From aa448cc544515fdc79ae765638f4c93b374aa194 Mon Sep 17 00:00:00 2001
From: Nander Stabel <nander.stabel@impierce.com>
Date: Mon, 4 May 2026 18:02:37 +0200
Subject: [PATCH 01/34] build: bump `identity_*` dependencies to
 `v1.9.6-beta.1` (#334)

---
 Cargo.lock                      | 634 ++++++++++++++------------------
 Cargo.toml                      |  30 +-
 agent_application/Cargo.toml    |   2 +-
 agent_secret_manager/Cargo.toml |   6 +-
 4 files changed, 294 insertions(+), 378 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 68c1b9fd..3af69266 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -308,7 +308,7 @@ dependencies = [
  "identity_document",
  "identity_iota",
  "identity_storage",
- "iota-sdk 1.19.1",
+ "iota-sdk 1.22.0-alpha",
  "itertools 0.14.0",
  "jsonwebtoken",
  "lazy_static",
@@ -433,7 +433,7 @@ dependencies = [
  "identity_jose",
  "identity_stronghold_ext",
  "iota-sdk 1.1.5",
- "iota-sdk 1.19.1",
+ "iota-sdk 1.22.0-alpha",
  "iota_stronghold",
  "jsonwebtoken",
  "lazy_static",
@@ -622,7 +622,7 @@ dependencies = [
  "rcgen",
  "ring",
  "rustls 0.23.28",
- "rustls-webpki 0.103.3",
+ "rustls-webpki 0.103.13",
  "serde",
  "serde_json",
  "socket2 0.5.10",
@@ -727,6 +727,16 @@ dependencies = [
  "derive_arbitrary",
 ]
 
+[[package]]
+name = "arc-swap"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a3a1fd6f75306b68087b831f025c712524bcb19aad54e557b1129cfa0a2b207"
+dependencies = [
+ "rustversion",
+ "serde",
+]
+
 [[package]]
 name = "ark-bn254"
 version = "0.4.0"
@@ -996,7 +1006,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.104",
- "synstructure 0.13.2",
+ "synstructure",
 ]
 
 [[package]]
@@ -1096,7 +1106,7 @@ dependencies = [
  "futures-lite",
  "parking",
  "polling",
- "rustix 1.0.7",
+ "rustix",
  "slab",
  "tracing",
  "windows-sys 0.59.0",
@@ -1281,9 +1291,9 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.13.3"
+version = "1.16.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c953fe1ba023e6b7730c0d4b031d06f267f23a46167dcbd40316644b10a17ba"
+checksum = "0ec6fb3fe69024a75fa7e1bfb48aa6cf59706a101658ea01bfd33b2b248a038f"
 dependencies = [
  "aws-lc-sys",
  "zeroize",
@@ -1291,11 +1301,10 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.30.0"
+version = "0.40.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbfd150b5dbdb988bcc8fb1fe787eb6b7ee6180ca24da683b61ea5405f3d43ff"
+checksum = "f50037ee5e1e41e7b8f9d161680a725bd1626cb6f8c7e901f91f942850852fe7"
 dependencies = [
- "bindgen",
  "cc",
  "cmake",
  "dunce",
@@ -1443,6 +1452,28 @@ dependencies = [
  "syn 2.0.104",
 ]
 
+[[package]]
+name = "axum-server"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1df331683d982a0b9492b38127151e6453639cd34926eb9c07d4cd8c6d22bfc"
+dependencies = [
+ "arc-swap",
+ "bytes",
+ "either",
+ "fs-err",
+ "http 1.3.1",
+ "http-body 1.0.1",
+ "hyper 1.9.0",
+ "hyper-util",
+ "pin-project-lite",
+ "rustls 0.23.28",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls 0.26.2",
+ "tower-service",
+]
+
 [[package]]
 name = "backtrace"
 version = "0.3.75"
@@ -1593,29 +1624,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "bindgen"
-version = "0.69.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "271383c67ccabffb7381723dea0672a673f292304fcb45c01cc648c7a8d58088"
-dependencies = [
- "bitflags 2.9.1",
- "cexpr",
- "clang-sys",
- "itertools 0.12.1",
- "lazy_static",
- "lazycell",
- "log",
- "prettyplease",
- "proc-macro2",
- "quote",
- "regex",
- "rustc-hash 1.1.0",
- "shlex",
- "syn 2.0.104",
- "which",
-]
-
 [[package]]
 name = "bip32"
 version = "0.5.3"
@@ -1779,7 +1787,6 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
 dependencies = [
- "block-padding 0.2.1",
  "generic-array",
 ]
 
@@ -1792,12 +1799,6 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "block-padding"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d696c370c750c948ada61c69a0ee2cbbb9c50b1019ddb86d9317157a99c2cae"
-
 [[package]]
 name = "block-padding"
 version = "0.3.3"
@@ -2003,15 +2004,6 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
 
-[[package]]
-name = "cexpr"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
-dependencies = [
- "nom 7.1.3",
-]
-
 [[package]]
 name = "cfg-if"
 version = "1.0.1"
@@ -2111,17 +2103,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "clang-sys"
-version = "1.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
-dependencies = [
- "glob",
- "libc",
- "libloading",
-]
-
 [[package]]
 name = "clap"
 version = "4.5.40"
@@ -2225,7 +2206,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "117725a109d387c937a1533ce01b450cbde6b88abceea8473c4d7a85853cda3c"
 dependencies = [
  "lazy_static",
- "windows-sys 0.59.0",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -2275,7 +2256,7 @@ dependencies = [
 [[package]]
 name = "consensus-config"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "fastcrypto",
  "iota-network-stack",
@@ -2370,7 +2351,7 @@ checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
 [[package]]
 name = "consumer"
 version = "0.1.0"
-source = "git+https://github.com/impierce/did-manager?rev=48c5b60#48c5b605778773df5d8be85fe42913d06081cbbb"
+source = "git+https://github.com/impierce/did-manager?rev=cbf2993#cbf299350391d47d1f4858f46b539b8f4e85870c"
 dependencies = [
  "did_iota",
  "did_jwk",
@@ -2867,7 +2848,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8d162beedaa69905488a8da94f5ac3edb4dd4788b732fadb7bd120b2625c1976"
 dependencies = [
  "data-encoding",
- "syn 2.0.104",
+ "syn 1.0.109",
 ]
 
 [[package]]
@@ -3166,12 +3147,12 @@ dependencies = [
 [[package]]
 name = "did_iota"
 version = "0.1.0"
-source = "git+https://github.com/impierce/did-manager?rev=48c5b60#48c5b605778773df5d8be85fe42913d06081cbbb"
+source = "git+https://github.com/impierce/did-manager?rev=cbf2993#cbf299350391d47d1f4858f46b539b8f4e85870c"
 dependencies = [
  "anyhow",
  "identity_iota",
  "identity_stronghold",
- "iota-sdk 1.19.1",
+ "iota-sdk 1.22.0-alpha",
  "log",
  "rustls 0.23.28",
  "shared",
@@ -3181,12 +3162,12 @@ dependencies = [
 [[package]]
 name = "did_jwk"
 version = "0.1.0"
-source = "git+https://github.com/impierce/did-manager?rev=48c5b60#48c5b605778773df5d8be85fe42913d06081cbbb"
+source = "git+https://github.com/impierce/did-manager?rev=cbf2993#cbf299350391d47d1f4858f46b539b8f4e85870c"
 dependencies = [
  "did-jwk",
  "identity_iota",
  "identity_stronghold",
- "iota-sdk 1.19.1",
+ "iota-sdk 1.22.0-alpha",
  "log",
  "serde_json",
  "shared",
@@ -3198,12 +3179,12 @@ dependencies = [
 [[package]]
 name = "did_key"
 version = "0.1.0"
-source = "git+https://github.com/impierce/did-manager?rev=48c5b60#48c5b605778773df5d8be85fe42913d06081cbbb"
+source = "git+https://github.com/impierce/did-manager?rev=cbf2993#cbf299350391d47d1f4858f46b539b8f4e85870c"
 dependencies = [
  "did-method-key",
  "identity_iota",
  "identity_stronghold",
- "iota-sdk 1.19.1",
+ "iota-sdk 1.22.0-alpha",
  "jsonwebkey",
  "log",
  "serde_json",
@@ -3216,7 +3197,7 @@ dependencies = [
 [[package]]
 name = "did_manager"
 version = "0.1.0"
-source = "git+https://github.com/impierce/did-manager?rev=48c5b60#48c5b605778773df5d8be85fe42913d06081cbbb"
+source = "git+https://github.com/impierce/did-manager?rev=cbf2993#cbf299350391d47d1f4858f46b539b8f4e85870c"
 dependencies = [
  "consumer",
  "producer",
@@ -3254,12 +3235,12 @@ dependencies = [
 [[package]]
 name = "did_web"
 version = "0.1.0"
-source = "git+https://github.com/impierce/did-manager?rev=48c5b60#48c5b605778773df5d8be85fe42913d06081cbbb"
+source = "git+https://github.com/impierce/did-manager?rev=cbf2993#cbf299350391d47d1f4858f46b539b8f4e85870c"
 dependencies = [
  "did-web",
  "identity_iota",
  "identity_stronghold",
- "iota-sdk 1.19.1",
+ "iota-sdk 1.22.0-alpha",
  "log",
  "serde_json",
  "shared",
@@ -3592,7 +3573,7 @@ dependencies = [
 [[package]]
 name = "enum-compat-util"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "serde_yaml",
 ]
@@ -3766,7 +3747,7 @@ dependencies = [
  "serde_json",
  "serde_with 3.13.0",
  "sha2 0.10.9",
- "sha3 0.10.8",
+ "sha3",
  "signature 2.2.0",
  "static_assertions",
  "thiserror 1.0.69",
@@ -3796,7 +3777,7 @@ dependencies = [
  "itertools 0.10.5",
  "rand 0.8.5",
  "serde",
- "sha3 0.10.8",
+ "sha3",
  "tap",
  "tracing",
  "typenum",
@@ -4014,6 +3995,16 @@ dependencies = [
  "num",
 ]
 
+[[package]]
+name = "fs-err"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73fde052dbfc920003cfd2c8e2c6e6d4cc7c1091538c3a24226cec0665ab08c0"
+dependencies = [
+ "autocfg",
+ "tokio",
+]
+
 [[package]]
 name = "fs_extra"
 version = "1.3.0"
@@ -5031,8 +5022,8 @@ checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
 
 [[package]]
 name = "identity_core"
-version = "1.9.4-beta.1"
-source = "git+https://github.com/iotaledger/identity?tag=v1.9.4-beta.1#b40bad246db7e7dd40bb079b43da5d375d9481d6"
+version = "1.9.6-beta.1"
+source = "git+https://github.com/iotaledger/identity?tag=v1.9.6-beta.1#d3fb5246d017cef360cef289e0f8e34ff2ce65ef"
 dependencies = [
  "deranged",
  "js-sys",
@@ -5049,8 +5040,8 @@ dependencies = [
 
 [[package]]
 name = "identity_credential"
-version = "1.9.4-beta.1"
-source = "git+https://github.com/iotaledger/identity?tag=v1.9.4-beta.1#b40bad246db7e7dd40bb079b43da5d375d9481d6"
+version = "1.9.6-beta.1"
+source = "git+https://github.com/iotaledger/identity?tag=v1.9.6-beta.1#d3fb5246d017cef360cef289e0f8e34ff2ce65ef"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -5077,8 +5068,8 @@ dependencies = [
 
 [[package]]
 name = "identity_did"
-version = "1.9.4-beta.1"
-source = "git+https://github.com/iotaledger/identity?tag=v1.9.4-beta.1#b40bad246db7e7dd40bb079b43da5d375d9481d6"
+version = "1.9.6-beta.1"
+source = "git+https://github.com/iotaledger/identity?tag=v1.9.6-beta.1#d3fb5246d017cef360cef289e0f8e34ff2ce65ef"
 dependencies = [
  "did_url_parser 0.3.0",
  "form_urlencoded",
@@ -5091,8 +5082,8 @@ dependencies = [
 
 [[package]]
 name = "identity_document"
-version = "1.9.4-beta.1"
-source = "git+https://github.com/iotaledger/identity?tag=v1.9.4-beta.1#b40bad246db7e7dd40bb079b43da5d375d9481d6"
+version = "1.9.6-beta.1"
+source = "git+https://github.com/iotaledger/identity?tag=v1.9.6-beta.1#d3fb5246d017cef360cef289e0f8e34ff2ce65ef"
 dependencies = [
  "did_url_parser 0.2.0",
  "identity_core",
@@ -5106,8 +5097,8 @@ dependencies = [
 
 [[package]]
 name = "identity_ecdsa_verifier"
-version = "1.9.4-beta.1"
-source = "git+https://github.com/iotaledger/identity?tag=v1.9.4-beta.1#b40bad246db7e7dd40bb079b43da5d375d9481d6"
+version = "1.9.6-beta.1"
+source = "git+https://github.com/iotaledger/identity?tag=v1.9.6-beta.1#d3fb5246d017cef360cef289e0f8e34ff2ce65ef"
 dependencies = [
  "identity_verification",
  "k256",
@@ -5117,8 +5108,8 @@ dependencies = [
 
 [[package]]
 name = "identity_eddsa_verifier"
-version = "1.9.4-beta.1"
-source = "git+https://github.com/iotaledger/identity?tag=v1.9.4-beta.1#b40bad246db7e7dd40bb079b43da5d375d9481d6"
+version = "1.9.6-beta.1"
+source = "git+https://github.com/iotaledger/identity?tag=v1.9.6-beta.1#d3fb5246d017cef360cef289e0f8e34ff2ce65ef"
 dependencies = [
  "identity_jose",
  "iota-crypto",
@@ -5126,8 +5117,8 @@ dependencies = [
 
 [[package]]
 name = "identity_iota"
-version = "1.9.4-beta.1"
-source = "git+https://github.com/iotaledger/identity?tag=v1.9.4-beta.1#b40bad246db7e7dd40bb079b43da5d375d9481d6"
+version = "1.9.6-beta.1"
+source = "git+https://github.com/iotaledger/identity?tag=v1.9.6-beta.1#d3fb5246d017cef360cef289e0f8e34ff2ce65ef"
 dependencies = [
  "identity_core",
  "identity_credential",
@@ -5142,8 +5133,8 @@ dependencies = [
 
 [[package]]
 name = "identity_iota_core"
-version = "1.9.4-beta.1"
-source = "git+https://github.com/iotaledger/identity?tag=v1.9.4-beta.1#b40bad246db7e7dd40bb079b43da5d375d9481d6"
+version = "1.9.6-beta.1"
+source = "git+https://github.com/iotaledger/identity?tag=v1.9.6-beta.1#d3fb5246d017cef360cef289e0f8e34ff2ce65ef"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -5162,7 +5153,7 @@ dependencies = [
  "identity_verification",
  "iota-config",
  "iota-crypto",
- "iota-sdk 1.19.1",
+ "iota-sdk 1.22.0-alpha",
  "iota_interaction",
  "iota_interaction_rust",
  "iota_interaction_ts",
@@ -5187,8 +5178,8 @@ dependencies = [
 
 [[package]]
 name = "identity_jose"
-version = "1.9.4-beta.1"
-source = "git+https://github.com/iotaledger/identity?tag=v1.9.4-beta.1#b40bad246db7e7dd40bb079b43da5d375d9481d6"
+version = "1.9.6-beta.1"
+source = "git+https://github.com/iotaledger/identity?tag=v1.9.6-beta.1#d3fb5246d017cef360cef289e0f8e34ff2ce65ef"
 dependencies = [
  "anyhow",
  "bls12_381_plus 0.8.18",
@@ -5207,8 +5198,8 @@ dependencies = [
 
 [[package]]
 name = "identity_resolver"
-version = "1.9.4-beta.1"
-source = "git+https://github.com/iotaledger/identity?tag=v1.9.4-beta.1#b40bad246db7e7dd40bb079b43da5d375d9481d6"
+version = "1.9.6-beta.1"
+source = "git+https://github.com/iotaledger/identity?tag=v1.9.6-beta.1#d3fb5246d017cef360cef289e0f8e34ff2ce65ef"
 dependencies = [
  "async-trait",
  "futures",
@@ -5224,8 +5215,8 @@ dependencies = [
 
 [[package]]
 name = "identity_storage"
-version = "1.9.4-beta.1"
-source = "git+https://github.com/iotaledger/identity?tag=v1.9.4-beta.1#b40bad246db7e7dd40bb079b43da5d375d9481d6"
+version = "1.9.6-beta.1"
+source = "git+https://github.com/iotaledger/identity?tag=v1.9.6-beta.1#d3fb5246d017cef360cef289e0f8e34ff2ce65ef"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -5252,8 +5243,8 @@ dependencies = [
 
 [[package]]
 name = "identity_stronghold"
-version = "1.9.4-beta.1"
-source = "git+https://github.com/iotaledger/identity?tag=v1.9.4-beta.1#b40bad246db7e7dd40bb079b43da5d375d9481d6"
+version = "1.9.6-beta.1"
+source = "git+https://github.com/iotaledger/identity?tag=v1.9.6-beta.1#d3fb5246d017cef360cef289e0f8e34ff2ce65ef"
 dependencies = [
  "async-trait",
  "identity_storage",
@@ -5269,7 +5260,7 @@ dependencies = [
 [[package]]
 name = "identity_stronghold_ext"
 version = "0.1.0"
-source = "git+https://github.com/impierce/did-manager?rev=48c5b60#48c5b605778773df5d8be85fe42913d06081cbbb"
+source = "git+https://github.com/impierce/did-manager?rev=cbf2993#cbf299350391d47d1f4858f46b539b8f4e85870c"
 dependencies = [
  "async-trait",
  "elliptic-curve 0.13.8",
@@ -5288,8 +5279,8 @@ dependencies = [
 
 [[package]]
 name = "identity_verification"
-version = "1.9.4-beta.1"
-source = "git+https://github.com/iotaledger/identity?tag=v1.9.4-beta.1#b40bad246db7e7dd40bb079b43da5d375d9481d6"
+version = "1.9.6-beta.1"
+source = "git+https://github.com/iotaledger/identity?tag=v1.9.6-beta.1#d3fb5246d017cef360cef289e0f8e34ff2ce65ef"
 dependencies = [
  "identity_core",
  "identity_did",
@@ -5423,7 +5414,7 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
 dependencies = [
- "block-padding 0.3.3",
+ "block-padding",
  "generic-array",
 ]
 
@@ -5454,10 +5445,11 @@ dependencies = [
 [[package]]
 name = "iota-adapter-latest"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "bcs",
+ "iota-common",
  "iota-macros",
  "iota-metrics",
  "iota-move-natives-latest",
@@ -5481,8 +5473,8 @@ dependencies = [
 
 [[package]]
 name = "iota-common"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "fastcrypto",
@@ -5492,7 +5484,6 @@ dependencies = [
  "iota-types",
  "once_cell",
  "parking_lot 0.12.4",
- "prometheus",
  "rand 0.8.5",
  "reqwest 0.12.20",
  "snap",
@@ -5503,8 +5494,8 @@ dependencies = [
 
 [[package]]
 name = "iota-config"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anemo",
  "anyhow",
@@ -5517,7 +5508,6 @@ dependencies = [
  "iota-genesis-common",
  "iota-keys",
  "iota-names",
- "iota-rest-api",
  "iota-types",
  "move-vm-config",
  "object_store",
@@ -5568,8 +5558,8 @@ dependencies = [
 
 [[package]]
 name = "iota-enum-compat-util"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "serde_yaml",
 ]
@@ -5577,7 +5567,7 @@ dependencies = [
 [[package]]
 name = "iota-execution"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "iota-adapter-latest",
  "iota-move-natives-latest",
@@ -5594,8 +5584,8 @@ dependencies = [
 
 [[package]]
 name = "iota-genesis-common"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "iota-execution",
  "iota-protocol-config",
@@ -5605,8 +5595,8 @@ dependencies = [
 
 [[package]]
 name = "iota-http"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "bytes",
  "http 1.3.1",
@@ -5614,6 +5604,7 @@ dependencies = [
  "http-body-util",
  "hyper 1.9.0",
  "hyper-util",
+ "iota-tls",
  "pin-project-lite",
  "socket2 0.5.10",
  "tokio",
@@ -5625,8 +5616,8 @@ dependencies = [
 
 [[package]]
 name = "iota-json"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "bcs",
@@ -5642,8 +5633,8 @@ dependencies = [
 
 [[package]]
 name = "iota-json-rpc-api"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "fastcrypto",
@@ -5662,8 +5653,8 @@ dependencies = [
 
 [[package]]
 name = "iota-json-rpc-types"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "bcs",
@@ -5697,8 +5688,8 @@ dependencies = [
 
 [[package]]
 name = "iota-keys"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "bip32",
@@ -5718,8 +5709,8 @@ dependencies = [
 
 [[package]]
 name = "iota-macros"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "futures",
  "iota-proc-macros",
@@ -5729,8 +5720,8 @@ dependencies = [
 
 [[package]]
 name = "iota-metrics"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anemo",
  "anemo-tower",
@@ -5756,7 +5747,7 @@ dependencies = [
 [[package]]
 name = "iota-move-natives-latest"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "bcs",
  "better_any",
@@ -5779,8 +5770,8 @@ dependencies = [
 
 [[package]]
 name = "iota-names"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "bcs",
@@ -5792,8 +5783,8 @@ dependencies = [
 
 [[package]]
 name = "iota-network-stack"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anemo",
  "bcs",
@@ -5822,8 +5813,8 @@ dependencies = [
 
 [[package]]
 name = "iota-open-rpc"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "schemars 0.8.22",
  "serde",
@@ -5833,8 +5824,8 @@ dependencies = [
 
 [[package]]
 name = "iota-open-rpc-macros"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "derive-syn-parse 0.1.5",
  "itertools 0.13.0",
@@ -5846,8 +5837,8 @@ dependencies = [
 
 [[package]]
 name = "iota-package-resolver"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "async-trait",
  "bcs",
@@ -5862,8 +5853,8 @@ dependencies = [
 
 [[package]]
 name = "iota-proc-macros"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "msim-macros",
  "proc-macro2",
@@ -5873,8 +5864,8 @@ dependencies = [
 
 [[package]]
 name = "iota-protocol-config"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "clap",
  "iota-protocol-config-macros",
@@ -5888,43 +5879,14 @@ dependencies = [
 
 [[package]]
 name = "iota-protocol-config-macros"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn 1.0.109",
 ]
 
-[[package]]
-name = "iota-rest-api"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
-dependencies = [
- "anyhow",
- "axum 0.8.3",
- "bcs",
- "fastcrypto",
- "iota-network-stack",
- "iota-protocol-config",
- "iota-sdk-types",
- "iota-types",
- "itertools 0.13.0",
- "mime",
- "move-binary-format",
- "openapiv3",
- "prometheus",
- "reqwest 0.12.20",
- "schemars 0.8.22",
- "serde",
- "serde_json",
- "serde_with 3.13.0",
- "serde_yaml",
- "tap",
- "tokio",
- "url",
-]
-
 [[package]]
 name = "iota-sdk"
 version = "1.1.5"
@@ -5971,8 +5933,8 @@ dependencies = [
 
 [[package]]
 name = "iota-sdk"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -6007,7 +5969,7 @@ dependencies = [
 [[package]]
 name = "iota-sdk-types"
 version = "0.0.1-alpha.1"
-source = "git+https://github.com/iotaledger/iota-rust-sdk.git?rev=d8cdab6ab3f2fd9ba8059ba56e80ba950badc88d#d8cdab6ab3f2fd9ba8059ba56e80ba950badc88d"
+source = "git+https://github.com/iotaledger/iota-rust-sdk.git?rev=e19c78a1bee17e0bf85fcd5b16a2f080cef26274#e19c78a1bee17e0bf85fcd5b16a2f080cef26274"
 dependencies = [
  "base64ct",
  "bcs",
@@ -6028,10 +5990,32 @@ dependencies = [
  "winnow 0.7.11",
 ]
 
+[[package]]
+name = "iota-tls"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
+dependencies = [
+ "anyhow",
+ "arc-swap",
+ "axum 0.8.3",
+ "axum-server",
+ "ed25519 2.2.3",
+ "fastcrypto",
+ "pkcs8 0.10.2",
+ "rcgen",
+ "reqwest 0.12.20",
+ "rustls 0.23.28",
+ "rustls-webpki 0.103.13",
+ "tokio",
+ "tokio-rustls 0.26.2",
+ "tower-layer",
+ "x509-parser",
+]
+
 [[package]]
 name = "iota-transaction-builder"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -6047,8 +6031,8 @@ dependencies = [
 
 [[package]]
 name = "iota-types"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anemo",
  "anyhow",
@@ -6085,7 +6069,6 @@ dependencies = [
  "move-vm-test-utils",
  "nonempty",
  "num-bigint 0.4.6",
- "num-rational",
  "num-traits",
  "once_cell",
  "parking_lot 0.12.4",
@@ -6114,7 +6097,7 @@ dependencies = [
 [[package]]
 name = "iota-verifier-latest"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "bcs",
  "iota-types",
@@ -6129,8 +6112,8 @@ dependencies = [
 
 [[package]]
 name = "iota_interaction"
-version = "0.8.14"
-source = "git+https://github.com/iotaledger/product-core?tag=v0.8.14#c18bea2bdd3f4d1ff6a5606fd8d5d03b0a6b4862"
+version = "0.8.16"
+source = "git+https://github.com/iotaledger/product-core?tag=v0.8.16#1d3480d6536cdf9152e754a4d1c7474438785f4a"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -6144,7 +6127,7 @@ dependencies = [
  "hex",
  "hyper 1.9.0",
  "indexmap 2.12.0",
- "iota-sdk 1.19.1",
+ "iota-sdk 1.22.0-alpha",
  "iota-sdk-types",
  "itertools 0.13.0",
  "jsonpath-rust",
@@ -6172,8 +6155,8 @@ dependencies = [
 
 [[package]]
 name = "iota_interaction_rust"
-version = "0.8.14"
-source = "git+https://github.com/iotaledger/product-core?tag=v0.8.14#c18bea2bdd3f4d1ff6a5606fd8d5d03b0a6b4862"
+version = "0.8.16"
+source = "git+https://github.com/iotaledger/product-core?tag=v0.8.16#1d3480d6536cdf9152e754a4d1c7474438785f4a"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -6185,8 +6168,8 @@ dependencies = [
 
 [[package]]
 name = "iota_interaction_ts"
-version = "0.8.14"
-source = "git+https://github.com/iotaledger/product-core?tag=v0.8.14#c18bea2bdd3f4d1ff6a5606fd8d5d03b0a6b4862"
+version = "0.8.16"
+source = "git+https://github.com/iotaledger/product-core?tag=v0.8.16#1d3480d6536cdf9152e754a4d1c7474438785f4a"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -6986,12 +6969,6 @@ dependencies = [
  "spin",
 ]
 
-[[package]]
-name = "lazycell"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
-
 [[package]]
 name = "leb128"
 version = "0.2.5"
@@ -7107,22 +7084,26 @@ dependencies = [
  "rle-decode-fast",
 ]
 
-[[package]]
-name = "libloading"
-version = "0.8.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07033963ba89ebaf1584d767badaa2e8fcec21aedea6b8c0346d487d49c28667"
-dependencies = [
- "cfg-if",
- "windows-targets 0.53.2",
-]
-
 [[package]]
 name = "libm"
 version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9fbbcab51052fe104eb5e5d351cf728d30a5be1fe14d9be8a3b097481fb97de"
 
+[[package]]
+name = "libp2p-identity"
+version = "0.2.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0c7892c221730ba55f7196e98b0b8ba5e04b4155651736036628e9f73ed6fc3"
+dependencies = [
+ "bs58 0.5.1",
+ "hkdf 0.12.4",
+ "multihash",
+ "sha2 0.10.9",
+ "thiserror 2.0.12",
+ "tracing",
+]
+
 [[package]]
 name = "libredox"
 version = "0.1.3"
@@ -7226,12 +7207,6 @@ version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
 
-[[package]]
-name = "linux-raw-sys"
-version = "0.4.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
-
 [[package]]
 name = "linux-raw-sys"
 version = "0.9.4"
@@ -7636,7 +7611,7 @@ dependencies = [
 [[package]]
 name = "move-abstract-interpreter"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "move-binary-format",
  "move-bytecode-verifier-meter",
@@ -7645,12 +7620,12 @@ dependencies = [
 [[package]]
 name = "move-abstract-stack"
 version = "0.0.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 
 [[package]]
 name = "move-binary-format"
 version = "0.0.3"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "enum-compat-util",
@@ -7665,12 +7640,12 @@ dependencies = [
 [[package]]
 name = "move-borrow-graph"
 version = "0.0.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 
 [[package]]
 name = "move-bytecode-source-map"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "bcs",
@@ -7686,7 +7661,7 @@ dependencies = [
 [[package]]
 name = "move-bytecode-utils"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "indexmap 2.12.0",
@@ -7700,7 +7675,7 @@ dependencies = [
 [[package]]
 name = "move-bytecode-verifier"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "move-abstract-interpreter",
  "move-abstract-stack",
@@ -7708,6 +7683,7 @@ dependencies = [
  "move-borrow-graph",
  "move-bytecode-verifier-meter",
  "move-core-types",
+ "move-regex-borrow-graph",
  "move-vm-config",
  "petgraph",
 ]
@@ -7715,7 +7691,7 @@ dependencies = [
 [[package]]
 name = "move-bytecode-verifier-meter"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "move-binary-format",
  "move-core-types",
@@ -7725,7 +7701,7 @@ dependencies = [
 [[package]]
 name = "move-command-line-common"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "bcs",
@@ -7737,7 +7713,7 @@ dependencies = [
  "once_cell",
  "packed_struct",
  "serde",
- "sha2 0.9.9",
+ "sha2 0.10.9",
  "vfs",
  "walkdir",
 ]
@@ -7745,7 +7721,7 @@ dependencies = [
 [[package]]
 name = "move-compiler"
 version = "0.0.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "bcs",
@@ -7780,7 +7756,7 @@ dependencies = [
 [[package]]
 name = "move-core-types"
 version = "0.0.4"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "bcs",
@@ -7804,7 +7780,7 @@ dependencies = [
 [[package]]
 name = "move-coverage"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "bcs",
@@ -7825,7 +7801,7 @@ dependencies = [
 [[package]]
 name = "move-disassembler"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "bcs",
@@ -7846,7 +7822,7 @@ dependencies = [
 [[package]]
 name = "move-ir-to-bytecode"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "codespan-reporting",
@@ -7864,7 +7840,7 @@ dependencies = [
 [[package]]
 name = "move-ir-to-bytecode-syntax"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "hex",
@@ -7877,7 +7853,7 @@ dependencies = [
 [[package]]
 name = "move-ir-types"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "hex",
  "move-command-line-common",
@@ -7890,31 +7866,41 @@ dependencies = [
 [[package]]
 name = "move-proc-macros"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "quote",
  "syn 2.0.104",
 ]
 
+[[package]]
+name = "move-regex-borrow-graph"
+version = "0.0.1"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
+dependencies = [
+ "move-binary-format",
+ "move-core-types",
+ "petgraph",
+]
+
 [[package]]
 name = "move-stdlib-natives"
 version = "0.1.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "hex",
  "move-binary-format",
  "move-core-types",
  "move-vm-runtime",
  "move-vm-types",
- "sha2 0.9.9",
- "sha3 0.9.1",
+ "sha2 0.10.9",
+ "sha3",
  "smallvec",
 ]
 
 [[package]]
 name = "move-symbol-pool"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "once_cell",
  "phf",
@@ -7924,7 +7910,7 @@ dependencies = [
 [[package]]
 name = "move-trace-format"
 version = "0.0.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "move-binary-format",
  "move-core-types",
@@ -7935,7 +7921,7 @@ dependencies = [
 [[package]]
 name = "move-vm-config"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "move-binary-format",
  "once_cell",
@@ -7944,7 +7930,7 @@ dependencies = [
 [[package]]
 name = "move-vm-profiler"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "move-vm-config",
  "once_cell",
@@ -7954,7 +7940,7 @@ dependencies = [
 [[package]]
 name = "move-vm-runtime"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "better_any",
  "fail",
@@ -7974,7 +7960,7 @@ dependencies = [
 [[package]]
 name = "move-vm-test-utils"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "move-binary-format",
@@ -7988,7 +7974,7 @@ dependencies = [
 [[package]]
 name = "move-vm-types"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "bcs",
  "move-binary-format",
@@ -8017,20 +8003,20 @@ dependencies = [
 
 [[package]]
 name = "multiaddr"
-version = "0.17.1"
+version = "0.18.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b36f567c7099511fa8612bbbb52dda2419ce0bdbacf31714e3a5ffdb766d3bd"
+checksum = "fe6351f60b488e04c1d21bc69e56b89cb3f5e8f5d22557d6e8031bdfd79b6961"
 dependencies = [
  "arrayref",
  "byteorder",
  "data-encoding",
- "log",
+ "libp2p-identity",
  "multibase 0.9.1",
  "multihash",
  "percent-encoding",
  "serde",
  "static_assertions",
- "unsigned-varint",
+ "unsigned-varint 0.8.0",
  "url",
 ]
 
@@ -8058,27 +8044,11 @@ dependencies = [
 
 [[package]]
 name = "multihash"
-version = "0.17.0"
+version = "0.19.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "835d6ff01d610179fbce3de1694d007e500bf33a7f29689838941d6bf783ae40"
+checksum = "577c63b00ad74d57e8c9aa870b5fccebf2fd64a308a5aee9f1bb88e4aea19447"
 dependencies = [
- "core2",
- "multihash-derive",
- "unsigned-varint",
-]
-
-[[package]]
-name = "multihash-derive"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc076939022111618a5026d3be019fd8b366e76314538ff9a1b59ffbcbf98bcd"
-dependencies = [
- "proc-macro-crate 1.3.1",
- "proc-macro-error",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
- "synstructure 0.12.6",
+ "unsigned-varint 0.8.0",
 ]
 
 [[package]]
@@ -8475,7 +8445,7 @@ dependencies = [
 [[package]]
 name = "oid4vc-core"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=0c3e60a#0c3e60a8ac7d8bfff2913a41c61ab39938f1e021"
+source = "git+https://github.com/impierce/openid4vc?rev=a9dd71a#a9dd71ab8baa5fff5368c04384a75fc48c1678b4"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -8507,7 +8477,7 @@ dependencies = [
 [[package]]
 name = "oid4vc-manager"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=0c3e60a#0c3e60a8ac7d8bfff2913a41c61ab39938f1e021"
+source = "git+https://github.com/impierce/openid4vc?rev=a9dd71a#a9dd71ab8baa5fff5368c04384a75fc48c1678b4"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -8540,7 +8510,7 @@ dependencies = [
 [[package]]
 name = "oid4vci"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=0c3e60a#0c3e60a8ac7d8bfff2913a41c61ab39938f1e021"
+source = "git+https://github.com/impierce/openid4vc?rev=a9dd71a#a9dd71ab8baa5fff5368c04384a75fc48c1678b4"
 dependencies = [
  "anyhow",
  "chrono",
@@ -8568,7 +8538,7 @@ dependencies = [
 [[package]]
 name = "oid4vp"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=0c3e60a#0c3e60a8ac7d8bfff2913a41c61ab39938f1e021"
+source = "git+https://github.com/impierce/openid4vc?rev=a9dd71a#a9dd71ab8baa5fff5368c04384a75fc48c1678b4"
 dependencies = [
  "anyhow",
  "chrono",
@@ -8615,17 +8585,6 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
-[[package]]
-name = "openapiv3"
-version = "2.0.0"
-source = "git+https://github.com/bmwill/openapiv3.git?rev=ca4b4845b7c159a39f5c68ad8f7f76cb6f4d6963#ca4b4845b7c159a39f5c68ad8f7f76cb6f4d6963"
-dependencies = [
- "indexmap 2.12.0",
- "schemars 0.8.22",
- "serde",
- "serde_json",
-]
-
 [[package]]
 name = "openssl-probe"
 version = "0.1.6"
@@ -9269,7 +9228,7 @@ dependencies = [
  "concurrent-queue",
  "hermit-abi",
  "pin-project-lite",
- "rustix 1.0.7",
+ "rustix",
  "tracing",
  "windows-sys 0.59.0",
 ]
@@ -9492,7 +9451,7 @@ dependencies = [
 [[package]]
 name = "producer"
 version = "0.1.0"
-source = "git+https://github.com/impierce/did-manager?rev=48c5b60#48c5b605778773df5d8be85fe42913d06081cbbb"
+source = "git+https://github.com/impierce/did-manager?rev=cbf2993#cbf299350391d47d1f4858f46b539b8f4e85870c"
 dependencies = [
  "did_iota",
  "did_jwk",
@@ -9513,8 +9472,8 @@ dependencies = [
 
 [[package]]
 name = "product_common"
-version = "0.8.14"
-source = "git+https://github.com/iotaledger/product-core?tag=v0.8.14#c18bea2bdd3f4d1ff6a5606fd8d5d03b0a6b4862"
+version = "0.8.16"
+source = "git+https://github.com/iotaledger/product-core?tag=v0.8.16#1d3480d6536cdf9152e754a4d1c7474438785f4a"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -9522,7 +9481,7 @@ dependencies = [
  "cfg-if",
  "fastcrypto",
  "hyper 1.9.0",
- "iota-sdk 1.19.1",
+ "iota-sdk 1.22.0-alpha",
  "iota-sdk-types",
  "iota_interaction",
  "iota_interaction_rust",
@@ -9557,8 +9516,8 @@ dependencies = [
 
 [[package]]
 name = "prometheus-closure-metric"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
  "prometheus",
@@ -9581,7 +9540,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
 dependencies = [
  "anyhow",
- "itertools 0.14.0",
+ "itertools 0.10.5",
  "proc-macro2",
  "quote",
  "syn 2.0.104",
@@ -10538,19 +10497,6 @@ dependencies = [
  "nom 7.1.3",
 ]
 
-[[package]]
-name = "rustix"
-version = "0.38.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
-dependencies = [
- "bitflags 2.9.1",
- "errno",
- "libc",
- "linux-raw-sys 0.4.15",
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "rustix"
 version = "1.0.7"
@@ -10560,7 +10506,7 @@ dependencies = [
  "bitflags 2.9.1",
  "errno",
  "libc",
- "linux-raw-sys 0.9.4",
+ "linux-raw-sys",
  "windows-sys 0.59.0",
 ]
 
