oi110|CrSdJ7Ae@x` z%QNJiucVPE z*PkE%qvrl^6;XyJ#C$gmxRS}Q8FyR2)ApQf&D8%j&eJgepF`Q+#~18d)eX}`&-2u$ zi5k*P28bLcuHP=FO1OazQ-i5`Kf8;?ukud+JGvvLPdN(&M8!G!d0hybm=^tLmX; z`%dVyXx1CMUYh#R*IevL3O8D#9Q2kxZ;GZrQEe)WaipDg6XP*se3}-Xd3@bhe25WO zOF%7PuBH*{B)P<1h3Uhb;WkpH z`#9;Z#QTI?7Vjyt;pS;&1T4*p4;oRCWn#}o(1A_`)eTq2o0MM*tJ%zL7 z_xyzv_uRgnJ@y_=$3Na${7_u;#U+MaO6-Hh2n=8c(AEnVFbbYkxw^>r;~<<6+^JJ< zN^P;mj7FXeGe0T{m1R;jWD(VxV51(Fqo$P1Qv9R5Toc-=W#cO{8E14? zg@&08*NRo92YQRa7Gs|sqEEvKVR*m&aWNi%FajE60gh#Y(vV+mzGMzrmc`S6$4zX@H{?s2;<}uGwEl{1~U^EkO zabdGOX}S4qb)oz8F3m^B{Am(#eJ$ADY0mj>s_hS`W%c5T_9r&G7{fL|nHB*}J3>{` z!~)2M7t1bWbvP9i$jORP&C6j!yk?y=a79_{hRQo;Qd^*&Ho(Iy-M`FKPp4#CiuPyUfeEMj@ zKopDAd8w9>67{amA6+3{LQKeZgE-SRoR=+>Mf+7)A0u)DNLm0zMm9RKhs0DMHCMB0 zcFSHLEw?P!FROw2-0NU{&3ViGbG0g4`EkN3Stu&I%oZOT%TH3Pq92AGtuaU08Z}!5 z+ocJ`jk>xr2y<&3gzMf!E7R$>S+_Oj{sW!O#2YEkmO8iNWn4g7IyXtO(F1UF_7u79wEtTD}#~B`1@b$1`u-D7_6`2Nsxoyf(pv(u< zRd1H;t}-1 zW8~hJ-~+UmG9&*oxXBSVfaadqEhtJu1Cb|c+P(&fS#|I;1ftVUiOH^(v$k|eIJ0n@ z>=myE&8J~%t$%U!liys-lk!;kkdc!WFKu8A6h&LPu`2`$=yk4O_}8uMS97Q4__gOB z<=5y#d1Hu2^I`n;sh62D{#n>#xZie#X&ay<`2zvF0%QNQ3PVBmdHmYsz5c$+chl}E zp)!dvF>*4JkX*-_&Gk-a|1e94v$Q6B~7cXVJ8441}Qcx z_>1$uk_4SOVl+#6a<_Ka*RJeql!o0AQlWRhL;FY#);3dzfpYwBSiWkh__fb&YvXt{g*36oJhC zZ9{~fb<0nSIkBhrH!WKk8B@fM8$-2IjLMlj5ow5~HRjsL)6w-^jSVY4=kPynd5#=U zXLBqo;xqk|NG&$xOcJWAi)paqq+}zUk7i>`<6yJNPb zy>??x9n21vS{T7BkBAabZY95eODpu>(t7(H#Y6DkmEtX)8pW9{k+a(_*JJGVWySXQ z{@GRL!!6ceHl>pM>`?j?Br|J%Irrp;ja4UCv!5reRzL=t*sO!KT;iVJV?c8=Gl|FH zG>NAZC@hSE^*kD_>xK!!!HmIZW9l@E8B@wsARY-B_o8cb;%5al-SCKm2;@!#NH{?ES$Ob@V*8w|wL{(O9I~|jvxB3F^D3$Kwo?^0 zSFD^nNS20jo)X!vZ{mw>Z*pGcmFg4p-xKvy(s0 zy~Pjs74$OCHnop|^B7fEy_+b-{F&jOR1*38rAT8e-|l}w4~qgm|AS8-@y>___!4CS z<7OjbzUsmD!Phpbh=PTh8Bq0mpii7PXdEPyB!ZcA>DyB@;)1AeSFyOmonC_b_*5W4 z!XchK4D>If|JJ~`>&SFE+a-%V?6?Resn%fNhH9!W$4^uK*( z9H{vFhQ0#vmp@nsC|q8D1Y ze}K4p?