@@ -10587,7 +10533,7 @@ dependencies = [
  "once_cell",
  "ring",
  "rustls-pki-types",
- "rustls-webpki 0.103.3",
+ "rustls-webpki 0.103.13",
  "subtle",
  "zeroize",
 ]
@@ -10671,7 +10617,7 @@ dependencies = [
  "rustls 0.23.28",
  "rustls-native-certs 0.8.1",
  "rustls-platform-verifier-android",
- "rustls-webpki 0.103.3",
+ "rustls-webpki 0.103.13",
  "security-framework 3.5.1",
  "security-framework-sys",
  "webpki-root-certs 0.26.11",
@@ -10692,7 +10638,7 @@ dependencies = [
  "rustls 0.23.28",
  "rustls-native-certs 0.8.1",
  "rustls-platform-verifier-android",
- "rustls-webpki 0.103.3",
+ "rustls-webpki 0.103.13",
  "security-framework 3.5.1",
  "security-framework-sys",
  "webpki-root-certs 1.0.1",
@@ -10727,9 +10673,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.3"
+version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4a72fe2bcf7a6ac6fd7d0b9e5cb68aeb7d4c0a0271730218b3e92d43b4eb435"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
  "aws-lc-rs",
  "ring",
@@ -11346,18 +11292,6 @@ dependencies = [
  "digest 0.10.7",
 ]
 
-[[package]]
-name = "sha3"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f81199417d4e5de3f04b1e871023acea7389672c4135918f05aa9cbf2f2fa809"
-dependencies = [
- "block-buffer 0.9.0",
- "digest 0.9.0",
- "keccak",
- "opaque-debug",
-]
-
 [[package]]
 name = "sha3"
 version = "0.10.8"
@@ -11380,7 +11314,7 @@ dependencies = [
 [[package]]
 name = "shared"
 version = "0.1.0"
-source = "git+https://github.com/impierce/did-manager?rev=48c5b60#48c5b605778773df5d8be85fe42913d06081cbbb"
+source = "git+https://github.com/impierce/did-manager?rev=cbf2993#cbf299350391d47d1f4858f46b539b8f4e85870c"
 dependencies = [
  "identity_iota",
  "identity_storage",
@@ -11503,7 +11437,7 @@ dependencies = [
 [[package]]
 name = "siopv2"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=0c3e60a#0c3e60a8ac7d8bfff2913a41c61ab39938f1e021"
+source = "git+https://github.com/impierce/openid4vc?rev=a9dd71a#a9dd71ab8baa5fff5368c04384a75fc48c1678b4"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -11608,7 +11542,7 @@ version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1c97747dbf44bb1ca44a561ece23508e99cb592e862f22222dcf42f51d1e451"
 dependencies = [
- "heck 0.5.0",
+ "heck 0.4.1",
  "proc-macro2",
  "quote",
  "syn 2.0.104",
@@ -12092,7 +12026,7 @@ dependencies = [
  "simple_asn1 0.5.4",
  "ssi-crypto 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "thiserror 1.0.69",
- "unsigned-varint",
+ "unsigned-varint 0.7.2",
  "zeroize",
 ]
 
@@ -12111,7 +12045,7 @@ dependencies = [
  "simple_asn1 0.5.4",
  "ssi-crypto 0.1.1 (git+https://github.com/impierce/spruceid-ssi.git)",
  "thiserror 1.0.69",
- "unsigned-varint",
+ "unsigned-varint 0.7.2",
  "zeroize",
 ]
 
@@ -12137,7 +12071,7 @@ dependencies = [
 [[package]]
 name = "starfish-config"
 version = "0.1.0"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "blake3",
  "fastcrypto",
@@ -12404,18 +12338,6 @@ dependencies = [
  "futures-core",
 ]
 
-[[package]]
-name = "synstructure"
-version = "0.12.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f36bdaa60a83aca3921b5259d5400cbf5e90fc51931376a9bd4a0eb79aa7210f"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
- "unicode-xid",
-]
-
 [[package]]
 name = "synstructure"
 version = "0.13.2"
@@ -12536,7 +12458,7 @@ dependencies = [
  "fastrand",
  "getrandom 0.3.4",
  "once_cell",
- "rustix 1.0.7",
+ "rustix",
  "windows-sys 0.59.0",
 ]
 
@@ -12555,7 +12477,7 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "45c6481c4829e4cc63825e62c49186a34538b7b2750b73b266581ffb612fb5ed"
 dependencies = [
- "rustix 1.0.7",
+ "rustix",
  "windows-sys 0.59.0",
 ]
 
@@ -13203,8 +13125,8 @@ dependencies = [
 
 [[package]]
 name = "typed-store-error"
-version = "1.19.1"
-source = "git+https://github.com/iotaledger/iota?tag=v1.19.1#fa39361cc6382e962c3ca059e773d76d19373b85"
+version = "1.22.0-alpha"
+source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "serde",
  "thiserror 1.0.69",
@@ -13347,6 +13269,12 @@ version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6889a77d49f1f013504cec6bf97a2c730394adedaeb1deb5ea08949a50541105"
 
+[[package]]
+name = "unsigned-varint"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb066959b24b5196ae73cb057f45598450d2c5f71460e98c49b738086eff9c06"
+
 [[package]]
 name = "untrusted"
 version = "0.9.0"
@@ -13754,18 +13682,6 @@ dependencies = [
  "rustls-pki-types",
 ]
 
-[[package]]
-name = "which"
-version = "4.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
-dependencies = [
- "either",
- "home",
- "once_cell",
- "rustix 0.38.44",
-]
-
 [[package]]
 name = "whoami"
 version = "1.6.0"
@@ -13804,7 +13720,7 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -14438,7 +14354,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0d65cbf2f12c15564212d48f4e3dfb87923d25d611f2aed18f4cb23f0413d89e"
 dependencies = [
  "libc",
- "rustix 1.0.7",
+ "rustix",
 ]
 
 [[package]]
@@ -14491,7 +14407,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.104",
- "synstructure 0.13.2",
+ "synstructure",
 ]
 
 [[package]]
@@ -14532,7 +14448,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.104",
- "synstructure 0.13.2",
+ "synstructure",
 ]
 
 [[package]]
@@ -14622,7 +14538,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2 0.10.9",
- "sha3 0.10.8",
+ "sha3",
  "thiserror 2.0.12",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index 081aecd5..16f4c1e4 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -33,11 +33,11 @@ rust-version = "1.76.0"
 pedantic = "warn"
 
 [workspace.dependencies]
-siopv2 = { git = "https://github.com/impierce/openid4vc", rev = "0c3e60a" }
-oid4vci = { git = "https://github.com/impierce/openid4vc", rev = "0c3e60a" }
-oid4vc-core = { git = "https://github.com/impierce/openid4vc", rev = "0c3e60a" }
-oid4vc-manager = { git = "https://github.com/impierce/openid4vc", rev = "0c3e60a" }
-oid4vp = { git = "https://github.com/impierce/openid4vc", rev = "0c3e60a" }
+siopv2 = { git = "https://github.com/impierce/openid4vc", rev = "a9dd71a" }
+oid4vci = { git = "https://github.com/impierce/openid4vc", rev = "a9dd71a" }
+oid4vc-core = { git = "https://github.com/impierce/openid4vc", rev = "a9dd71a" }
+oid4vc-manager = { git = "https://github.com/impierce/openid4vc", rev = "a9dd71a" }
+oid4vp = { git = "https://github.com/impierce/openid4vc", rev = "a9dd71a" }
 
 shared-kernel = { path = "shared-kernel" }
 
@@ -50,19 +50,19 @@ chrono = { version = "0.4", features = ["serde"] }
 cqrs-es = "0.4.12"
 derivative = "2.2"
 futures = "0.3"
-identity_core = { git = "https://github.com/iotaledger/identity", tag = "v1.9.4-beta.1" }
-identity_credential = { git = "https://github.com/iotaledger/identity", tag = "v1.9.4-beta.1", default-features = false, features = [
+identity_core = { git = "https://github.com/iotaledger/identity", tag = "v1.9.6-beta.1" }
+identity_credential = { git = "https://github.com/iotaledger/identity", tag = "v1.9.6-beta.1", default-features = false, features = [
     "domain-linkage",
     "presentation",
     "sd-jwt-vc",
 ] }
-identity_did = { git = "https://github.com/iotaledger/identity", tag = "v1.9.4-beta.1" }
-identity_document = { git = "https://github.com/iotaledger/identity", tag = "v1.9.4-beta.1" }
-identity_iota = { git = "https://github.com/iotaledger/identity", tag = "v1.9.4-beta.1" }
-identity_jose = { git = "https://github.com/iotaledger/identity", tag = "v1.9.4-beta.1" }
-identity_storage = { git = "https://github.com/iotaledger/identity", tag = "v1.9.4-beta.1" }
-identity_verification = { git = "https://github.com/iotaledger/identity", tag = "v1.9.4-beta.1", default-features = false }
-iota-sdk = { git = "https://github.com/iotaledger/iota", package = "iota-sdk", tag = "v1.19.1" }
+identity_did = { git = "https://github.com/iotaledger/identity", tag = "v1.9.6-beta.1" }
+identity_document = { git = "https://github.com/iotaledger/identity", tag = "v1.9.6-beta.1" }
+identity_iota = { git = "https://github.com/iotaledger/identity", tag = "v1.9.6-beta.1" }
+identity_jose = { git = "https://github.com/iotaledger/identity", tag = "v1.9.6-beta.1" }
+identity_storage = { git = "https://github.com/iotaledger/identity", tag = "v1.9.6-beta.1" }
+identity_verification = { git = "https://github.com/iotaledger/identity", tag = "v1.9.6-beta.1", default-features = false }
+iota-sdk = { git = "https://github.com/iotaledger/iota", package = "iota-sdk", rev = "96196f0da231883ec69cda04892c600ef6afa982" }
 # TODO: Check if this is still needed.
 iota-sdk-legacy = { version = "1.0", package = "iota-sdk", default-features = false, features = [
     "tls",
@@ -74,7 +74,7 @@ lazy_static = "1.4"
 mime = { version = "0.3" }
 oauth_tsl = { git = "https://github.com/impierce/oauth-token-status-list", rev = "0aa0228" }
 once_cell = { version = "1.19" }
-product_common = { git = "https://github.com/iotaledger/product-core", tag = "v0.8.14", package = "product_common", features = [
+product_common = { git = "https://github.com/iotaledger/product-core", tag = "v0.8.16", package = "product_common", features = [
     "gas-station",
     "default-http-client",
 ] }
diff --git a/agent_application/Cargo.toml b/agent_application/Cargo.toml
index 6a70070b..78bf69bd 100644
--- a/agent_application/Cargo.toml
+++ b/agent_application/Cargo.toml
@@ -16,7 +16,7 @@ agent_secret_manager = { path = "../agent_secret_manager" }
 agent_shared = { path = "../agent_shared" }
 agent_store = { path = "../agent_store" }
 agent_verification = { path = "../agent_verification" }
-did_manager = { git = "https://github.com/impierce/did-manager", rev = "48c5b60" }
+did_manager = { git = "https://github.com/impierce/did-manager", rev = "cbf2993" }
 
 anyhow.workspace = true
 axum.workspace = true
diff --git a/agent_secret_manager/Cargo.toml b/agent_secret_manager/Cargo.toml
index 5612bdff..873aeb4c 100644
--- a/agent_secret_manager/Cargo.toml
+++ b/agent_secret_manager/Cargo.toml
@@ -13,9 +13,9 @@ agent_shared = { path = "../agent_shared" }
 # - All components of the `identity_stronghold_ext` module are still active.
 #
 # Future work: Migrate the remaining functionality into UniCore.
-did_manager_consumer = { git = "https://github.com/impierce/did-manager", rev = "48c5b60", package = "consumer" }
-did_manager_identity_stronghold_ext = { git = "https://github.com/impierce/did-manager", rev = "48c5b60", package = "identity_stronghold_ext" }
-did_manager_iota = { git = "https://github.com/impierce/did-manager", rev = "48c5b60", package = "did_iota" }
+did_manager_consumer = { git = "https://github.com/impierce/did-manager", rev = "cbf2993", package = "consumer" }
+did_manager_identity_stronghold_ext = { git = "https://github.com/impierce/did-manager", rev = "cbf2993", package = "identity_stronghold_ext" }
+did_manager_iota = { git = "https://github.com/impierce/did-manager", rev = "cbf2993", package = "did_iota" }
 
 anyhow.workspace = true
 async-trait.workspace = true

From d5dbe82a2773f321adc7e046a9a91d7f39b17de6 Mon Sep 17 00:00:00 2001
From: Chaya <79284542+coplat@users.noreply.github.com>
Date: Fri, 8 May 2026 19:22:23 +0800
Subject: [PATCH 02/34] fix: add `vc+sd-jwt` to `vp_formats_supported` (#335)

---
 Cargo.lock                     | 10 +++++-----
 Cargo.toml                     | 10 +++++-----
 agent_shared/src/config/mod.rs | 11 ++++++++++-
 3 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 3af69266..40fc37e6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -8445,7 +8445,7 @@ dependencies = [
 [[package]]
 name = "oid4vc-core"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=a9dd71a#a9dd71ab8baa5fff5368c04384a75fc48c1678b4"
+source = "git+https://github.com/impierce/openid4vc?rev=e860178#e860178d46ff18cf6b08657ac4c8fa46e63ffa52"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -8477,7 +8477,7 @@ dependencies = [
 [[package]]
 name = "oid4vc-manager"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=a9dd71a#a9dd71ab8baa5fff5368c04384a75fc48c1678b4"
+source = "git+https://github.com/impierce/openid4vc?rev=e860178#e860178d46ff18cf6b08657ac4c8fa46e63ffa52"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -8510,7 +8510,7 @@ dependencies = [
 [[package]]
 name = "oid4vci"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=a9dd71a#a9dd71ab8baa5fff5368c04384a75fc48c1678b4"
+source = "git+https://github.com/impierce/openid4vc?rev=e860178#e860178d46ff18cf6b08657ac4c8fa46e63ffa52"
 dependencies = [
  "anyhow",
  "chrono",
@@ -8538,7 +8538,7 @@ dependencies = [
 [[package]]
 name = "oid4vp"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=a9dd71a#a9dd71ab8baa5fff5368c04384a75fc48c1678b4"
+source = "git+https://github.com/impierce/openid4vc?rev=e860178#e860178d46ff18cf6b08657ac4c8fa46e63ffa52"
 dependencies = [
  "anyhow",
  "chrono",
@@ -11437,7 +11437,7 @@ dependencies = [
 [[package]]
 name = "siopv2"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=a9dd71a#a9dd71ab8baa5fff5368c04384a75fc48c1678b4"
+source = "git+https://github.com/impierce/openid4vc?rev=e860178#e860178d46ff18cf6b08657ac4c8fa46e63ffa52"
 dependencies = [
  "anyhow",
  "async-trait",
diff --git a/Cargo.toml b/Cargo.toml
index 16f4c1e4..0cead50f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -33,11 +33,11 @@ rust-version = "1.76.0"
 pedantic = "warn"
 
 [workspace.dependencies]
-siopv2 = { git = "https://github.com/impierce/openid4vc", rev = "a9dd71a" }
-oid4vci = { git = "https://github.com/impierce/openid4vc", rev = "a9dd71a" }
-oid4vc-core = { git = "https://github.com/impierce/openid4vc", rev = "a9dd71a" }
-oid4vc-manager = { git = "https://github.com/impierce/openid4vc", rev = "a9dd71a" }
-oid4vp = { git = "https://github.com/impierce/openid4vc", rev = "a9dd71a" }
+siopv2 = { git = "https://github.com/impierce/openid4vc", rev = "e860178" }
+oid4vci = { git = "https://github.com/impierce/openid4vc", rev = "e860178" }
+oid4vc-core = { git = "https://github.com/impierce/openid4vc", rev = "e860178" }
+oid4vc-manager = { git = "https://github.com/impierce/openid4vc", rev = "e860178" }
+oid4vp = { git = "https://github.com/impierce/openid4vc", rev = "e860178" }
 
 shared-kernel = { path = "shared-kernel" }
 
diff --git a/agent_shared/src/config/mod.rs b/agent_shared/src/config/mod.rs
index 6a203cc9..d64cf2ea 100644
--- a/agent_shared/src/config/mod.rs
+++ b/agent_shared/src/config/mod.rs
@@ -12,6 +12,7 @@ use oid4vc_core::SubjectSyntaxType;
 use oid4vci::credential_issuer::credential_configurations_supported::CredentialMetadata;
 use oid4vci::credential_offer::TxCodeConstraints;
 use oid4vp::authorization_request::AlgValues;
+use oid4vp::authorization_request::VcSdJwtParameters;
 use oid4vp::authorization_request::{DcSdJwtParameters, JwtVcJsonParameters, JwtVpJsonParameters, VpFormatsSupported};
 use once_cell::sync::Lazy;
 use rand::Rng;
@@ -309,6 +310,10 @@ pub struct ApplicationConfiguration {
             sd_jwt_alg_values: Some(AlgValues::try_new(vec![Algorithm::ES256]).unwrap()),
             kb_jwt_alg_values: Some(AlgValues::try_new(vec![Algorithm::ES256]).unwrap())
                 }),
+        vc_sd_jwt: Some(VcSdJwtParameters {
+            sd_jwt_alg_values: Some(AlgValues::try_new(vec![Algorithm::ES256]).unwrap()),
+            kb_jwt_alg_values: Some(AlgValues::try_new(vec![Algorithm::ES256]).unwrap())
+                }),
         ldp_vc: None,
         di_vp: None,
         mso_mdoc: None,
@@ -1150,7 +1155,11 @@ mod tests {
                 "dc+sd-jwt": {
                   "sd-jwt_alg_values": ["ES256"],
                   "kb-jwt_alg_values": ["ES256"]
-                }
+                },
+                "vc+sd-jwt": {
+                  "sd-jwt_alg_values": ["ES256"],
+                  "kb-jwt_alg_values": ["ES256"]
+                },
               },
             })
         );

From ec6f88bea4527da8e28ced6dbe30b9a94839cb34 Mon Sep 17 00:00:00 2001
From: Nander Stabel <nander.stabel@impierce.com>
Date: Mon, 11 May 2026 14:50:51 +0200
Subject: [PATCH 03/34] fix: update issuer URL handling in server metadata
 loading (#338)

---
 agent_issuance/src/server_config/aggregate.rs |  9 ++++++++-
 agent_issuance/src/state.rs                   | 12 +++++-------
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/agent_issuance/src/server_config/aggregate.rs b/agent_issuance/src/server_config/aggregate.rs
index 3d622c79..a6d12cc2 100644
--- a/agent_issuance/src/server_config/aggregate.rs
+++ b/agent_issuance/src/server_config/aggregate.rs
@@ -1,4 +1,5 @@
 use agent_shared::config::{config, Authorization};
+use agent_shared::UrlAppendHelpers as _;
 use async_trait::async_trait;
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
 use cqrs_es::Aggregate;
@@ -106,9 +107,15 @@ impl Aggregate for ServerConfig {
             UpdateIssuerUrl { url } => {
                 let mut authorization_server_metadata = self.authorization_server_metadata.clone();
                 authorization_server_metadata.issuer = url.clone();
+                authorization_server_metadata.authorization_endpoint = Some(url.append_path_segment("auth/authorize"));
+                authorization_server_metadata.token_endpoint = Some(url.append_path_segment("auth/token"));
+                authorization_server_metadata.pushed_authorization_request_endpoint =
+                    Some(url.append_path_segment("auth/par"));
 
                 let mut credential_issuer_metadata = self.credential_issuer_metadata.clone();
-                credential_issuer_metadata.credential_issuer = url;
+                credential_issuer_metadata.credential_issuer = url.clone();
+                credential_issuer_metadata.credential_endpoint = url.append_path_segment("openid4vci/credential");
+                credential_issuer_metadata.nonce_endpoint = Some(url.append_path_segment("openid4vci/nonce"));
 
                 Ok(vec![IssuerUrlUpdated {
                     authorization_server_metadata: Box::new(authorization_server_metadata),
diff --git a/agent_issuance/src/state.rs b/agent_issuance/src/state.rs
index 11a1ce7b..6a326617 100644
--- a/agent_issuance/src/state.rs
+++ b/agent_issuance/src/state.rs
@@ -128,14 +128,12 @@ pub async fn load_server_metadata(state: &IssuanceState) -> anyhow::Result<()> {
 
     match query_handler(SERVER_CONFIG_ID, &state.query.server_config).await? {
         Some(server_config_view) => {
-            if public_url != server_config_view.authorization_server_metadata.issuer {
-                debug!("The server metadata issuer URL does not match the configured URL.");
+            info!("Update Issuer URL in server metadata");
 
-                let command = ServerConfigCommand::UpdateIssuerUrl {
-                    url: public_url.clone(),
-                };
-                command_handler(SERVER_CONFIG_ID, &state.command.server_config, command).await?;
-            }
+            let command = ServerConfigCommand::UpdateIssuerUrl {
+                url: public_url.clone(),
+            };
+            command_handler(SERVER_CONFIG_ID, &state.command.server_config, command).await?;
 
             if display != server_config_view.credential_issuer_metadata.display {
                 debug!("The server metadata display does not match the configured display.");

From 17835e52d337d35398f6420504cdfbabd6000448 Mon Sep 17 00:00:00 2001
From: Chaya <79284542+coplat@users.noreply.github.com>
Date: Tue, 19 May 2026 15:26:58 +0700
Subject: [PATCH 04/34] fix: access token and credential endpoint error
 responses (#343)

* fix: access token error responses
---
 .../issuance/credential_issuer/credential.rs  | 15 +++----
 .../credential_issuer/notification.rs         | 18 ++++----
 agent_api_http/src/v0/issuance/error.rs       | 41 ++++++++++++++++---
 3 files changed, 51 insertions(+), 23 deletions(-)

diff --git a/agent_api_http/src/v0/issuance/credential_issuer/credential.rs b/agent_api_http/src/v0/issuance/credential_issuer/credential.rs
index 81dea3ec..9c1e3ac1 100644
--- a/agent_api_http/src/v0/issuance/credential_issuer/credential.rs
+++ b/agent_api_http/src/v0/issuance/credential_issuer/credential.rs
@@ -7,7 +7,8 @@ use crate::{
 };
 use agent_issuance::{
     application::{
-        access_token_validation_service::AccessTokenValidationService, nonce_validation_service::NonceValidationService,
+        access_token_validation_service::{AccessTokenValidationError, AccessTokenValidationService},
+        nonce_validation_service::NonceValidationService,
     },
     credential::{command::CredentialCommand, views::CredentialView},
     offer::{command::OfferCommand, views::OfferView},
@@ -40,12 +41,12 @@ pub(crate) async fn credential(
     AuthBearer(access_token): AuthBearer,
     Json(credential_request): Json<CredentialRequest>,
 ) -> Result<Response, PublicError> {
-    let offer_id = AccessTokenValidationService::validate(&state, &access_token)
-        .await
-        .ok()
-        // The Access Token must contain the `issuer_state` claim, which is used to identify the `offer_id`.
-        .and_then(|claims| claims.issuer_state)
-        .ok_or_else(|| PublicError::from(CredentialErrorResponse::InvalidProof))?;
+    let claims = AccessTokenValidationService::validate(&state, &access_token).await?;
+
+    // The Access Token must contain the `issuer_state` claim, which is used to identify the `offer_id`.
+    let offer_id = claims
+        .issuer_state
+        .ok_or_else(|| PublicError::from(AccessTokenValidationError::InvalidToken))?;
 
     NonceValidationService::validate(&state, &credential_request)
         .await
diff --git a/agent_api_http/src/v0/issuance/credential_issuer/notification.rs b/agent_api_http/src/v0/issuance/credential_issuer/notification.rs
index d015c62a..73bc78d2 100644
--- a/agent_api_http/src/v0/issuance/credential_issuer/notification.rs
+++ b/agent_api_http/src/v0/issuance/credential_issuer/notification.rs
@@ -25,13 +25,11 @@ pub async fn notification(
 ) -> Result<Response, PublicError> {
     info!("Notification Request: {}", json!(raw_value));
 
+    let _claims = AccessTokenValidationService::validate(&state, &access_token).await?;
+
     let notification_request: NotificationRequest = serde_json::from_value::<NotificationRequest>(raw_value)
         .map_err(|_| PublicError::from(NotificationErrorResponse::InvalidNotificationRequest))?;
 
-    let _claims = AccessTokenValidationService::validate(&state, &access_token)
-        .await
-        .map_err(|_err| PublicError::from(NotificationErrorResponse::InvalidNotificationRequest))?;
-
     let credentials = match query_handler("all_credentials", &state.query.all_credentials).await? {
         Some(all_credentials) => all_credentials.credentials,
         _ => return Err(internal_server_error()),
@@ -145,7 +143,7 @@ mod tests {
             name: &'static str,
             access_token: String,
             payload: String,
-            expected_error: NotificationErrorResponse,
+            expected_status: StatusCode,
         }
 
         let test_cases = vec![
@@ -158,7 +156,7 @@ mod tests {
                     event_description: None,
                 })
                 .unwrap(),
-                expected_error: NotificationErrorResponse::InvalidNotificationId,
+                expected_status: NotificationErrorResponse::InvalidNotificationId.status_code(),
             },
             TestCase {
                 name: "Invalid Access Token",
@@ -169,13 +167,13 @@ mod tests {
                     event_description: None,
                 })
                 .unwrap(),
-                expected_error: NotificationErrorResponse::InvalidNotificationRequest,
+                expected_status: StatusCode::UNAUTHORIZED,
             },
             TestCase {
                 name: "Invalid Notification Event",
                 access_token: access_token.clone(),
                 payload: format!(r#"{{"notification_id": "{notification_id}", "event": "InvalidEventValue"}}"#),
-                expected_error: NotificationErrorResponse::InvalidNotificationRequest,
+                expected_status: NotificationErrorResponse::InvalidNotificationRequest.status_code(),
             },
         ];
 
@@ -191,10 +189,10 @@ mod tests {
             let response = issuance_app.clone().oneshot(request).await.unwrap();
             assert_eq!(
                 response.status(),
-                test_case.expected_error.status_code(),
+                test_case.expected_status,
                 "Test case {} failed: expected status {}, got {}",
                 test_case.name,
-                test_case.expected_error.status_code(),
+                test_case.expected_status,
                 response.status(),
             );
         }
diff --git a/agent_api_http/src/v0/issuance/error.rs b/agent_api_http/src/v0/issuance/error.rs
index 00545a87..69423df8 100644
--- a/agent_api_http/src/v0/issuance/error.rs
+++ b/agent_api_http/src/v0/issuance/error.rs
@@ -179,7 +179,12 @@ impl axum::response::IntoResponse for PublicError {
                 let status = oid4vc_error.error.status_code();
                 (status, axum::Json(oid4vc_error)).into_response()
             }
-            PublicError::AccessTokenError(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),
+            PublicError::AccessTokenError(_) => (
+                StatusCode::UNAUTHORIZED,
+                [("WWW-Authenticate", "Bearer error=\"invalid_token\"")],
+                Json(serde_json::json!({"error": "invalid_token"})),
+            )
+                .into_response(),
             PublicError::InternalServerError => StatusCode::INTERNAL_SERVER_ERROR.into_response(),
             PublicError::NotFoundError => StatusCode::NOT_FOUND.into_response(),
         }
@@ -212,17 +217,41 @@ impl IntoPublicError for OfferError {
     fn into_public_error(self) -> PublicError {
         use OfferError::*;
         match self {
-            MissingCredentialOfferError => {
-                PublicError::CredentialError(OID4VCError::new(CredentialErrorResponse::InvalidCredentialRequest))
-            }
+            // `/auth/token` endpoint
             MissingTxCodeError => PublicError::TokenError(OID4VCError::new(TokenErrorResponse::InvalidRequest)),
             InvalidTxCodeError => PublicError::TokenError(OID4VCError::new(TokenErrorResponse::InvalidGrant)),
             InvalidPreAuthorizedCodeError => {
                 PublicError::TokenError(OID4VCError::new(TokenErrorResponse::InvalidGrant))
             }
             UnrequestedTxCodeError => PublicError::TokenError(OID4VCError::new(TokenErrorResponse::InvalidRequest)),
-            // TODO: check for missing error responses
-            _ => PublicError::InternalServerError,
+
+            // `/openid4vci/credential` endpoint
+            MissingCredentialOfferError => {
+                PublicError::CredentialError(OID4VCError::new(CredentialErrorResponse::InvalidCredentialRequest))
+            }
+            MissingCredentialError => {
+                PublicError::CredentialError(OID4VCError::new(CredentialErrorResponse::InvalidCredentialRequest))
+            }
+            MissingProofError => PublicError::CredentialError(OID4VCError::new(CredentialErrorResponse::InvalidProof)),
+            InvalidProofError(_) => {
+                PublicError::CredentialError(OID4VCError::new(CredentialErrorResponse::InvalidProof))
+            }
+            MissingProofIssuerError => {
+                PublicError::CredentialError(OID4VCError::new(CredentialErrorResponse::InvalidProof))
+            }
+            MissingCredentialConfigurationIdsError => {
+                PublicError::CredentialError(OID4VCError::new(CredentialErrorResponse::InvalidCredentialRequest))
+            }
+            UnknownCredentialConfiguration(_) => PublicError::CredentialError(OID4VCError::new(
+                CredentialErrorResponse::UnknownCredentialConfiguration,
+            )),
+            UnsupportedCredentialIdentifierError => {
+                PublicError::CredentialError(OID4VCError::new(CredentialErrorResponse::UnknownCredentialIdentifier))
+            }
+            // Internal errors that shouldn't reach the public API
+            SendCredentialOfferError(_) => PublicError::InternalServerError,
+            UnsupportedTokenRequestGrantTypeError => PublicError::InternalServerError,
+            InvalidCredentialOfferUriError(_) => PublicError::InternalServerError,
         }
     }
 }

From dabb29f8dbe074641bdf75cf83b85b33ceaeb253 Mon Sep 17 00:00:00 2001
From: Daniel Mader <daniel.mader@impierce.com>
Date: Wed, 20 May 2026 16:34:41 +0200
Subject: [PATCH 05/34] docs: replace text with banner image (#345)

---
 .github/banner.png | Bin 0 -> 416538 bytes
 README.md          |   2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)
 create mode 100644 .github/banner.png