^?m2PY?-gsg_;(*S2>zX)=>ICtVAo0y z?E8P0@c%|viN`sv6$67+p@J7z7y^mZHv2}Jf6v1U$hAn{mEuN-d>*Iz%q6Bt$C2fz z-U%U8OC%|1B0TeMJR5^?lp_gjeDM#MqCc!liz>4lr93T{e?~E`vI}!BCG@R_<54;? zZ_=L;fJhu!X-jwk*`Fl}2Kv%iN+eWtrfOYX1dnb>VTushOEOP*XHE=`E`iWLk!KA4 zTC{g)U?eu5#qU}H5&Pp)Kfb`2cn1bccZ~<*OwJH=&E|v(M7%R5n2{sT4=YH(JSpL1 zQ3CH(D_Sh^$s7_*lnURK@{{t1@if zQHCvpA?y#iuD|c^8x{g?U3>U+U;)i!VbW?-3=Z=TeTMYA;Qc%p%8-Ic@C^ZyCz^WE z5E-9={=0&4oEQZH{3E($QtWP#<`RqiHHOff*nv6k`C#Iu{f2+42n26XLhL`pU=sn5 z1g0P%5PbL|_b=W4@I-OZnE)u1rzfyk{)8Zod(w#dd6B4zpp9azuu|mnWSDzLE_OJyp&~e6;%jXRhb9IuNN3>o|79^5D>!Do6 zPv^M{Gea{3k_c03(i3$mL)5d!WMU+;AjU@_JpvDCCj880MUsb(LnYKpRZVD=RR9w} z_xbauvOGIl!@MOfX27#{)BA0%ld|GbJ#|u&leqG)=P)job+`B~o-#wH#azpY69LT% zRwLwAEYYDbr3mq;##O82r+L?+n=ePAUfA?YC62c%+<^vor8qarQMfDvSn`!AajJto zOE6-0W4Yf2dj5SGE(wl~NA|wMiEZX-?iT~~!O3uSRQ+glV<4R=0tFM;wJaVi5|$mP ziB1QRgX4At`HVM z#{=?*HO_XON@*+oyOpx64)B_cQ}PmZ#=63^vymE9Ok60GO!Ik~N;hqlNZ1jtL)`U~ zADOxtBnD_3PbZ-)4`PxAY4E11!B8^Ib^N!pRpZpD?;8xT#BCU%zP2ef7(gJ^_+2Tr z?z#bXENZ(EN)ly2mq8E05!T)gsqJ!UrRMy^uVNd*6a!eexFo8rXs|vMh)r^ajA+N0 zf@h~$G`pJZ*93Sz1oM>Yt5;S04K2nrVF;e%rZ37r$+C&>@o|S(%eNTjrzFJ0jJ!}b zDR>|zSkl=S5Ip(+_g2E}MBhIOfv%8J8c`kibzrYGSSc9DHs77%CH%kD9Gj0`q8<3_ zgGxq>D{gqb$;P!Zz6;%yGUz(YvA4Y;5J|f;#@~dRf2?*TB2(?)*A?hS2B|gb88ehmT_|nQUj1^0YLX{hePyOm+Y<9u?V*-< zk7e6l2vuHTs|jywj64`d!j4LQ&!2u5B$jJnxbMTv*@)4qxOn~BvN$_E;<-$Y+%^V+ zZ=b0}FQB|pUeKj_uT*N46*D9dY*!*gLs|M?Eg&@X+ZSF3Xnyj1y&U4B8Mo#LH!Z29 zaFUn+tF7sgwDqJOt}gSJb-~_^T`7w2pUGlCa0cbg_wZ9lW(d-fiwJv z{##Nlpg8)e?C2kJUZcoDjK#4L9~V4Qg&Cy<9u%;Spb(8A9N~WtF`X{qfxLi^ zG)88?q{LIok~98ou&|)|2lkJ7&uJ_1w;%;tpP^C4vW|m zDC6ly;#he5L)ih`kNMIk+RbU`JepZdrbs@0 z8elmWjMiRk@%0;9))bS#&es7Lo11JY{YP{}V%bp890`LVn>4a+lNIgQAGCgE*g5PHw9DiLZU&DtS9_lJM0Bt7{XaR1GprO676P15R>SeCWdk{|)DG{=-t za=qo43uUv?4saN7QDNn%qUh3=@@lBdttOa}7;#TioHZSH<6%q@;rg9ibe#zu+C>vf zCu5*RB1mOl85azp`eG)~;xKtz_?s9^%rziYR9WDpDM|@iA`OE9g2yjRbWGfNSZGO) zV`@#gVp4N-7Wn|#m~i_Xm|kYRK3m^hS>LMYW7OKYma9N!zb29S_j~%~v)a*v{Or8P z&4=HZS0;+u*4nwPh7)mLe#@2am4}N=(d`Xp!|UcT`o+&_J;0ANZf&yudK=@f_hM|P z?J8S9v@~s0n=`4*40^xK)j4m-z4i`G%ULM|E0w39^}H z$2Ero%&8@^GHsv)YqHo79+y=?DEqC_&O zn5gB-8KZWlN5sUb1>N+6>3U^W5?Ik8wrPknL-0lEQq-sXMfwBn+z8uWH@E;ls90*9cx0(%_-{f-U=pQJ%qq|1}w?nZS(T$84KR=Tkp6l{Jn>fT439M zx(vWT$H4?fdjBr+|No2M!zACa&$!M8Xk6{#XTjP7z$VO*i}?S#E!qAG=Ze8GM(IBh zY6MZ7`9*Y;?K>0uEI_}*IowO$o`P=~ySRPf(ayKTCUxG>{SI~5Y4Hm%#vb+(fpMyL zaG#Q3bqu=H%s*g{gQV7Mav zNzSIO@ezf74n}VWJ){^T&|wufh6Sk>%Fjl)7{AZ+TEo#JPE09X#si7_ zU6b=At$syFVf`MIX-i#i!(gVBF4nau9!K`5e5gGuIQKtEHO|T|3(~`B8~0IMONR@; z*+=Z>-6^1AJ_ux@?ZO1o!+j*Qm2c^=_^de^u0s$7SvaG5 zpsAHpnh1}4BH6+-N8Hm%rM=LChm#?CyT8J-va+bXJf~v)Xw2Y~t4FpwtxjBq-y0GX zntk~z?&A0SCzzu1k+!fT-)Dw8;3F`{+Pt??=J|B05CYWN2-Xu>>yRds#l~KD<*BfC zMM6`nK6owf^_F0xX~pl#XU zhI(#UZB^eCt#lpf42|@Q>P($M?fo+TZVCkyaa)^*C*sS4?HHUYRd0Y6rm$a(qIpHL zH4RazEy|Fl8^*y$F{%C`mZHPk#`tEmO{iw$EOuh94yv<8s0v0*p>)MYUxC0};(mFi zmXfq;+6)=XoUJ9t!JO@{uD3-s5x9ms7;e?!axu&_X)AT5c*_;F)kgNIT#YgUMKnSk z`k<^*5Tx>d3~N@6nW!)#x1 zYttF4!ZKN?FLSwu5n_?#dbFB!_m`79crb%#lI2Y#wE~zVpKT+v38C?DTxAj z5L@4j6wlJ6S-8w8jATGTiabK%~0k}uesLzudc3R-aU`K zHJ04|rh+mXJi7r)O514&A1Np+#T$o{!mIsZrF<6q1z_<1%BO!c&5`BLfZs4v6Xf#3 zVUm{KE%?cT2BS|#6=%6*--sf+5QTYH%B%p{#X2iGwBql{7~)qw0$5%V*MFrvo)dk) z6hk5%x~sCiK$Ca#iCsG(c9Bt#;g!n#22BscFQ(t`*tbdS`sZ2wXR(Dk9UC!nX8ObW zOu32-!V+XRygVcJcVQR%Ek447pYpy=L&TVV_eEtnFB~&30l=%k(G>Itnikg`d zmxc9+IK&19 z#VnCCUIH?0f%Tj4R`EWT*A+)_bAY@1C@sFD??!