diff --git a/.github/banner.png b/.github/banner.png
new file mode 100644
index 0000000000000000000000000000000000000000..5ef4fa25348100a9dc85e42f3087c7a7753afd28
GIT binary patch
literal 416538
zcmY(qc|4SV{O;e1NcK{RY^m%ayGdk;h?ISoC0iOhGm}Jip^$AVB+|&fo2)~Yk!0*+
zi7A7@U}ntryM502o^yWxpt~MD#(lr<_v^Z@=k-p!Z)V8Jeu4eSkt3YOM*5aVj<B>H
zIdb$h8w+rSw(_0l$Pw-%#`?Ne;YZio6C<V7GfRC83CxsVN^=kA9=<*QuA0D8z|8IZ
z`&7ztX~}AKz3Qo}TBzU2Tb3U)E&t5?V|H!hMPLO`@*d`wDu^C^K;;4zF^H`Mb0%Y>
zv5dL5r&`7&z@6a?ER06n1-)jXc7B7*(BdkH@d4omE*}PnVX@70-(`x}Gv!1g$c0L{
zb4=8=?RBQdJmjJ}?g_{r#=}77w+uVSAbhqdDNI?Wnm=Iywi7<ouxj|;*Tw-$#_pv5
zG7Q^7hHI_nE;$#nGZnW4H}kTYl!w2m&dk&ZB!<u#w)^`ZHaz+Va+SIN+oBEMWSvN*
z&sdi-XRMj2z@?3_Ekgd}YSk@F9c{+ixiCc*xR}>SM{X}iQ9${vzECa(0SOC<l!xL2
zH-!eXnQ#kq#~bw0Tv<kIIRl0!7LxWz*4v0EO~xxy_&geG9@VyCxC9#wLttn+9_Zqc
zy|%ARv(4%3DviL{ecS24xt+Le=5Emy3VN6^&14V0mn<UUKA7D|cRp?IyaZ+TxoZ=?
zP`utp+00_euqxWdE@P^JVHkmvC5H)Pk#xHIe30Q1_MawZX4xMm%h;$xFt5*tAWze-
zi^M*b9|j$t>t2ddZSaejagK*kXM7$~tCr>(Gf-DZziB7QT%_E!&Fuz}MCN;f1L4tp
zkTd^*%-KyP(&M>I8q&<meh2AKo?u=jw4JKO_OzEFH;7fL4DI=S>m|%O5nnB`jEM!s
zGehif+CMa_wgZa;h}12(mJaqZc1P!+6&4+Gu!)Bibujnyf2Ct#VFwhHh&ht6Gx!hq
z6Nrvgn_qH{rfuWk+uc>jUTYA8pSe9p+GaxN_h?jAY#$8D)T1qz!Ix&7p@||esw|XF
zPbU{ng3QX)Qk6K~@JC({;H@b?F53z*BC@%8rO92>lHks`b(%N9$OUKHXv#1$OR1Ke
z$4!&-O_FZ$U)Sf-|3Fe#j4?X)dQ{!X(x{5N@pFr^OSas=nednA{@Ds!govf+How0D
z?scCG)J=5pJpJZ!5vxmffA7qL`lha5JzWx>iJC9qSG!6OB<`QI65v@hXWv<rcR@5t
zb>>3u?=Q|~zBBQB9F|53NZ$4a)*u4?c3j)_8(n6&(dc%c-v(jp>Bt{>CxZ#K%vY>;
z9^P?f|I++k=Y<ZT07DbFdQ%hQ&$uvDvF!a<*;AXSmeN}BIr+p`$XELXwRdFCfVnX!
zKAWpac}?wXMiNKi713*AZ<xIBg@<=|Z12@un)8$r5cbTCHZk82_}B~4mZOz7gr3`a
zR@9<qpeH(h1|ojZpq1Cb^A|rgS}<kz7JQpWkNN#9nc3$F8`|JaDOG*xbH)Q}|GF%<
zJ9N2`vHGs3W@Y*AR!VscXV}*1;nK_pk6k~BX2hM}Z0%ypw^8O+5%jZpo*GwkAy?1G
zdPz8E0$NU?+iYaF0n0>OagyXvMS*+{2SM@jBN{uSldQha;#dq`ZWy`ML1OKh0&<Cd
zg?QtZACl{`Y2I^W2`)_T%V8J01Kr%NN==0qE}vKoZsq!>xlW4Psn!$<aE*2K)#~%7
zli4IQ-(8Z@&9#?v-PPi*wUV3vRIwsZbmi<7MU&a$S!XZluub1N0`jf1`3&rK5Y1SZ
z(2LyaC&&4AH!>ib7qU0codz$gp*j7Ltm<jqwMB1N;V~aw_bld1S&;hvwDg@3dj)>e
zI8x^m-ac7W|M(P_s}9Prx`Iy_9~pyEQq=k(@;F7o?e1wVHYGnU;LDXwup{n_Rh@{e
zn2o?`+ly=xd`Y86CdQtmhBb@DJ0EXs+knT+%nzscx{Uj{Y1D=!cXj(FV%Vx=eUY~J
zy)s<X&Kgm5o-CUqB%Su9ZEVHZE#l6m=$}lH{K);#yVJ<(yUqVxGBx@jpadd45{%(U
zPP_G_a*f|BbuBp_zIUA~ep!q^&YL~{rdGh}hyI^?0V|inPOP4N<|=(z$$=CQe5|W7
zTAGay(XYg=BG`BKbK!p3cgZQMXXk)-+?tZ*s0$JG-6dK3R1>xvki6#W%O%tBZDq3i
z)ee;XnzqUBrayIpLHpMTUWqD!QSQI9@|?w_-jBG!BRU!v^|*CLf1vdlG&+e)&v9OE
zgu~LDp)^tG!R8Ek6V6NtWNbf-W)5SviCmzb!05CcDLA|bN#2@buB2`8iMUXXBVf$^
zRx&*L`<}BFu!*?PdyeB+<4~DiJ!BW(=<h46VGa4z1%sK?;q>poo>fN4d8re&!J101
zNsH2pN(d7ULk^JWZl#WhL}e3Gj_qMWciT#(63+Fz?&AiJC}LCJ+>9Fz0e`j;wyu7L
z8e1^8GVv^M+;_9J;*n2}_O}$(?dh@pScM!dwqF-feP=HZadQw)3Xa!3z1>h!TM$2|
zGiW%gSX<ELUVbh=GQ)j;<{JvKKZTwBD^yJH^J@0BX(=*ygZ5d4`>}ab!^ywAXOj5B
zxWdRnSlXbT+>3vZm3Qd;)eB=z=<+G&AbS`}rGp@K-T9)v<V|>W!;3h`Hx2#=ncYGB
zAdEkh?O^BgdPKdG#+t)FWCmvW)_g)>QCQqYruF&~vQQJXL_hz)`<qp6{qD0T;tTDU
z-%^3C`gRq#eU*8a>@}Ylw%(dd25(V+s!UK|Zgy*vUjK9^WThf6n7m-TJ?E3&c}*o;
zC?4Sx1X@OZ9QT*g3}hV6pw{#D;R#w*cl&tzO<_cRd83YVH^hq4pW*B@uq}@l=TDyP
z@cec|wQa-s$m+-^h%!jnJer`_#Q7#VCED3UBznEOZM|1osPObmK1xn1TO*knx(OMM
z0EQvQD#B=ZF4nq<<l%}fI<E}IpVh2AJ$RDP@*eWisxS^bt-Lb7Mc8f|9DuDBZ@x>X
z7f>cZ+g4y#j>}p89$7uBO8e+jh`=af)TpyHReLuRr+tF3Xif=<-VbZ@Pje>rTXgi(
zTx5j0qF-hiXjf%Ss=RQ$WJJ~etC_!?4`bQs-)U-znhPPGNBxpo_QNjwgLuJS%G!m=
zZp~d&5VN-9N>|Gt{7SgSnJ6<P5SSTyb~Q8SCEM$Fp*Bl}ZNeDSkH@4;RB{C52bVzL
zkFz8;v%MDKM;Kq7;u(Re`iPBA+tS~WCkQ%-hi=JukX${UPW#HVn2(^^c-hi`8&K8L
zF*kiLWM?|Gm@qWCze*}rYRL*(3V2@rz3?*blsxL2!?U7}ZdDh7^bKGhr<SbxF^&yo
zHjke2SnZ8wIq>~CTSkfMmqTMYgc^Y@{o<-zO+YWUj~a!*M%gr~VF{-y?I+sS<QU7%
zQ6qbVm5yKPu=Gay*<HRTX{{sXZDIc~+10(O;Yka}5g>BqN)8;FBtjPz6nPFI?SYo1
zbOI@KjPs>kc`4=%k#I^?9fPr)PC4hmz<(u>d$t=vjDB;)-g*=Exx|;RO1P8$sNB|I
zxyCPS`P-Lq+OxFWiHNiC<0$8Rr840A(nFsYv~&s6lo}W%I{%QqYIr$L-0dIVI+k{Q
z+Upe03%{Q_`u>JoCCw#64?aKb^}n#6PZN+&^w!OtkZqXsn5$Xp`Pww}Lg9oXS#(GV
z^<pF`<2>W*3+u&1hE$SLE!t<x>;6ul!d7YYdn<>QbB@KEom5eJw7h)>`8ssiKmShg
zh+nHC*H`y^kr;&QHY1hGL}3zFPpeFAg$(lz827-N1_gX!K{GNuzGpaQ(7ZPK{4Aer
zB|dRRUCl(XDBkc-)js`|n2$U*=YyD`o!@O<rLE@l>-uy|!g15%(nY>TRl4kkkA(M@
z<7`NIb7Hr7&K@|rDcppj>~07*h787=jM&pGw^dPMV?*L4D2ly)TbzyfHs?LwgD&hA
zvKJrjx26gcZpXP?Mf2?@3SH3Z8~q+16@e4jeB4NX`*->*p@)3qgMw0EaPrheaV7dN
zU;E|Ec14QFvSPdyB{qIMdO<jls+lWrg$aD;xq9tS_vtsmZ%rQOZ0fpUQ?Uohn9$Lw
zM2TOoQ!WS|&j+RPCnZRN9zkAmobs4l77nhIybgCW?R+D+FUl^N!y??}XelZx%J!?}
z@t{B0=;M}H-qNoQV4Z0eJ=&wq+s0hOVvrZi?MS{*iMxA5z2B8l)oJgPbh_HTa4L`J
zrA{-_efutgVUO{k*Q{YfDVvwLJ^dnFJo?!EfhiuPpm4)oK;(4F&^K+Z%QrGk9edKf
ztYG%|WNh5|@jdm_&pa}K#-APs-b&_a50jzwH~n2!`Un@Z?Cz$TOnlkXpA98xxMSPS
zlZf6q@0tB+;O%9B9J9WD%D|`o_7vn_eP3)FF#wfR`EXG*QY59t2|e-NUZ=<9&wam$
z{xpaCw>;k{c7^k$KlPS7FQV>IY?*2)suC8i-+PDukpg~!=P{rwAS3Ek6z9awT&mvk
zg+Qu*ZrPBA0PG@(w3yZypa`n|z$Yo=o5s`qZ=IP-^_o<Nra#Ce9si-E#t?9@!{i{q
z<?CbGe{D>jvbYcGfVSTa27=^8p3`^fVcS)^i#Z~LWJ^?)1A<xml8MI$E`g9#oet^>
z<}Y$#N2*QgCgXJGh}2MYMdFgitsQE{1%}$&o{H{~P&H1WUQGwL(M-*WF|DoPS&iE{
zKlH+!i0g?P=Ql5ap+tR5!?&ukCSTJoS2Y&LSDamywXIw)DS}cNI}cm;ysAm#A$iF3
z`MxNx$%Ew9PjS*^j)mO?U#1reF_Y@U@;{Lezl|po%jo{hBZMRZHu5PjfEcF_bbu94
zDn>hzmLuog2NIR0=a)47=bBa;hIcYxY3<|qYUg!e$nu@cy|wZ|;j4YLbzinDZouG~
z>Fpb}%fB)T;+lIfQ(j2IxK>8oyEs1ETvaduoEB(?nLcKAWu~XALuXfWEGSh%X}F@O
zeu}F~eeIm<@Ow_)*wRmQ5*RyE04sc;85^L7HU3>r1~gj4@eY@LJaibuNB=%T&l8D(
zR3YFRxB~nqSv2~=ypG9Eq|83uq>V5v<314R1XI6*t2}3+<xQC0<|YM>hg~Xerk>A7
zUWip1q3?&!1fmwqqO;1B@=ntG1kT2_GA|z?4d|ce>k>NgT)`q+9hg1W!YX8jlqG5u
z;5dHQ1ET^l(G00OAJINYkzZXrvCB817eX#HQv97qU)dcrbExn7Ql)?5itws17UBta
zCIV32MXI_qr8Yv<fkn`RDw;p`y}PW|GwbE`+B$5@%JGrn{!jz?rF?gfgSwSig}{aJ
zEe4yXQzD#pVl<!}OEX$;4<24ceN4B&eQqIu5zjYdwi}6n%RHb{EkWVw>mBe|C~Te%
zXd-=V*l*&yHK!rSY8RhZ1N{-8F9L`&PAYR!f_;ut2ZYtV+(JCgH}YS44(>sagQ-lJ
zw2=8dO$_60dxh5Hk^jj8*zgH@Unn|dOSuB7Y~{Z5`-Y=o3b>8!25j2;PfZnvJDb6e
zvABO9f<A;Lhpzs$#R={n2VHNzKJ3}&T2TcLk_N@R0%PjJS^M6U!=AP1#D19`KYUwH
zKvIjXe-lqtzFlz3F2Y|al5YA5S}P&~S|XMH`6jE<@pZ`hq3~1>-gr%KGAE)GOnztX
z*~KZi7N0CxJtMUv$Giz$+-q{$X{Z|2mOX>KB`iB5^AGkWtMNzKLVOicN{;cB&Nh!F
z<`90CZMQdlqodyw!bh;n^{ksX{`JoA3*kaxT*)MNzp0%D*p-9YTxS?V9ZK8JCvS>4
z_o6`zZrIMdd(oZC$+YkIGAuNmdBAu@#$uu8ur!(pnHgrX^vh7rQsc}uYq;M>Be&E)
zov$|+r~h12c=_t3u#s4H4`<`>3r*fCszA~=Si<dr(iqlf##X<YJ4*iWPP&=k`_h}-
zuY3qMGSOyxkQ>5kz&$knovq*YDr{m<*urM}=*!p<-k`!6Q-xX@M~*_IaDwgioVBd$
z99jFfiyBFRl12}!DD=PWTTTlOxJ-E6zN&m3+7d}=nrxU=OdgfXp4@Eia|xbR=_w5R
zr?F26qRMPE7QGP7AW91NcdL{|4)bkGE+Lb=KzD~fH(lXr+~VO^H%h&mBqV*twQs6w
z3*vAnivERe;(){@Q50_WlYYBb-XhlncZ;*mSmxk0pYo?$FH`dV&fntQ)x2+qGQl)E
z@MZ7^aaMm_SAEJOeywZrm^Hpnk6dy5;W=Sj*wW%=r^1uVulLi#Q38>vLmcto80p!G
z@51WYO(i0e*qaRCwGQ;#^50eM;DlZhXIieMk{eT^QczcznbvbIO<b=bBDy%6@Fc;J
zu@E#%VZG(%!uh<xH<59T*MLps6d={o)pds!*tOBTLZhLV*;N$u^jhAAIV|5qZg8;Z
zwfxDgB}iwm$Z=ieS$R72qd=Y`cKDpW{S+LRc{?EY^Xu2Q5Fh-r?dfUt!EM0MMxEh8
ziESX?Wr-&$XM9Y!Z*(j;MlfFc<6c+7ZO)YNHzo)k3rhUb7+%r-k0k^!#5I>hs~X|n
zeI?d=zR<+^WNcN~Y!^Lbw<NB0eh4tpY3e*}s~OAs?Po9Asm^y_BW%&8x_%5fexXRe
z7Jpi`c_9&yhUvwR_FP-FdYo*coviq3uck?Q$#q8V=YKx?NZUii7)JvPb*qBb6K7pk
z^J4Vl6rrTmmV8Y;!k^@%JlfwFw%To(pb3wA7XxNuYQ6$9n{hYTKUoc4{djPu!$m>)
z)LKQKj&)x>$c3Hj!%0gUI|bpTq)PtNAC6X*u2k3rfmq*WyJEg4)ak4fG*Wr+k(0lU
z{SZE>XF(Us2)Ug1;zMji0X|Ob6*VW*w~o#>bhcT)$*H1Qe@N?|%uvo0WTcsqwCoK{
zOsc!q7%z9i(da}Aw>WQ12ddi86dLzR!Y^i=X&@ylc-m)iPn#$RogSY9BCC@%C+9Dc
zwIq8XB2`O{jgdw<4tCMJk(c|jt%KHBw9Q~eOBg_*5|9ipG6+Vd20E|8c18&oBO;;a
ziLabt$xQlO*tQ53CIX`E+ZVLS>Nu$!8zAzTuCLybnYCzZ7CtjG!(_9Z^ttu>jxod9
zZPTLwP4#9d^6CnIkxz)yr#`1L5;Rcx)MF{p+4rcsXL@dHzYtlKu!NTXqPa_?^2r9t
zFX&uEJr2_m<IEflS?I$CdCeXKE(p|&tA>Hyby%AA!yyOgo9%i_fY<ig4RjBtuTljU
z$-Re390%mw@37&SfYb3mgD~7-Iw8|YRH3gAY;9IniRd*_UnZ-_*EDeYgvcMn<Dm2I
zgYVK?;`b$|U+Z3lr$k8AZ9tTr#j7%_t7<@fj&38WVa^pR?yj?kFDNm?lW(pO@V^k}
z2wfp)I_~@xB$7cEx&&L4+HZk#bmGWwWM13ZF7g%k4E0}v3Y{lFG?ySw=HDd)mTaq<
zd~N=|==9}y6R`gl*l}UP2l5rOUx8FmX%zNPndGBWOnRs_0#kpyseP^}o*sepwW~nX
z%RAFf=Z7@|f>5F*yO*Ad@xc2+ueK<jWc?$}8CkSfziQfDMM<3NG-P!mVu+0lPC{GX
zybn<t5U5c^>yHFq1UA|L&IE+j3n_%=7tXd=T(kW0wLd%0@nYg<j_-@Buh0Yw@ggX7
z0kq~?b3<bR#P9C0i%okX-@o)&A|u2&eq9{I5214JBjp?EN~4709Gz+^SXbft%>;GP
zzU&9#Lkv=Ldvyg*ilj(a+gmDv4ISC{uGN5O{oY&$11ve!otMN)l$Po`PV7ZiVy03~
zaq~=b#Npo{FO~N@EQt<L)s2U~ydt<=gw4S&Brg0ey3Pg$Vv={=A_H@e5jh1NN@JNm
zCYvmQA4m@-mO|Um8zGNSSaf0YZjfy9*FL1>6YF{7fsNV5g})=dPJe&nYDnS1cfy{+
z+==H~!PGz?kr9f_0hImZvw@ih{XV&+QI0&PpI-TK!@0LLK>X5!;ZmcD=E{gXo7@gd
zrz{keUhjfHqGkd-&fy3rl>z~Iffe}z-8`Ua*KKeF04fQy6U9kVf}SOzbHN~NHN|UT
zU)zz$@n_2B=BA2NmGMpQi*l=yq%6;U`2w38XE)1Qlg;)Am{fUW4;MC?4+|rP(Dw22
z(C`jHikQyU4ikidMUx=3jaMQ|7%Y=5NZV`iSNFJWuIM!nWR5<koXyMN)0S7YN-8ik
z;h~{xNDAOQtS*|q**&vl4|tQ`X$~63H#i4Amt`Cqw_j6+v6P<$Bx>tVFa1@m0aIIN
zUjNs(Dyv3C*-tr7i{Lz19&<mjJth7q*t2JW@ipEs9CzNFJ-#c%Oh#(^&ZhAjTK*}M
zOXW?$T9%pZVRN?{z2Aonf@gax(tYo|%<Y#RRgvBFI-KX&7c;Y~uiW$<zIf%I3_SQ+
z_EO9uT;@agn^&JZEh)xBZiC$j<wvxKMSU~$v`YSSTz$m9vIYXFNAf}G>;4bTJ*&qZ
z!=I?JgU|Iy9tWIj*u@qXgES~$O6DmJjTEJ;*Ti1O@E)8@53l9S;1|xc5FOa<LZ%}7
z{IjxYs@IJ_KDr!dxoFRSHx7soeYO18djAsHQ-qfMI=Po3q%|hSwkKqL<@N)8O~9P7
z@y@MnLdh_=X5SLqva=|V407EONqKR+kJC-?!4ve9!keS2RKvn+I<j7fHBRg7iM+;k
zo+=>>&FqbS9NRylqTtxrxjbr<zFUI*IvRYTS?DtNzya#xZJq~?ahZ7UU@i}Y^t<u{
z+s09AOC!Cmzue-_6w02BvVUk;qc=1og#ja%4+S)1`8)>Bau?HV73#wUQJtNbVk$~0
z6ZU%4O`LH#_j)E7w-eP!Y#$8u_tFwB6@^A8cHRmbQ7X8uh_i3Jud%V1abiVIBG>p)
zlapL5uE>9OtA_7g=$&o%j3-}OhCyB8bkULiB|!5feyUMr3f@U5P`-cM-%|gELfN^}
zxVUn*34W{kfHz-dCS>P7SFbqDM;tFLzj;&iw*}AN+fH!^|9=M)RfC2+|0~sg815ai
z^!%EbwYyIz_s!=I<Buy0nuY*E9-Vu!|Ku+L(+6@Z<|;XB*-zxW<dk373dj^Kiu$rw
z{r9E0KhKhrYuMrF;7NVpA0-;*x^RM2m`_gkwQ+fG;+00R=f0!|e&~SbH9|VSGNGGx
zQfCefjxQ(jmW8Pya_NTK2=_N{!Zvh1|LrXWLV*W7MN`hAJ~_)Ca!|Hk4i`)GC#I$`
zG&B~L4)37KLH~4D$*(YRgXp*9FY!!J3xh}%>Du{4PL_jp^?SXF&i!l7712q4V0@E|
zm{VkP6;Gc{boXd^^4r}J?B<9h2HhwNrwKkyZ{ahio{`FXG=843I>j+FS0F?JL+@H`
zjBh($W^l~ZH?jJEX}@1gIeZgz(znk}_1y#=bL?J%2$Fiuj|%&2mbp3giXSwdZZRiX
zyD)E_ME&R(#_AD#_f=shBb`kgvCX~dvDGWyz`%;2Z137c@^clKI<@p#Xk~b*rC$9p
z6x+&rQd_lcIVJS`9A=Vszl2;L3H2M(p$#|72A<R<GPt%|v*W1EcIXa2Pr~2!r>A|q
zT&FwIoN1GZHsO2r<fTTh22~gr#IP1gkyZ%H<Kn*1|05KveXLpXiMDM{Y9+8soZN4(
z^|dNG9$Z9q@sJB;+q4hwfg|F^mj!WctM*LUSw(OMOnP|M8@>&E(u<9IGxPn%>b`#{
z?eK*&4gC*#oQD#QZh?LjZX6UMS9{mX?(n@vr6*?A3RA7XK1HH3(q=tLWuVmGOG8Re
ze1=(qR@w!>3MzUP5q1@wAlWpWdYNmKN#P;5$mo+}CEvUc(LKUaHH$;-r}S$nzg8jc
z=o>zJ5&_&WWj~6IV1x(yz`1h{%qthOAs6*hL0;Y9O5@FEqC+^flitqlcB%)^l*ay>
z4gUeWHuL2Ua&E{-QiK4Zg*pim+0_A7ZF&zQ;(6KVFOXrlGXe*mjn_rD<Rme3qu?eG
zoSj*5T1c{p^>S2AYI7D2lTyx*6A3{x_>7CXi&(Flv6;{G!uZhd!**1mhS}u@%1GAs
z74;4Zy<d28D3hd!n`kO_d7shGjt;p^I5UF~ao(r<zD{k?yid2tbat_8&I(H7qR)_}
zXH~(7SY*T!5Fy<{GFHRkT{O9MB?~2Dz@N1G-Sd@YDYS9NUl>onDPkjC3|iogM=o3n
z)AaNp9S1ViXP1`ikLRW^9?db&?p{I%4a;W;k2?cf5&}M9J8mAs`@>D9-QjO=eLyDx
z=eH_6(u&@&!Q!*Yz>PlVGM|nQKzaeRp=!H_G^c^`BWa&=rqTr`=NU5*7>c0dFH1;U
zBTRd-(^ZZduVCJ$HOS&RKSGDA(iUd|mtF-TQ$b|zl$>too6H)nHU{MvdXbqf2OE`4
zlfSlmRpXqfw!|IA@qE@6i3e82EC!-F#*3mc2`AiMf6u;e#Gaj*8$3h!Gu@+_^JY(l
zmYEc|eF-VirhzkN|7Y{zy_98$g%(=-o_7Qr*PRo+xrvHorK=V%&mWgez#Yw%e6}6>
zP<Fv|x41cKYcFAG2ux?l#%4`0P!X7*Dqh&ppmyz3ee1CXV8Y&o#yLd;YAX5}=3B5f
zK3mC95m(WKw2}C@o6xFw^-4A(dCmAkLGxr_@r%xnx+i1>zIwKyUS++0xOI}yWIswR
zTF!&9{Lr*k;NL_YobcS&q^xkAd;o-Xe2<D*rX|j9Y&EFz-t{QJ*E{mW)XlY=oZlCi
z_VPg<hLGcRkc8ku-(}cKO+(8Q^>tEYf$D8x)ECRIn-A<1^v(aDZB(RFbqyVX);+QI
zKUu&q997XWo=7wK>`O}>y`#L8P44xYnFyTO;5}U=h7%qg_o`#E0YnYqHCMBOd-dHc
zxy`f&RjuSc;vB@LMEA8Sz3M2_k{E?$XG!7_jJWG3rveiGCp=~u1_aYaCDnsR@9IY!
zEALdVx#bo#@wvr&(l$$4SwU=!aa79llIjwAKhA`m$>DDD`M}fxm}G7X#cf2EF`1Im
zD=#Ak6mQ&V68_GXnR`L-s5-|6x@E&&xFjz1T*6|7_Qz#OlzwziX;M~Nx6Iq*nJ*1b
z<H{1_jE8u`M8dcRA9o<rtYwkufk^k{K>8|On5Ms!X9%6sDJL#_ZVH)TY6DL7S@egN
zuYx6?!s8r~bN~^C>{)E;#Y&UQT<-7+q&?`l#o3k<HvdBO$u}#ygy+o;A;YXSKH=Y>
zZ~AGtX0*VAc5OsT`S0!0>g$4CUt(_6XwQch7Q1;Tm)0YNN&6G~?h1k-6aB4h@gr`s
z-{g5u+uOfarDz7|KAvZF(B(JL7p)k5k@5L?wLbqxc3HthcESI1>D0A4w@++V69w!b
zRoinZ2?7|Ug4u^q;1+gxlWntDyZ71dh~|l*^6<xD>j!!n#dsB%r01Z6H|GuaO$_aj
z1r9|<TmfKUQ=k6>h5NbZ-Q~)I?<nZ;zL1kR=9s{fcq<SJI-nNS{Q;7n{{;gz(zoln
zXF3d+D-FHanJU0F@7tdX3%i)3!Qh=z43XQIhnE0`IT@C2B7lMZ(?I3zNhq7FzlUUN
zGdcJBqeI_Zl@?|6CK=8SGRYel@*=)!87BfuKt3TuR?GJHVI5o84$93A#=o+4yty8w
z@|%ugkJ}lo;cE*wo_{GmaCbZsYhAPr_bJ1?W!Ru}Mz?COfKE>9wGltRrsT|$l5>2&
z8^V1H?p4wVU}q_Tf7U_0*Pgp+-h!__y41KdQa}06U(!xD_q?yE=AKa05wEc3w+QTP
znB`aRCG`WyUxM0e<5N<<j&+rA3i!QHfN=XIBcallA0g`(n$kBA)gyRp(dTHYjMS5h
z_M0n(jV=lm)_zX_A-VplXt}M?cQzC!xS^^u=-55BS7|?@C9ug;H`jIi@4G&}(5&Lo
zmDR{$kcc`D(GJ@dOT5w?pYjFwZF$C-oPi_;=zZL&*Zr+eoMyj3b*bmzn~rz)__XaR
z)QhGJJHH5yXxyAYcH@H<X1iengQ(Q)t?E49<eN>Lp2usyhZIc=z@x{X%yG?rej^P3
z**2Od?o&AL6@j_7YX_-p-p@&A3`!Bks5fuIgdJtw%H8KINlVCz>*_r2QN~+MZ?wmR
zV_Wk!a<mL)iGPK&*W5P-b6SQU!+~G|{T?j43GDsPkou(P^S)9)jvzf;JH-o+$eVwi
zbmYbu7Q8N?I9;!=PN8)=d>e02-9MAZJeliNaBveQdC-x4P}atjCB;2-ppevZ@+liw
zoFmS?<nl^(6EFZEB`G4yZO&%>yNv8`+P>|LGev)Iy?j^QSGOEi`M9?_P^}gHs1S*Q
zpx)l)GsoP_&e)a6A*X>%{&bzawR#;%Nue{a)M`k2BSe?PHXjJS-Ow@#@W2-A1NnW)
zdFQYVdE2FY*5cjw&_CfP!(1^C7Kj&^0ZcmSj8`$Jnbz{w0G;LV1CN3Ype^$s3e0zn
zshuhK79;r1eA{e9quE9MPD$RNUYjsd5|(bQU!+Veh`4UOu20$ew+cmksP&`*|C>s1
zehp^2EfQ<l4pc9qF+MWpUwx7OXALii<V^2n9%cdOD%)X0nwxJY8|_=m&FT+4?-Hkj
z`gX=Oh&92b_M_*)vpruF&`XOVvqKhpdDpV>eIVXnZwG&*ul#Qk2tDGN=<xaU4TwG)
zUzaK4{NJcTsxmyou@JdGa~Svt0x-~g#rYWwTR+5jXHSY^rKa`{zaX8EDp3$jW}e`P
zKKy||`LYS6O)z;#h5sesRUhCAn01726s6tEX-?`)KSv({+W?(eC2N}r2unX=eZciq
zEyTjczb6mMJ@^Bv>V+PER@$6~e%MBf5|WqOS3Ve_VMJgl1STb&EX`1Q1wV+vfXJ`$
z$PT6`lu0z#5we<(DdEohe^?=u%X9S&mIjrG)u>!#7#M$Wk+?1)QO*;Q5H{~GSe@nz
zJ;6eS<CT#~Y4tCSbXlIbOukaic@xAg&@p)F#?lRjM$SuXwRisu6Yj_zmKV0O=ITEu
zOWx-ZjfOl|D2AFWs6)pzkbrBWsGhAr;EfI)PWeyug8iYH`KCS1i5jx;O4`fG`I;4f
z*l9g{+kee3vP0i1Nx}6Q%8cE>MiKp-Lq<?iS3;K(=HaFg$IpL_MZ5y=ma&VaUldr}
zJo0)U_Vl0rSgff0Te_=a@<303bh@Rh0Ep~&JH7~C{A5d%y=%`zIedv6xNWI_RYHPW
zlEXNId8Ti2+!uI!S%uV>VlwME-dIKIhqQVRT9+gWGK4KiHWF~wy4_NUyi>U}jJ-|C
zC#H@8J+!MS_mHb7_dm_qEsF8++W#*pGzykY*1QP1=iT!sBN%7o5R{cr#~NG4?`zt2
z>`AZAF`XsF`0)&{?)xltu;ljGuaG5M3JXvj`&cr)cndJr5|+LXtC|AMZhNt2n(A5p
z0gbX4Kflc@cwFV_;0#02^0HWVQ~yB@5K><L?fs$ls@1_Ql@`@!5;+d{cHQk7J&-CW
zq0B3QI&7~7=fP6S)@yr!ks*>OMQLwV^KvD+kE-Auz}n^Wq#XZk_f@ZA!*EiwKBlfI
zr&?0*t8?#H<}G1%^xqD}aIr`?h0%9G5?owKYYzOeua5&W6c?HFpC%8$K@qLMI=4(o
z@ZD3q@hj_p@L+!Pjb|X(w&s;4L3>NCJANmbasC&HXE1$-h#W|&B!Q;O)z&ATDHkJ9
zDjJwEpaPX*Cm`%5&suzQkEK!NZ#I{rp!(Ar%K^gfuZL1H<cmMDe17Nd7<6*p;X9jr
zMK8bxuduUlC<UzO;DmrEhH+jnrI||^vE2ZQk65d;2SyK;Pqr4eI$=I9c(e~dg!enl
zNu;MKf@VF1_suWwIx;UFP18&bFDtOgeTQMJ0(ZVGYg5V*XE{|$8r3nm|7&tbi0dm+
zob=jY93#d#tJQ;iA2^uJ*E24r`0o#$f`V@^hhh8Bpy*BKC`vP5l`xXFZAhawVtZ9V
z%&u3lly|NlsjE_XR}EYqBMTp7nTzLy>)6gNDqr^7mI|wsoObH}q3Q96%H1M?Zr2%b
zbVp#ce%8yb<L+<fWjz&4L(9bj%#he3|9_ZaR5fWdVwj*8=&sWpvYB@lQ4m@m2u7?L
zIECbp(<5NhSO|dM==Ns-39kZUX-6M64IrKU*i{>{Pj@2}TUfeWX-@;5NkiKP%0>HJ
zw%z}a6iW5od3xi}GnpGC^@^Pl3I$ChBRBhE{LLkF4p|}Zf2=U-f3w0*t#f^s2Gm1|
zjnMFWHw>JJCK8`gD$g)-sq<`}k7&a3nu_|Xx`bQUDd7EM8{#`S>H<Ol&!54*3mFO_
z9a^mpYm#|k)KmI6s+}KqEf6lbL7gRe2TojuremBfe@2W;n@wDznO_Kj;PL~1GJN;_
zXNwCi;hc{JAI^(q!6~Vx2k=+L>Hjo^p1g4ODo;5%@*gGad#S*BEjPTP*;GzV>99B=
zrRH^ch6^&`>iWzQezp^UpaTz{T_T{G)_Xh)wP7=XhClAnXXAv|%Qg(fQXS5G*12jO
zF@x<Kss%}>(mPN@g9JR;q^D*FHbf07?+EUvY5r6{Tg3S=Fe?yVN}rGwc`AITLFEY#
zR!BUnHZ_`!$YRDxNOxJ)5I(;01z;~}jnFDT@Zm45kEwZj$FFrHBo!<v&D0_7HJKHM
zm=LKy3Ah|+XVkw6%)Yf7k{Jdg`7i_{2_X!1EXgr?qpHY+w$X-n_~>ghi=O07nW$Qt
zfOX;()p5|j&P&8*)L8T9Arp|nl`2$0v(|9)oZ^@H%K$Kf>%x5j*yaxtQjZM_F#2<b
zFG7Kr6cOp|@OSRx#<S=zk*d#dHX|X@>GCoSMWvL<lL|`)JsHp>rJMt9Ip6N7z!?!;
z>wMy&H9q|4A*Q~P+@AlMcM6RC@Ny*MgtjSUBB9M7KvO&~7SJYD`f2F2wdhR%vUc>D
zetlff4Xt>5O(?N(r}Tu~aE5s)Ycu>uNf921xaIp1#tv$dkD~FgHxI^9#XMO#2a;6;
zN2z(%aIUIeMiDYP9Rc+R9RpB?8POz|&|;0k6bUanqMEZ8<WiG^AtdsbIH{xHsf+*F
z4s)obP&(x{qKN<1LlOL0ttm_-J5M5%TQ-(?@GG4HSEp4n1FLdi3wv~VWFK>}8-XQ{
zCZox>Ew746RK-n5RQ1M+&UM#UoD;pm%ah4tobsKU=VAbS#ZMk2{h@MS^a9k_2NUD)
zOy!{?{_L6wyN}UnhwXuVKq?-ZA0Xc5_q-=~)b$Cg_|qFRB7pf>K}SxBvrFqde>!@S
zy*45BmTs=N+4a_7A<uG$3iApX(`gR%`3{o(2_WijSMBKdX6sqtF$c7mhR(Iqd;?}=
z==K+C{eNQGBe{G}8=xHZW^vln*jb<p64$w3+xD7uI5(sHFCVw31fZaMV~@HT9K;^|
zdHF?lQlD~rUvWx?__9rIP=j9XVn%;g3J0=_TC_2oeyakGZ*?M~dtRHD{bhVu%DHM<
z1Ac#KSskCIxU=ggd`{eqzaz$5t^IsV!~D9O|7bmrk9%Mmn)*7P$$svpF;8E%w8Mtd
z5;M2zx&~e*gOZG_vvX{$bIJ9&%>4tVID!A15Jt<;)3?bu_s1ss;%|2sqV)n$wYdkG
zXF+ln`tqox$P$R}oqt!6T`HSvoD}?6&nzPzFJAMQJm>H5U#;~?$&W5mJuwdADY<}*
z;9m9*u>ixj(l=tibAmhWLV~PV2{3_XfXJ1XYxtn*7JIAAd;K^1KEpErsV^;`@A~<z
zHXiRJmi?CLE_aPTML+K4OEH$aNi>r1v{%p{mAc{oYP)LrY>AtCdF~$9#rQLi2=v|Z
z%M@!6%71w&<NJWfYQjqh@0Shfl&kAa35LyoF7Uh!yefAo-S!56f1k+t9(G%2cy~0I
ziC0V`t>CLUf3?Z<NR;fXbCtPW6Mi@vD5dA}b@~dcn~nQce+XIDF4#GPhPziPtF~kZ
z`GS(bCpLfo7OSSvKXdIgGU8tS9bN)|%**Y~W;MGb_ZhX|9s1vX$shl!3zu}?Ox{aa
zIBE3;CnEwh@jqEW?}meicM|56LnnyGQ_G}4rL<w?vG$X>M}dHx5k3p=ovc~O(5sAk
zk=&Y8d%`^}?hKrl6u$5<oNYtF>VE2BleP4BMa}U6dclJy-G~?-AIKy&<U+Sz5TXoH
zR5ZY37q$g;QBS2`67Ghc0G6#c+l}rJ&~f0EG$)!^mE3EtzXJlxHn8m)Hh1aqsvNTj
zH@eML!cf)t2i~gt_lx${$Yh>loHFaR*zjBX4IOCSrP7PaDK9dq*Tne8G<h##W3*;f
z4Im1hY4bGo6dRo3Y}YBbnnss!`RBybae&n812M>jT<whWKu;aq7D<NS2P4TKS90UF
zlrO_-Jau0IL>GTgA7<YDqhwM<X}<EQuPlose*R0F$tKwS5`-N6CL9sFT+DhS=*8GP
zBQ9(fWps2br)f3ENRTeSF)!N{%<Ki20f48)qXs*k!V7g8-dsDi_WdjKsM9qQZ7_T=
zH=Prq?F47kniCS544Ysk#l)0VfN*rA^Wd9+!nsP3!Q86v?wl32Mis6os1!yU3c@`o
z+Zev&KDEQgG9&BI=(UQT{jZKXi#D<c36)Myy1m+y=O&){1W^HqVnsEx2HRJ71Eng}
zDxCf^Y*GKuP+XMOS!$=c#Z)aNCj|nFaP@0xM$U(0z0v}Ee{~K&i}S%AR6YIZv;1;A
z;Yh2Q;$7E^Eh@ZM4CJ<bL?(7H$J=X=_^R-{4_1%xak&HXg+-qRz77GKhc8oW6B+%i
zaoSfOfN;zmph*|qw@`!#BK+Ln2aUukX|%4?E&4Mt-=X`v0YIME@~XG}f0M<XywLV+