#yK(77mUGWC45aG>rS>P>7>IvDB zS{{mBpXgWK_UIIxFNvobA{hs3qU~hv1;TG7hut=Glu}kI4eCe^vjZ)Tk9_(*lg>?x zvi@J~eN|Lk-?JtJ2#^3FxO;Gdy9R3{SRl9thv4oIBoN%)f(3U7Zb1UU-Ge&>cbMJz z-T%Ea53^?OT6Z31&Gb|E>C>mr-lul$ud2SPQVLLZs^Dy_?vOxRx*>hdSwpmYzmYjKCso!hsmq z7WejM1ph&g&U~TG&Hyb`7&14!PP_iEh9X)yI5Yx_zfoTv5KS&C=C=ritm>btP|a%a zeofE%ATH`LbY_Shu*A9b+xMbtHgeE5Qph|MO=ii2sJ`feL3X=;PI0e8MWQBBk?Nw+ z=~dY00QZp|lH7LfOcOd){UQnMqcxX?qg&iY`CI2mGnYry?e7trf?UxFSEs&ZDYgZ6 zNlr=?;@qu$4IgWIk_a=O@OVYW7lnAU0`rN{__qHJAvG+Ap^ z$vL82TfP0zuapo-vL5y9gL@2lMAAniQoY~1_+7iMcAK}Dh^06Ff$bDil^Qn@-^piQ z%x3PHpOXnW+g6{1J!!-_nVy{qU3!H#$s|pzWKr^Y=P)7nD`J-?;FvLqR#GuU<*KM~ zS{N~NnaKvfN_qEf-gZmvX0XXW*qYIJ{ZKKKEy^&zN#j~@VIn{xiyBR6${VN9bGhte z5CP$#{0;0&u3FQ1>XtdnlD`9AfDT+ouAXev8^(es7YV|?11p51CFkCX2n!=c9AvxB zcta^_Y*aMqwR9I$I=CXU!=If|rbtTMN&eY5C%)S%Af2m?TtLdA`0nJpbfO_PiZZf` z>!1zj5I{cR@csv>nTkpA14j{{aCMjCEDd_icQ!thCFv1M$s8fjBz?;0oF^Q3LhQIL zYHa(pYUZed=Z4{@R5FK;!KO|&o7J~4#rkX=zg2f$;rs_rs{z+U*GC<9p9&}K)>%29 z-`Hkn;}}o1no?v5Ch^3H^28D;mL$vn!tk)t&rf4eyu6<6S+Wv7JmX;eRQ-+Px22`Z zQyP_;%LyD=F&kOUMos_l5J`kMUFCUo;U&+=jVl~;L+QZ6gWbaLU@@MP#8@=r;8G_C zCO|qXEq(WSWlWB)EX8RyfFLx+qHZ?INMkzV?>et6L*J7bNlb7s)Oc4%#-7mxLdqgb z%T%^?AzP!Qt^CJto5RdJslGDaj%sy}EWv2?ua?48o}xJ#od)_BqEhvV z@>WfQ&{6=DfCW5`JjNq__&AY1AXxhwTA@-Nc8qjB$HxHPDDL}DWXCX4M9s>l@wlz7|8y0Q2S|6|+OswAIVe{fyu{$U z9|Xhafc)lk{wPgk8wDncJwWV+pC%w8I<|mG4o&mldkSjO!jHp)s#~u=vEzOC*)HE^#Ao{6Mi*GBsp~>k5wo3>iP5gD7^Q3W3;L!}DG@-~B+=5&UP1!{8(8 z-;X5!*)jY_W#AhXPESkQ?q%*5m`VJi>3X;0_^Tnf9_6(Qo}IUuJ6?WZZbWXt`I9!O zYQG%zImd64f0wp7o!4UfFt^3LkPbY*_c)@M6W6`knLCeVa`9o+^XeUN)pW96TvUUU zwK@eruh0m>&hO)w@%jHO6K_yyy|=;aC*}WR`@Es4@KPcsVC6Fnx0NON3&_@L%1ZZ= z*5QTCt;8ZkYR+ptG(DBt#@-H^tqk)MP@TMH9;R#G?bDta?