z&K1ec!uoS<r@yNWJ2F3m_pt+-RT;R*Q2#TYcfM`>=TMObXbSLy0b%fOTh}iNba)22
zFaZOV9bM5#ABh0vv@NIUO&=&;pjXD{L^Zj~zH1zJC)r*nt%-BO<`+9>H(KF%=M}+s
zey@xUqQFWdYA6wX3z_b8&=bytUTE5KvGQA>PKu<c3*U7rkQ7W7>56_sMHr!{`&JDw
z$^jdO+kA1W2g6=M=BmPhpfR(n!9~l!fsPXUn|K}Ib5V^>t}eY&NXPL%M%<i>RwlL&
zGnBAorBoAtrnFksLbOA>2*!Lw$Ma?6IU_^uB*%IpXf<t}Q5u!=cnX)MZr7mQxOdoF
ze=svcbq3ozQo*BzEy!w0N_*D6D)aPu)DHA6X{}Jue!_|HMLUlCt~4r6;p^L5xuxlQ
z58LoJ$K-xHBmsNeP;pzb+B+^3#di>pN!lJc6qW9Xw8O(Ak_S}x-=u&gn)W#1)Qg`C
zd*CjWSm0`kASQ);iZKOU-TTF~j$h41u<XJJD(E;>`#s#HlsLWIU+TVhWr(tQzd^!N
z%TTEG>FFVRwFs-rx&O$CjqQq5d1z=4EtjvSWdHLr>b2*Qn;8A5lq_-pV~I&=B{(tQ
zYSB}yPK@{X88~cFPfO?LvgsJr=(5F8E1|o81S8V7DwS7MLB}NH+B#!0GfgnuGe4jg
zt9E)UZ8Lq03^-F_h64?G#oZFqEl5Ts8nXO6Y<qiGGcWcR$iGV*>r#<mnf5Z?eC>+N
z$~yl>w?HK2_P}SQDy-b|_+!>uUFJ)8&VivJ)%2~vvv1~TFNw-a0lGeg@&Y+&hIixZ
z#_!y7>NlQjl<@m{5xy*EV61nyUqw9a7Uo-1$6>L8!4}}F0^%3%+Ou<;wE(-S;l=iE
znO*zzac!_yk2d(uApehKNsJ<3qUM{nt$C{61`dBfzqcQv45u6J4|(Ra+(`D-(pF<{
z*R0D|uZ}5L{wXDVkqU@SrN4zh>XWW-oFQ&e$7gjhC7k2lKAX>QBg2;_>-Oi)L=;C{
z$<{YUyx1w{|6z{6I!hhX&@m`Hq&fy?g0fxMwxjtAeg8${JADwuhNJ}GLR(MG_yzHU
zo55*-DMH@%E{xioA13JHIxeEY{ful*&T{FLgjdbC<$^{qayiReS9oCppq;=Si45Jv
z7|Wo4#Mhgm!}QTbe`F5;$jtP9gci90F)o|c-&rX&`0arZdEnLu6hX4@|85Lu?vjjC
zmPj#E6hrS+wvOv@n6lMBBw&ZlWrm_*%<EeI2Pz=m(nvV$!c~Es%{y4m#*h(eE?*ug
za;czH6DBR@>D!uRxIV$Qn4GXFqN%k(=8cWnEbwXq%f4ZE55JY0F`FbQNDwo-Vv!Ny
z6dJx6u|wFdc_4?snk15JW&his@lJ3lMMekyJ+FpmPk8(awENeWQn_eu<@L&8zAy?u
zUNCTWa_6Wuit`P>VsLT%;S|f>^rg4>iKi_;EPoXDYKP?oP$sRzy#K=TTR^zJPe54x
zEX;CgBp2bJ5Hr;DQyz6qu=)G<0vVr^zFlrRhG$&Q11BpKo_$Vn>P~*q*>xJU$DgEF
ztX5|VJH-WH#=lQQfSidAsXllrdUe=*exZ=2e~QD0QdFw2<JG~pXSPG~-FSBU20`}v
z=Hc`LYa2&k%3{Vs<lZ`J@H!6iuDf>L2ggaU@x7^A;{NpX#<p%QrYW8dmH63vRPv+5
zU7)O|)K|#3<|Ia9&-o_Ko8Wwm=adi)1BWGvP!^<}lxef-b-N-k#(8FEJRN=`*cJBU
zpE(PkqQp+3^OEMQdQ;5yDRK2SzuZPJ3}GAt9=T>#?iILJ&-64)!>j8^K9Mh9rusQ-
z#4!MEhxtY}?KAYqpP{h@b0(7>&z=MQ(HfgI@6|dy5cUQ+e9N|B;UH+0v2py6b@?X(
zHEQkM2rn2g3P>s#f2Y5iwd2~d4FEuqv6M%b8WOuMzkZjmIFADGrP9R+-uo}r*HmC!
zmo%vPB1wM00Xp+ypuP##yeaA}wU10hC2?sQn?{K&Sc$$<-$~X3x)dPpPpTF-*}zZh
z@?xzOO=F8A+&v;|ztvw7|21Eum-|;=gR9GdIQ#1lpjmP?_s;(#K!IVtt36By{1RMO
z__SxJiH9pfL<EECZwnx`Z&&D0lOKRvtf_eUvgysO3hQlvMXPLLHS(7))vk7invb)W
zj6!kh6J#C&kfcY?kQBn@n$4-h5CNq|?7jh2WU<2<7s3$sGFkcYHp=VMk7qSR_P__!
ztXhS+F<TG&Udvx4>*ut-m@<~;RX<E(X2SxasOJvb|24@F7)m?s4H{>)fs)p4R}|Xh
zC}9d1x#pa#kiWY_QV>Tmgc_d$%US10I^SUoeqkyTUw2=fYBoy>K1=hOQ><Fu47$^F
zqG5pOM!q~0bj6Q*)mJUf$GP1ec@FXlYz90CUpv6#0V$aCD5?^iy#dS%xk=EuU@TC}
zqZ6OQ4FFgmyxV~zuaexilpf3_<9`>;<I-#o)b{hpLG7MgAlZ07_nTVIRB);`^IPCD
zdbaAp+U)mJu7M`Bds?v-(259MKJ(?SuWtcH3FC5nwh!Pwc_XeoSuMd30DGdUxxsz@
z%kt_|vp;#AwXD~juhb~Q&wQqTa9HsNx!(!8BThJKb^|={>JYKY)o;$wy*B>}pjm@^
z_KO;fOmU7tfMl>~cb4!oJUavVlt3O5(g{`b^8?k7MCGRI;AkdA*#n2M&D}q|J3*_H
ziNKDBodJ&I@V4F&hTd(?;9Hf@D<(lUV~f>PCt7~`2PvSI13<R>wwpU)PU7{CD1c+a
zN6qnKX-eOaII3?I6^OT-^{~EE=Fv<9*kSp%`!)#RnvyM_fL4^O{ro=c<Zf2zyceJ%
zNZ+<TZ|j3LOgb)0F?-s>c;BrA7WHRIWsrNMX(VT88UabsFpJLaG1(Z6_{-{qtnOrz
zfyya`1iHOb7HW|oH-|Dl&6U`e4Uo#s|41c&%vGxd;e^}1X|mitlkS%RDyD%lxhvOx
z#%CeXii;mj6gKr{a)%*GiF!P)J16c+D7B`Y*p5ExIpEOd|IkE@k1p6jdlVD3b?`||
z$xI`SdU7pN))5(@V26xv0)sa4n|&RZ8#L#=k=srH2m^{9e(Kh}%RE6bf<jz9#ex#a
zr9_K&KRhds|9mpv+bvFf79)^!rfBg_r;BUf@mXpS5lDvIK$Z%l{GN)Khg;^!j^^7#
zXE5fRy@G28x8Dx@S0!!92%BXY_{0XT*2_)uhG#(Lx=TYkf(r-hd5n1sB({Mn$a|Rw
z&}TDp5}NlWP!W$O)}VlW*y4ty=~|zvxTf`lGyIQQJkoy+0E*yW)#IGO$z$7nb{}2S
zV@NwAt!bT~byi-*!*Ba5HR=@8)1TsO4i7L5>NS`>V?~cT^s~NG#P~9FDlC;Pr!GIq
zyzRKhcXNFury*DJ_Vjf6a_8&p$kBDuc_Z=0qi+&+PFTi*Jz{#6DlI|)yLZLf+eN>m
zopM%u%-q!NG?UYT_ooI9cnC4F4Rrx+IhwenQRR|Su9w$_T8@jedH!FUzVUx;`thq7
zJ?qh@mMEukWuI*aS=m2V`kB7W(6Cd%=}h2pFQ;H)qqLHGW~eZQ?v{wfrBw$bU2>0G
z!_2&?+WkR7MSGP%vLTZAanT_#{eLsbkwYd)OE_%5Itgm2tPM!~fz{+CzZ<9)46;C<
zO))))XYD^NlX1K&MXHHVz2j)~(_!&LB1i1)%FgQ&7M<Lt$74JIEpfp@OxKHEHQ`p9
z1$bWoQ)(pFyNJlz3#<G2S9czq^{@5Y;K-qRcYmm9w>avacvWA(PJvfIAv@u=)rXVf
z|Lf92pZbdRThD-U>GU@|TS;GQ$Pe^|-y*5u6JN9h(~|G=f4ufgsMq~r`dBO=B7lQV
zR&*<{Em65zp&KGU%JMQI9~;A#6&^>Bkrcc-RHOTK$N?xE4>t;aNO=8HE1m(BmZbpm
z)O=UFeBWOSVBpAfMsk2jds+Epy1Hyc;6hX8>KLG>UKBj1BH<=K+D3pA8kOgzKG?dw
z2V$^uE*_B3+^f=^8r-rQJQ-w}^v@bReOvu4S1<bx?QexwJ6h5xGlAR7jo2PIjJBBe
zDiKQ(wp<Upxev!eM34+d)bHi2R;vy+A-Hm+UNc+;)JvR&KavX>{o8#3=o&s=ydFq(
z&wVBKR_W=PX}4SEz1~msx1xB53IKT>I$hv>(zV8CsXQxmw7LO101+|!7dcD}_)Jn3
zp+0N3ti8JNImHfs0Ol_k`W+~xg>qE-6geR~hiO^SPpMvU7fw02mooY1ELWd4v<n>)
zy$bM0jPi6Ku=-GAlnGfS5_s`tXQ(?-|04I5oP4DmLv{a0lwoG%AN`@nBHW*v36H0g
z?WXbSDpcuBaTrdZW~Zh9dLkxV=Zp*@5Okd{74mItRLOYSHW&5O`jcSoZ=1&8|H%S?
zvCIZBy&mB-Y>pbo8Ei%kM2Z77R7alWDw8x=?t@|?kTK^7F;fKWzigCJZVagf_K9>m
zK1N_^CI-yMzuFFAMu_d20a^YtV!I{>6dsKTvaW5XbEH>N*}~FF*X*b}z37FA9AGhu
zEL{yXDR7rDQ*_GOU3A$o%DV&oTJLGUbf3jxJE!asF6R+mC(Pdjl4>-Z%*P(}Ro*VS
zJ%Z3gaef}rR~`s#!`PXzS5-Ox9ZiJ9VbpR4mj8My@7S;s+E5v{>l}CToyA<Crwy6u
z^qFu#U)p-5yE{`rtLyXDFP<8zgI$x48){?y%eyz*0T{@O-M^@y_bezXbjk9m=Y*2*
zHuwcHZ9i%ip-TLUY<3qyu5|p~IZ41y1)pd#QaB5G8NneXgI5kUBLXKW)DBNlh$MEr
zYn~SlY^^SGhw5COS2MVRex*Wa692ie8p+|sI<(rH6%`@nCCpKK&$h~V8r*s827DVs
z_sXcmw8`w{f$2(8PkMjp&Q3s&hdufPF7I1aYBAlmJJ&INa<v}WhOo2y+PH-PCn8*{
zQHRqVd1*=~>{|~A5N1Dd^~%VeX{y^{Y*RQ4$wR*CD4qfaWXJn@jWXi!h|OJ{W65*V
z2_jG>d%TL}dZxQ`uSkFEW=wABvvSC%yum!6M)6M^<EWeaDhP`QHlM~h;83D7)eA_;
z6k0tC@!R&WAQ<y2`2o~9V3TyB0X=)*Mj&T(_iKwDddZ;lzA&fd2B(?8JJ^41@Kw@#
z_+>CH1p0%hiJ(P4ey*T?8*gwGt%JnM40sD`Qq8XHJK@5ge$z+`uX9(6aw|sI>?L75
z$CB=%e{vCG3rr8brA5~vbE%3h=eAkll9%WoFs&lt&HrS_U{iZkIBduDGF(j~(fr?O
zL0;j`O6A`^P*A4srHL&ae%j0;Z^wZATz8^lZ<YG6Ue{T+Ng7+qz4q0_ecRi0w;R0S
zkKL`o)Yq$-HEHqAW16#wDQ5@XsTaU;C%@`}mKC}AkSh)=#K_QLFg=c{%J;N4Bm5&e
z@#9cs)CHRG8~uQdUlIQa`2UZ!H;;z;|Ns8ql}ad4+4m*N9<ozXlnRl3S7cv?tTU64
z-4JCr@2I3gC_58bl4U}SeX`9c%V3znn3>;mdVk*E>wEpqb*}6Bo%8#nj?;1KXkM@9
za$jzbi7S{lk!70M1wYa?u~pBFZ!-syY*c>X$k!hTV)xH1<#7?PVX^nhodZr_jMG~6
zo2m+d16h@Z8W05QD~R$upFjRTT8h<*S7=iEcCw}AW?o0)_D#+pzTFH`Z#;B0_bzZf
zmmuJlDH&0pDLR-W*6(6r;Hr4~>5+pk(qqL=GK)X0U-YF5u#uh>9=WI|a7EyB?q00#
zy20{uoDAEM1`oX-nquRy9_;#Iv1jy)x4X{Mo>~<$&)We(6j67w_L45Q+i>0P29H~U
za+iwAFH6F_D}BJrOy&@%N;(YBS%RBowOVQ}KA*>=Osl@eEeVy{&2y*I&`O>7W-uyw
za;IFl=vkXA(?vR4mW7r8xcxas|F9pCTZ0%ctr+}!uSXiPT<f?abqyt+@%!U<o6|QO
z_`;Y&dm0=AuUl}(dQQ70-x`&(^P608+NgkN6<z$Z6BNv=?D3n#2q)fYsjSQkQ7Gqs
zwRvcl7{4V;K&nl>d%2f&dw0-dRzS-~&$y#E?0X9Dw2Vlfkq{fR^5f3h4zRnT14_}m
ztb{ph(|Li@E~?od4V%%&T-{B@Y{ghlafQD&jXE-Pf24HR!&TbkxO7}xVg<NXq}#U@
z$g)H3yWi#hTRC1)@2A13(}5=&C+*+uRxO=Kaz^X(mD@dbv6o1&%@Olk5G1Qxx|grn
z*_JCS7%O(n{AI~o;i4JaeZb1}KAF#8+gl+>x>oz1p}e$+@;4rr=5KCn1$~zjo+xI<
zv|n&P?d9Czt6e-NrmK%k{*7nkC{PDul*n;UcA+_?QBwZP3TuSqk<wQDMZMJH1?N);
z*{cd)j?s^8GihSO8Z%HC0b&G|xjF$WlD7|>C~kIVX5150Xd{>k-Hv(j*{#jL2-%mk
zG79=0$b(tFN>1GD{;A?|yEZ4dTl-s2=9|M$I5PUgpT_Io2{XDj-7`NOMvudoU}2GC
zP7%8e{Ae~h{2>)X#&-L|e;|uSN+D63>hK#6rsu9DM$&4zarm4x;UVov=g22bT?JT%
z4S6}XYEc~Ac=C7lU)DlJ^o}_5d8isr35yeTwT@-Iqt?=7Nsf)TiIne?dFVS+s<QSR
zi{4nAeOpZP@>&V}opYHm-h|%dPeFX9`5q;M20R(uFT24#gHVFDCC^2CDpjrX?Wsct
z&84Nt!3u2E{2F}gjCDxH``~mCqHXr**c47G{g-tz+Q*(riue@yfRp+5S(7^^{2zFK
z%lm9O6lLfe1`w2&Qz9Y@9O_jccj?*;j*Io&^l-wHnz<3Evu6zLL2mrUDRl5$-rx+S
zUdAl;mo`&B^xI59B+AR5&IfWQFc7~j8si?I*`sznKpO(wtO6ENpp|R*JsI8I$=07?
zY=W8OPXX9`o31%fUgW)6$^qvu{q~>t52;c_$*rT-D5?{u7_VPJ?jZzh^hQ+otC8Or
zbI(uh|HyteUr*eyy>;D6{(A3W4+g9wTu&-7mkNGv`PT#OvABxQY=;qZ4j#f#X}!`2
zVGwT@=(~R)^ok%F%61ZWKwHKn1YjMw=ByinvFsC>&4fXGPm&G$D&K_rEU#5~zB;2)
z=C}I@!ZU%e?NICfx{x9c$`<WC8!+9zW%YFZSS$2ss*T6yB<YP0(8su-Y-_PPR?~B%
za`u9gm5{tsBoRU*q6CXlpvI6pW-xausg;*dPRL~dqrpCIMJEw$ehXmg(LRyg;8ul*
zd}c8{l-<aR&uyEhvJtu;{P=lnQP(3pe%>{0-}wVCPh8HDdakqvL?dO`rSGklk^kJu
zEy2E!d|^aEo0^-^mYkTCx}^}o{xac2;qj_=Na4CTs1e3TnmoTH%r_qK99JS^x@~#^
zXN2+|*nT>^XtcG4j{tFep?U9ZpPC(`u9}n`N`s01s0RJ^O!z7HIOC#9oucy!SFy%q
zwTo~z$h%JgLRn^<?Ngg7RRQ_pX$kpZ-O!X)y&FZ#gpH4<a+az`t-i|p*1V*u-_~$^
z>_F%sN7nXU%klJwL)q>2D}T~v^cWQsI1{u&!+%!SZaRkQ>l6T-%FrV4)1!u{w0UFB
zBBs9k{wHxgCQs+TD}>2U;9pDE{4TLT&Z3@Wb`*H|YzAJa+)3=!d4zXd>8*@j80#ej
zZxV2Y7;EzHJqI#E55^8(3hAJiVupposG!`j`(YWKZ1PJn44tuLLX!oIk(W9=IJrTR
zzN#<{_f+g;9LwM#vn6-=#0Q1*l9Jh<x$JD!U>$<Wy=QgZg*E$?j(ykSiOwvG<~WJV
zbK@Z;jI#dYKN1*>ma$?3#hO*l4&q;ZoDKEmZx0tF()e1b<<VfdI^1IDnC_Fto7_SQ
z9~vcCC#xq{y@JcQ0Vz?_lF*6S*I{FvX(8x=DxU_$G1zmdFw+!X2e49)ZGQfma%SSu
z1D-Q%T<&bcmt<9~w6%wdl5Nx#xNkC?M>Z|BCFlSN{43&SD;@y71Wci`f(z#Or`lr)
z`WLGmulTMA6U}@U&K;Cns_An6+4RAUb>UExLCX9Sqs~{y{iuIhjAW^0t{oe_lz5q2
z)$3njr`SW;pO_tr{s`~TTGO21vytMdIBY*#dxZ40szZ|cnO3_2WY^ZJ7j=W^or^mm
zDf_)|)aI}k)_8>SBiaI>B9s<Rhsk#HuK`z|TtCD=GyCh?tH<X3_xmS7%f0WB0T)iP
z`zu>TpR#t6OauCbidW~Wk}%A8w-;&$Y^pJke(*RazCGgjC4^kBFM~Sq^NuBN$Y3Vn
zZz$K^jSio|i^h}XcDg@R*b^iEXNQrr8W|`qb*XH#-0r0+`-AsB9EiYDvy|~&@W~v`
zk%W}Bmf@;#o~|y{a-x+)<b(E?hTAsvk$cpgi5XgEEiI0+ydwwew$_{hSLYa)NY*T*
zd2`*<$a?g|Mi-EX?0Ly66&Yjuupei^J+)XZ8J+CqdQtIUdq<{n_Lm)L82AK?wt(##
zCQYheIdPQ|q89q(b(Gm<nG>uo$1Oie^LRZxJfF1MvO|fQ{QVEIN|2u{$&<(Q%r3Ep
zX}-~kH%4pl=Gg=@>o_5_sH8!hv;Eb>j-qjveW#<p<(V&aQUz4ZnJ#v^*yl&Ae|*G3
zJIBL9P978E0_{Z_PnZIsIl)x%w1WcEc9f|5FZ%~fApbfEif(va@?}p(W3jCE{4Yfz
zwzB0By1SH|fLaSz6AFK$a<=r=G~+2sf8HFr9)5#sjm#Osz9wEy9RdMld9xr?r~Da&
zbk-4=7&|%Tl|LIy_*%2Da23fgr$+IYAlu%xgmaZ34U%hU&~;TH?x~nq@$&V~R~Q%A
z()M)S#>zSc7w^5lN)evJV`1<1M@nHiCw|hJKj>b4AJMPC!Ai9bzq)x$bauc_ed3!*
z-wASQQrLB=cunuLc<sFR`>fbKvc_S1!2scVKRVM%hhHdBK!0rQ@yd+hl_}w`P_WwR
zTnTbnKBPrULfsTU(JqmfcJXqK&w^&92|Z9NX2&kPo0n>LD*S1N{|rzmdxduGg#O6-
zKzGIrhF%~5(g;sVBrrvG0)y5%!|l>`SMYl}3iYYE#)_G)HvvYd{o`XrQN|bgRx->r
z>Sr;k5)&>}vkL9n^FQdCmH2=ssnCb^v!ihS&@v6=`v`%0fysWe+y_iGI31z566;Zq
z*|6~iCl;tlc$)TKYF{||sH&*+`JZ26+9zN>80ra;6Yz@H<@}yG50?{!KX_|<o6yJ_
zcH*NU=l$l!{pWbCrmCJ#i9KAF^hS+O_!-}a)=tB17S}*AQfA$R54<zzCFp5HGAg}V
zrykR;{uLWCHkIQ5|E|EdXEU7tr%370J2%tiUA?UeXPHhocqr`JrPnr2-dtavQ@lIo
zuFk9WH}>W4j<spf{#p9@!@30%TT2@piM-J3n6OFig?D)M`1u&aG9V$4DU`r>nk&IS
z&QUzpwF}uF&B6Y{+wNgMx8QH~$1#bAW`x*J2xzBU^_p?Fzuc2F(PGUc<5qe^Pr9!S
zFEy#{QTMzRmwYuk6KQMa1hlu_t8DmS@=>>{!fS;*VJwJFf37c9JSkSYP^&C7jPdsA
z?gAi8ingdWvCOBb$KwTo5$%TE>+X|eZ`Up|&-!ImM)rMAxh1~(yTMB<wqZRfOs+J-
zH+h8m)GjxCl_fbe_ja&hg@%hKO3=Zr%xZ+8?Ecmw<yjbXIueClCQ0>$lpkqp)ISmM
z<+IHZY9nQ%s-dx~5;_X+{?!8hNwMzSON%<*_<N`{C)_)3CCR1{bEfStk78L!r)Xbi
zBI*2X2V4*nGZ82vGJ{U}47+sU;(!yymys8e+>2bdhtGy55y_?~wE%mH|7@DWocyvc
z)i98L^H-|_I#ioT0!);8C_84#<oi%~IYjlnwv=^CuHfyzlnb|^kF7C}6n&lWr}_jQ
ziiz|c2VE9IvWRu(YM>ss0ET8P@t7({0`9qBe7FZVQPzB!!Y^-x>U!^O^su)G(LOH=
z>rqeZeTb%Ip>vRgRFhrz8Ip(Tov+#2rgwsR5+tq}EphO7)B@i;MwEk}nTI=J@hwyV
zR@HsBa#zPl)n7!c<Mca_S<{4gUq;0bHa!2{P$9u1mVcU)Ga+r>g5{f-{$n$1l*3=C
z6h^<%7N3uN@UR`m$MZw)*1pP0UGW0;=1<l(5Xaooz9aUs;>+#vQVE~Yx(E5MR!8N?
zL3r6Y_m3(sW50QPr1Az=yjr$~Th@L8K`G>Ayls7k;@S;q%hs?gL^GsyYC`rct^JD^
zpP=hOSch_AeRNe~os@KlL}Mqwv294#rb+X#96M$(s|u<y!-n?a6@mO%QoB0Ffe3Q`
zEj0}=BKXM-L=H)Att+0F$YuNSIic?4!#D{=zqx^o;57J^O!<aYe^IY%MmM6eLLEy`
z?9EqA&5abdJb5&N*SIyZygRtuQfk>F0CVWmh8l($v%cJC93BghRV;uH0v>>X$#=Wv
zOR0C9Ki4a<x!qVj7xNLf!GyknkBXa`V=>X1G1yN8GCIE*=a~oUrsw6MLPI()Upax)
z-;?@InszB@jU3E)Pv^6cc70oE8l;n4k=Pd^p?nv*{Cv%A`e63yp>&@5IeDcOz=pt3
zyl=!?Y`=*e$cx&bEUUg&=QOd!FxXEAUqxX5n2)tfEh9PwW2IXeaDI5txwh$tf*4qa
z!FPOPESi(!Q+5K6HiwQ9&r+JkQ_yo8a$!SANQa8H-K;MDeJQ8ytIp)kfy#P72bcmS
z)F%e1nh%OCrEz;77T}Uko<qx+-}yAND@P2N+gj%&eLd6HbFi*oL_se6a*{gHxi4x+
z5W;~X8S}3dTvyp**fEcV{`@Biou7+gsoT@4sFG1*f3kG=!?$()zD;u~jys3H=P>5q
zt|P1bUidY+_g<>nv9Dg=G;7NfCZ_bpX}5#J#hfo<-TaiojRDXa_Hb6j>3$#41vR2Q
z%5RX62{&%We86B03HXYT&CBPioEOkhIH|i1bhZewwCj3>|I{5vw<Q;+L*d}5WO$>_
z>|LM)FVrBV)eG0+ei1YjZ}j=RABcT&m+T#mY&~DKVPfAN8fQGlajZiDw5%Khgx#tQ
zW0?#k6pO>8CF0^=eue)uv}ZB`SJy^C`p#nZ4q!sg4bEb|O*dfao8D2BVe~?(i4ygg
za67)F`5?C)ao-?dQ?I?yZKE`)E9>u=W!TgA5yLhAlpRYq@_e8`A7peCX5s@m^cINo
z>x``ZmcQVSFF$D<fD_k(^?N{(Thhv#XV7B&FbdEHZj6H6wDGSRfM0P$LELTd#GtL=
zdD+hF99-OGQFp(A9S$<)O!t|_C!HRumgblTbjijM25^hU7U7hO#-;QtfW!GQvYYcP
zt-5u)QCOuSR#nXg#@5%#9{9ZQP-Vxw&D_`N*}L~PKy|^2(RoZiRYjf1URI;aWE>An
zUU}60<k`FRBp=3ZqT)7`ELbleYeTN-hWaxp$yBIUUdLR@<Gzy*8MA|54-pQ%J(BnV
zIF3zSzDO#1y<&I?25G5PJK`Y(BQ0eXaeBZVE{|)$y2|O6Ykn2x8=ZaQcR=?sG4aCL
zSPkYEC*6bAWAFF5+$gza{OiIk?V7ViUh=Vz7s<N*v#pTskp1?i0sIREmo*?lSyyT}
zWt*5Bb-L7^7h0gC!yA93y74cYzC?Vg&X=BYSn#FLmd5Nh-<tKC*PB9mxx0vLGnjNn
zcD|sKyeWi)+CdfSRt<~2ZJLiVP^M5}s>MR?g*CpvJH(rT0-B1;2Ia>eGjrdO{84EY
z@Z(e%v{nr?7YU%bD7oho0_%paV7r`xkp5-!6OnV>E@%(RC~9{1Q(K^1B+W&yo8o;!
zLoGmmQzP5DmkOF-jgYcW2yjmGUeYRJq=6`m`XfjSLh`3BD}Fb+*Yd5mNQS1sI-YKF
z{70+lf0~a2f0~cYLUn`ObRiSU0<yu$NoFSSki#@Bv<hu7Fj8L*59qetlYehlI~Dnn
zDw`kmAmmyPj}yek%eQsgX+3agdZ!#&TA@`iPY!qIB;U9v<MW802MSi?O40Ed*U>8Y
ztZ#AHfIYM4)E;3W>qU+S$>dvmYz^yap^7c3ivNIBp=^8?!fkJpR_ICuLR=wm7{6mF
zcwOL75}M{r^2zdmi-8HXo1^WjKI-SGo2pf~8#bi4EHEP;yQ?IX5YC6DHm&2d558-4
zx;y1dWS!cRD)MM-AHLlWR?w!Y$)72LYL1W@L!2shr{Su8fz@v06h{S-nYK5N*jPr>
z_7iVSX%N8nm#s%jKn<rO79YGaS~%6%VGUUgxSm@&n;pzgP&efqf2+N$aH`JKsQRh&
zxr|Ptk6PQd2qFg<jF*+%UD;slHzbtY{{GiwbogU3sz&XWA0#gvzNYM6uq92<##BGp
zuZ`Va=42y#N4wMQ>dBhjYHFI;e{DvHr1l984}&V<gm($^Z*}G(q7)0<cz6<%Do(Mu
z%R9$%kIZc!s(7ZSJ(R_|627JTMe9XYAh<H}o`wQURb|_IzO`(=B&DoUw(GNS*_$pu
zE?Io6AIF9#F~20fxBKbq^a2X{YIRYcB_q`R5-jW$egdFyYwEczbEfI7G#_dm@eev|
zkIB`-z^m;f-{<pR4&>Z_t=W(00IkUFJYhtJQ#TMI;BJSKA9Sqlf>aMc+qoz{pE!wo
zPCVV-m{!*o_~#|GH}1AGF{|hek|ESzJO47zIK#pwXEwgp)KUt(dMroyWm7mxqY03q
zYxbSSNCa>iTfe8@Qx`Z_{}wbHTCb5*NS|uWFRU(lq;8hDc(i;wb3@Bpv<mpXQOP?8
z&ED*f%Bclh7d@UBtuQwja`Ynng!t$#2hQ%r;<wht7YQFWWH~y;*RCeI_6=l;6e)a`
z%}uT=^E!7qXDoLtR-l)<UE_rgDW^c2H<zO*Cemqo=YoVwo5Jt4WNPX?Y;cpER^Y*X
z9zpU?z}Tyy@g6!d;9hq1%kPqA<KwWzi5+1^^-Vg5g%C3$kz$vYQC0&2acKzGyHeVt
z+XoRIu3=evK(_42;t@LOJ|+ZyYyJWq*wiu|6!`x}M-}nQa2}gD*z((-qI;gm1rPF7
zw-A^A-`kC_wH~hHLM~j~Boa36hixafhv4?$dX3{^+q&+*a8#i`a8yP>{<BXmYx!mO
z`nBmLrr2;vrworfjX_E#$BwWlyD=Y=QO>?+ex0elds5e><Fwv*Nd7d|U(&2(4&)Sz
zmLi9S$bgNyg!)+fBQo!8V2@{8<bg?JQvFAgF=#=b3V<h5E#=P<H670n<UKsr&v~fa
z4lECZ&pFF+V@cK-E(nACs<`)If?*1X1hdM3d|@*Zvs>8Bjn_3)X8Ee4+<em0U7)>s
zr0X-zZfZ}VUX4RERg=Tz)~4oGLi*_>YbIJR8QUq0q6?8vpa`upc!0sN-iW%8^G$2X
zgs@YOP*j<-4!@7{fE`+mNFkTTR3Oh(>rTX~w57_O1l+bOq%cWjyShF1XYAD5<;wa<
zyOsCGA{{L4eb#OiK}J1t%LQKI2*EmhDo(^7pvh*i%3XfVj~Nu{>-QJ$h@Sc+TaZrN
zQIo!Ld+S5X9|gB`{f%u^*<Ed(8sWyINCf5fkO@ELfnU_~rYD`-sUP2TAH1@uvTm(<
zbXg<%F<MC`ZC7Y*9W4FX@wz^1=Lu5&Oqp`wNAXvFUXRr2c87OD7XZ?96rzV$Lsr?k
zy-<)juATW)lglBuxbN-c{>iQTX5&P!mf)LE|Ap4N_iA(bcn6oJg{=>QfsQai1E)DM
zHLdF2%-2BLQzh>-pS3T-ZB4gdkX-_~OUmh9OQ_&H^7MXK3em~3!HGKZ%(v8~&JP{p
zhk(de%_*!p_zM@h{c0SgkGw33?5+3{PL0bh#^2o-*jN1=_#Bt$coOv_y3a%)`p^!a
zgKc?LFUZ>gi<VXROtYv~qZ?7-FG&0_qv?;ljO~32{}$QOB~!8AT5G3{xHG!E6Bk;D
z$T;{?A&{|e8S(0khF2D(|DxV&_I<wPlvsmi#KzAMw7<7PsL+A3Al6Su-${h0?UN`K
zHFqcZhm9PGp^6R-7E%A<#Wcg+kGkoBc%xWa4P9rg@*PzuA`ycAhTY58>fW#uO4+<h
zV()4f?K4#O{6XYPbP(qmjsA#@X{`aDfQJaXoo@LQmYRoFFVf}pVB`=pmY{caG?ls2
zE(R8z)2KSp(bJq98i1=(tg)USg`Xt1cp%Lx!)q7Uxtr%tTyks(4iNR8>6EO+2pJP4
z8$a5jo6hzPBGv~Weu;7wSl~ip4Qn%{$|JG^?dV$C%PT<hMtmZ7{>kRNpIraVUv}Hk
zm(iW9&9<bV5L%Fd{ID~8YRdy@-qGxE8~I%$**eT!?I%FHP<@(Lv&*VzjMJA&&*dia
zE>+4wkf2>H-lPpz2t$NU`Q|izZ3O5>0-*s$aGRcsLP>q_vmw51+CkvgG%%=a%I!Z;
zExYd~Z#334^)_Z+IoWk_VV#$|`fyd%unV(`R*k|(1wb{&DQ0Ex=u5~5965g<y8`V{
z5Rh9|;jEeSrEB+Ty(&cC{akcoBWYKY(5$@o{$9bZIwsej%3W{|$B90(7C?9tcijCI
za`$`kdK1n8P*v%5z3|yZlgY;><9>!>RvTi18<xXqMLb_<41Vw1a*$^^cus)B80k#M
zSq<tMC!D;OOcM3diV*3SykDdrC*wE#0lQEccHMxr{i9!1=UMQONcnZ%=ZY0wYG-#T
z(%=fVOzB(q7infO+0rvB$c5gH(TjNskBR2~Q}<J7yfz&}zOuLLs5@uuvxq_qLYkOD
zRWP7+2~ND*{~Jsy0n$8MU&F+eF)|dDETQO|`p&v5ot}8cbRGS#77*dwFY%_kSj#la
zCL~`kMwiit<oxw(;E91ulH_fU7xnR{T9OosWJnl5gO#Z<b89{c6~^zqU}mMtEAjB7
z+~jx>la2SkNaE#SWjpz99G*Cip}tSEcJw^d)egG^)%KkyXUli_X=*F}3hiS*d}$2C
zPM=b$Cc(8nTOoI}BRoZp@7o_}{?H$Is!3z#N@_+fjq$ej%+!BDr78%y8AV2op=m%R
z(8}S>WFT^lvMfSXz)e#y`iJ#M!vM6CQ}>}*j|u}G;hWAREfK9`8Y+H_qY8v?n-+ZG
z%nrkx#b+*<9{QpS__ZnKZ`RMPahBX3m61PomU(#3=Ik1Cd;yfjqGN1mgFFv5Vly<M
z(18e9e;I-V^*;+eJ&XQE;pLp&@kNd`9j(f$-wN9kj!Lyhztqdv(WABN-Q0r-j}+Z{
z4~Z*VJ~-5FKN%C9!TWB<+4<g+)!73Xi8oKC^InWI%rsz2l)Y(fArQ+e1il#l<TMMp
zDqWfl4#ZZ)W8Dm+NzBgKz1x86wOG($NVP!MvuE~tajYLCL$tfjbo)=5RlmK30^jZS
zy~(Ph!O8oEvEq$o)uEZ29BP|sO@cDjmgIACJjGJrFr=Jw*x)d??RVJ^xGQYePV84d
zWo7xA(&OaCCw}uzzocun;n*|d_-oFO6~7!h{amTU^pJRx;rk77c!#ELaRd4m>99Y=
zDH@<v_5Y7(Rg~`>SzR(*?{DpxWz=Ki<-I=!dgD<+?_&ebKH<ptQQFs{gEvfbg1#>+
zzJ-0CEH))23#MgibauSd!k>`OnB4d~IJL=PTyh?WwG|~Y#*V%Iw>BGbwMMRWm37@q
zM1URW0Ch@XG8<~tFNwZUhn=&dho0I!t)Q2od<5CRo3Zy}_2C*{)RSJVK+Da1Dcx^c
z{vw^@qj!Ycr&cnoQ~D??5~i(Qbu`(%6-X+MP*S%sGgC*KtMDv~|1jX<hzU#$b#&`i
zK^f33+wLd~AW5M}5~DE5&TyBImkE#o247(%M6Uv`^Sq$`)TEt!c&8kV9Ns<sWP41Z
z>c85OVPeX4ejC%g+@k3Xy{krgtTm3p8ONdA(i*-XO4uI!w?oIyF3T%NkkjFLBG|4C
zArQH4KO80OIOy)p%uB^xKZ18(WGlKpG|;Y6hZ&>c8)VE1el;@N3T>U(Dzqs4#)!hI
zrL&6wCJzZhRe8x#cNIMds9s~_8{1I>73$Qy`Fo?(CjW`?yRKccGqc<3ax@$~ZAZ0q
z?oDVuT#$f$Q`yX1vTKh8ko&kc4SXvIxMQmpJH}JxwEg<r*P50_11^*o-k*~q5yo4C
zs}zTU>k(CC9-C{YQoEy(t;u>Suj!!j>E?f_jeDlB6CsQQsz9IbU!jJAmB)cKc}QF4
z)*p;`aYpyISG%z9YYQQWLc`PyEGcxbimNE)e=t>D>IbU08BEn`Oa{Bl%;&OMDo0;4
zr{3<dza6&ysM0GsDG`4~=0?=fHMU6j#!iRf_L2KeKu6Y_Y#79b*D=h=?HKacR=gyN
zVNU8HmoMsZLXmgT9`7Kzl)gBr0Ut^^EzNrhSJ&dzXrh?XRK1Purzr93gzJ|_w0sFv
zGSs#0KNXkrIf>h)GebE$UPG|!y=KhLRvGT`vd~rop25GF9ON&H45Icnmm{sQDgBA8
zCaDMGY|0(6@9MXNJVJeAAHOfTI3Xn5bnrY^+=CO!Bq~Tob)HE*XWp_99Dc;=Q`sj_
zac17LU0Q@%wT$)+CDv`(4`<nq`vZKs2JFk^Oirc5o(ce~cKnWS6{}cJi<Au7f&6KE
zx|i9ivwxF5=HdrXb5ZPT@tSjqpvh|ZPGe^jg%0;>+5#lxyTR<qy$&KxAN!xu3^l^@
zqomP?Rx0|tMzN=qIKN}BAg;j)NJbh~@3BB4fgmN3u8FrVrH0gY(pf-fnEYq<2#RT;
zr){ex>r#$X(eTkA)QvEaD95BPZ(BoH3#*aar^PsXu17ugKo1<Pgw%PMc+eTItlPu&
z++qeZ9hr)vZJF=WmMd4*YQu>~9qBIvU@*K1CVemKR>sa>*{5mTUC%!cHG-^a!SykF