>?bE7iyjPN#8c1EA4)% z=LrGKwubjtTQ^8<`S%uGiKR&Cg{s8ut8XU~*&H?p`lH~oRq8M3Ey>G2UDfsv4o5wl zH(p}$)Nemw;}R_(s8znUm~ZY*`@7qovQB zN3lT*ii7^Ht*aJ)LtbH8#VK-`Pm+LxOWv8W@yn0I7S+ZK3t0HF2Yx!Wca7)S4^}s+ z$g7f>)rZc&JWB)eal1Z!FS_rEtvi30T0crV=%aL89n1dV>XoEUtl{ugsF~>&4d1%W zgNx(1Q2~)*y4EFnI@gb1)o1cM>7kk=39UY+g<{A;C*A4&ACFpoAIdk16Z9;e?K3GA zs$EfF#CT}=%zK`*%gLDkbmz?X{C+>JHqI>U`8-rMs!jrZuf_BM7qi8geHKI$13S1Wy><>TG2 z#RGB1-MV7R`So^{Z;z=pyk<^3rwc~M1rJJu&E!^zR%)@Kam>qf<)6Nj|CsKoe_K?2 zA3fqx+U!$cZ5(J(jx{Z>r<3`u%sZ%s1w2=n7eK;ASC1ZlB#xL0@RB=nc>g%^*-Vx` zSrz|n!S+Y%q;q{;0{41HZF0zDu7Tll!d+x z7yVhw?bb&;x%aa!08WW9fpffx$=*-T^ORI;vU!yeq*z|6zsewe_npxZHGD$#d^@TQ;hRx_DW3vWt ztI$PMH%6fJnN6^ooa!Kge}qBFPrNoB2SO%V`ayZ)7g zM?7@4G$y|;BtO@%7agrN4TJd4T(IoKHO7rfRW~1l^ROM8(Jp zL)g=k^~Tbvq;K+I_*;7IyU+KF>o|)@U&c7!kyfJvgHuO-Y&$TM%ZmC$&iAtoo$6A; z5pRjx42ubM&B027>2&#lgaSL@XQhe4q+10n8QUvW&a}L3Qrd7CW@^;0dV~yP`J8C` z=vVppVj*sG2Sg}PoL9#zJ6n5GkCp_|-X&N5NS|Pq7ho99jBwjdT&^WCAv+toD0g|R zXudnW7bgn+YI^$}g>NRY!Vo(b&EzJuh4nTMNsS=dw5;{gmrGrgu=~yEkS00DwENV+ zbbZukew#(E2J@EjJ{-H>;z)V>5)BnLY2b+HMzc#^fll zoKk&GCpQVWF5Npw2ms&KRzEw(H_1FRwS_b z6U}_MkUuou9XVt6jsCH0NT+v~hOZ7eFdCx7!0B*4ab&jdMmvhiyUMSwe(C*kzL;x1J@fGJ`x;DUG8>&H0tQGDwWkNG&ja)V34_;|IT-2sqS5-){xl# zy^kWm7`foOQeau`&2#oAO`z6FzOQXk)*Gb~9saq&J&_=HRD!c-%gR>J*@?bj!}Rr5 zHVjMs-;$GL^I^i5&)l;*Fdel&2jPE-!rX?z+uZV(=BYol&dzj|e~?EdmO5xt!xaqm zn%Se#B9S~p0Xs14nTYAPl082hkMv1{CfwR}sY~_)UTdEqEF1TkMZm!~u&hrrgiuHn~ z>HIvFD8ZQvvhmuyKBc~^+!g8-y+XyTUuaJ=Ot-% zgr%kvz&Wv?q@rlo;Cn096guE)wduoMPTjGNh-px6H1_-$I*EvY%1=XBk{G?jHdXnFC^SSvjdB_F=MvxtpF{IE|2TD2t= zOjS^x!@hE+am0fU1Nui*+0Fg7dlzB*#E`&^rN0nQtY;s&w(bE=L_!8ODC{rLEq0BU}jpChWQ?r7&` z;o26lj_T11F?n?|sr3ynEvn-P>h21gEgeIqU5!4(aGk7JeK=!e(!7zHGe+Y7sb8$V zKI$Kv3%p^;VseRplstHWj1vX0j?5Oc>rtik1S;QU)4j8f$VT-tdD<~TU>@@pj|+}Ukj$K64#%@Xs(TK!qK2Zl_QKAaqTxXOJ@LRD41Yw$1;gfbvb?25z(nl+qxx}WHytzE)EzJy zums1;^scR?zpS&8pAh41)FLo}x`A;Z&*V9_>Xb}<*nDwPM?WPY@LO+G@JwKqF;s-P z#1oG6SEB`xyrGjpx0W2AAGCM;nkgx4l#F$)Oi-oWn(>r7$3W9JW>@BHW`pFI8krcU zS%bt!czluW0>^_@8xk>8n;g4ha-$_!xbv*zHL7h($h5f)M>hZ5l)-g+bhs-SCD3HP zL-NjBzdVGl4$kIY*qemPoo~T+{H+qD=LnNP6 zPMz#swCWDd4r1UczbYWtlk)I>H1$204A5y+Ek3q5nU2&SAO7 z(aEo9@;(k?>^7 z*^?=IOC@Wm!I;jf* zDLaR?4}j_tx%re=@?$Ym7nK-mDYx9Ve5GA5P|*<`nI}U+8^ngO#2l33G^xx)K+Ds> zB%2wj@u*{j?Gsoqmy>}}^TG*^fZEq$(XDg&9!36MO%NpTYcyb|$x3or`174z4i>l< zPev{*R+~KiQgV=iu}okgZS?~wO*6;^Vo^rV1k(Bg_&2DAQtbS~9bo|`?EB+O|aRoh|)`K*3X(PcpmSveO$655AWn(!i%5)vK;Vt!gi~w7ek2W>S0oq=1GdxHV+VCPLxuUP2xN9AuC9%Ngsy zheChJ-L4IlsKgO&7J8OU8{r*;~ds3UXPAcKaPPp}7v*-!FADdQsYypoimbW%WtEDe{+G z+%+}ukM2Jg#g`fgvd5Qu9Mx7$7?I8Pm{iy1X&wAX4&;`Z?W}njnqQh zK(PL%V1zR%i<0Tz+?cRCnb{e31`h{j5HqQnuN=R*5AzlTa%Fh#A!p=Ex6A}30 zlBYx3l*8hr`IW5H6s(M@&vXBYjThY=yt_u!>MgD)fJ)nP$InE#txO5BE&=ZQ-qYtp z)G+vTffu}0N}fxr3D3$RVeHW(PGK}G{)vbGkLnf=4i(0s&~e}j?-2sN!G{ML3Hth9 z*LnxFfPS4XoRK1nBhRRZhR7l<{}J>*ZK z-UMmh)wYb^T>g-pXL}27xQgV-_Q&^sQ#K{_MmIwwe~d)!^z#R7&gseva96Pc`Xv2m zeaQ!Ru-UAG{oNayVFM5R|9|%%DPgc?KX`t+C_`TS*r{Wm0*K3bQJUMC%7`A@HdzWF zljErTfCS^@qyUtB4{U8TAV&V2?e+4jl5yN55E4mI+aRN!ttu~BHH!Lw^-@y_BG(Oxm zki99hyiadYj`2AZ$v|-}Kp@NrR9&$v`kVhkVy-W(77U{fOHcWbHM_(EFDFooCR9Q!MR4WWo zQ)BAfyy|Sl8?_y3lkZZ|!g?9aZ#3Ll)TxZ=cjKgC9G}sPy{hck&}pICotfza+>W6jhXEciLa%X-y=LAaqkB(bO0KqAEPBV;zB2d5jGQcTC1{ z`mbc&5SG4Q*>>;jvon)vL2ZY(Z->;qatnIUSGjAA5xxw}8LryCoQs?RZH#UWR6%8z zX4wcmj!&`Bd__j0yd0i?_J@Y3)Zp-E+zK@-l8*X4e#oZ*XZ-s}=+Ae9b7bzlu(?Nq zU}4$=CE%-+0m;5?OnP5rhidb-Z?X!S-ZwIT2!eJS&%v_ots5aH?e@mll^&qPB|{u3 zF0b>C6_qDy%U%+Yo-sKg>@-Am{NokhCOAW|XnshZaj2^`^-tE}7*8JFia!^yxI(fK z`96<6nB0%^nz>Zraiz4xhO$Hz7#mUVPA2gxut#H!2mC3~c#dxha2oe!x4l<|nQ zUq+xPNOa}8#d2We(5j14qcz-&l7!ps00QPF&2TVfQIj(@k-L(kLDW6XJvQufs4xr8f9FI(%0QCGNLJW0OQOdH4kE zN9-vpjLvb?m+y2mvRW`>y-#UUcC5MXgB7hk;)K@UBYIS*1+gy@q6mji_K4wLh1Ogs z_(+hoMMB4Ct&aqe$K)IPD&CCG^o;8WdHUzEjKsg`-S7v>zbvJuS*BmP|M0|3DDHaO zJ~a1}MlHQNbi9>L6%ebZd`o6J8vTQ~UwGR#l=EgdQ1<)HAMria(&#uBl)5R^Lgh)v za8A5U4XiXpLIF4y(f62UXP>(Rp{aTFrHz0;T2Ul~9!