zBja2DN3tr#UhFIJSl^F-dy(NYGpJ`GcU!<m0^M>9Yr8KvFR9n_aIw``p>?S)pj%eI
zDTkPk=1Ixbg5m1Xk=0PdB!KH|pJq!;dVlD2@k^aK7oiFc4x6JoC(j;veJ1u;Pi}9n
z-DQ=hr`fnx1Deg`C7&Gi%2Eny?hU*!FHpJOTFHoj1#6KZ)40k%)kxTXuSQPyU*|Iy
z(T`idc942G>ucfWtGQ}`ocsTqv8wf?`?aH@z3^8UL$GOV-9Ek8i1MMH0&uh&;Fqeu
zxfrYRAs}iCLmua}Jqs_A+*5s&dF-yVn4;l}Bd*EJo`|}ZjIo4st^eVyDifX=9m+nM
zl@O%vet#f4t__!+aDS0uW2>K->$2gd>U>0VYJt=fWA@DfL@Fv=ox35Q0a`WF=XjCM
zv~*C3Ez)2)jw6nbXG0g2lIfHDM*B+OuWgWz1x97H;&@s*X3_*GX7Bb^H!_>KQBK@d
zU6T!{fq~tAU#-EYe(~<>BVQf>n3>S+@OV6$%hG)<f{}0#CA_78c!6HpH{Ie4^oyU!
z$7ilvWKo~Sf2hjROUzAWs0;0Huk1=c1Qi8QHpGOJ>EQ4ZgjYPixM2-9@Lg-SxcIDI
zgh;y&qxWbt{A7}(KmKrX{=NsqO~Eh#^C2Pck7)b2?YqRAcYG9kUJUKgIqg_3BNxxM
zumqXvJBqPKK0JT^Zq8v1|MG%sho`fFtv?Cu5FMJrk+zq{OPr<O!X&EKL;!U4i|`@B
zVj(w2lE9kNjfz2%xT4(x=WIk7j#G(|jdgM-Yk<T^TFI{D`JvZSe2piAMFA`?#fWK7
zs9UIN^XQfK3ZqD<$qLH0izjfTH8nC8xfEF(XF<Jv=#?r^-_tFd)dEl;8v8B`b9d(5
zmXg$_fQ%$X<#x%}v=V>qSdQi91UvQ1H$xEt+N|aoF;IiQrLJ`(n-&`?9=QQ5%n~gl
zNAWEBrFyZak~4jUF`&344tmY58SFa>fS_D=0#!*@92I^@C4usT31R=&qNMAr`6Wx3
z*t!Sufp7ra>-rCknJIoH_rsg{rwr^2=dV+!MhCvh{aM|g;xZAfmMzFD)QbL%F^A^^
z_i_C2?!v%jRJ4`R#aU^K8zCaM&mKh$EDyt{?4Qj4!(BDoDJTR+rg4fj!w2<qSuGDH
z`|G+Xy0@l&>8D;>!v?k~J`_-)*4nraY)2GP&uZV~)?WR!o_gnijyLZMFjvU!MThi_
z7ZTu-{&$*k)I}Wcbl6JCF5j|7feSC0C)8`Cd>{8ALOUuf1rydVlo-K=i+TDgXg190
z0_b5*{S^^G$5U<|Qd8Tf39VNE9|0$SNieKpT;x;rXQ^w+xfxpf>KA6%-;2-S?V;B)
zk?I@otw53~?SgzYDPOKNN!|~A#!ne~>clm=<Osk`dN|YXKch4`0i#i&({2C$56_<)
zQ<M+&e~`X3NoPH~2nDb_GTz*&$*^0st+@DNe)E9OyJsGs^MICL|HS23^D1TAT~~9Z
z%b&^*%0w;0I4eb&n<TKUw$_10EiW{N;b3ZSyt?@AI52WRzp14jz9XLrPQ!iX-yi3V
z;~inS-RIsI3KDoj8QLQI&%0vzIJZFnbN`h(>y~`-EWvj?*IcBp21}R+eKnN7<L|>Q
za;4FLQ9yLIC>J507NSheFk~Frjgz?YsZjl}QRRUt)jZTe=upENBmasV9f$<iHJL$B
z2m%M9AWq!Vqb@V(>#mz#UmL#pS8rmx@1G#G<azMKM@p7Pwmxif3L<HU+c{4RnZ?aG
z*(7H^52P$T@L28ir)E#(8bdMFV_y3*uO2QIW=#!1Zx{khzJ8@{c1w4OOk)g%AE-X5
zEtzQy|L255S*Y#O$moQX5^<De<AO1{QH<y3&8+*aNukr%G+#4xyMN;7#DvOA@bX+n
zLWzI;KJ0klOdqI|Y>~U)64nB@BOfU43ms4g5Bu7ug~IAlj{x9V>P}-rePCylE{yY6
z4w!4F!cf{^Ojq!{#^>M8d&SVN$DG{*pjZ*iw&=~tvd72U3p5_eN+`#->>gQ;tL{)k
zb$m7`&tQ+_D6K{_eF(2CVgDUNYE~X%bm>1gS5*-Ldwss}b<fF9BGuIoJV=Jm)&`#Z
ztsx{gKLMAa6UkTr*7Bo#U;e`045Q8?c1U<9{W}SQMvafhEJ@w!i&w<dPJRe42%jW$
ze~mB(No0zgk!tPhgiCKK4Kt=L;i7tOW^q-B1|Ao@Fo^*EWo>jlOp%3Zcf8hcs#^;k
zc1Q7a1;kY&QHq`k2s@{qYl3!Q*h`5>LSwYw;HBl~`1<6#!k8pxB`ME8Q)MXp!Wq8c
z1E*Z!;lOPA)cm}K+RieSU_nTp?hY{fZeCJ!Qy)|&Z}~jUPCwFh0`?Q^4oOE!eqWtJ
z$ZPzEJs(Hy+pyiZ=K}YVj+;3?(O)ojX<%cCus+tI3O~Fj0rpb#-!Bs`9l5c@tv%O&
z(SVUpjFT8<rC+4+)!nk)#J-V8w2cOQR(~_;GvGX5x$&`#y96zx7?e<R_)0>leAt5Z
z{&lqR<m3mOD}7bzV)n7(S?<PC`TBCD_k<EL%Rn%900b>#DoDZ1p@&$Gt7E#e%)Ly8
z65@B?C@+>S_MKrlqRsJqEGk)ew{C-9K9R*(4_Ig6M&$J8Fdzx?%yCgl>_rnV7`fhq
zTb`}GGz4SwGOyfqS!xl3==9tS7rHJg8qH((RO{XtJI>;St!RZ4q0VCl28Y&CjkG;~
zg%<C4u8W(!C2#+y6gY8(@N80@qKAvcwG^pa{aW6yPUM+%lIFk*iEbslnc=AVGMuIW
ztjmG$By;zHI=>geJYU3*eRD8U%zXbw^Q60C5c;BD7yw6niV@x=Z+;tS1iG5CQU|Yf
z)a_{1K?@R2xP&<)v%<~R12xp%Zo%Zu^43=En<dvWm;aBkAds$!9<t!iPyhXfIast(
zA9Jv#=)k{PKy5H|8M9cD0A}C_u@OYnLtH#Ro!5>fK)yRX_G3ZV9um@ESW#gW&Ur!S
z;BOmDkKa3Dt9Z}iLp8wNUHEdvx=ZEi-49_W3c{F3iKTh052MO(7dDtry`L?`Ii<Gc
zkPq}jp}@{`-QJM<K^~rS<c4h?Q7Swydz*dzRD;y!O!aLj0**M92i2rW&xE8r-K=O~
zx7eB+a*AFnV@9u3rhf$IF>XdYACo}gIrfsy3BY)4_Y1!g|2{g@7&yn-%3p6FAQs(W
zEFu=oJ+&$oX<#G_IZVG$F?WXJsXmA3xlJcmBF4=JoJPPA7)9N3+iyGSw9&TiO`J}z
zgzqJ?Pu<2yK3t)7to`-k9OTylmra|WZ;rbNeL2@*)%$y7&oBr1raGGeyaLk8r&P+E
zFQ!$-y|XY)U=~62XAeeN(MH=yb^IWsKZ98T1Df8)Q#%TGTJ56H<@^X-MFX<}YGdqq
zIcUR{UOR2_a$maWE3|+KtzGY(UvDDHA1(V363;i?4J2&Z$vgYDMZ(07>~M$>2f()W
zma|Lb{CW^2aJXGNp~>(f|MuwA@v84Xh66u%6>TI7Ydv2O-f=iLe=Ukg{vN7A0V^l6
zO*;|&nf7P$78Krs!c~554Mk$N8H?&ncGY|(k(nN6krIhJb3+|nmFQ0ehi41a*F9Rf
z3Zw+uRT7Tzof-v`!vd}m+<GVd`bvK$Xg#GAWk+=Od5$nG1UeTlyzkZ>vCs2h?oB#X
zHTTQJ?UOn&#nu+$Y_ENEsN)W-FBh*>2&|e4qUJ*IN+cMNamGkI`*0Nhn^uv(Vld5h
z7Bf{I?t6omM*DhC3G|dLLgheTtIASunM-IkN*jda@|*AyK54!+y)H3|4X;dosuV-P
zmC$j^VL$^+JgD#ubONZ>u#nb&QLR${4b^&@Fk)gP(wf~)0?DG8b}c{Q>5{e1Z7+5L
zq+51dz`G2ZUAa@7@06)I&lxI(t~_o&?V$U+h${6|J6=c4wBTe>Z8H6A(PhGd|9+aR
z`L-vFJ)##9MWkfte8`m~xDAvC8n#^$&rl6_sjv#0RQNufNVnHIZUxPEa=sck@(K0F
zwk!a061yHSjMJWyf9ra*xSicv_9r#v?K-FnH9=-lr*vdzN;YK0;j<3m)}(!3Jj*o+
zsjJ=$+j0;uKvzP86Fbm*<9oYv+$6x3=5)oc+fD}$_M8(vUv9q=!q1Q!5WUt9=I4I#
zPoW3VvnyRXo?Q!`yGoUW5aX%x=6T0Nn7<OnpC+_7RRf<b9f>@qcQ(x%3?5vLN&y0h
zZtFZiwqEbBCmnYw3hRG%ynSEbcFA3=vQx{?v0kky#L=rc9UDJEI2HuD8hXtTt-Rfs
zN9}=zS_0rO?YL+MnR#pw#x4%8B6PxA3l9bSenk-SkDRXr^QX#YkObJz?O}gZCjvzs
zIO@m3g?s$8o!-79RyN^xODaM|AxqHmsBU-6*55~!mpgx=|2E+GZ-X4~eqyxjaBFR+
z(&zqP#8$n_4*n*Ol_-B#b+?fJr>Sm2Rvj%@3phGqB0`-aHnN3?-?_KI)o#3aJumtF
zxe@zdWz2cl$?D#jf2y+J9w}}%)A0C3fWs)at0f}6R9|2J?E7ns2^tf#zWx$fU)3?*
zO=1T<n?hKdS7ko_QTo~I4cNPnXCy8EwZ`{U?9D5kw#tN5vW~o~KiTSDISc!J*axtB
zK4fdWVR~!U%-eo8!)-%Ka*Zo$66}9M?<jYqHWiQ+8*2L8g9&zX+(=(L6bQL1;y{a0
zP25CuxP~fSbk(L&$m`ab0*swTV4u2PEXS+YO6?MNxo{o#F~d`MQ$^F1OQX-WJpb9T
zoT62NY%V2An~126g>o6m4)EROKCZQVx59M7=4kP)jXOlaslC~!Z{EK30CkK%1nHwg
z+7g9_<NmK|kNSN>4Ldw<N3FsD?7l-b&@d1_U2Y2##%{Ni&e@^DQFz^qdR&GR(&YDk
zeJ&`q0jOr)(JumDk^E_wY6%yBjs|>5{BLm~4D;34hR1MyM1otx#chK_CWWgn=8(~A
z!E2|4#swBxTvJ)n6rXgT_VChrtq2G=WbPMlUX0C$F_)>fzhN$EO8~^VHc*XmmMb3}
zn<d$T`)T!JE%dohq?#UAjG0tYbH4ME?C3#?SlfqBha)mk^IR4<=;t#A{|hkdfBjKT
zy1tBi(xv<TW$Td4kTyE92|k{2-==Z<gUhz#9Yfz=HcW5c;W?S!h_a;HiZLIEWj1}p
zckuG2O2-p<{64+4{HI#q)CFxZ@$(92Y$AR4f{89)D%Of}@7gGPS4et(nU^Y<x&;fg
zyz8X0|Gua5g9FQ%;<zB6aP9TwAC;zQ6`@^|u*3flUqRQNc0u!ii+hXqsn}!ef`OCz
zY^UA3atsZAi7K7pV2%(0Q#Y;|==;+&_b8qnd1P5aJ=&#(oU^R30!bWcZSJ5}w#pXz
z>(n>l!wkBy;)uUO)>dbn7>K0zG-V;Pz*U4g&br2tDetP(1LR^KJ=URVA7__UF?(ku
zBh6H(LHKm~T}XlU*`_k8UR%P~t%_4-+H+Tb$kXmu^d<0wyfj}+$Ug}mmJB+mRJ#&B
ziM*oZ%K76K6&JY=CioVk=-ZVSkx5uGQj@MnrxBWixOYvUNnQBp-CrWl4ep%E_s_UD
z^r7KkV87Fq2%pVlbDp>fpPuc!Q+cH0q5jE*h8v{mmD}-(@75><)AtjnShw>ir!W&Y
z_yXBw=QV^W!LTxM_V&JJ-svdZw%vgVs%5)!!Hti3M5-O9Oz81meP6fUcg;l0(<Kp}
zR!#K`dowY=fiRaaxyA>$&U%X#F25p-&rgXzXu7XG<yk<r8uP3vo7^X7WGW%{aDr1O
zdLJsM#r@hLaaYjX2HwdKi>?%hwcN`FGYv;aKbU4eJ05nnZCg25GD-2>Z6e}t#C0k3
zm%U#(qz#G6?&xL?LZxv9GBmE7DpNV;QSXL}=y8B>>IHarjz*0oRkYZ50$&pYl6!i}
zdrq4D6mJ^j{abIrGH{2~c{N$f))W$%)}S-Mfe3kV!T%Gzpy~OmWjlIJGIEwEga(ln
zKwGOvZJd?9DReF}tA6%u{gE9>)_3YM+kEgsEexYg8rgbLK<kadjo7uYNjL}Os5we`
zh6HYH9|Krhk#UCQ;iAv0D#h0fdr3FQ6}209T3Tev48}HIr~xV7=WsF!0STT-iliR^
zHBB6Hck+bh=&B|y7IK61sY?yrBu;-)GH_0K8@b`}K>p*AT>H3u-|)#)s_x7-YF?1c
zwzuqsig%oEIl4iM>Z!z&vbE>FnN^87X;l1_U(f`jMFK$1TrJ%&uX}QOxgsA}n0~w-
zkwon0Dc)PzcFM8=5A#o5JSk2zY|gAX!K$3BwnjDCj1Z_{<}HvIvA@_XyHnLjNG%O=
z#&+wpIY{;fBD<7l9+vd-+2vt`9A162Mb6&+r48HG>T*rqfR;H_?jq+LLOUlYU<5PL
zKu;6&F~PSJ`j)iah?qg%5cazsb6-p^mEI9ZSpoWL1ZSVm^Bn*x?UL;p+CK;y5f;-H
zka5r#Q6v`YM$;x#FuuCtO^wjiI%-NCRj1G49`YLsPiytgr7G90kx!8Llk*eFf3e<?
z?)vTI++HUV=Ng5tY{YLw(#6-b3Mqv^PkezCF?@*m)UrPVK|N0)H)DrG_Iai9yOTyb
zvs2^;$Y)Ml@=vn6j*ltKt=Wf!e{asVo0f~`_*V3UUNGOI2^ZRO`|Q_6JFeT!zf@!X
zW_i~vItW@ab45?*x-}8qAXEEYL<Xzgr}^r;*YxIFJE2Mf@tY%&ykAKtQBj+k)X&R$
z)NTL0UM&4Zf+<bI;G9@Xd_t(3KMc$p;%xZ^rmsCfUcD@RLGj49R%TU1LJI5E*}5rF
zart>fxWUik1vi(u?0l;IcAtmN#OCkxtl9qP6tj>xStN1t_3t_+SXcHKP7TE=zR%A#
z(j5Y<rIkUY0@A=tU?eaN-ytp5q)$%TkpKk;u`g)#M*6+u9ij;XZqd6_o6y!;h^l-x
zwKfj#zQW6WK8wX)`$Pjo)}Ry{k#t^n+o<veLjQQjSCwH=*Lz713SYRsb&6F@)w^c(
znz`n;DvA?Y0TSPl_t<9=MF(#@NM*hLf}rlWFM95DG;`v;B<4kAvRP9^Kl~81+D<s`
zo{Jt?8X%!HN1txUAOfb`Xp8m|#dFEV9B86~=P7^MD^<Gj9fJk`A^0!lHxAP{Ov$Ez
zw?it&mkK3U=PzKHVL?|<!X&|rox)VqSryk!qsAIewJC!eO+4DKtW`Hy-khN@hjpl4
zGcbHE>e@RJh2RT}q;x3H9h(WXay9sI;^;LnBbn(A#JsNFU*%w7p+Rh!Sc;PAA>^VU
zndh9WXX@}$q~x7KuE0#wmqL-j{tNDg+?xWSJ?q6k5e0SJhhgrMvu~0Tt`F?{`mYq=
z5P?0q-c!8(lxOv^*!-h-S#1#6J`T|Q1S0o9gF)f&7^fNR5i-@1PMp#yAOmQ>*pm$l
z5{<PX>Zm#B(e7|=zz;gq{vJvgx4&<Z_OV70JKJhL{X1?TY?8n7QseYq!wmS_4b6tk
zpecP@VAkH1Zy+YSse(w+Mmtf{IJn)6f3tWh>=1k?IsRcQQ69~!RzUaaP^`T)eivX=
z0_<Gf2A{+Qw@=cvE$@|A*yZtDW`Cs0rq?EW(jq`qk)?&jTesuypr7}C->*<Ia{n#w
zRDI6N3~`)&w*PQevw@uB(d?W0Y+SEr7In$MuvRlmX%MzBY+fa}6kS-hr0Ea{s2Xf7
zZj{@fEhg|q?BQ?ZUwcI@Q@h8+K9dfIXsp9m_fG`cyHWC;5;-zLhp1v{;RfU4tyd_r
z#jmRtJ?yLct=2?S-ypB@)i*rWEB5a#I@OVKSLN3L<pARE=RAoo5*|HpW@}CgEo@J}
zxD6I$I`7vbs^l|dH<-qai60|8)BdKn_Q4GF{C$O%iBE>8T5|0I9Sf(2?w+~=-wQou
zxASo;3#}VGLnFF~-2Gm7$YpaJd$>S9t8$_omDEx?;7#L;;3wv$HF(?B>rafd_BSL+
zg^xJQ3lnL+kJg6wSyr$?>oAZHf3^e#SvPFSW}U{`YVQXEwN<P4H(8^==>f76k-2eG
zXcxWt%@G|p1X>o}^`?)GSqQNVH+FhlsCb;Ys}kzmg|P{*9=iGU=Z-g%TVe0NS^xnP
zM9^AJ+w1>z$L@2_N3zD6(Li7xiu}d<snTX1R$S@+y^wXcfx~Gw8!=Ox`P`f_QtW#N
z_Xa?+&qQqXEkSuB+*MCx1-;P^KQ;cL>CpJI68MR80|MK>SX@S-RR>U)ju=kwpc@GN
zj+_U)@X%rqlfj@~+EP1v_%_f1^dmHTbTa_yk@)lBd>WU5e+iJM5R1_><R#+HHRGsw
zP@?Rv{AfGdH`Jn^GkQa$Z>U?7G5*o%KjR<apEVAR!<NAAk(s&okvVNa_GVGuWSCyp
zeW{Df1-szMyW{s8FTdri=ZoU>TnM_feOUtp1&-7VjaAO0!)BNRS5bzt{B*Y&gz@&P
zD>zi*z^C>1UmHi|6oQ0wYL!WsXuMJhJ-micX5z8iw-`Lvi$aH1--a&hb*_zoN@nuR
zMUU~qejWGOw`11|D_5RbHLijeAvNuj3S5v1D_TvXCXm11tz1QRz)%Dl_)K-SX5?5s
ztOrAFw|(AGlq!n|>lH+v=`a7hom!5F9y$68cq$stXN)htK%nyEvU1Pu@&@0}Q+x*_
zBL7CK;*kLTk60PkQj-XZPt@i~#B1xQ$Zz=#-qvWn)glF!(7MKF-K>+N`6|Lqe_fkO
zs2?&3#MuhB-(OXy_)@f%ydaD>``MB$S4Em<Ia9mrv`nn0FEjeZi)U2NwalmC$=Hor
zwV+AfK>@I+&?SPbA6igCk>F?{=k6spFJK6J>*0Cu6ne+@U^y;9iYT^LdhwNCNIq7)
zNg}`vyWT=~xLt%W6hEsFl6TtBBcEqEa{ejy3MCR>3Q#?vRGgKV;hb!U5E!S8NSlRm
z-H%%RCD=N(>EO0HZ!7r;F(iXSmQtdT<aKc3HU6$}PyQR_YebA)U4RxWsG^!U?=1hW
z`6s%_^*i$5$CBH3#0!Vhq&7;MmruLLzo+OB>cIdM(bij!Y9I>ICL3vyd}XV|={e-j
z*d?$l`aij%0mevTX{1o<qA=Zb2cf6q9p0hk_xHmMFUpZuZjo$FAGeKha#<4r8E5(Z
z#m;2c@_he%_Jv4aUj~WM@Sf?u+26TXV*5FF2|4S5y84}jAB@Bu{_37<+ukTS)&yFU
z%X1Dh;c=6WE%9<mgMo$#lv+bdzFpl)xbp|<S>c6ZUi0x}-N%a00BeMc`%t^ZUgx6@
zkppsPQavL&?p|B`s?LRTyM5BUZa<w2?U<yUdbwBLx~xLKWw8_dVy#jdhKN45BEWOV
zm*si=JWn^<Nzvl7jr?30oK-E+9Fxrna~xX1z7nn;3}R~n5ABf9n3(>BT7mTkNDexB
zccKcgTCHrH*lKu~r8f~>5h<e3d8;&$_8VcBD>^I99KZybgD45;Eokcz_=!UAV_rOV
zj`OY-sBhd9CGL5zm-lWLi6xdAuV^c*v-Q9FFHY-G?Rv?fEBvu1gc5Z<jFOn+Bre4%
zoy>ok03IB?SxSPcP~Ns)^y!B-BAjNN;s8Kh=_YL-__i(xu(F0k=f=mJ@EoG_!OzUf
z3%tQ8SH))<7q1S?o~{~IpJ!6K0ua5Aq<>uU;SgQbsAXO;Vp89|pJw2UP59BOU-n`C
zrAK%y<YgKnr=h=7TsPiEGy8Wo7|`i^cr%=$uY9)UtrIbF%W>baW!`eF5@Y;+YTLb)
ztQOj*zy4gNTmR1#$kuko6iAJ(8;}xjUNY&Oy5Ubphg*sLPTgVYC~~F!Wq&T@sgaJG
zk@5v*tlm>|B7NRF(h=`4`<z*ZtLDM$DtiUj7Qq=RyFuCY8~gc=Isrl#vbox#(dt&?
z?x*U?nSHhII<mSMRrk@)#I4ax+;uPW6O_93{dFg;ggpJ_t-p$Ym;Z8d#QLTF59#tz
zX|41rbeoaynA_i3qjgk=QZu0!b}j1oU%C6ppWpVLlEo3HDqK(pYb@kdm~w-rv6qmL
zHAt7ZejjHUumsmHr6k1C<fTmVHm?YAMBg%^7CLqiepW9J?`Qr?WL^A2WCf4vA0lfK
z#~L@#Pq7IPTUi^XtV(p><d*o?KQ2Gw-JJ0B&6%X=r$s-(2O)Z7<NeT)4WD}OmLS5I
zR6BThHUtoF>J!i}WDLWeiP0aervnSJ-uJ6XxaI4#*t4EiCMhdgC%<#}Q=|qzEjxt^
z(oxO(kT|!Cn{;}w(~hZ}o*jSvlpBm?x4H1(mi2tT%;blZh<Aedg&?5DoC!L_|Gn1;
z<^%G3DA-^o+jEq;`L8|L*zZsqu^*fJoIy{)c0;;vMk|_C)t`>dg{D?`Y@JQn{-x*V
zagu(5?C%*|G#FI@49Uo>TAIm5g`KsB!ZbA>E#1{e4y+Gv&Z2}C04)83y?jWE+CWI;
zOd!7?GUsr8&rK%m!tMNJ8<VOppXjkUp^B^TcDa@{id@3e@by>T-R@M2ADPcM48>Xp
zRObcUzb@Zxwr@!WcLww$2DNoY!)hM7yKL;@;5suc19K(sRs_CFrYA%SdkWK(i#{cK
z(#cVwN6bNI?2&f$cE0-O(dW3xs0D1d6Pl_}Xg`8iyGUo+bJG2%JShN~rm~*zPSjHP
zkx5G<ddl^Ft#KUMPNFtg>BZm#FVc^LfCz;jagX2)JGaRf-11!TKe$$QfNM1exK<+S
zs}{hu`uzvj`sd_^svX$Q0|Kfbaq%IV6gma2h06s;vX-?U=8?Df0kPJy4(1<#7h7?Z
zf7aVK=<5%kd4aIJmR7`caeaIzrv5^C$kQ6d8pI$)IYRgv%84$wMOprY+=PA#AGeb4
z^0K>Da72DHhl+(nss^!kS`$V4JQ@f|>+d~${DP0q&%n-*d+?0@Vd6s1{HkHzfO>A|
z)a6>I#Ngi74&;>HG&X$=gOr=iHUy!-3szdOyP5!?aEmn7`H<8|SK(}Xr+N1zPIJ{n
zIXhA^G`qnuXm5Zy#7ZL6EeST+&)WR%VPW@FhTqSxL-^KFxieLJzD>45+hY_YKBP8{
ze6E>{y&U?R27o=J+Y@l0(MaxDjz)B*g+;QoP=>tXl#R(OF19k!ipIjrrC}J~mkw_m
zPG5f(_p4;n7Kj&>)CM%Ke^bWvR4WPIt+kf9L_pltGYO;!{U-laTSw<zvo>Cw#?<(i
z*W9Z#3BZ;uKh&eAXb?&CBcw=8J&x(h-4xhk9OlSDAH8|lP#+CaH1gos9p(9I=_rJj
z-t|7!6Yb4-a1>xyo#T737L$><>U(>xZkt5w)+VHUm_XL45eNmLGg5<E4I}s}&m#4D
zvO_^j8bn|tcyX?~_uIu8F8sLdgX1#fmf4G<MUhRu&uhVc)ZlCN4NIf$IE7C`e{PfE
z`&a0{{Nd)YdL_f3ca-j28nQLC(Nh%FpZQtU>rK1RsCEH=HRtM@f*81CDb-4Ze*HjC
zNS@Wa6RRW<XL=XqAksyNI#%@lw41vQ<eUoeaJ50FP7DXFKUP(@IILsa=sKx!)R%#8
z4K+A9+_>Q})hX?1WLE!r>sauuWXk`;*L#Ok9sd90m4>pTD4S$uC1jpLMv02DcSu&8
zjN{-$$Ue!4j1wg)Bgr18vgc_!_K|UpeQ<Cb$2q?DsrUPHeLlZGeplC}{wSSZ-LLz;
zpO1N};%Rsp{(0dUtk?ItSNO<3Z;n**23%FryA83k`+~~#{3P8Z<?{0I3T%`=m@YF_
zy<T?v-Wt9Fq_?htHB1zT->veB$eNEUK4Mr9{ABBb<ee@#q424ZVQ_gzL`_h@6md0)
z*|_U7^TUv~q#wMhomZl@#F7f)6q`xJ=|nGXKijq!dlE&s?V^`&c(~#*>nUDIL-=cz
zZ;QDnwooqv^tZUf)5TZn0)A=VOE6EVk#rtjuWO%nQRR4u;iD^FUa34+eP18)WS}z6
zdDnxv42l_Vq!e{QyEbitEVx!C99DgF7RJ`~E~^W!ev;kR+ehE`$?y>3!P2s%mJ7eI
zf1h}dkiYgv+bgAkmMLs-5`2v6NVxFEn-KHDF}`5vS2Fk*#ovP;=XQ*GoT7=veG*uW
z`=dN{gh$Ey{0?)6@z$0$W><yddKM?Pgp9+puqfkjh-1%(w!9)F41Q5}-JJB-;w-<z
zXKQ?6Nc93(1q<QaI0b&xWvhm_{-KRtq}eSp_NbX=i@wsgJQDYc9ZS*O^dr%4XYQPH
z2?Hs``qHGfp$E*|?*lMVis<PRk|#P0pT5g!0QdhBxvA|0)(`GOaXZI4<RdzN@_X5D
zi-6)VOvs2IU3yTJ5$pQMu#+u`*>kRgZ^!Q?+^V5s({<R;j?sE1iX0ky<Rpr`)OgbV
zx&<5T*E^<if%gz;e>D?J`K(KC@;9DL>n7PbIhkgDic)cYvD?FC)nVbxYLO!K$`W=|
z$tr8zT!H7bd3%AI#w;p{+qIly94JNnUZNH52+JQVqD-;1bn#xbGU_Fti|IkFom`On
zL&W;`9PMsWxINYgQaZ_-Bfd#-P1L{72&Wgr!=-jp0GiClhBk#w9^-|bG9H=%hz=zA
z9W73~_}(nnoY^Y#)KliC+svHt`*Mg}j?pxoOeG$!^*F_j*jAwjMUdBydZ#^CB)1rM
zIOFurIik)R1EM74OU-`tpOoU%B3g+$aeHgJD()L@Z^x4M#l!j(L@vU|%wlH`e0NSc
zig5v?pZ~}1v4?Ee$d&YWOVAw0$a3ek{3L>y?soLUF|O6Kpc$G4iC$F2CR1xU#t2uJ
zaK3X5{b)U0H((}@ZnWSV`dPvaGg}lEGvC*Hl^3?}jJ$#sJU9=1+=24Xx8QM32?f9V
z$p9VyT<l4pHbm8ctgK21^49$p=GYigy1ihRP0mEgoKeoZ-aG|*A0{}W=dY);eH9QW
z!%yC3{W*D$$6Xtr`^eZ{OaN#^ph+h8IiJH1Xwt#)ceO8%lC%*#jz^r`XzrtWMjTof
zQLG9Dng02%cL%3uTR7eQas1Ksvpx#x3y!8YHHo(A+0%gpTqiHK%e-S$6-)Lj%I05I
zZUMRge-v)Z<0fV7$B=^K-sHsdv!$}uangH@W5ea6lzz|K_shpLm2YRZ4=_!<*^=~d
zZiuPss!1q%V?0a@xs$!y-fX5@=~qu2+uEvVnm%pp#>+rMg{4uL`VpjMXsGMOF<zs+
z{q!Nz{r{3&Eftla=zAjXIX+KEZ=D1M7d0~)asWUHn{E+yUGGM1Ax;uonCe+;I^}cr
z#C~LL{chYeoNLT+1pvxF=oVb`Mq3Jz)`WAT`L%w2h)i&*(x8{gnxNSDIF+zJ|0;#l
z112%9P+V0rWl?JD#@|#VV!i92PKx$%h`Zs|a1C<UzvYfa#Q<y)*NNNi%DE^59jZF2
z{b437!{Z02r9+GN&QzqjXc_puB_)Af5F_3^+;<vSExjU)2`w}&DIn{INP_Uz;~>0M
z0C=H46xOY$k`GH}*W-iB<evT)3((6V3%E{ry6A{(T4iaD3{AoP#)s%^w_ID{#ANth
z+L(%5xZ$9=LBzt!mo2}Y;3kp=-A%`LG82LMd7c6`SV+9x6`cVA<w}YyXu+D!!MWCU
zwVFwr1$@oDdvBw~FZ=-yp~FV4L5}?m>a6LZ?vI%DXK2#t`RZ;zDhZTN4sPSokr4_?
zWObkd(giuLye$Z<dP*JIbZBCYNLpbG$+yCr8NHL;J$7U^XL+r)p2N-&vF0H^2}#^-
zrP_Cs9Ni*ba^WDR?%)HB6mRR9j(<{{n6l5`@e!^tF7@sVy3o0@J2p9h^WW3x+JEtP
z0}ij?gomUc?d>91@f~i20VrO(_zp``dZoO0#r*0X4YwC=b*GLBVAS<UOZ`<*ySR4l
zc%G9OkZ1ZVnXAH|V3q66Gk>14-{5KAk_HzihQledue}p_|ENcyV=Hfh(p!R%7Kez5
zoWCHM`}3wvLj+XG2BJGwkJ{=Vt4^s~PEi~2+m#Mx1J#E4QGYl)1rG$GJ^XP)R{}mf
z47YHPYllv%gz>!c{q05P28qABc+}_B0llQBi&YMB);{kn?L^(B4&2Q8aN70d^)JWG
z)>B4Bhk2aKgP5VK-N>7v&kUn~RXVjPafGELG9T4`+GYtOL;_Xpt;OOxWL=77kxg^j
zk2dBYrVp`y*!n(66TxdMxLZii#qNfd%6r+*`n3zLDd<|pbJccK=!|YfjOOzy?eZ+V
z0Q}`Enk5ifg6d4^)WwFT&&n5ge_Vd!%kkDi#=!lVYm)sKbd12PbR&r?HBjtyHCXiQ
z?QvF%mrroTBE{KM84-s|u%*WJ#Hxk3Ct}MWxV8(KqaADiY}u%Aq@}f4Scpr%Qw}2b
z%<vH-zZE>BWaE3~an-`nr?RFGr8B#CTsr!7H=kQ^>h&N?(bpbck*yLn#i%oH4jWw3
zLhP@)BClim>m;ZGML`kQ%WR<Gi<{7|OODK1z+f|tsb62*T7ZD~);iQpR#)ia$vz6S
zRkO=KH>elF06h+CW-qF7tVy;d9E`$WG?7V)WSBgc<|3sw1c-GfPCz4$n+RW;FE5wl
z%ic&k(#3Of_L1Ty(+WJBl;dH&P(GIVSu9rR7@HLn*YWkZf>UHIMg1N4@7U^1)MILM
zE+F_HyR=;|jo0)XhR%MdZa=&T|J47nwnA%6GDzTbjasbJxm%+5U&g2MMO7Nblti92
zaAEEcJ5gxhS#2;JskcIK8sZjTkvl^kZCbB-w^P7{3GHfskjo>Z&oWz=;AIIwLm<#~
zUKBBh((oML_cJS#h#<YyIs(j6LhE@&agkro@&D@S6R%n0>L*LZ0FBm!9s-eUMatPb
zEWcr2xaDJK8ZwGDr0a&wSdKw+c_#QDde3NUKnlGt?T7<(P*Q|AF%h^$$N!rf-!G}>
zC-0@RAQvy#)LuX^Wl)x+luF|QMQlbSB<ShaZX2HO5nn8PRQfSbK7KuG>CG0vWrwfZ
ztAU##d-XJOm%7cglECHQso<vHrd{inQF8I^)9t5MpUWF6;dj0*t?`386Chp(L?pTu
zO`BB+_T3W*P^ORK=x@+_t?0-7gmj8@_IF>M?^=Jp&YG>?GU?+k6Y1MX4r|;_P0D6}
zy0eu%;u)4!H41VhDM#f45q+I4b``(Q^{oAkbgep++c)Yb`7n&?Xo&q)mXCN`_?kN6
zVI8MbqlI^|kXsH&Ok7Jqt=bCWzHrr!t0ZsnBYGIElD8b|)K~{^rj30&_H}F|o>=_H
z?3)|FNYTjLr}bMgiv8gVi+{fVaKOABcJxQ?<^?BN!Se3jmfP^uaUJK)`~%MEnG3G&
z%BovTXW%?~nkCarRu9|+ZpN$m9&&y&UTHMmm@MIu%l}Hu>+qwQh7|P58J%8D_C6Wl
zIPej+s`jczU#R&=dLEwpWkqc_I}<i&w}?T~pWm1$!uWYdXg4%`8m#tx3ttc3coxGq
zdaW%y)7}$1S?*5N#>T+~0cQ|cmazo0-V^W|pJ;dv;2PQQ)#p}xwVp9@UAwa9g_he?
zoWj`hr`A>I8pU@9c22tnKIGf<Huh}koS2`WCu#+2ZF<r9=is)~b6WDuymx{&{_&1M
zUzPo4^RRJ}ix&_=(k2v@7K-+9d}qK$<yFf!W=|BA2`2ziBp=jE)Oi_R16i$tZ&m)I
z9#fDFW>oST(7p54>^on7SOe6c!KOj@Idx=WS91f~AAxD=sDB=^*F1xr9|nM>dIY9j
z3U%HwDMK%d_~1tg;dZ>e9_!+z5y#88?*d?^qZ`lsnepH7U0BJ%Y)^V#bs4bB#jc?~
zk4az8wDmu?T1{ce{icEx>r*Xi{ul0wn5yVhPQ2TUcl&eq?W2%!Nohi}vkYz<v;IL-
z_NQSpzH?}BB!=W&VB&6Dd%^M5)%U-xi++c;*|%@OAEvYmx%TGQ(qN_b6>CILK3@vW
zy6xjtQ)UH66Tk)&D*2C}#5h09UrVYDzv2}*ppF>~9k9)zaaSD7_h^OGWxvuuUtH`!
zh!Pu=Z$)_b*($-00=(ySRNwUo67CXidW?_+VqVKh@K_Sa#vyzg7HAY%^da?B4k}FG
zpfrcphNAVF2(;k`3^4SYgVvE1YBkMzBbz`|MI5RhZZgNJ_sH&jh4VW6P7L<;hV{k2
z)_I?ph79VX>56tl9LQo<rAmM7td~!pDz(ST?96dYcM%_)pKsMz|4#27!-NO<kD8G*
zH-?WkRUv8Ao1gouDGpM#NXTSL({FJ~QgQfpW5DRWtPH>1lLRB?pE@Gb<$%@(8brh$
z$}|!&gBW=*fx|OZ>}_D_h~OBpsJc4Q9#OMKSGi;J%sy537LoWZ(SC8U#kN($HnlMj
z^QtA*#m)@KjgvX0whkaN@#}RRGgWNUZwO)2_Q3l+!Ip1eG)n57gnVJ%GtgV^4HQc-
z)Y2vVYPOhgH8sBS(4Js(Act`^qYKE?_yc}$y!9*BaP(c;?QT1zi%+0wul&CGdaLaT
za`;T6rUxpGPWWlhrX%Ze5S^nFMoMq8PoEgR4hP8F@o`VUZ%YDdh9XPYcfl(H3Ey)C
z$#UI1YmG*FZk^vPh1(jiOR=Y)aqdWfEfM#UuWe%Y#-dU5GLphusVgQ!&*H9J!;yN@
zk{q9j=?Xa>^VW^vtzI164gJOU<&;Wt-SkM(kYc5yPsbqIt>Fr|P=iuQz7AAZWBsR0
zlx`ksjKzijDP3P7ZhC(i{m1<bv8(SlbG?${Z0}n8Hc1`2<_UiVYWbM@;<^F&s3>;-
z3B&ytcHnLOTiY>S-pBz{v9A_f9egE`{p9T~G}2K$Mq(VAOjjs?o;!9`jLG%olHLmt
zl@?RDYB(lgkXLG{CFZo>*#_O+Civ%RjzV+-pREQx+)k=TAdogOTn%}A&3jQ5(7_Ag
z;lE4ap5uHsBQ9Ydpt{5Fylo)ldQG-i?n%~54WwhdxT2*O4Js9fS$`h;8a>lDD<jX5