*nXc2vkz zmY8B`HJyk-qU}suOW2--U@HR#oU1wcEcfY<+8xBuVX3FQ9|6U@NB zwQc$HXnJ&LnA3U$7vbamdC;HS=`MFB#81Oe?Me6st!`geuxvASrKSZ&-mcLCpSTXB ziAQ#3lePjw1|GYFQe(mRTPncRBYanG&Rd-^(r3H-700ETojjYg=Ec_ZU+<)J#o6Uyla-h1Cu6iTdkxQ0EAEm$;QXf2{zChl*sH8 zW6IIpz`z6G*+rKa5jW~LfyXo?zWuQ`)FiE6b{*HUgY6;Rc>Xpd&xZ&Iqm-?c&WS(Ytx;sl z)}Cs|2i5!474toP1U`A;$8eo9%G*?zh6_Pakn`f3{3b_YTmnv#UD8kz9oHml?Rd@q zLYQl=&An4I9;&F>2ZB6|BqGkuY8NM&BTEg4=kORtdTKI!E-af4S*MExyuo8^56i{R zVa<`wF`#4-7fBrzcHW*lWqz3Go&l>NX_Ui+!<^$|(gur!2%(vf@uNog{kVNl2EY~{ zv%qh1+;XBRgYjXl^v4-4PM7uV!36&zA>c~kCgA;)^m3$f?){N=rFEAeu;^J*&6dp8 zZN0W3Qd~>~ za=H8YqRR!?P3`;n9XYd znEhXZ_?4~B$o}Zn8zbpY!F;z_x!Ey*fj}uO{zm1MWiS)!sjM8m3+X$#t7I!dIN1aa5XBLOXsxK|z^Spr~AJ zx-nPPiK3uf4Q@r>S^uf~ZVd;q9j;JJ{CtM0-tuoITC~zU_hnb>-i~(8{_!d6Mw95; zYHPLkUiD3$E*dL+i<}4ZnqJ~POGTi|$A8=gIx7)eE)r>YSXT=1qV?JJ$G-&xSpX!J7d_#+<_ zc_=`UJ&xqVES3uH&XWXbyKvPjC)-KlShB^*!@H*=f!gL+(T;0+pC{>k>#cOb^HjoJ zN$bg)@*>?Yb^EVLI2%UBs9vZY3?+)lsB&XHrF`E==)$q5Y%Hemekxd)FWvP3=|HBs z)*=<2(ETlf@q2`hBoag04{4aTZ1oNY`3DbjcXnyfn4Zj9#a-O9lTm~MTT^o>3v%#!aNsazwwBebiJg}`7?tV$O4m7CtD+(I#=-{VUqmKMF;ujpLdwhNuQ8M=j8zs9>!Sy{Q6 zsa+GwE-o@LVbTt>Dr8lcEyY&mGhV$;%Yk1G%V_Vz+?#s*g6Gaw6Y?0q-=ZX6ym9Vd z<*aNgA<*GFRbc~_mo zZ+Z4xd`5_{?!bJXq;ZYJTOe*NB5eW1Zft6PiAiI2cNr7! z6$>8!+ZU2N`Ja5ea~wS;4_ACP7~J=kQJTmcosYS;-YDq&+3m)^HlCMREUh)vm3Upz zrCzp^FWdR>)oCjAGlZI`k&38qWWVHP)3I|8%QWi}^7g08;2kU*k3V%8B4@KUIq3UK+XePVEY6DMY44z4lyR$?w0%j=xQp?Tg1To(KY=I;?mpISFH%-xmo5 zC;q7)6TP&6U_3nx3fDG`kHh6WKt8k@?_#**fWM4?Y)=UyuB9}QrO5Qn_=DqS4bfMZ zh}7L(QX-wp?QANhzk`>dszQRi@L_fz>YldVE!j3bC@m@Cq0L!h21?VYD#B~kX^T~a zuZ;OF@MwRzTAq}_RHZTJJH6{MfKn_w0tbnNLVP|~SM9x-xxSY&g!awJz z+7^Od=8r25?w8gsGS^;(#>L7A%D%om0RcX5vV6XO@IanUg@e(ry06+<7@BUZi8SY|aRcnWw-llUUr*6(+Gyr?%hzE7)p-E1e?cpAX% zX~l-Xf{NL`@RJX-@xpU5@t`m>O5J z9jOD}mKgf4@bB(b1)Pc(n;%}h;}%XTtiNTxdGexluYqNW{3@n1pe4v|EJR1GtY_U8Sc~$i9pua>4w-Bvp=-8kwj95=0 zn4oTtC}+DbT@4@HPY&dGzhyb`L&v9tT96^Dj>ErQ6?RS>wx2ofsqycPWEXVq@&4Iq zCv9EAzVt)KW`Isv$m#;Zva13w9AP>C^I<;)R0|H_dy&n7&o>E1)Sq`X^zw(F>M|aa zASwNwVRlK{947=m$HhiP!Q#mQWzl+8iN63?3X7XDxNwjohcjjR{?9rkbH-?s4JqMG zv%bFf+DPvxa{%s|9}BfNAc(<)P;d**ZlB-2$P{#R{Jn$72It}=r+Flqz6?q&AwfhS z1|c(0j6`hR(tR}`=iE9~%fZfTYrud1*q7)N;Z8PBDjXc<8$n^5k=8~FE;z0~S%oz& zC-029TXedK$ZnXq9BfMlg(TvVB9Q1>DZX1!IZvMeYq?GlC4HN~QAqi_fbmhig9X}o zH(T4w6_FG{g1?viVBT2c#QpEWXFn#A@pXagpH@|HD^ixU?6aA%Rq_b3+RK>zkzQh=?>0!2pb=cb}0jYM;RRK8}Y#| zW!<>n&yWMiPZBj)ohzfv%e2ZOF2($$M;cK0_s?K2M-HYQUO>^`Tyq6Ee}n?2WIq4I zqNJO~@LCkc4Bo!|KYO9T4k ztT@~r4F_V7hs5?a8)N&?Dm^nMo zGrC&N%I*fry%4!7%Lp(Pv>-8LCLXQU*!O+)6up}9y`((gQ8|v2P5ES844{&x1IpR& zH3jC(Lwo_3jsk_niuU-_49`6#2Q?;Hx>l zw>Hj;hGhb4&(r?upt{#|*Of=NdbJPhm&n`dJI^>Q&rQyz_nIW8xF3G@B0dAgL0JA@ zlR``|l_D!#u&xKRJxO@jN_qGx24us8Y!ELTUycBk(2x8HAIVK|zR&(u|LKM75fp0w z`U;x^ED|xn-p?;y_DDa@R0?QuwX9m6sSn4ghlvBT;K%gThIZwlQRHc1$EWTIhctD+ zh|GsM;+geEPRO&2bHUSc&uMOeNwf**Qy2)CQeG3VOq`0Nk6@lpXzsPuH#~hEdVAY? zG&zSD!HNf-2u5&E2=$ksFPmQ^L-RxRKYR~c%-!K-u05JB_ulqgbBUg(*QRH%PH0A9 zu#9F*W46M{cvi&sgDWm+%Jb@<#+em+9{wu5f*AWV^ott z6J)RW%e&m%iy>&wNf?$d`BhIHeqShx49jJ#HSO|y9DW6dVUTj7OA1Rmh`#StF*4X% zJ}l%O4&OB7f^rQo=wIDRz?Vedi;wr82^P5E{E`(Kzs5%elMfTzmcbdx86y@t)NdS0 z+;~)Fw9?$LG$dpKP2ICiAE%mPnG$eDSktJU4cS_DKG*m#TSx55VY{}v!BECqmR2&s z>!1xCyS74^?s=`t#dX=ulUTy+jm;Hb=R?!-p3H*>h}`oNY5HO10B zhSAQ>^^#K8QxZ7@E*U%AovpPoM=+*FZoUlotCeflI!*G)DZ6{yzl&k;d;qc!leAOg zU9Nqs^POjAe)_2Tm3agww_C)f-S1h;gv@lpwgVxChYuu+BYtYZZ9fpb>JF;QZ$4%Y z<9cF)AG1`OlQe0U@ixlrSHiq5S7 literal 0 HcmV?d00001