z&|W4TdualHMp<Q+YA4H~vd8v%^o=74aZIK$<^3g&_w}r1|C@%iBU$?9)P>mIvfTIO
z^zlW>GeLpi=xTU!g>_oS#Zs1K-gv^F=n4|*TZ(>zLf1I1B{nCvR<1YVs~0Etxq1kX
z-AQdX*FBKIBx$YyO}=~{%K7e6R`-|BQ}qOArfWl|)?Zw+O0<Ap4nGYNAnDc<{^&@T
zzVMgl5p1M%+{`kqolzO`i#(Y<IuYiq$0E&QwUyEt_XTi|u-3im-r%EHPmts)t0cBQ
z(BKH>?%;3gCvSpM$<vnJ(?pn*n7~89g}VF(WKYEx&w*U;7Y{p|db<-}o|F<l?kq21
zDJ3?;<(!lVq*J;YGd_C<4Wj=RmR|Y$698SgZ~@D^9QD`4y~YZ&)OYe-pEV#m9&waS
zrYN`(f1~VbBce6;Qr1ODs&8qA+eozUUdD5D&Dh7iX&k-h$rJAsGewel*HQmf^Ft_4
z7cW}zkTytj#ey_fvK{b1T(w*tZK~O0CpKVQ_ku2weIgF+e8~eO#L-X`2u<xQ2|Hfy
zkAy+kS1fnJDh5G-YZBH-n|IKrA8iPUlp$R7B`T~~B@)}}dIlXa;kTLWWEHr*Oh?1b
zf{p$p)5KQ7J;rZVs3YTQAHA$}yz{WeNb%?Q&ar&r)Ef5nRGb%`uludY9Z3-P9nzPe
z5M>&pbx90)ZE7N-FWeBC2hJ#zQ~ozbY-=&auaM{oBG%MC5Qk~z1femtO@D><PS+4p
z#TeN=Q+*o~LhF^*aI>G!N(_o{xVIhHDQh-Q_8SU@jP@h=+p~c+vck~c9k+4*TZ7vl
z5Jnq_=x?KIp=Pu5uDSiUg)Y$aIH^Wr@ucwQxncuRkHVeJrp0`5pW%T8aD2Z`?LDBQ
z@{S|-!|XvPH}*YQhAXn4$i?Dcs->d?8R4jR%(1BdEo-`5+Nd{rPRp8Oda3FYh&tL|
ztd3O)<wA5EbqTFK!Qw3R;C=|=Vm6L?^yRn>xWWy==U?<!ToHa;H8J1-B&1pgKm84B
zJxgq;a781D^uO3G4uRPOQzvM8d^PonQvcFtnQT8=GY#8w19r{M;9O$MYf_%;Ff^ZQ
z<1Mh_5F!TpC>T=MK;=V6i?f=m`XVOjx%GA(!)sZ$gE{Tvb+CYP-t0ORrW~s;^jJS7
zt#19-(4~KfT97%>ctxPM%xsntZ)sE3-&y|1IaofR2sPDLtrOk5e#k+xTn7+)(kYsO
zsQU82YYzO0n>;DchiZx`a}N>`sX#|!{pV3FEv;*fw1(d~4kkx*r_3MP9Xo#<NjX=R
z@9jMmvk+`}k`8Z?f#ANc`rY%-Z~3sfcAU1~Vpor0gfMhUcj`0<u_<oDot6ptSaP`=
zsrlC$>I1d;Gw|qS%s~N?jeCW$BhPGWkTjbXFV?<ZtjD9ShXg2kp(X&{uzFCQKboSq
zV!59;!UnPJX%Q~`AS$c6xNo?9`mWI5yw+?id`cx%08Ys>rO!4ko^(I5bz`~SkB96>
zMePq)AnAbTZT8(m?+!%xK1N_X+?URj(#_lX>X{8_|HGeXMG5DqG!otye{$nTztWiY
zQJC@jDOI(HIX$7Xx{erl8otx235ypw?R>Vj|06-nM0G-60}q;KJD8tk!-XQhla6G)
zt*^7UU;)J-!P~mZ_%a58B}CII3D@4z9Q?61D5vGzI`om?<2Sa`jCBKkVZj7&JAJUC
zr^eMvQKN|PdbqxWAN~4EbR@FvK`h@n6E;RLtD2pVC#KzGp!ZOk7BCThgg$<D{kXxK
zc(Md#>%)Js03UBS$;|27U0}NdT+vy<uf=^5>MSHpA<aG474|bqOeZdz3-QrnUHSy<
zyZVuIHY8s}rwE9*35qi_YWwgCGIiNR->4&#NeFaABJ%t+Zn(|%gmOQBpXi(vd1*u#
zaI)-zMWwQ_UQ7=vLb=gFFtCgvUlfcTU!m5#R$U*KN_45~j{c1_&QGNO##Ht=`_BFZ
z_y2s|SZI9S;-UP4dW&R`-{Wa?*I5UDP^mow*7GXl3|U<)x$+N}B?uo+`5m#Tws$ZA
zq_l!1hWk=-*kN{8StubHB0tGx?e^=6Swz&9^&J1@J|Ul~PveYNv0ki1Z3Z9-ti}a#
z`wDL`RbFYkZ-{(^n0`(J(-T-ypQ?>9>&#o9OGAn;XZ`(O((SudZ-E0J<P*mXd5PtE
z_C{$7__xT0A|n)VFj+E|C~;?HN7)bUlPQPX)p3O<@|E!yP#zZt_R5aI=R;io%Qael
z)oy%oJO`ap*^9`R{Z9`hTe^semO8XP2{~08+FzlMl3nZ;f7sFL8#5xT0QG1~7q*CF
zdm{ZILB&Ql>E7XEloU)0YSCkSgl_!MC(+DVix&tsEqsmDxTc4M8HuguOgLSg*dEeY
zrMWCPr#baPn4~|soIEb$HE>B`h49kaXh`?@+R*RE#fMnI<jY)-`eb-c)L^v8XRNAe
z`b-R8!Mik>#FaW-75UE~cShp!8;}?Y1Xe4y!s&Q2-&NaRcf_a8%NyupS+Yt5jSBd<
zWGjgAo56uxsCG9?G$q4`WkU0px*a*m@Zy`5f~kqwykI0(IeJ7q;aUurWF6VDYc~IM
z_+_>TxvQh0Ke#%(?kc!^;E>MxqjFQo)3BadJj$gn60Ea`Q|d*U27qkT6_x%fTQbSP
z%yCqkbG75U#1+=Y*H3x4j(KJn=60z&G=?at(!cB<W;_r8q52L(N6U{RL?BoVyko5+
z=Qb5b4`tcAzs!&WSm-==T^HwJTu2nlL`<0f&o5^B+@>g$xAhQDrX1X#iM@jrPtWxn
zNw+WozDM_bY!+&AicIfgxF6qbdw>+z#miQtejnlvD2cRl>ps%$@8(sWM`KW}qdV2L
zTa}GP8$cY$XBb4p1&xiN1NK0i09R{BT0E4NpY4Y}3dB?YhxPm$>*{+eVEP7D?Qfu~
zSrqKZ&xiyp^jyCy%8iiKO{Np-%mEi!H8}lwcE}f0g>Xb?#Qsef2tzg=@9yhi;2O$>
zL}_xnbW%TU)4i2UHy^N{B-s~d`PQ+`8^0I+knzWr$xw@|YtZQj)2Uj01{w6&O{u)t
zTX*$$BN$o;e}r=}<6eG00BULWf#HP&y}YN|BN7suF9sMdg|MNuQ>f~egTc+2??#u*
z9w~Si<iovm|7rgEL(af);18P5860GvJheaDJ-p1C4GvE3g)7ru2NyL^c-JGf+q^Ks
z^{f;5lY+q#JNfv~evb_a?bh~JQ*|lmDDw23z+umcpOT8f{h4q3)!!-Xl;I}!v>ZPQ
zt(DI{>pxNh!Ca(NO#VKf7;r|TNP|=ICx0v9)$?&;uTL;SJb$B>#yv;=4jq@XY^kV0
zFUj({R?CT-GV#JnBb3=tYpIUv1EinYzem>_G>aUQ7)6pU1C7n6!#@HQ@2Sq83e-^s
zi%-a-0(sA{I<)_>Vg)FW+^L=n=U<HYY1A0HJjCu?-Xx~e`_^I9B@jJx$K9dv>y-T)
z?(tMxQ>zh_A=YZ~b~OXy-AU1YmQXSzzIUP~97(7*Tb`R>JRQkO->>h3&GYV$2N(|d
zg4i8pg+w!a7v|;r^6-T0+B;q4pipg`ll8&b9t|~tuXcI&P*cC$$_*bWa=-uv%TTTQ
z>4?|*Q%C%$jBocH#{qoF81u1~Cp+4YKm#Ug@Y3mEM?WGuf$DLUyd2sxon4D&=#vx(
zK%eyA9M|{0&m8i_x5@;VNP?z<EmcqZ9@5)Jb-v{tjk?WH9jdQ;uSLF{302g6OF1v8
zylD5N#p_)%jjyR9^5V#z|BU<?Y^CZ?8f5t~RVT5^V{26Fx83fx4eSRl(Aa;xG1TV>
z+})1*0Y-_|JK#q490A`Fw->q^iFKr}a5R;)6+c-gL>=MNgp-8Do5k!T?g>7;d>HUt
zq=M12i=e$wA>jO#Q_*9b;@@D$UGBE@@jlBsFMqi~SJ_ddFBuWPKxQ}CR^uMr1zH%0
z;nff1YEzOcPh}?Gz43LK-~k!=JG7oRb?hK$c&Edxt0jme`%UHCSX@$Z;kS<BU`kic
z`pxXt{ObW~4m`m3z8x1lc4>LaQ0WjtD`)TExC=-L(GJBL#c?HEijHoQ5lcr*aUr>|
zbx1#Wfo~w10M>4(2WUJ1!q1XerF*=_;z|C~j>ne3xl#m#;$l-L_hL@^V|?~*-7rsx
zYYPSivht0gx4aj;R?YsyGQJw9&@5NV-?R)FTkwYQw1ZxXDA`U>26&QJk%56hBB>7G
zq%kW{yE^%3RM5HS)c5??2}1#_vvZq=5O*5dpL|te4;fiIJ7qRTs)59FT|RW0JxNMv
z4Q>>CrIa>Mr_bu|q91K}g-=ECunxxfsiFS9t|N*(KP=REo@m9=d>(S#9Y883E&<E?
zrRab5$25*{CB{CZo?6H{^<q;8j$bBYJ;6u0RvOOx;+*CLpjS)CwBFC)slzuW>S8qE
zoy#<&deM3d?|^l~BI44S9f8C#TR<{S#?QsOywt>B1s!o$d!;~js{$jt)gn;DL<zVb
zbtW0y;%99?D%@zWB=O|0JNH(OT%+fdSdqD|ShaRw6<-mWi~zs+no;ucV3hSwk%YpT
z*ZjP$__UR*#_ckQOJ|<4F)NKBxhX9E%fw9SOlde|+-HLwY@`Z4<ozx;bMyUVj}p)m
zet|yn>?zuPix22*-DIlbVs?F*bn3CB%Qe<v8RUnP>wmxen+D@G<=N79f3X6>QEg%i
zcd5Z|Cx5L5ahw+Zpd1~5GYyASBi7nqo^u;OyGBPj2wJ8L`-RufmeCb%c{?h~ZRfnY
zrLgXyI|?EsJNYWhgt;hI57FRpp(9tEx!{VKQYrNTW<i;IFrnz!G$FD5Idx#vF}K*{
zhU@Sw?{XtQ2Y(j-AkHO1XOND>I;7ID#Ffvf%r|7pZ|HZ4gN69nP>VT^d8#N5cjdIq
z889s-IqEkUn?qm%4|4pXAc2SjK1KC`y?QOQi*gMq&{Vun%d|KR4?F;DEIy>?`%6LW
z4m$hIwpTWNty6gCJ!ExVvKnU;@k5>RmwfCtQ<!&dj#e1tA1Hps-$F+BYWlU)is}6o
zmmr+bJix{iK|OKAp@4QRo@+XuV3JVU88{c=og`NQFt9N~ZS##p|K#t5W6)t(1jim@
zL8HcvoL|(xNz{4L@*d=yoR|xD6IAu^25k^~hIPVBi4|Q|z_c?z!5ckKmF16Czi89{
zg>>UKCfMk3n-@j2uQONVth#krVtp}yIk-WAWcD0TlI)obk;j1N;^@p}XZ$?3b=GKS
zXSmXN<nn}Mg}yr_hxZns8`sfsKk9;`P*VeMHF`q!28RK#TM4`)47_d(>qR}4pgch9
zUp#hlU@{FiJ+XH#xVkz*30kvnZF+y!r~3`ly?yasDH?^}@B3bLeG%e*9c*(l<-0mq
z<+0$Ex)etkmZH5O(MJP{y2a{_YRcsA&$8~g!wUl`t;l@tC6m4`>2lZv-&U=9{cq&4
zxpGVL`8uDILFqw@nUGT$<q$_bFlR8>#O;VAOqb3UgH#0=5ZP0U7qS^*kfhm+9HrvG
zH7bP`(Xu5np$T{N3Zp{eX{3GFR9X%?YGMy`Dhh>nXrQKr0h|h+h{IytR`$lY&LXaz
zfQ?lr_d%9wLlFI<#G|InW;hkPT)y$|ieEn3aCdNiG=2~E{tHji1cq6z+yRoH(b<%?
zORqQ=_nQG;@yJIm)aer1OM&$!TdifZURe2qD##amXbNQ7vl!H!zPMQD=*X|L<kPF|
zOg;IQ@(dvisq?bhF#*<<746Xo?)>|2gY%|bu^}&rGzBQG#|~Niu5oMuMd~}VlGb%+
z=+ZJK96SN!(<KnrPAk{CmiCNMX6QJRUR2^yyVa_5vGFseHABlE+-1NndVS9I+tcod
zv+ylM9~JIQP}^hMfG2`j1<P;L@@)y6-UYJPx2;7Od2Kw?0`&vfdTW;*uY?>|!ZtJb
zPjTp<>Ki)DBpcH&?}(Ne!d=S4RLK>1F*9_8pZ>{QVNEnxgCfYtZgrd$rq-VV(XDjl
z6=p2O@)CQS+y-o2j2+f#AL|=ay172B?stYdn(@{3#Za%HFsv1Q4iC1k^E}0+{aFd5
zTC09;#~H+G7Y6oNL21EcS2(O@^9aiSy9T7xlD;S}Nd-YFicwB)AUApV{#;3@6RNr^
ze;ac9r27{2pgfP;Eu1#((Upa3ySa@Wy8ei%x*J53wyf|Q+Py%-Xd4Em3O+%nu#CT*
zbLNU?0^YR!6O;)*s6Tv-eA(>{*TbmK<T|bMD!fCRbK!}Cp{K#yefc}M&S9MHWKfG@
zT`Xqa0xg5^Nq48D$dY@ZBRH7o(RnRUN99E2Uj8>RAzwb3js>+M91pOcLeL%QZyf_b
zxYgOmal!R`<?{FW^sZh{y2NDF`e46%_FGeu>{{XuI23`if`8s7c-GO|DTB}7gI=Sy
zGCdlR<Wkx!@@!rDb;6O4dr9!UDu6)=`e{o9*gpsNX_Z@||Jt(Ct+Je~4ngt9T|OvE
zs9MFzbfo1f-gY=+u&cw6&4hy&&2#4Cr89+R47_2ZwMKol{<9vpXaCY;dZ|H!x-K!%
zh1)`FM~_~ie2<Bq>JUG0GFVHDM@gRv()K&>2-wUaPkyMHYE0Ew-^+_wl(^;0nx0Z`
z5j4*#Zl`x2(WZoyg0}^N(lvi-iJZVHFbl<7PfyI!Lv8C9F-Mef)P8F7Rzj-db4+~@
z9lCNlb45H>{Q*_o3GahA6y5?t9sQiX)$JTaqIjP55tV|rz_KkXc`12q^Sa9$ZOev$
z%d~wxuC|sB-^JStiI}VQFn#^SQHQan$n)G!IUBFi#_R>kAR~`ABzDR;8y;)Vf{lf6
zx`K2Ev>bH;TnLB-e1Yeat4`bM3OQVBN~pWt#xO_D0gj!ooZBlbOHYmOYY*TN55M4x
z7v)Q|h&z4H<;*{_G5wBL`Z%WOgT%petgHXU0uDd#d+6b}cg?8mdYJ#<O<^|3q9|`G
z^{H;mJyC<Dx(WQT*|{C?_gXsD^u-K{n3q!-o<^aWC+jAu<#v6b`O?{)RrKR|Qrw5P
z`Uk)$E}8yjyITk|OrxoYmD~i@0VduZ`N}Q(!w3$VLbcrH#GCtLP@C0>uUpTQg(^1<
zFQ5%gKhw&#JYf2F9XbtpJg&omp%Em)fPDe+=*6P!kWI+#XeD2P$5D{0jTU@NMOc_r
zTh_vt*G%#pONXfyZE<5U4Zi>W<1Vpzw{$k|rN|n#l|07TL|cA|{p?fUozD#;8F$x=
z)sU|w)eEHyHN^96F?mwYG}IJPtr2Fs++D%h?{UK4WD#HAZYw(kt%)`<BX!q*&^NXB
zI=3wyhBtA0bdHw7oBClwJsXk{cYbcO5tM6K=eP0nyT2)x>oMVD3%Xg}S?sO84(Jmi
z@`X!Sf9$7+_KTS@4jq};dcKIy0|&`(I%UU#&x8Es2GsY6>GxymnFF=?QKJ5pA7P<q
zD%DZ^cR2BbrZzjmFUO&bOE`o>T@<>^;rxP{KiK-Js5#%Y3Oyx6(X4o?;+T0?LKRiH
z!od=5EtnwPJ$o?$x1fqX7;bH`rB(VoMZ<CjH4{jjN#4f8EQeNL?d2eX4tj0^r6j@s
z8t<DM@Vo4`cbT%^HBry(aX64<C_F50w>Gfd`@PCBpiOL~Y?kcuT6m3TP|0>SZ4owV
z6HqrnB5bQ7j0hnNR9Xmn?S<aLGza4T5iELmnAAkJV_{0w1+$H)8Td)@srhYvg|23_
z%x{^NpjrdPs_C21^02nR$74#O|JVrhBLaJ|23T5HQAfdfO)RN7n>Q0R+Cz<%$oCh@
zNJh-w{Xq~ky*yGz=@%CFj5ufL_<jYA|5J-`Ddxxn(t7u$rCQ(ax`89Y4}wr-@AGdb
zD3iy69f}@=Hek8#aLxzaBA#Q{gmMRWDV<jy01@aR5D?0*JXcXc19Ljrp`E%VfzBUw
z{0LM64|L+UGqo*K-W4QqPoFX!ss$!LaK@{20+wQ<zb~8-(5k96pv68RWr`Oh*2#Wf
zekUZDEo+z)va(d1`^-x)K}ju)h>inwk;*diu!<GiOeWJ`*XZH9ZEsf=+g-}uHB?xO
zo4WK&RZ~ub*xCV^vccfG#*2O@Z0#xlTNRN~y-1)@8Q_98GB6VmseVr5A1rYufgAU)
zxx(&OH-ED6aLCl?tQ_a6LQG|RCV4NaK`ojM614Gc$)WdDfX@tTHSB9`Gpf*bE`vqx
z5;#iOHkt<*=WFuPd9;B#QFFo{Q}Et@>A=GCkAo0AJ>P!w`EJYD7*Vj)cFB?Aa&;++
z*?Pvm2&YX5tq4HD1^}XfI9zYNVgYmL6ehV52(tUWnB3m&`Cig_pYUuV-j$GHM`Zfx
zX>eos=<Yu9$@wd@@AkAibEwYF8XSq3^Xty7DGJM0^fPmCH#Jwp;jMeELylD9HxKcZ
zfe9FVPf#)&*4s%Oko8b#MFlMyL4<su7K<JDQwxWr8?`y{#TSd9L9{b_Q@zJWnSiDO
z{djL1PV-<RF;$>xk2#vw&97_lbBPu_O)@G>snd(qrnQ6pp7Tv$qMWLAt@lNLej#@;
z*2^5bocLtd%O34rzrKFmWtQJ?lp5&U`9~ohW>R>@fSeqzfTGCN2qO=qt*@;<w%RNq
z&L05;qHy*Tqjh*t5n*-l!1XhWncB6>wp@?Hh1&1RjV*iS8<~pH+suVVc90;#`xd3F
zSgYS~0(3WxPFS_~Tima!j)JI6-_l9A*|4Ars1+QPehT@rSd;&FS@e%{u14`L(PAzl
zFK_6-JjmP?cLpe5A&*^ztznbk?Kit|%>6@b+Y4Qs-WXNQF6pK?si0NZnX0`vLIJ+U
z6OLLzVMN@zLN}V_tIa(jE`EBEh(VXfjYh_H4Y@qaJW%M__S!Z)L(?N;QcLz{a?JfO
z(1$f;+JQV8lMSoUcJ~9uKQ-{a>JPo=1@erk)8bP}9MpdFG;kmasz5%MDh`A5R=hCi
zg5p$`VY>Fzi8EWH+w0T>@o&S%`dN&*_!7U^0p=?QOCr}?Uq5<Xo$@ilNjG{oT9Y^4
zK99ds@-^7haW{DAagF*w#dIkP+zWkk^o}zr92Z1)-iUVdL*y#}&pPU}#IBI`5Y!pK
z()!JqijhF!K_wi`?#5OE0!LJ?$H=(UO}t&A@dm_b{caBYI@)sCMa_=Y+eF*-`H?UF
zEFGNZ`4b<C56yxuvJ2t;X2;D<PtQSx8H3y7@V?EQy|W(=xd)ltb&gG!%}Sd+FJ#@l
zX<oO__Ex9s*n`~~dx@Np4WQcd+dUOZ79HQIKIzHz>XSppmb<8Sx8@40w996^nDP3Z
zRElceSLz&cSXnXd;nxKBuP->1N(8oBugXgmG&@GtpX6aS=cu<3J*cc=FvO>J;PEe>
zXzS=rWBJq>3TJqEwfrB>HzRb+B_({zxBiG1=vbYMk12dy7=Hv>BDZNLe>6-KQ4rlu
zpY2d`35h{0PYL_mthI;?rJ<3Clj1d-fZc6+48+IH{I)HGgfhor%}2+tP*j$LFS~K8
zU5y`F%R`Cac}Pr%gMk{tNf)PlEw`Abf%rA$dxm&ZCO8kVa<vj-L(7Eakxj7YBlsm^
z_+AO4CVcDd<3RjEz-OP9qx2l#c9au8!_~_~UIE)tIAhV2oknHM5)r{yY2j9MNjA!_
z3lK`!DT<h}X@txRD-cRP^~z{k#uoABgQD~o$%W!IFtX6)9)tU)nUnp)W$Y%HRa(-(
z?PyU7eP<o`0)ubVu{IL>0x*J&SMvzqnoGKcq@Bj?s@O?=J}AS{&YfK!m`EI`I~Lhz
z?rXSXon<H1AN|Yz<;<sXvdgo-39MPzZD4CfZNYKSFz7pXnlN-=eg~>;Vsb7wCqp^p
ztg$A`&oPJTDzFD@2TLR<+w)%TecbY>CGDL#g>j>C$?xLriLkF_5R8mo$N<m_i2=Qk
z{oIm!+60LYYYcvIP`!WA@#=SJqNR-d$d3QuByxA8jjFcRnDRYrh5RHv(8q7DI92e6
zc~{i-S)G`2pZT3ZxiQI~Hr=sKQOY+5)z{jQi?Q5?Jqo)f?BxIOI8Q8C*RG0q2t#i7
z(XvjuORbDaY@1I6-q{evMyy=r@H_Zqd0#lhwfI9X(`{i1pz_M-gaO)1+eI|xH}B`^
z$SpB)_-wzskd2t(Rqu!>AaEmbjktS)s#>N2=Zjl&#$iCCJ8*Gbv`_M)N|<R>_K~$T
z)V`71#6d*Dc;n(<Wtxsb-m8UhO#Oixp!x&aXw5g2#X0gaP?7<OCSpY=d7=|!t+DUq
z%bHEo_Rg;YWyy|`6j!T<Mn?0V+e#-o)D0OXr_*`VEhTJ6H;bj)ghAwG_qye>yWSbU
zJk%aIMpgnWq4q})T#{(2=JlD2@v>&gY&@aC_ta8a;?Z%9XTS3D4Bq5kPD0x6Kar?=
z;R!!AEXU)-!lUx<G;_aEj&F^5UO<lR7$x9g+o}1XsI61lr&K&b(Q&`1+7_E|pdUpO
zRH)^LT34%QopKrl7f(pMKtoVh1Ssc%XBFM=4lUEo`tbe0Ez)(<qU&^ZLeWR{t0X<(
zL+BkBMP>q?5#8H8I;#h3aSrxT#S=4V+CPWr&9q|^xaslE&3xe6W(_#gf>VeC@v6DC
zJAzd^US_Dt@y_aNO~Pa<cXx>Cxh8}A$YwQxzTfQ5^rzI@Uzz?0@wnd6PG5lRdgO}W
z)2k9YyS27FFeyin^*_7O6viN*G#m-%Y^7dgVD&GB(_o+r)BttLnzYRshM!x3l3Jkw
zj-F;;13p)lL%Wf`2Pg~1%Qv^P(aSNr%ft7m$`gUdkaS`Dauh~zry7CTTf?p?G|{(?
z#Dtkdi8sY@@E}sGWuCtS<~Zd=!~x!f^M0E-5CdW=@0o5BIUSvkm$IIO4FhzfAu~qu
zL5DT^dHJ|{zXy*iJ|$1xcfhvV2Qtlw3e`TOCq^}CdfKZ}9NN#lCNTwR%MmVmBU8@2
z7~9L_YVkC?6o333*ltbq#8}MPCqN5Y4WQ!=(+CaykoZq`e~5<l*a5?khmd9q5=Rw=
zTE3K0zQJ{2_RvdoJlD*zQ+$!^9MNYJm;o0DY89A`QxV4<C$m-B)y(=5?rmG=NV~M=
z&(tfIWy@L)=F|yD#3~&=;K?Y0<ny^b$kkfCug<bL-m$R>tXRiqEe42b>}2Ph)wQRt
z-jq|kwD*p`xj|-)4#TkyGFH>OHp7OgXhs1f`0@8MlK|mwZkJ8C{;OhtuE{;AGtPIM
zS=-J^Gn}2W30(ddB@dLD7@M6?oPK(*k}S049INVIFEQ9oqozfCa|6Glfz@2&KaBxL
z>@*QjbzWF@8aLPLLlPjFQ|wWl9&4+7wS&}&j!X0QLVr%*n&nS0<b(7A<?3(A+b7SC
z9-Sd=#kiY<-bUlebIse@L7in|j%LrT>KFUNh<+<s)>}bJ?vM)zcF)nOG5?9QN~nh~
zU~WY$TWJl63}zkGIrQtXcK?Z`n0CSy6(xSD%UK}-_<&Qw?S7jt&@t;JwD^R415|H`
zKmp!gJ-9t<;T6kKwPRj-L0T7<)@195K@8a(gG==N50`lDKU^Z*2?RJgOHK%jyuEyg
z_l1&T^s?ySrDJ7TG0~^jq0erMiWbzuw7NP`TuyNiQG=2l>D0}GYtej4yQjBhh+4)4
z0*n~d`_vOaq?&4{@Z0WnHs~*>C^cf#vA72U{Y0hony#{fBT+(e(L!-tsoyXcgFL5s
z#Sg%xmgy~gHxZV+kvBCy5vM2qux#?$=v$!OoZ84u)8&_J)*QaluD&n~19_2M@Z^xb
z_@;J)GgK8*afT$zui#UETK=DdO5^qcTEK_U`#AiR4EwT}5EqZ@Uw9n$@CkFptr_7D
z>U=<x1(N?B6$_wV$8kwYGr&}vS+3`UR==}IK1vLm-8FI*gHqIypudbL9}i1(3>$K|
z>4tb7?BIMZ=JXz>yjb0qGA+FK4U4nhJzBWk^%PT0c{`wd^i5<~6tlAqM%FEv5f^@!
z<>5nSAa4X-#b1JJkY3FJtLJu`IjC3bU#w|I!j@VCEv*eEs@4Q8=aeg|>&R|iwT`T>
zrc*eBb;6b*(*xC?aG}Ry^+TcK`PLX!?i`?dHBs&PZxiJIR6<U@kx*j~6xJ&gJjqWt
z20q43zn1pU6gR6ClJ?54cea#%=gpAqTZ%$!0Y%)Kr~8gbUz`15wr>4jEa2-Jy{~H`
zEP!clo`zddW*Zw@rT*OW15*iq@cxC*(Eh`3GY;t}+4Loi{pn0yi*OQL(<Uq^zu0Yy
z_h_CfclJ*QK)m31i>|HALM>(cHjC;F8jx&lp=S!~$AAT{1vw?wk=pxtvHrd77=|Hk
z*i&}VPFNgx0ir5?PWg6-4^zRkg40zy>%Xt!M%RT!ul^22E(?d&(nYP=SFJzk_F)8-
zEz=xfr#o3o3})I7ioz@J{74BIwY1y5mGk>>ORpx<X4+xQv88tgxG+dOpI*9e)u%vD
zFWkbwi^E7-KcB#=`_59bE|}eQ4t3og5{vGJ`ve&!;EEA1sI-j{!;PAA0DL$JvnXAa
zi>q`??F1nW<5TTc(;|Jc7v0v`lR+;cc5G;udyYSA5x`0ORL_+rP!XLrN6lJP`!8+i
zNI0VeJ25jhqc*&~sB-=YRj6M%sWtrB&u}eV>20j7<CfQZsw6vmh^0|G@cUN`-L8QV
z=;2Ml?(<<_$Z&jJsR@rTT;TDl0Mz09T+e2MwmB6NxpD!kJ?*2m#hyn7L+IkSj4<;R
zJ4TwS;s2zmiZaqv10()dn(DvEn>f_x(6Wkfuxlji6R?~_4?Ga5?!fQ<4i26rdnknp
zFO%U+eQE%)uO4iY@S+_iW71cC(!y1N5EWgUOU?C1i}ltf5zd}G4tN9?J`C3#?|vmk
zYzQ;ylxg0%1Mb=%DC}O!@6i<P^`!?OMpZnz*>2!%Zg_cXlWUJZ%wa!qbaYRvL60n4
z+cb}(>#zJU+IO1jIvy~3@c=n3=)F;A@ry)FYxVff>h8VR>7L;=W4dI`xkfYW3x@2k
z-SWP7Jz=*@i0X~5)LGq`=D4CCpK>E1YZ>b=b2CR}G4YR%*8IdwZ<n(CW%U?EPiO1G
z1^Pkp-JGLdd4Pezic1W`u_qcN4%^h)^`0oNzxtQ94l|uT@v-9fuA$Vt6i$_8Vgr;&
zNhz&b@ifF9Ii&6Si-r3TBEX$H=WC+a;ro-IFrBG7v7*q$LVKPtcap(}h{K&BPzUdj
z^TVjqR|^_nY4^vU2uL*Ci}m8gf<=<n_fMY^_cU6+i!V}szE|~(m=kbR0+IlYgiO@{
zi()CFK>uKMG>-vK#9PI}RfdY7w;b%-fGa%c!7a{-shjSp+)10rtf_VGeN3zE4C!b!
zJ!25|65bM(QvEPLus45nOL~|LbVvx6X4vr~N&Kyf?)q@w*aFs&5y*ncnrHo5$;4{c
zkIGpezc&69FS?k)!4p!7pdql0C^~+k5*P@PZJf0u;D*9mSg9rUEhcQAt7R=^cCJ~x
z7Q|(|LL3xg(Q=vVn7P&Vp*uvd_?c9)g*`$Wn33%YCkVl4Fv7)!qR^}i29mki(0BeM
zSwm8V82qQH$ZxSsbyR^Tz9r2_O`dq=7J2Z$<e*{hc_;{^FLFyaJf8misnc2OcN&~;
z`073QgPWFaIp<D_?^!zxTdM)xr}E7&*;ZjI`@9OT3<K+t)3GChARQI)Iwt1Saj#?d
zKl!rST9?{3Dg8|hJ8WQ5U3uu1pq?(rjQQM1X1O0td)PAMdEy_zICI|2J6>Jlt2Fk8
z#JQ8}CAS~UW`(?~pH%;RVfGf?0$Omoi{}NOGb@icXU9`ZSakKjFIc;;Hm_xnSuo~I
z7AaV~O;e9qJLlsVSdZq4+SBo|tv?Z9JEDbu*x6QHpnCdO$U1g(WFG59yFP4_9joju
zGYzj$+bewPU$7O0R=>Yh|03AlRexr@Q9&kjEl$p0_i!-ssaBPvl$fcyDSqLJBI=LQ
zl#qDjhU4@LbW%d;D=m(Or-R9WA0!_{im=D;i%0HDWnN8bq}_eavzGN_JI((Dhj}y>
zkck*k{u_*R20kWnm)1>|+!Y&Y60&(tmILuMm(Rh{6JhHx^F7dzev0^E3m4)?IsmT3
zwJzSnq#6V}x<i3;E|wCB#nIO|bXI4$O%caJrNUBiLy-1nCE}|^6iGIMzd*iW2ShUw
zzoE1+bUf-(xt1_5SvI`+ImVwnbZtBpp1>PjSyY#tL1Nri)wQl<51ZV1O8j1s=iyBk
zpSfX3iRk;Ov)f-US8MQXU5e?byT)l@!$?ICk(JtS&@30MN92(F>3<|b>lD^1=W%k#
zr(w*|tY4>snA3)MLsmQ!0R4y`2s^w0a+x9ATj5)DutBUlDUnox;tdChn2@~Ommn)o
z`y$BV>0q?ngczrg*9^yMz}SbFxrQhhB-Fth%wAD3AjoB^4>Uz41s<v<4zFmDn)j>+
z0u^~7pj=2xzR$fJbJ8z;?n1S5YqwX*3sL@*)NG1vUrD#a7@?$&SWg`C7eowz9>;G_
z9H?+hfnNSrXU)&yj;_T|d-vbwn0;CcbY;q9(B>H0sx@=ZGT?qaVnVCoJK5Q!(dT5a
zYR#_d|2Pae`kG%&-%V-UIfZ`zIFjKtwERxZh5p<5Xvu^r*FkkzJeb4E!JM}Fp&q^c
z<;@53ce>e2+;a?Lhe7KRgSXTWNjlK+C!}!R7?xmXsw)~gsFMN3jOw`J0!JNYDAfhf
zFXlQ66T69z`*(lo-$_{u%r}--Uzmw82_w`No16g2t`8F#Q#zy2@dcSt=$OiP@65-u
z3VoYE)QO3la9X*$gr*4Y_&(Ky6aGN+a`uioAakk~%5x;2p^Rv4c+HJPFGeovH6!Hp
z-86u4>r`!~r=m2dn?im&qQaUhTIH_%h$&oW@B~X%Mlr(`XxARHyzlIi>xx$zC3p`0
zg60vHewL>UFJ&LS>5+RtOW+sb979&O`@uJoK>E@!duw3cJ}p_%ld3@^!t(xlKQ`b|
zK*MACjZm^3L!1s2#z(LoQ(407Xs#$VJSp0#Bct<I&$yIRV-<<&2KcXDC1ITS>fETD
z9kmt9JmI-azdB)#1jXX!>ubwquN@em-b%o)#f#dV_0lPmO$mO!iPUjY3Y8>sWb)Ty
z1ml)ssMCgb!0rmxVx~H~h5|m1X2e1K&-H$!?JEnRv8Cy~2p$r|Jfz=|O@%AbzleLj
zzBHRhc@o}6-qX9r5u#&Rf?F#NdmFB`jO#SpMMCHW6_6pTgL&GLCMvvZk!~UtlkeBc
zmlG%OavL5g6Yml6KD(qQl3nj{3jf9cgj>m7*urBBo=59X9#HzP$8h@ULcZcqL>k`D
zb!<Uq=548*!Ma_WjKa-CEHBJ^>PUg<Fc7$a;!iY1Qn87|DL%7PD%@5oALH@AOoo!+
zy@)>k*0#Ck$(h%n2zj-}@0-pwYMHIjDl=$tG}2$Id(>#4Z}cm{SXBUFl&1ErV*2*m
z!Ka3I!z*L84lFCry(<judUfYZ#<VuQy4Q~m?Yq8K-LN$q>X_AHfUfwJLBEZ7qDg=i
z$Z2D@@yhEw=ld_pPT>B3Siy=G#Zr0}RY3G`0#{c9*P7Q~kqfvs{x32RZ5W^mYq!1)
z1LGqHOzOvg2B%K~@?Jy~9HJ#wa{4v~cuHJ*e>W|%zpfXXIxE!&Pf0x$-MRlNU$%eL
zaZ`7yMA!9uh@ZXkC+;-uQ=el?5{VzCaB<@E4V^ZcIDsuk$JF8)kn7%G5z6!#k8!7m
z9{UCjhoA}9E(UL+ptIQd--rQ0SAPVs1tmHQKZU5-Me5)f`gH~&s6PQ?6`C@OJ7LVK
zF8?}GY4tXkGi6G?+}cdb8s7F7xc&~Q^$z_Z#P^0!8t&KStiQf|zdDRM)pDhcFT3NZ
z(=x}#%(@~=y3u>9YwtIcM!guAPyT34k4JSl5sxk83uK?QkLOaWJiGKh&e@A)LmJUp
z#+OZg)H%R`Onv_U@frT*2dzY6?)2&Ey7ix0hb9MJG3FP7{F(6uj?H&Fg?~J*%f~L?
zD&dq%ckP{ybS#dD33%8H4j3~hUs2wg1LtRT6kc(2y3g8P&RV^ZuXLmRk>bx-<2&v`
zT&fvHlR!{9Vffc?_!pXCp;{FV_}KvxkixPK0#r?!o=c5`eM`Sxe@tAnud`&GAzxq^
zfwZRd-R%BPq^YZXb@L5i(EI_ldv|f3c{Y`LdB3$vXSeIeoRK~5q)AqJ#sA>b2dk^l
zeHo{?UZp(j5%lMt@@vpH73s(XG9##zfk{*YNUmlGh9;1I{XtqglBw#Uv-C?2lr&Qc
z2W1;^SG|xHGu0ZDDirg}m?}qqzvQ<*v<GR}wVV9;D{cWxkNe_yiMIBnh5lvA4D)G~
zNfZ^Ul6l{CIIT*N^7)zB_=7(TmSN_lTLq5&8_SqV&00%abxL?<3}`B`WT?Q_OB_ai
z%gckLLf<L(70ruNHI1==3pA_uvTDdTbBSoRsIxpUl8=-Fp#a$cJ;fQa_h=Cl(>&2c
zQNO#Ly(yB*n*#aMy|}H8@UT%9Yf|-P3m4L<Mf!(t&wm$WJ=^6othCL;3tx6TnWx3E
zSo~@rgDwff!3i^1=>SrBQu-&qS=B7Iz5|_FWoZy~mB##f;kuhg&AhzyJ$0I1St5od
z^M{ckSm_O$z*2QG28noJO8h}pRozo>cyR%{Myx0u)9KYss?=X9o=Oj5Te)9@gC^IZ
zUcs&2A*&JE^B(rZCW_=Y6}c6+rlZHw3<rcHd@n|42N}*>JKe7O==lTB>SvGxLjDAs
z1+SFqXWGS=HEV`6Pt#1Nb>=Y2rkh~3ROsV=+W7t1W>&Lc_zXQRB5m+#IuCNtJEL?y
zY5jVY^1mj-^W@%m(DVnH9H_jTr;HfA-1(!25O8&6{!tZ`)pPF@S+LQRYDSr(CPDO|
z&MYEnKHnn4HE>NhG-OIJIAuk2BG{6qKH%s`ZT_^}?*orbyjfY;5)c;E_+il@vSpO<
z^e+iHfKI52&exQrO*>l}xZ^=Rykk9%@f)csCc9m_?ke_1|K!<o_Vrp*g1P?Z`cxE-
za)~G}e`w={X_sf~A2Q9nFW+u$UwiKTUI&@Zd-3<~hg9dXhQ2@_6;!HI0D}yK1;OqI
zR{yxK5}a|W*L=}iA-u*GVRj$uwE}`@?7tVQyq|Cgm$yBJ*#-0LxIZId*mp@#(+}tk
zgaoY#<r>_=u?I9Vrkw6#ezyHcb8@fxt2cC4%ESwU654B<AjT$}cf)uCTgVW(4&RPI
zKFDQ+*bxifL&py6WPIGRU8ll;#RUGAkEZuuEP#^?0QhUewQCVXCzSu9qsiN55#5up
zi!0}Jm|^X>z=3Zbxr>YhR8h6gJZUmw#nG1@9_Ei8IOoD=`;yLn$r-2VWPo1R%POk6
z)w6gj>kGH!GyTCohSa0QM}KY(zk-i1_^6+ow#wS5aZXU%)S)NMX`;x1Ae$$lh5y+2
zt^%~&Hw`fm-YVCE9ZVjO`DAc;3yd#d9X5a%-CC`w6pCf4M2#kxhxb_5YlB^dZ=>r1
z6Ss3NPRqQ<HKJ*~A6Cu6e)KHM`Sx#h#9$g)=#y6jxLm|Ef2DA@S?CWJeU1A%t84c)
zhyCWW)@?P;gj(9Mq@lrNDWOV3GX7KWR>~+<(94?kIv`WSY<|`;kkq_1O{Np;T^7Lw
z6jTRL)mr3SK9~`RUJ{)?s3Mq{di=%Xes&}47iUr`If1xD`rY;~@n#wAV=9WP)-Q;u
zXWo=)=q;}UCC-v>pSRfUoAbIG^*{nmOx6AtT#X(OC+VH$i|^)1T?%;p^5c3*MI@JJ
z5rqIU({DP8TF=3eE`1Rtu5zak1L6RY7EeH^^Tub@^Q>v@JyTu7JKB)Y0K-ah++n>B
zMz_rptxh{jb(bL(16J>ljNt#r*n0*w6}H{NDhen{5oywkA|N2rq((X_f;2-3AR<L+
z2Bec9y?5y)R6(i&(jiLkMS6{Nqy$4rfRN;DeBNi~yz|YO`DPgSgR=L|zOS~{wU+sk
zvHO37E2__<ADl%mte5wX_S5<Il;XRu|9*Ns(Xk850+tK=I1T7bV{##m&f{VB@Q*BF
z=khuL%c7Y5-vI4u!MXv{=dd21NXj+Nk&rMziggSyY9s@GiIX>&uN>M3_rFT#axu1I
z#iS>i#^)fcr*#yYQm@}mHAB`L8}@TonUn2B$5kD?u`e*dwALTqi(l{<bSCk?5C4v8
zQ%t4@cE56cCK^hHaGAS*#iLj1prtTE!_T9aKHZ3XE8*A7I@Wv0xX31(5+ABIgFJ>H
zW5{(%{Xc-v-nblugRfhdMTLvW1@WxTJNG<Y@hmtK7Jxlkg5IYO1~k0l3gPz$;?8{;
z<p+6rhY!F=s}8m4ghu6ADx%z+;yNpb+&NF%c7*@^+D);ir3`%{&ngX__lJBqgsOld
zX9WK`%B<z5Bg4WzH~IN;VTx<-oqWcl>A$p#kjK5x#+TjR_wseTvfMI5yAGcK(m9=}
zcqKPLB8FpKpxS8-<?6RrGeAr;t(!)E{TX~SS-3mQvf+gDpwdkKi!U;EzI40B&lwq@
zQ3iYQ=j5OA8cVt9hf;bm*X@5++QST{$SRxLx}Zpj_pVp`R8h$a{9!DmcE7T4WE@Ju
zVmDRjEUQ$^I-0aC-TUAuplG$_qL`Wo?*Itbr<yONVvVRA?;a1%(38ZiAxXvMn6%aV
z&AZ5Ov^54BCG4|^wf*|K_4t8VqWo}Y7)JDG)QhdMlR?}g#lOpm;);i__kRi^d=I8i
z=of73{rX=4!-T74&q@eDZ~@dSWdKJ54QTFJT(2cNX?oA7|KWa_={wS=rHa^k$LgIG
zTa=Yqztraw`%NChqWuWdx?_>3QU`+D3*8*+4G*5X-6!TzQY?uX18`5kTG3b{KKMie
z*Sc}MK3{LjYj<d^W{bZpzCcKwJ1{$2q^W!o8b5W$5iY=68fdYR`D&n#lW$LmMs*E5
z>haR8_z4_9AG4=ver%4NNsr>halobS__!g*W$N$+is;-&G=MvK4QO~9YO<1Xz<!Z8
zOQU7^1Kb~v6Iu6OH|w@@LVi0bil?^&z`>2;G9eDKDQOpfEfn|r40zT&<+aT4hj)Wy
zC@)y%mANi|S=U4V&&Cq*qbqq8VZ@f5@h(4mQAd1caId}#>t1*L4ujv2+@9APQ+<#}
zE(QKAJ_+#AAS<Ei;|6#ssYzXMcE7Fz^)P#q!t0r1&I34Gi75L+((?}$!M17>3lrb|
zSr)Kwj9SU@GLinHT&fs!a=GX;PUC?qYplQfM3b9Ux2c~Yw&7oZuNyRWw{;b!0(aDI
zL)L>@dP|4XNv>!d2B7HyNFOH%_m;@<u6fwvW~usu&bB(r&$3(kW%eFm0=Ni`9hC%P
zIdIne((p2C;?zswwSOd`2J5$JEJgUd;fxFZHUnF(0Dy4)H1i)_iEQ<#XU!+nVbpEP
zlXYvc4?c|1KIx_Q^1cU2od|n|RrDTCHeD#uP%?FP>FO5w7%%-$mP5nDd}%0cCDAsi
zv1xTjnhww}T^Ksw7voflS!onje7fDGfQxrT_KJ|^_YxD_{%Mz<e$hHGRoF?psMkqz
zgU;?Rfb-AveLg?7_Nj$WmL6!O#=7*02L+GCK6;p75$d*Q-?EPD5t*M`esA?`|6IRx
z@iWJBcVE1MbMId6Hm=XU0l6_u07ST2x6ehV4`=ETYMC?j*L@NA#YsiOF{!=of8%P~
z9OS)$^BJnBl6hf<Y~Y;D(z<7~Na@bmqtv|<*h{Zt|2!wCtW$lzK56|QPVjO-@%#vi
zzf$1Xh6Dc)q0T{u*kdGJ=I>x#(tT2%d<P^Yw6G13!4fkI>ssQF!mN&w)#W!(014Lb
zuWvy%;O#O|dB%!5A+Wha@S-d7;A%A0W@+;g|6bQ9l2-A@b=4mG`s2i5ql0v0OvMt#
z{pmnVwy34g{MjJYZuPjcdPS{*$AF-Ng}noAK98B*BdFflrwR#>#Iq^L=bZPIMAF5Q
zS~htp^}}BRf=yyvT8;#xcgYG_CGl8@6GV=5(7au?39CHGT?cbbNFAk<?h5)g#tpZ>
z%d@JHyz95K%yAGezpt!(aNmJ=Tis#hTqgVhYcS6_2*!8*V-?Y{I*f@*U(VpSQ3HGv
z25)_{)Y+d;%QQAA@2$>ewh^Q4*;D|$MsRQqf$gv*qYG$5rlqM0fIRR!rJ!<j`1qXi
zp|)WXa2p`g)iWE`?RUZlI_qx>q$L(<F8{eHH%uk3;`-$_;8r*m*VA@(k;W<faD+TJ
zP$O@c<s9a@`r<#}9*_mRZt=d34z(fZa0Qz&0^nXpn6NVdQzca^-tG~cYB`q+-j?TC
z1>I)0WX!jCr5<$M=dw2tde?mb#}I(G&0dtoQ!Mwt_XvY(Hl}$1+Wzm=6q%d;u$!g3
zLZ7b5X?rJYJkr=Y4ojPZ$S->jBs3Tx{zrg*#)b=VASz+`EB_SWKkoh9o0D@|BQ~~l
z^qD!Yn<Dq|p@ci%R{C@manBl0Sbiqk5*D9zvu3cGwb$2?K2cl&RKF^_e?t?M6Y#;u
z^qUD-$Xl8uGd<7sfK%fS{D71&AXkWgb}!b^tbzV+zDtm=)74KD%w#ue5iWAd_V74h
zxxAUxZ@*9PkGbTZ^{KwrQ{eZ{6@w8yz<b_DS7sX!Y5MDVN2*n>G-6jMwnm!i{wkea
zie=clbJ?16CMmlndgDcb)Q;GTr`vPHim`jKBjx6q2Zvfjo%hzTUVMD_)v2!*{>Fk#
zw*#~q(9S?^0HmMjxNX7#4(A=ubLR`cltljLC)}}NKkgO~V?^>W)%8245+uG~2{>9e
z5u9;@qZ^Gi>DFE&+OTbKV?pCq>~t<Xd`tsf{vBac@v8LaZPB~}-J%zQJF@4?gx7<a
zSNl!!3RLC80b{fxW~Jw1<mzk(VO1Kw)MhemrMFHff<iyt$8<TWC=PV?w31!K=4FIg
zg5qj*^6X6;5l1?apd5tHEu4;&wXlfdeQ?aO1!x6NqF@3EG&n{185b@&bI{G~xh%R_
zJho8on5LPA_-b}jm{YN?jWu_!x1Ao6+!npmEvP{cPus`J&Xq`Si6vX-xb;uWOM-i8
z@X0=aVF9!H9*GhfEAC<f)cj=tVD`F6jn-y;7;r|+v0=R6*JE~f+l1x&z;l{!R&1{b
zh>u?U`lxl&vJHojHATb<b-649itS~r2IJ~t16%h@OdsDvTM^C`v=-Fn=q=G!8TD*8
zRKdFl&{myK{mBM}bmPZxKseE9pweUVt1y1>zr7J_cw0A)RE<_5<cjwB%?-sys1&ST
zbx(^?e<k9NHPF!AIRM1)I{|Q~<<_EFR&d1vGRHf`BYW7vSlw*<&P3fI2tPZVzGw?H
zOSrG~br?--D<Cyj`6u7I)_BW4`a3s3+BlK)9V^c~g(+WhA~FGOFxI~E<f2XJ`8o$M
z?%U>oY7e^!H@M=#F^)T~wRMPRL(Pcy*Wwmo({Hg&z_u0puStFmLfNUjJ%RshNNw8j
z^ZG;A4^xhQfJUj2y2%~?8@{})dXr}=z=W0%wOBNY7dwUFopVvnl>`a6h!J@OBr1ZT
zRRg}3y5eZmkXBqB!Mt}00~gpToNwsf#$gfr!IuCpJMn$h{Z%NIcPB`BLuP0QrQB$H
zfCf6QRvwmtq<qImLE)0y8~cp>;SK95sl82}2mY<yGbs552%5hE88UE`SUt>=yLbg4
z5x856*MdF4yRxwjybC??g~Nn0Q^D6qbMD{ex4z+kn!|y8Pv3J78HgSyL=W2TWYv&>
z;N-d~SLMmy1-vKO%G&Ms7q&xQeFR8ECjyIZtbbD9iKyvWTb>GfMZ<>BQ^fy>!#Fvi
zs9FKLjwgq>&JsjXJ#6pL=OTc#UH2#}+(&QE)J+;!P4U<7jk`4={JJu|@P1@~J{2Mi
zJ>{zoQX*WtKezls%SiL<jkcN=2ikRy%tt(De5GgMfXgfgi?pYt1t6q82VT|nC^ya0
z!BpTC*R$f#u1xP!3Ozd^%`1xG=ntjC3z9l)nKyFRp7Uozofo}!{W20$-LfAmySV!%
z_^k!Ei2i&ycwUPG=d781rQvTKY-f%b0UHn+5*jX_BV}yU;lN`u#7w*wVeN*n@3pQ1
zmma{nLw@DvC%_aVO*HOKvka;0r&ZK+m)fn^dJchJ^C>|1FnIVTfYrjg%p58z-#`CD
zzX{kMi<@)fO$J5Po>WZbK{W=++Mm<B7G3@HI-~?%UmpOH8MD*()a`hD1K66AR{RUr
ztu!1?*Y^u>0xDOMOqGUI-Q-nqcFf`LdxuUV+3OwG8ang++P_EI!>@R6{1c||c)-KQ
zO~yO2L?`~#Vw#QVTo5vZr|l4c^F%A2H#^eV6H`9HS5gAf^;FM=oB)G~4AIWd+1lqK
zrG0cWI)}P30HCLf%Ms9)navKe?q6YyjhvAmQLs90zueGWHC{qTV3X|z6yp)xHA4y>
zd%$@b&OJX*Jo5{)adjufuKls{8PuL{N?$NzIC&OT@K1bI<CK2-({;<|?Epw8fapz{
z$w=)C?m_qbvc^)YvY5`XK?)UUsn8I8gbGJHQ9|!o&)a4gqZ&4nQjIG@j)N|OnI~T*
zss|YUyuJQbfBVa0{{PMbDi<rqOsJ?1^6N+7xmU&U_X7cGuOql03p3y+WOxWzLDV&O
zXTB)EnP~3z5^=)Hv-_?B;xF>WXEUgX-69V#LTpITH*{6lW;7`@<9PBy`E?SZfo-<X
z3iMM;Z2vm-ET-yNFov#R>$B4VO7)8E8;lHD8H-e2Yrr?4+&k<tVN#^L?LH}<jm_|j
z_&&%gT`T{46iUXce7jLB1dyfTNJiTejIeZ5m=Xg3+mn*!I@j7(jI0o843d90aS<Fd
zp+lJ*-fp1Yn_2-WV2`EGcE9TEc`=E%EV#Mv{M-7?NghM5jscagkjIAxu4#Z7gv`AV
zi<>)7)$Nu6k*CD^dVw1}Pv5pS{{%!v@1^W<UrPe52#=e#p^8@CYCoMk(OXjhK59V3
z()}FQ6FnE=IpYv42&)fYPPOj<L`nL{!1X=-nr(N_CHUSN>}u@Ds0qbB_6yLU4ORWv
zq481k^0aU4G0zU}8=zPlrx7G3#fJSTMBpae{-x;(`nJal>?5jrMG;o{rvq8hp0|y|
zY|S>vIF`nSmgZuo+7J$v=<mCf_I{ye;T6_UpB0c!>;632!p93ZWu-lYgzikg0XekH
z*?#D6;%fgUO7;OjHwI*Lj{(_SxkE)8KcHDc%n=|+FK*Ot&#DS6aN13a&4$;5<<Hvv
zuHcIP8g{Fh0g=^7c6j<s?~Q)Nlm`lyzOe`QEWIqozDs*KcDI%p`f%{?3EToBH>sR0
z6y;s4HTR5b;KQ$WBTSqn!qd@ax>v(=g~Jv6t150ykuv>Y4j$B6J#)U-$N!gQCS_Zi
zB%Zrxzo-LT45|qaG?jZJI4OLFv+il29HX9l&7VcDJ179p>y*=BaW<W*Mx!zwNCT{o
zN~lHU?r`4zz-|1|6Q)Dqbwk<>7?p2I(^e)bGof(3Z#yncu>bYOMQ43HFs)r^Gk#;*
zsW(=z;~`(FMO;?o&z-KD_i*w76r;^HWC1cJaWSb5FK1Nw^Si|X_<_e(<RLGa)G%vf
zLR0eEWGFST&;JvFd%LhdH?P3I<lZp!4ZK5pw=M_`Q%*%J-THj)Z%BvDmPG@f_W4Sm
z&p$@3&}pjMP*n?Xx!>%iklk<)3I-5lPGP42Yf%VLn!*fPXkf@p7Gk$ChwvWu>WIDB
zlk=9G1t%t#T}f~TL<s)jckmWH+()bBKaHn|Wfp@Yy}@T`p0~kH<ysTx{|_VJZa8)B
zZYa4YwjtHPD>kC}CU`>@P<YuLj}^resjI|1$VxcRyUrUz5$#dURF67S?G-4i(d>8j
zCJ4^nxXW|vQy$yu;HGvc&cl7{&DkP}&!eK#M`H2KYGtz=4V4C)$!?C<M$4cE!jx#0
zO{eb*<bP^JtXQ|U1M%7^2hg$OriJ&v>h}TrTm0p24crdWP7BLYUCFDe3hVIO4OcuF
zV+nKK$JN7tIOxjc@xSbVA{#g#07t{o%%(3zTAimFW^EmiNT=rR6kXgu9M4mf<lUAS
z-+*RqgY5V2RV$r8?8QSFz(T;DhGhjD&uPbpJH9+zFF=gb=iiO4^Q<fKn{yjzP^;aj
z-$xzPlD4@hmH`AW!y+~wHrcomC<r2-$2oHR%^1E0S9zw8J?I;w>yet=*-Y%}{akQ1
zXkgiWPzRyr&DoJ7QpA2Z1w_JHcYR2|38ayIzt&;544+|VOd%H9Pr5Rc^f#^?HeByp
zv{OVF{wwNdG*gxHfZ*@&^dOk37G`Pr&dVR~D&1Z80e&!l|0o@Z&WHwkz!(k~H6SrX
zz($<eFu?OtS=9=~Rv(i!K>`c6a~_US$}0VqoKL#fRpvbioY!-+9D3$OuP{0n*d&!$
z>B5A57)!+CTX)O4nC<kxb|f~hxTnsDO(=DLMwceh^R@Kys%OP>>dIFvn^Ali42v@X
zb;3H_ngu7evOe8a|H=xO_AtFlPTK;spWwRAL%{C)%ardG`*q7P$4t4U9bu*`V1%O&
z(s4MF8Gg;}xg9oRlqdwOc{XMP#7Z}_#kEy2Hy_PHJ+X(0Y*stV*(-_~Vg9c#S81zW
zAO8WY12WUun-%l4{k^;ONB+_poh|`T1|6Rs7Z@rj2@OF=dfg*``V>#5Js?%FLV+gy
z4T~f7O!EMMZ{>Q0%+*l+j#>J)>jRiePcMsG<y^Le4_{@5>TL(>S*}sh`i!$OE8Wy5
z<K@amew^W9;^cov_5SXu+q{Ko>H2(k<FO3a{<b5Y=~lNWH}>l(Vx!O7{!GRrst_M;
zN&Qt6C-Rm^?ZQ@Mtsn$U91uTpFc6Qmcn`LA&i_H`ME~DN-M#MNhT+05=B|Rzrom3n
zUeUEP2a}iiQ(pDz7>V-XVCErwSLV0LaG$S5CBXK8*W3O@lx*()&bcb+RlMNq>Df!L
zJ`_|a<luF8uBDIFKlRW5$JQSEqg6O{h=SPiqOuEea1MVC(B;Pur$esK6~5p$xz}w7
z0j#hpI~?MvOexaR0UBBu_2bkuzfdWzf&FuQE^hC>8el#+lLNqW-=bsfsBdy!49UFv
zn9e^H8ADWL{k9H_^8IcyVZW(nwby3?h;KZSmJ?&zgp#Wnu3szooBacuuuca&B%vxR
zwBH(<^V@z45?Jn7<kdFlQp+)x7-=j#;n=O-*%f_ntth8;UFaIouD#H{-oTA7U%raw
zT94qIN>q6Jn<jaYT8%f-ZUlgmC7S1s(RpvH>RH(GiG>a~pKO@7T%f$HB4{T2<Iz|4
zPWHKuuqQ977l(Cew(YLtIN!Bp7hyCa{T`-KmCc`T>-`e&J5a_f)xX!^hFX(uLxL^j
zNE!0lL<Hpa5l@Lu2e2$jXAdgoK{s?{y>cdr%aejrM8`QlO*k{$6CJPRHOIyne>R#!
zH!#n!Il6RscIq4pqkI$rQ10`8K{@j+Dio!dk;e1aTG>z2UBnou4sL4CJ<mE<{|x(&
z`X|ly-O*n|{B_}#`$KZ-Wxj%$X7r@}DdZ-Suty9e&XI^n@QR<u4-$&hPWquPKVvWi
z@hpaiRA|!KOuQvBo*EhK%Ma*ukK1zkZSYS@1wwmvF|$xqIsR0i*pY#{vcsNwrFAKb
z!e;yy0@%tZ1(#z}*4xvfvp+W-NB9gPtgB)qHyD#&mTu3U+WrJh?=>UVr>xwJx1SOT
zNx)6+M-tef;OZ6vz@>(T%60!&4>Z#r)bH&v2=cFZ3l&|7FQB1F)cB<p&gv9k{}{d-
zYy)}S+9kBd0GJ!V2ER$Y8E1`Z%Xgh)^`RIfT}_qCI0e{Whb`r>WA9$YfqwIO56_MU
z0}c(1{P=EJ&kf1tlSvd5r>QhsiCxEOrgHX=b_<%NEpoOEWP;CPzSmC+Bk>=xGsGXm
z=$Y=@sCf^QFSjskM;riU<LW>hWcpIi>g~-3r)fC6$2nQikDPE+jRO3`(E^L1q9;e*
zSdV7M7?i76U(o=Q)f(-(T&Bd9m*MLv+IHDEEO^92sv96y`d#vR<OOMoYy`MS?p6x8
zf-7x&VzwfP^#=X)`z=>lf7`oW7lj6-g`Rve*<}g3^5!#p@-a_kw^(BFk0*LpEGwpn
z60SpXTJ5(`UOG9|4`Jg9E7p}0)~4bW^E+wpyaay@EziMYhiay+&M8!&ScgzKqZLqR
z6FTBM4oKWOd7R}9#D9zSZ~nIqXv{wy&>-I+hh0w%lxrC;NBO#8^EM<5n3&XFdkEvB
zq;JzY*IdoQ13Me6GuH6o_lpB_@EeV?Q!gGP^-g`tQLaXH2FP;M-i;k`fB^ywN}};_
zM?Xeb(E%LTx0z@2xVxD6w`A=d#Cb@R<Z>X5Ymr6M6$u_0U$xnnb%a5;`bH_=d~bOz
z#Ww5%Im}%Y;p82|0+8KdNFz<q$u<5_ipzqWYlr~?^S8)38Gwn_DtB#RKl^uUgJia_
z!#+40isi0#dW5T6>PRJP3G^STIg%}V2Mk+D`fYb=i{8S8_v>8qhoL}~WJ?F?WiiE`
zVMRNgB;`<`r6*Xtfe!ERH-IDr*%3cbKT`p?mB_P;Gi_~e#(wg@eG19@x(nnxI^vCx
zl5JUFMUNxbwPR5hEmpL8x791x-Z+4H#V2q2JaPdR($*NSs6EZ~h@Uc<2;WU<C*0RU
zQcUPC4nc!W7Bn-JF^jW;S`xy$09>e%OaA&z`X5SCKWQKNi*)9PL8=nLnoFdekEBYH
zG|5z&&QP>dcjsl@3GZ2*AKruDL0STBB8h%ypd$o{i6l+1B^8k(i5?_8DUcXTnjsmJ
zrbuVV5fTA;T6sh|btbYBx=F{*`wgY$n%5+e-Ep@}cDV%(*}I!COv4QLJ+A0aS<}V3
zoT{j9h+jKHLNM`vnHMUMT<+i0C0Y?dE;!DQzZ?yd?#Xx2sXQy?JNn{?tM;3loT^<Q
zACL%;NL32p;t9*Sm!tWKE$KdGG}pCDPvf|_AWEu_e}5?-9tpd2E#NYpKRJCGe%CKb
zW~z+61pCFztz;<J9F=ZAAhu#siVZ)4;V!L?Acw?hh(0t4-vE9P;qrCTH@ZZ{PMTP|
zK&VI=`P3uzKwk1)rhGAMEQ?LP5c>Wmgi0dnPTpwUv6z_m7k`_>>lM}=&(oiO#D?Xi
zDSb{BVsx!hdb!>=@`-#6!DF&GuK1hon|}%+Rr8_8bextp2brO(fpmj&+^34HIEgE7
z->693SL}2ozV#h8Wd0$mv5lmc?Y>k}P{7UFruYP!K&SBlqcwlWB&#?jvw&GmqTJNs
zTW_OvpCjw3M)TJFZl?r`Gx@J$GL4g{X-T*y-@%4|SsG5SF<uM#7&LZBBzO_#mrMjk
z-nS&|P~DpP=3}PnI$#}U^vZz(yZ-+91w*E2il;O|As?QzCA6!kH3$ll-SKg~WB)pC
z&-Ezt9-O1tDIeY`N~ik45zL+S(&{Y-`MXg*+R_J~lRGo%W;Ss1Qk%<;SJ`j95V~02
zO{=}d2%`Bw^Y0nW8jA5U?nelHs3<&k9|(h7r74l-3;&{IMWG$65zLZ#%IYDJDZTXY
zV#9?lHF!<#t3mZo!g(wZO=J0@OewqEtjmx3*W&c)g+GXGje7J6!edeh^0c?x74sf|
z?sqxf*t(0GLhdA5_=L`5m$RhC1q$guw=7$K`ia$kR~JfpldyNQLf?qE9IBcC<)4Vv
z(nbS2gpVZw&FPijk2t^8J$R}>``VSgI3+kodbIyr{Z_)(ogiK1bh4jHaX}PsSN*wl
ze%t<c79gX3MCq_<jpTd5+V)lS15JkKOo|o7lu~J3$OUzHjV>lyxq1AD<YKVb_v5T>
zhM61(jLt&mFrdP_Y{vTRbMwxDXP$IFG(wBeFC#Hcv`*DEfN5Xv|JD*xdKS#KEA7pf
z&smF!u%9Ldrz}FJ#Kq4{$-UxRT8@oJ_T*^}BAqohd5+pYFBZDCz7q1#vY2W}me)D$
zI*X4zRh!>#rCAi*gYAL3EciC<>$R_a2vzaHjEz27IfI@}ljb*CF5o5=pP}7Q6w${m
ztbP-vM2H%9@7ereT+uUoEqsedKAtr&^76aU4;Pz0C3*;0i=wA&j4JC()LXK=<~9T^
zAQ@&7Ei@Z4*5b42IJ-est*9}3F;={_!<hS%TbwJ%vjhBL$fOWvvs<3Ju5nOjxdcpd
z@|^*jvw$17JeKDwj#}!8(Qry>{OH_rx045W{w%q!{f3h-mG6`rk`vt0^&MjkZhqK`
z5k&cC01cDpNFb;Gh5{+rbI*sQv@v1s%XM_X?oE%+DcMYIu-IS%>5P;6UQ_xop*ut~
zp;dh}CZZ~FpjeYzzoGhtmn4r<m@QSlG!Zj(wSHv3ADO1IJI^W1VK09`3n#TiS}M5W
zhv{=&Z{Qg~^2)Z8Nwx4vJ>TvxYw5U@Mlkfby#P=87axYv8k?(<jN-)^@5w~<a~Pjr
z!D61(Tiy4L&yVFydOlzIZFddjU)R{kyIV1wv2kt8-J8TFiZ^}{ohkD7Pr>QOi&hmE
zj3qPtm^hNiy*j6K89U!jL~b5DljE(#W8wL)#}jL>I#zEo^fy1rgeC8r);TQ6M$Oil
zL?BkK{Tfd*RiGQZ0g-G5_)0oBp~t&b9)Ci+W}i(6!;KEbK1@!`BsPVrfj?utv|WRD
zdrQ$oBNS>%F@h5yWS@RT16QKB>H3C49Yph~{H)b=ZfK}9)*|qhT|N8>_KC&xUATgP
zH-Q4qBGrA8#?tXe2@usdYqrQuAFL$uq-zg&^Q1>V>-S==pmwxrQ6GOj(BDdP$`RrP
z1jpHG4=2j;Eb{fjQ?F~0XW`%0w^^ajygGNo(3Yb=d8>1!Y3G69g-YA)UPX(QanAcZ
z%IRPsKZ@YIwJkDXYc$oUX7itC+-)+fYHZu!tjQ8dNIdRieWmK~+ZuFttN!$N&q4h#
za1Vc&3tdLN3ThH~00+z<yHO{T?1xhOReLesTIw3iP+V30&h2;LTH`jq`xWH*r`z&K
z8@K$*T;ja@^(G`gGoawBd1(Kj4D8DeTW|L0-blkO83N>1!(mC#B%dN^`{6qa*XA9c
zT#%qiZ1l;XGeWKIbL^<o9et5dn?0sc$d8Hc4TG;XUHq{$*F@imHc9S+l_=IrnBC|X
zzMQf~T3lk@m>&mIFPI=vGUiyX@r>!lDPyEB8oBTM`=J-_H^fNGrXuffV`2W3`R8U_
zL2W0<jfpcKo-sN5neYJEARZ%8OnvIE&L<L?3}ZmIab``!0-Mjwj==N4-MfruQE!!R
zJSUtwuH0+gfOqAfZr1uO1$)weA8UG*zUljeR!T1YIn9G-(%KD<DlGW!@1+}mD5Lx4
zf?O)Gc7D+9WPvFx?_w+M6+qbZr+zk8%OMem+=H<mn2`xqT-|02vwO`u%Wdg;^R|h^
zsMZbZUY0W&;_q0@o89VF0Ue*oFi-<Vy5-Lx9cSeJ6y1A-Q920guo9F)h|@e`nG}L+
zcC;<Q>MLstp4g4D@p!D4YxeVU-FUa^_w(qCsg)UYYUR;3<-0O*6fz00T4H_g!w)(|
zJ2OzHQZUUJ#iW%Q4A$dJ0ltxh47KoVON7oLnv1r~$fTQlV}FMu&m@|GX2N{8N>nL{
zTk~$-5_M)DcSE1;ivOhW{@&2iKy*Oy6kb12-Th+J$b+g}t{r`Ito7zSRd&1j<j3<u
z*p9>}i|1$Z@8us)wr%Cpmfm`l1^3Ma)f)E!i{G-Lr!?Ct?GRd6On8OkDDRt8CT)n^
zU&`n^_CY0T;@AC6B!+){F}>_dt*jEEdx5ur`HCixu_1jzP8_*PSh#N7cJq#{5`%l=
zM}NIby<)(TV@@JJT7RVU7;3`$RF0SbsxogJ*PS>AK=$<+A?CY5vs-_V6?drX9R^T8
zgNmM|0p&$nzAF$F7Ip0MHf5CK4?S(YZ;!iJLoy%gs}C}2aKvbQF{*+We~a=;t+DHZ
z$Ao7^*jJq1+VgdI!e8{cb*kv~8O%2q*PMnw@alF$I%Y*AA@!rI`+(j$y!f;U+$RFr
zWozx@bdig2R_{p5{T6G{&AK*>sdCm(SEwb>o~qa-UB0=<?;qko`7vAd<mYPm<JZiE
z9E_$I!v)}t7U!0yM9{y|5*4DR$$Ru%>HdZRIRyr?5=81@vomYE%Ct6u?CM^uei-FV
zXLkln^Y0tztTaCkB#W2rGah2`f}N$Rn70M~V&u)W6aHcIDRR*2QwfVn4&z`pK24lA
z&RyX8Zd7KXFXk)dpVJ`nCE|};*4z?dhxtnt&HEQ<Z>vs_sYw<!?{xpLV~J$tH4U>T
zm$`eIS$e7$QOQdO4Au(td9rRkmc65Xl?!H}?HOlqLz9vw;TLx=YBYW$aG^j4qmpN`
z>GM%Oc6$i=OU#RgrB1Z6*^SQ(S(n)Bb^yh_ad8QF#1ZO~JHhn2r;rK6dTGV?6@7}X
zzK?&1PvFNF_FVEEH)=UA^%lpJXgICEneFA}E(R@<FDbbUbl#(Q@-|Ka0-fWtUDGvo
zyYTkH-J_hJ{+hujUVsx=3Bs-a)13P~4C{WoNyf>Ovnv<73rRoDg395gbC2ebWo<!;
zEEe$n$IV-r0Z<CE^Yq~|K4a*i2;Tx-RL3aj;KM7PBQ0=L$-g@96jeZ4OeeR26cqBX
zqR1uxv{OgLZf6<n*_^h)*8j=l;k1)~m`z82vz@Hsewn7kQDVbqhVai}PmSa4?xys5
zg*=wKFSQdfWXvNs87&7j+qfEuh*{VoK6GO7h_r03%F~Wr{8*{Yc*S0FbmEF}h~PK7
zk~c!FC8lRDjy?7~DbVm({7NZuY3n$A4s`>0lz{q40Xkb!n=`$AI7-Fzmx6>s{D#x`
zKB{mzvR|V1Xq8?(?vh?hYp!+eGILs`{#uv&6M6>|PzZX7`LT|pst?CgJBpH0@gJ~_
zGney;;|O3BIP?(v5SvjrY@%+VcNT!|Z7L=L@!9q#)jNp+R7Xo}jf!)Ppc4MsVsyPi
zZT<;v!_Li&`_A@fBBpk7%m6O}zYZ++_^><+@hzSMb@#VYn&y&wU&;*TI1)=wh7hD-
zdiL8Ld&3t86TeQQ+`mSk;=$&*+O!N2R2!Z%G~um9mMzOFhgXD`;F4@$Oz7_;Kw*8?
z05>+Z>(#}c*!^YPMBy;qE5gocBP)<s>)C*j!H8YuXyNVJ<43NkuSe-v(Z6wS4Jrj;
zc26DMR3!o_-i?mqy87OSh1u+krTUpN3z4`z;T8yj9_N&fX;F4<N|~$OoBOw#24k6F
zzAx4+?~F`O?KSD0mQ2RYnV&IFfBE?@m(w0`d2T610eMo2<M#JKUBYrxzWe8yjc_}T
z?9$?OyRlBw>ShlXN%p#BdcS(NFKeL7QyOuCjq%?%D~6fqMc!57S=5peO)ApB*tJau
zaQWHpd^`-c;gk^7GyR;XGW}TryP^2K+8$};REqOq`>?iUo4H~wJ*h3&dhGRTK_AVV
zhEGnOzWAlajg1|{swHg1RrL82oFfvva53a|<SdmWUO3W@BO348{}qnmeh0?Lv_Wfu
zK*LE-`0j3m+*o8^wil2%QwV*<k2XmjFs-z;u&9fi1z?%9Uv4F>d!9Z07Fer1WD47)
zD4ODd8;o(Y<5t0!jW*SJ3+^}XqYR$UvD<4Q10+-4uYCy!kYoq_wstPQz_3T)N#BO3
zKc6URmK-mwAP8xWLGk;2a%^2$C6G+RN8SB!iSeuxn~)<7-`_MoD~ld3X60B5`EjE&
zZ)4-l%EqVAh40?hOp{UdJZ+8;Zcgdy70*)OrQ0~?22w|7@WD=Z5kr<FHk~H00{@|{
z+RCRC!h<j@>ksesNPJrV(9Fgwc}0pZF75OdnnfO+jrDA=!&YsyKWEKzCY4ApoSrRb
z&_#Uzn(NkIF)!0nZ-i}MUh<@!4tWt(xLn4m`qkmst!xpW<9Z)$lgYsTZgnn$UYFv=
zm!X>#kGKu1Ey;&ny}o`Z=3^6m)4pu0<cu-fgVUgWNTJIal~8v1UE|@Oc+jy@X7}-C
zC)3IdlE`|Tyw`lu2{zaC+Zl!R_zU+{d^mZdc_;X>UFq>FF6n$WN}Yq1u+6L++e{$7
z1XXI@iI}`huJ@Oyccvo|^~&2GdEWfdtUA;krP`K7aQ-dVUt9T0z)i=6F^`)m1>PK%
zsTr;s-!s~jV2EY@)OoE%v%brEyr9E1Y_8r)n89}8;aV;Gv(GK-o-<6j(xpGhce_UN
zv$?O68^;fNJ{a0*D4B9q7pgd$??__8DyzkM&afsJ1YMKllXiW$ySk*ipoDeXc$CB3
zsT5cMj#HO-)4m3|`j<-}PJ*vc#pS|k!4MEA7dKm;hMW|zT(r76*#O~63kcyw-yGy1
z!ekCx>b4COB@*xlH6|5jp}*Pj@T>?A@#dY-#}ARHz1s;HGHLErBR*Gp2n~7~Cm9Vs
zY(^K36wGp(rVQf#h0OogH_G4U$qb?Dab~(t()$9oJ0G^grd0ees$M*?(?EgDDOfs@
zq<(ZM9(MCPIY{R+9`+#o<!n8x`r(6E%h9|iTrVxPgqLesHVgSgf__A(SoKgeT1_r@
z!(H04#AzQA9BQoqsz8o;SAu}3PwZG&JErWD(2~+F+IPe($0<mof>tAn-7}~wPb>Fs
zh#PrkE&c6pVOJ%&Z`_u+Y4ZI-xSr&alJTrW(o;LY$T*se`sJ;&O_p3W`c9zP5!>OH
zoz=h`{1{5fQD2OGjI#0!#wNz>dkE(|t6tWViJr6dSC{Sqy=~SH*TydE<)d@GCWP50
z`M*@3;v-cbj^YypEnN1Q0kT2V>Br8iKtb+5p9o%bHz1RyfAHcdm(02~Ld_u@aY~VC
zfF{@O6X6ctPgK4t09jeY{-FMND<w{uONKJxFIV_6Z|1&0(RDrsnz)U~ca)d7t}3sv
z=`MU!0(lNV@%Q&xm)RYKI?GLK_c3#C59MZt?Dd)l?3)Wku{tX{OBHW1FQe`Nb>6{`
z9oWsOUAU|Ku6gb>z326n#Pf4`8jaeL9Bzbvp07N!UHXt)BFeT;&-wnijx%I_ug!7U
z8boz^qs|hJ87vmn^xkAc5Mf?x3|m=$i?>-#?xJJ+t{x^F{c4Spn_L!WSz&)(=+tRF
zC-5U_^1riyak5N61$q9!X&xUT?>J=Sd!vY$|9)>F&nM<|(#=>*AJ@A2t43GqEmh@H
zHPdG5cf#m_6S4}f=RVb~VV@5f`SWHDDw;l8crWX}pD4AU((&FO!{o-YVJ%!Om+Fo1
zo=cJD0nQEUH~tFgc#(^QdF(<qqTMPdfSJ<^(UA51sb@da3ETX6j%oP3=#oO8?cGj)
zDmXcxVoE-4iRg2q{cKr%3Yd(}r-03uYRqRgXk}NvBE29_sx#(59bfzeaDXLB7r!`I
zhz`kdDN*k^Kcw<S!J){N4TsNsCcIAK>PhABJ@Er^cnp4s9ZbvyFP`LzT23Q@zt5>9
zBJ}r9;pwGIU66}a@1*=(I>YQIwrTBO*;%GArg}jGo8EUe>LB=^OO?-bH{Qt>H7+;p
zSRs~~idb^k{#8sL020DYK%g4`AX&?6CR!f_oMdjmm+L#td8=aBC*e70{T?C;R}DG;
zScEnFP!+p11j{1@i<#K4ElI!$Oy(y{8j6}3QS9zt%=cMqd4#gn-g(V=UKSlmx#ChI
zEatvA_7oAX#tvVlS}uYLEegz3Zw<K?c2v`*_Pd)y#W#ok^tA#3K4Zi~p@s<+v-M^D
z0IE-tohtuBox}Y+xW?(XWfH-P>^mL8Bn}^66_3|u*Ck30+z*y1S%`Khee?%=y&*u-
zanO@)a2KKk?N;~8WO<fp*7)tr8WpztJ;HO>6?i9D(6h<1`9KBeqf=X{+D+3k!C=Q^
z`6Tl|=s_MMey;Z=rcvEvI#A=z8vD)f433)o@7#bIL^`*srLfovC<T3Dlk(PO@`qj{
zU8*c5bQ>Mgb2kh3t$xR;%CxP&7f62#qMvfgM_<r5BFDa+zg}4hYd}`OZpd?%Rqhf!
zF^Um;0gE18KEqz{gEFt{=CH|81>p(Q`S1{L!~iO2Zy7vK&SrCYU@^t6GUr=<<0ne@
zSl%PldehA`F^@Yb1Qp*W%Nd?9OewB6r}PLZVti04B(~T-^um_!{ewpbuMogPq)@?q
zIy_n~r$9bvbdyWp<j6?=+GT3)Z8#+FH}*z<Dy`I^tq(PzIqv*D`IOy5sj_(#xgb9D
z_teks4^!!=Z45qbU$GClY=$+4t}B9lw?Gux9<zI;$FlD#XLX!WDd24Lu_p>Gse+)R
z%7X}TckjU{yGN@StVt_v7?ainS-<=3sSI29%H>GbEawj&p<p!Ivo%wic<vW8mai}Z
zP6s;6YD~|QuGH8`ed>B)^{>@^)V`+H$jlr$z8e-C_?K`Y>QCV@cU*~Fnf}=$X2T_T
z?h~;9s9;<W$!@eDN~@#oTc5L+e#N`5*LOO}cB^}w(S8$0fuJ+`<1ZA1od!arhy%+W
z=?BI8N`yCM>mCLCmLDm`<87U+{aj_uDl1s44DVuBPyg~rFHn7!j>9f9t2E5ULPIt2
z=5YJ(aP0OwJEOC|VaGmnumvx8z&^{&ewlNEBN0k15ptwP7aMnL?#ifhm_A7l5MGU_
z<7hL&TMJayD;rWuCiCUK8@*g(ckQhqvpA!&O61*~8+V@ucPUpqc*8-~d!Vt)_y%<z
zIHDmhe>@iOUrkMcMMcO+I&JAxFc@p3?|&!fpQin|oACG(EI^+`uB|r%nc!`RPpnFL
zl=oqUMFwKU1$@Z;w9MUrXtyKdcN$>(@>Adi2gubpw&{?91WBQoTcepSdg{YuuRld}
z&b_If|IuEcrY{DYZ=FYg#XY8{8j%*ZzOBN3{GAx~+{G5;M%Zz-Yg-Y~3%HvtiW{y!
zw>JE_Me!oVE05&2j0NBvnvw&GQB7}FwtK?;EEH2Txb7|y?6TH!%)V(VTxhd`P?Tiq
zyL(bfTJp-PN<hict~RYybe&ges2^E#6*HI!T;-Fv*A)`*3b=3wU4u*DQ!o3}57{f$
zAU;6;>F?k4WrkUB?<d}nazJVq#r{We=fF-xR$2L_@Z&s#r-ABR+@G&#etP<Lgp#kL
z21u%DCKXyu2!+|Uu8ZPPyYq>qjCZ)IvOg#X`atifbHtsDyf?duRU4Ukyk-@WLZD?9
zeti)lY9O561m)M1kY1&O-VG6AJfOAH9F1ZQ{?QkgSR-(Sb_i2NL(AMjvjefgO&KPX
z#AASIvE0$_G;a4c3XqJg6+UTsI%%}=E_d&ugHGDY>a-4{g+|t6+|*o(OF}#t^Twsz
zlE2V+1Tc332IJSmEMYH9^MPWiqW*dgk!$BM59=j7l<VLEuRQtD^H8kSdp+CtOCkTt
zQirgR&Z0+0l~Cy`JufN75!@-%A06B;Tz-7>GI^W72tM6H>J=N={q>RGj|*a4A`ujT
z3<+KgElTWNsoD90+<@nEU=nrKnRHaou3V}iX(X?-!MTS1kOKQFzoUd5kNR~UVwJK%
z%7Huhh=2mi0Dg*P!;Q;=lr+Bx5r`gNS@6eS+Fx%l<T9JpTNwPq3cN7FHa&A0P$55P
z{y}t%G`cU#>Wl9-_ruHYKyh|m8D3q>{!&0kJ0W3n-xXrbG}ssWo9ovQ>x4`1p~6vU
zG9!Lxxi!;**x^X*dp171rKxXL{xg)hGLUhq&aA}dGAG-2yi_%umeVEt-ks%*2k&~m
zG>B;z3E+jyPkfF684yu(OcRpRnA1Lz#Az|r`tvy^eTq<MF3Q<cIbefH3!&?z?_Z&}
zfzJXFnx5Sr%8*~q>FmjE?y)DYqkHz3l4N$}$<fR}E&(#){&Z5tK;>e3j8Y_1*7P?(
ztvbQ2tnjkVkrjM!Zl})p-;l)ns=RcBM>0Z=j=1b^&PU969Ke1y>PCx9Yx-QcRq6iw
z#*8jQgbp;r?>3-8!p}M`4EG%000ASnqn0CiLThaeVhA=BQ+f;}XLPX+R&Z(qh~~Ir
z31qS?0%s{XT9jy~z5^JRn?M|rEMP&{8AXgeZd4X;Y#6uxse7T<93!;2RpD8RT-GOj
z480wBdQEadD*ZAe=WC+yl49$z$mVd-QHv{LBYgz7VCI|6aVoSZ)g3GIx_~C0COSLP
z4&9#g+1s4XNHWLLj23G);vo|y3cy9+mzAYW8)i(LuYG)ZhOo;Ufm_8aa<|^S%l~<)
zY2xl1A=}^7klgZAi97Z&^<~|^Pfpdv-A0}$Gek64oV1s@R#-BVW0LAFWHJ0HcfxQt
zYVAWdJa-J;`jDVX#YN)?;R^7>HER^7>lBRG+Pt4^m0cJM{9U8EjD_m_sVY_&e^(XI
zbPne$O!Pkb?Zl-YAQx^|;VD?<+2<z+9_T@mRW>UZcHM_xj!O7eocKaqWL<s)VHyGh
zdKKwh_m<Q2SALj<2kvxk51m;mE58%7yBa%Bh~_^Utp}=|_CWF;!<GcIhQ0Tx=hKDD
zgvU2lqz<%E)#KgC-#Vm?8pW!POpN!m4vj%>NNN|YdX;pGY(Q@Oy9WCUv+?_rkA;C=
zb<}by?~C|!jxXKdSp6klr;i&0D=`y`xReL;m34^b<(HdH;I@c5Smp6JvMZ@fCd#8I
zyVT<#bfK{W&jy`fhwiq^E4OG4MV1;4Y%#5pz7`(%@CS-BfbMVAeJt0ReD1VxiLh#O
zKW%>kdD(Pg^PuHuaS!qL!a<d&vVv89eK6as$LjavW%y@Dixmd&^gbA4jiPeH>K}Y2
zQiYL1nf@UETxgMz3LOciCTv6Qke|eSe<5YnD`gJtr)BGAKv8^qf1Fu?G=hNf^S3y^
zlM{bOu;-rXi;PYFp(*Imx3ao=H#4$<hh?V6M62Vv`UsafROW5|c>8Oi#u8RGs?gd?
z*51^k8b)nTn7Bl|e@6aQscU8@;(Sn%v1^zZk5>9A<S5OG2XH23A1XcNO5?KeoEZ+d
zAo(Tf<0S3T9FPgaRPrand`H*$9W6Ha>HS<j4jiv${{7;YWy|qO{-XNHI)9FD3u%Nc
z@f1h`wn`nZGAT-bO2&--4pYK+3Ix)FOn1%)bo0MFC3GzZAN{$NUl*0WB+9X=raT+T
zel~VI$mSULN5d_3#acA8D+TsZ*NY4&RO8>Ei@6)p65sNBD0ODvM!@ajetoA;czxkX
z2Pe0LruUV%sw&wmh8G@NQ0V$)rNH<<2#1$^xpGl61R~3Kd5!0Mgq>FZjIQAFt<f5%
zG?zKHo0?vC*g8UCF)1(^_i~OWc3VE12kkLLj;zwwPMYvH#O6531M{-}vTAgDi|q!3
z4WZS1M!d`2j@j0F3&cgS6uuSRMOH|mtkQT_eV#mgeVY0Pi=<dYXh>ALW|PG8^E4?Z
zuWF}E{{%p=#HJbgc`CRD6|?_(NuO7L6R-&sECRtFpr~*~Ku@C3Ud3ehy3^W&c|*$L
zcbZ26A_aWD>L=jF6MyURXWt_^8DW<$C7wbs`-jQDZl;_HImy_(sR*L@E~I%=Kd_7C
zQ4$A(?bnmt;Fa3<!508v_et|}%h1rw^vRdl<%hr2pJHxRLD7Rr#c!V1=v8lO_%KTY
z<C!O15+N`(%U0Gd0Sd4FdL+>XaW-q*JVq{?1PtlQ>!TiK1|zigiy-BPgbOS8(XLwB
zG5EONUKn6KX}8yvFedW|%j>NlcgYEx-^qTN?)l>wU2<uPBZ@&L$`E$zc4DT1(;8Lp
z^ZDIh+P86QNnlL?;BAPhjWef%PHF~R`2Y7cVyC%p5EJfai+-7)SV<NNIsMds*}$TP
zd$A@+a<Q=GB{JXalsvOBWj{jhZewldoD^D=-@BTPYzCncxN8yO1<ETiJ<`?+G=<Ld
zI8-hP!nrl@H#ncv#lP_biSwk>n?r+z{TM8;><?r$n!T?^R<4Zu1swZ%p0K~QSd~|1
zD&dqmax&>EcWpTQY&NybX8-4nc=Bb=>Cer}$=r=l2xehK?W-qnFj3F?nF^jq*ldXi
z<)wu(diZyhZ(SDKrKwQUuWe=(aK9Q++7<8zNk{KiLzi!1ntx5LWx2$g*&KFlL2Cmt
zk)lv^f6#oMHEzN*Q6Q7P#={OZls_Hd6G6LY$lem$V?Xav6C{UDLt-KG=onmwhG;7@
zK4zGJRAim1pEZ0RIyZk4`L{T9`Hv3qO7q_-L<qQb)ywmzYj!}l!l`Bbo&q|Ev*m>5
zcT+3D^e>`y6@;F<2Ee>{3~ya4ulY$6veIe;cFLCf=S*GZgV3+L=S_y&7oV5XU%bm5
z^)2YKFcKnlR>E{BS44N&yIaWLM!l&*C2OJwIxGGI&zf_(+E3T92!3T-HmnekHZ85(
z8v|d={yL$1+xW9G|C=hL+UWO3p*hnV)qpO;sKmsd%RK3NCdFavXvmXv-43H=vLN75
zNx0vMda;!2Iq_#S^sl%9?B9G?Hnsn%nKJtEe`f*nX7BLRaZ0KO7vu$Lwr*Ky7~d)~
zOhM!0Yk4bu4vG0~d?3Pp5G<h9_^`t<s(M%tzMU)#2_1De5$$9GFa}$P6P|RcdcYp@
z+T=Vf=<k1EUfa$sGdCb1(F7{0XY+1n4Y^&JHRnWTf*00|P=Q_+XnmlFKo!y8Z-Mwu
zA;vVjcw)s8kPWXD9rdB7xUSr8oik25^;n0$tO6f~#r6(DL<SYjRjZ+IW#sPIUsIP4
ze<}02t4bWaCMAxfL&%OBt;$jX;O+?k?k?IbBJd|(^kdzXF)JCm?aSfcLO?Z1pwyjU
zUB@5&t-RheHyM7F%uhOZj+NN#KS{|mv@NNBMe*BEW0PY7bXdhs3rn}$U8d5N8%?uP
zxUx2DFf0}MOR`+@EhhTp8sjPKrgizg$7+)FkK(WA%$Q=8?Lgk)6~#_m`@N*dA>P6y
zprP1*@KzVcSQMt#yj+{F_(5GGZN<{VIkLYZ*ZpnAoin`4+Vg$2qqAQ0>}(iPy=$YQ
z>p#O|3g$_~iZzPDO%=AV#}~KSP#xo_P+8AWbUsaJ07u|AviM0xzmDG9VevOdcMio8
zrRWC5UHm?6=E0m8#s<9gs&o#9p;z8gyWGXNymP{83`a0It!smceMkT{YI6_0r`WYw
z>=SRQ0WQ0>SGmJURUG~2r3-3N2a`2wn|SEuP4C-N7`qkOJx&Nx2ur>JnS{GzUbf5c
zDdaj*Ar4X$bdk^P9f!M0wE>aV&m^4+PxbL(QbHdw5THJ8Gm4xa_?uut5)c?$L0j77
zN4Y3;gR_MW(k%0sQ0BN_)Dp`HB=UA`Jo7q}MSwTeb&O4hg=&j&h=8(HV$1SsjBmHm
zXGrB*kDn$r!&ngBgex!nvCz%I)e+j!j%m@zyNofE(P~!#Y_s!s<2Q%Zhwrd(9_;my
z-e;IGIw}gWGTz!S@H{td(A_1Nouogsk2`QTN9A?AtSWjy)bB*-_w3Xew%n!A`PfAA
zP7d{mqPB_)o5o$g*)c?P)8Y!TzJ842zB?<zEx3PWUAlo=#2c&sm(;q$BYzrC(<ST-
z)rahsfV&uw`~4U-(h?QM3vnQGyi7V)tKTxL2x5ip9lh_KTet?o$KjVwhT#w4Dqhmf
zi{GJt{EjNWZXfq(fFev6)`vV7w#{iOh&fXq6fY^z+_>$Kt}DS@_#*wW{ksO9M-uA|
zndvPS=PfqjuPQ7nIs_;LLObX$@CUZ?M_1;rJT1=r6>Yong0!<?5(fBij%=nUm)I}l
zY4ki0&8*j6T8g;isyva$5(1QLO|Ey|DudS>Zf;(vrFs=~EB`{c1M?RyAeBt<O7!eP
zEJty1#Q`GxuW~*GS{Y29<bC~mEZg^RACZ-KdEwFj7XS`v|CX>Xy57hAMM5z60%gLb
zirnji)St2``Kq|Tit?M0_4ul|>>mT2WN$0b-;cZBlWA?y7k_@#2k)F3_3>}TRn%wW
z58ifXH!a5L5IWh%1Uv`m^7UJ8vObkYw;3)j&3b$sO52o8-sdE93o-;vogWHL7Fcn<
zHRq5EZMtgL#T@?l%)2?n8kr?|N@ulko^1vomdNYUaHvAl10Jyz3A(({k>&d|Q=f1(
z1tEmGd!xu(+B(xF<7EcWNT267yyOs-#3R}-jSOX%Z)Xsqm>b9j?Rae7sAS$~kg-@V
z6AJ#a))&Qe87JN|lAd+L|0~CUg&PGkd%!dLcft7b{QJBlAY@%oRZwbQ4(+(dPW8Jn
zx9d`77q4pM`aSghd7SJ3CsgJ?DDTVv8|97Zr;a)s;j-p$%eJ5rP>_+(B<!cf?bc5}
zKRur=UYgKD(H}zuI;Wsp!1Rb?MX`4m5?^ZcaJm61sr(_T^-zVDO%D2sjpqK+wO@Rc
zH;w`&mp-+txRX&wz4@RraVIgcTf>8^r9`0^)V8b)Os6m1d>T{@QM~XblI-yXKBb%#
zN48C?c&k+B$p0JVy^mo%Y@hAy28do$;)1&X1SO<8nRN#G{xvu;N`4aAVbUj5@jl%G
zdr>*ife@6(HRUyf(^v@K!k%nHqIVfzcwQ3t%hfHv+u{d63D?7+^Lpq<)>{<2)R@;N
zgR&rbm7uP;;S+W%UC-td8wJ&n$44JkUDrf8n5lQw0HhKSqBYL%j~StkWDlN90rXYr
zV4|ZH69S4|BItgobzQ6KL&bxI<qs8MsSKQ|V0X4Cu<X<BycIS^<ZlwuSN{Jn_MTBq
zMeVn*h>A)R5RqOiNR9MPKtM#KsSu>9ARtKZB}4@2y@=G%lqOADXbIAb5PI*S_ntsV
zxEtT|p7THB-Vb*SKJWnsB-wkf_00L3b1jl!zfGwNM^)o8ncMZ=_umoEX7vOqp>__a
ziMvq_J9s($9VwZo?fQ}+*m!pvYGgmf$o-@f-k9jK2kYC|WLl@I7Ig6+h*<b-K(2Ec
zsqcxcL#OR|gJ2}v&ebw=2Vkr-!!}1Vafz_gPCWxKUMqDo5Bv+svuclN3D;ydJ27nH
z4&L2~R$<nRx7i&uJ>Csi0@6mbhaws42%o(2td`U2iO!c}8#{qAn`5Pu!bq7MbNCQ=
zWYjCv8r~Z9kLNb)jHY(Q18X(5Ne|(dehaepgV@&7l@&FfV7K(Pe(SBSeN(rIzKj5p
zB)h561XxG0;+wC0f<2+esVxA5k@wv#GJFyc9o@w9SI|ehnoTA|rMIb1f9Ue9vqx@-
z78H8Tly@;i$s}W{*g53Y5#OsgvhoK%l8J{{d6_vD%|v+;i{7q!&xgxA#A5rQP;7<E
zx-I|OTufPXN!(p^X%7lQuCupL0ZD|ssj@Q<HjPJioiS)i4B)n)`|kkc!Y!Na656N7
ztl3LEpjhNkX0^}AHtWr>01{jfYXJvk)yP0%El^UrcO7YZX5j41f9S0b30KoeAy^MW
zf$8o#A4M_Ynz&$}y0!X;2fX~7OQxzTlDwE|eC}Rv<!j_WB4H*rcTe->H)r@jf0E^L
zLkc56SOoo9pCbZ8^Af$~uii+R2*}iYUxKw|h>2|v^u7p4K*ywKs39^KI3n@osVBdQ
zEBUa{kbZ0cQ}>$e697$#q4pzAiTo02@3tEf#5e~Z1Om{8GR&9-SdfV`jgCvRK{D0o
zjfIUvPlxjtYx2Xh?w@?wBnc*Vk?kv&ZS&5Qia|G%e~Y4mEpjczZMl-`9F};RsnhUR
z@4z#Xt&aD&lGle9ltp`vT&!SR$?c27D-L(vGn|k?0aLK?sF3Z7f)W{4$7#z8wm@FO
z*%->E5Tkdz_}mrx2N6l}s_unQH`{+^<p;p5jJn?^ComIPcIC9kXzkTseZsNUN@<Bl
z7Nqg~<=+W66gY(nqqWk9%qmX*fC&{j(DPZqipYn9@0Q4`J1QE<;%Rb4ZY1t&x(^cB
zO@bw+p7qWRq1egzKxH@~pax7jHko8Zi=LlFT4^|c!tzPwbi94aRcj0WKTY$%h@7<O
z{Eg1(BW(;rn8qQOp_1s-u&F1dP$&9fU&m?Vc)viPYv@koMA)&&-)x-B?1|<XZfiR*
z%A}8s?ORmJ%<46d@vwA%=ILE8#1Oa9&749tH{}OU-f)Cy;YZJzW?|VIn5-4qtB~_$
zdjlk+3XxDZ6Hzyd_tWM?u)Vft=G7n6p%}{IVWnLPvwA-37l-i}VDSROKd(nW{pfc^
z%_Ft(S+uBe*z96;#3n{7UhQQ~^!?Zn?q~PuF2<)ZjrGhUDQabk^<RA%EzVS1<?(>6
z@Hd|@X&~G_etB%6W+9({9ynmPSs&19z}Gar0c~pM>kNXHxq>+^Q{%TRpVBL))IaPA
zkdwbN3*iGS2frD*)B$0EMy=q>P0{;taVtUVRKIrsYL7k}F@pq^$UcdfS9~6{c)dey
zdVx%J$M`p}Ru7!U?d!L6{$%ziH820;AzA!f`=i>((Tdr@L1SbewcP8S7J&X8fDP7^
zX#E3sq+BScN4ijHe6KAFy?QHu9fX(LYmp4C+$PcU)t3Ie9>U1xc5*qBb6U!BzTnF{
z<k2mwJfz-cTSCr_C}10)NLpz{<(aA&sQg~!eVaT3xGF4SA9&QDNfp!7!qDpPG(W!Z
z-gC`);nHV8vC)Svwd%j0A*Rf$E-|1dFd{JXz0ACkHH1}4Dvz>_eYDK&6Hv8&RCXZ)
zXeNGaL$WY!2Oxq>_^2W(xVSPLf#6y)6iTD<T$b#vHNVrR#>cI(L~XOqSHLaDuLaU0
zMi@Qi&C>7)m*j--KWQX)-n$774G6r`^Txz+#c!g=ntdArJl;%ag8*%7RD9%QAii(w
zkIa%=Vg1>Jjqkv^YmezvX4*F;=L92YiIVX43^eDtmZk~qYWkfDsD3U0tOUIyi_0D_
z72$qX+oAWm@li3ZH+VB>#GSGqueL@mnJ;;R=d~<Pd~}o8wi(6drH-xCK6r4qhfuT$
z@UBD!O<cPE`Tq5Y!27B!D~-dfP&iH(=HQWs`a^6q&^uN;8v=J5nj8%7m`hA+|1)?2
z!xmV^LXZV!{|Ewz=7cFnBhwTABT!|9s!nU_-2jrN9~aZ^x`fwJGQ+6vZ|6dhJuLdg
zDY|LxsjeyDqU1G1u9rB+zMZ6YW!O5O|H1zDs0o*5-|+6I1Xeo4_Unj%<x;Uw0`lQ|
z>IQI4#77zC66uQ=MN)*mbUfQ$?W3Ntu_WzQ@g;B5clN||(4-Y1f@yjiSD89wxD1Jx
z$SzlZC0CT|aMkK*Y26a5TAWVd7UnF*m}dF;!0V}i?!0^^@=c`3RT~SRJ*BxI@cz50
zeR21;y4i#D51`;Ic|UH%tlUmO-RzMY;t)lA%_@RkAq4!Ck>ew7Xw`|b9e~-wWoC&Z
zh@lX9lDwVRlSz>G)pS_D{konj#Fl+xZpJ9Fm@)UpP*(m#!D=m6ve~wGw2sJDXC`(D
zA{!a&HasG4i<nD}tte@?-=7o@#~OZHeu@tdTGp+0FhFg7?MteU;sMnOm1GREo;)0J
zTsQ49E-HclH8SMo8rsO>d0=6=!jjl<_EL54Po>qdfU;=oJ@vb<)ScjFt8fg`tUUpi
z4w=SeQcq*C#XhM>(-UgH6QOTM#`b`OMb}0Jb=<36mS<&1-dqBUK#ClVb>lS(sW}oW
z+Adt+iW29gZK+$f#j`1!T*<a2q=MN$?bOA0Aj$`yjIIvJdnX|IMof51aR1b~NlB2r
zMY@PtWNRVNpNq^59i=(VY{g4cEmPY-2>_j_v5IH9kmOhTE&qBu%CVYSg41MvmaOQj
zj{*f;`#y{|NVT6rbZl_aKu<$J)uXrfBo)*xA2*9zzo-7!*z<l`?Ce?Ovr2NYZ`x*x
zdxL$3%%@>HfFay-=s8(q*UdgqriCH`fI%5A(Tu#3^TH2~rS+j~E|BTJD&<rNyOw|R
z>wmQXCY0aG#<Fz*A8fDj>l9W#++FM-t+Y2MJ*GNZX5^*&JK&<8$=>4ocm(vJ7`Yj@
zcdf|L!%s&&hIu~e>YaSp5vuS*0WUmqMBeSn!-@9N5{>2DOfAVn^q!tU=73YxfLcX*
zMB!%>s^QT$&m}_J4&F|4v7!B4yA^9RcakT9e@=t~gQpgOF5UFt6al<F08K^4I08Zf
zv%N5Ka1<k(SYzt1EQ)^#Yo*sb=-xKr8RvGz8b3NYUAvTMUN4?Gz60b#(z^4;*UTP4
zxsrpHcqI!^3&gxZIeOD(zghQuu4MlP+g;UE>uX)?lHJCdN4!+s2)pNot|n~^)vbgP
z&sOMW235u@EI#RC;y8L(we2cyDnDzu6J<*9HY)?yIIoMn_)%n2zf?4}Oze5hR4eHD
z`Gw7t9U;(q$+QWyn!wg3whd#Xcdgp>(2F<SE3faC4<iiXNF9umOtO60<wos^uTeN@
zO#-mP9<*U1jMRwd9XFhd&a73koraZUdaLQVt@X;>j~cC9zlo7p@S>ye4Gx#44}ZWX
z_~6r5ukTOmH)ZaX!}k?Dvevmg`1P9AY$(L;2rjd<Hs5<u_FaJCN5&Cr7PcYef+qRu
z?*J|$Ys|ac7sv4+BSh~@{Aa$%H<~!=JGk=i**7vm_MZSJm7}8LitNI;<D5y(e{joF
z!cGeyW@|VI{H)XC@E&^r^UR!A!8R4`QTEN!>Q8--%LFiBpYoKsPAv}#LGL7V<A5U^
zPGt0%BkVvB?)QUx@tNh1J5(v!ZjRHKN%#tP0yCFsWEmp`M$26KBSG_tD$X0qzMZ<1
zRkc3e&cL3<#yJ>VzCfV-cQ-e`+#6B4YlGrnqKD+&%xsIj515g=!`uVwNi}Fit7k$t
z4UDhFwyV05jbnjN2~1uPGkBFEp7vR!=eU;YQuuzXjmolGoax3>&BvPn#?0Ij*J|mo
z&cK~t@YicZpz5wVRZpRvk{DTM!n1y(6=Ca_^HZcG4?h0p<QNFZY|Db)zZ~-E`hBuC
zM9+>x`=x~cK(o#70DE{V$#Cqy_ORWQ9RJ1%(I>g`&^aq!qaNwLos7!1Iogv`^+`8r
z0xE^UW}Wd$&GL#q)UZ24$7#p{U~}pFEJvDp<0#e3nB;OPypR1knS*|>np}Y&H^lAn
ziBLbQ-qAdb#)sztqG$yVip`&HU043O#5b{WR0KJ9E*&GLOGN?Kio|YT$-e!Z&Pqc7
z^4GyzV5$0I8SVv`H9+IejNyJVMJbA)wTW(Euo^Sqs_ig!Jm|<9#QQs^mA77{eQ)qt
zIY0hdgu;^-<k6231~O=#1?$9GwT6FwT_kh^>}}wE<?(_nIb{10xJJ+1^y9t_B^Bi)
z36~C2<{tqTx^r1Fn(XxpG?LVeyv&O4i3S4QyLu(WV%adpDwNLg>GQ9F!4_lYUlKUE
zKfb!jalxB^ZsdTyU9qS`A!A=_o?a}kA!*0`WwWZIINv<e?@{}4-8nlXFWsl5G%YBk
zRIIeIVwG5yyZA&W;RD|E7sd2BBebH>&`IDSNXb&{hm;q0%GeCKaEZGmqa76%B-z>e
zO+&T$gsC1knZ1>eD@+?=Gx}d%hvh9gd@oCkVwH3wzkAE`+o%DOCGGcsz4RNTWaYr|
zQuQdz^kUbrgGQim+%fOm(1bwQ1@5#%&=MnA!#LFs5gpeiU#Gjh+xIuByv#=)FpGo7
zaZ(wY<iB@Dowsy>u}ku3r<-r*%Ea|KnJA<j2(Q>L$G^_tTBI)7tk&fC$=8XqL^4w|
zhyCx7cquz?1IaaNv(8ZU8-|%q9Q}tWPI|hJEcmM?5uk#eJk7oA_qR<;TQYAm<f**k
z-_D$^s3>*sK}JA~=0%a!b)#-N2j7!&b+5`b=Or$GT7Ax&m2@Gtq5~Yq9N{{0TkqMo
zSETk0eD@H1<0Cc49C(@8Bf+yNGZ>FsrFqR?OCRa<L!9co^{mf_uXSFb?BT!05Z1Zh
z3b7WjEU`)5tkxgUbl4F+iY3ZtjKFZNUV=Sq2G5PAJICCtO;mu^*P`1mn|$8{W?QJ#
z@><{?gZaADnfsmlX*n)et-y?l;(r}frMIJ34FElgfYDgzDTFeBuhsr+Z3uth)hVkq
z;v<Z6Zse_URAk?|#K>~5FUZBZW<5lI6{xC!-D^d}ek*DE$ZI0=$oIzERL4H|iy3;=
zdws*TmMz5Y(bm8u@|#1$^O%yuK+M^U>G4+H6W-BwV26&*?!r|@9;~(`&uFoOP|$C|
zbkr^x$|CP0-X+eKeWOW)HdW%SbWfb8+*9+d7uF`)M0w>pq|+CoXv?g~pY-Se*zfWz
z(>4Z3tF0)2udfA6tUsQCn{IfUO@>WY1t{G!%RCKsq}XmM_P%pyOmzTU#nd6SZVkxo
z^paK<P+ggve2l~*pf0s(4!_n47ianP?(QImSh%0?RqOuS<d7&~>qw87Qk(wpoThx3
zR(grqZQZMBkB0Q0$_g|9OWG22t68@P6vwOI&D$(pl}xSkr%Nqtbirz*+1b6**dyqU
zVK`oW`!^bVr=<4ayX6|;pC(wZTY?PvmAdg=rpe9B%ZYWrVo~bbc$!c+`!0V5cfkoW
zaNwx#-}{p-hVQRR=8P6atam<c?>5Qn``#M$Sx5MeE3I`K5lsp$X_jvd$}=vKUzr5h
zG$ebQV3yW$i8HLBl7gUQH~k)kf|S}Z9{ifbQ=_My^<m7|G%5`69!O-ef7fsut&}6A
zA-M-sU00aZWT$uTs<#?eD~mPgjp*`QtQ#yHT4(q5JQ!$mgEg`>7H1{v$Z3ZyyKU30
zUHUSW8{c8rZtMGDmBqkve@QAEjGToeO_fYqX)$}W_GIlCdGek28a1e%98AgZ?;+JC
zr1|=jZ(6gPnH)D~*S+~qOaYj%(`JJ1Zo2|#QFDf`_vmrVQLJIL0;*HwcmUsk9Y#^u
zobME-Pm+H(Oldt9su}}Fz~}pr+4ctvSP@%1QwbtF!<UI|SdJpf61;BF&}(@Id?kHV
z1BCimm8d{H^caQX>=WZJwx2RQyKMze+0S-6i6DQl|5`-*D=GJsIC=7{R|h}0=FvTZ
zzU=iMR<ybd6+CzHEtMcIX?iY%1thiCY;!%J(a3pl2P*I>v#VZe`Dio~0~4X<W82?V
z#X$E!nWe5q^G=D)BJfiWpJB)uWEkxutaB}(>Z{p;X%{P&(iA_8AZSflZ^-k_g=qO+
zTcD%5o(FpWEa*O>ul50gG}*REZPFW@bk<Ts>(oKw1oOST3WZs#WJsy4$$|g8lX`dr
zJS?!Pa1y5Q0|h9Je?&H=IR97z#ALz94Y;0x5+X}r-AW|9&3lsU&#baqrKl9u$CN1b
z$&V^}pgs2+pTf^?8?vg*<|@S$`SA_61d4H&!^0Jg_RKgsr`{<!iEs~Ure95v>C)N`
zyZ6I}`@V)E?VhR?sTzsm%izFIk^ub>$$KdyN@>V+1#miaH3Sf}U-Bi)GriT1F@kEK
zf|0&T{@*PXb~hHZzr-svkyP7us1idb+3R$m891STVPW)G&+czHCG=Z;;ycy>n3*)R
zDz5XYv^U@}Sr*A7SE}Cpj<U&BXg&sPB<hYMoJW?IQi<Qg%SF#b<CK(?>E?q1gC8Ex
z?`jJ}I)$|XBdIsvGXPEY_-7)p>r~<zcGm}{0fMZy;Xt@1U^Lul;SJAUdYh`#d8FjR
zSrs6NX6iy&Ox~6-OBuP~vZzk46sKN}7;>T?-hPFq_ulU^jATp#$mb*Z$4)Ox91Sz=
z_Grmz{J%T(Me65V7mIn?hzKTSEO@I?@kjLGy_WYhzymdGw2g%Bi4r+;rq!#m+tA*3
zCVL0URuuS<_jDk<@7>(++9Xsjp|Vf-kQz8+laMApmLKrp?}zwI!;|WRIJGkth#Hi=
zQPO{d-9HX<`VW+1$#NyHXxFex`EfQPkn8NQsd`9}J%q_(LP+I-wP#~(0l#qbD(SSV
z+gy%QCJmsOByn6o^Y2|kee3qRWT=P!2yK#Xjh@Y2fBTw2AG4cB91*aQh267+1fTg;
z;#fBaB3{`|D*W93w^;{T;^Zza9jH|LYL5$rxm3`#4O6chD!RF7kS}l5XostKn+Abg
z3Mf5zR{LvFIZF!I4_yn_^gl~4tln&0Yhe8ffzw4R&*rWGDW$<ZW&70D6n{L&p`+wq
zJ|uH(uy5%d^Yq&q8{a&zutw){?I$6r$&nf~{V$A#^uE~iZywZXXGd>Q89$OQk0aFu
zYlr>hH8<Yzrb`^nr~SBIs9Won`Bnom`FBgFo{2y8W@J7UrS21vjw|%{)HU($E7FQ7
zNwdMn(u)Jxox+E#7HI$xL=jGhzuHGMf<>N>!%^4Jp4;}TM%~MD+g>tfco5FLxL{PQ
zpf`&p`(j@C;SrVs0~b417V=N*rp%n(sXwDf73xoWP6fT*vc^dV*iAl#vF~_`7UC8d
zQu!F2RVuyKW+P0sv%5r+>yTx*G98)YS(RuPTH9xU`3pMV4%U&&D=uW7On8tmO<<zI
ziQWFSEMBbe)hdF~nqN`Z_)#%W>-1H?{_SmpM&@O!h<Gs`FhXo;H2MXB`A25Ai|@6@
z)&#l(p?PAf8!m3q<9IX5cg4?oQT(!dVgc0ZDDd*)7-RN8hUT7R*`^$1jV94jbsPUu
zZ*%l0uAA1?eEce_O+TNh>r*TE#YJRh_tVCvVQF+(+=)@F5@IQ-x!_9=%3Zz&EMHXn
z2^oi*#<fE0yfdf8!aZrg1V!Coo2Ki{vTRtr8a&~aZbJu|=m4Y3wRXTVB`ASSXpJ2}
z^q>9ti@i)J9a8K4(%Xa2s|Aie)PE_9o@fWH3|q1qH!qm9(OShLX>y5T>FyO>)9X7J
z%=qBTnwMgu1Yv8p+FR)648Ht4i;)X!hy2v1`3(3hmhu|#R{|sQ>R85CJUxaa`|A>_
z76!6=-)Y0Ojcgw{*Ka+EhW=32Y-Rsa7ud=g&bc*}S%@i?EckKp+u0fEH%0~egFZ~E
z87PasigKkb;nN4s@X2f9g#r5eY6QZ`@tyf~-BwT$SB~u*z5BBvJw1XEuvdXfgbzFq
zX%4mmLPfzAd1a66A`=@Nn1FrC_Yxa+KoOj@i7r}j4fzg?&e)}{1Gm>kub@M3n+|OB
z7)<>MVlTIYQzoeY5E@!bFH#~v2Ab+%8G&9$?6dpV{d|C5t<)~pn5t5Le)!(z*qiR(
z0ONN0SQ8$+oIb@Ku_gFgnSVpSI#21aj4dlzVd+Y`A3mKB4oO>FU!5pOncAw%6*(w~
zyGx&qwyWP4ym2T;i3ea#(9?!5rEI_cs|8#yt_wA7q+bXdETlCMWTmsQ#TwqWA*!A6
zK2ETmUmLaWHb`2W7zx%Q$m|2)q&jNeiTyn6(Y=Sh;PR?O7&Y5y#kZ2W@LHJ+dq+ST
z27LM2K^-W;%^qapiGP<n+J=721pL*KKJSEIxcjs2tF?Tn_tlOo6qqnFUa&Uwav1e)
z3%YdXcJuSYf+80wF>m1Yg#u4*niAPyE3Up!Wf3V+Wl^Ey?pTqndF9B`_TLNNaft^7
zgV|WQuJ+$Lp1GWr=u8;!dGH8MW@cZvRgBw}uPBzZ61$WCRGc5bJ(a|pr3O3}(z%jb
z-2n$!>mfJy-H7Y4fSq~qbr*KoeJ(~U7(@)<mLF!<)E7psJvWWoIjgc!KJTLD4_klr
zbxiWIb0wt+G4xr$Q)R8_d&EAnDRMX=2@-9K_h|xw8?M#_4imI@P%>{~PXK?1d)?^^
z65UAw!rz@orEp~CxM1v9*5R&c<dl)?ip{=?W9Tovm8&#DzjD?~D2zVlZ#Lc&{iaxe
zu(*4<(kdN*t{=L5P3QBYvZ}i<a5FgoREIBhIk7?2DjFyXU-f?RnlzE&v3A!VA>Iw2
z&!U-n`JyQt=)Y<Of`+WX;BS+f^DCCqpn9wvi0xlU-sBMH=%U0@M0oNQh3MOlX(&J3
zyYZstQ_d#sOUd14qbFVRw+ffkuh8;QjU~nvlb9npr93?V?$8{rZN_-;_+$T2)g!5N
z)GIoTqYn8CXZN!&N5TJbcB2Tv=#ArChbEeP&~1j-&{x&dcg#9JPI>d7$`Ji0ZTST4
zR9?|vrataDChVUt8QHT+m0?+4M}F&yD^PnO_1!T@8NzaLQ_qsm)1)L0WTVL>g2;4I
ze{y_tZ1wBnSjI^0(d`8Z=Z@%!nsaf>7Lgg|4*wf1i)}MCEiVQ<>~%^i<@LNaS<99L
z_V)o~KUgVl=nh^E@4M3#D<Ycz#3FUB)adG3=;lU{o{=Pai4m7s<~7nxm6~Aonhb#F
zz*nAj>t7lr*9}|lui3E~vy6-ju(%oB5%^j1KZ)I9*|*VJ9?|iXv~8o1-@peUhb~D7
znxD?OC@|pE7I1BwLTwyPRn-Sou!lj6vCm0pJAv+ys8(Hu8PZee+YUwB1cRD;m#tiB
z{aOl0KP?Db(*^|YzZ1BnkRj`*;57H^S;0fm|3tp_JyyGNAfNYCA8B&v&xKAteB;P#
z(eZ<nBZc)6N%R#zlPU)*3XBTgh%SWirSu{i@sjY1-SF%hp;XoB+&pe%F&OpuQp6&+
zCB|#zoe}p&nYuCni^TS$&KA?__uUkXNjgTfE=1_MyTf2Vre^<~w-=jf4x!>#K9mir
zoyiSLank<gONrYDTTN;}%lw@kh3D`NH8M&8FS-|C*Y@xakYe5>OO+$-mp=by^?SRL
zn9|~-t1mr6(q`kse{n`(Jo{C~?1op>g_FB~B%K&+-2_-A8X>bcdsY=zj4K)&)fPHf
z==r{H{hIwuI1t?zD92S*6Kr!@vIZu17s5aQDYNH|OA0z?v4iD$&j(7>Tt%)~kG3R~
z92+A>T<yZy5hqdeRqhBfHo`$vGn}{vpI-<AGd(c-cm&nzv|XK$W9Bx>buenhPa7Xp
zBagNm(<M$n#Y$8iP@bU9x>1knNb8@H3<HYFt~+vL+T)LXgL(fJY(3ZK=C(H)?n2*c
zslncujJ=b0D&HAeZFLas2gVJ70K4PO12g4jyOakfKR|?h+@BPml1@F(r5%D+{d~!6
z4&uTvmGI>}&a4P*1)udt&7sd1DsjV>a%9;0S^qtP1WF8v_x8O6IT^9R*ql#RFQ5om
zn+2JY0|MfYhVPYX)Iq}@j$7_3Y&QrN4jZspvevZ>W?0m3;_F?-3xBIuLE}u%dklA<
zsx73%;JyXgkFd?;YWAh12NusupZ5g;{vUA=GQS7(5=`wCV_T`GPa|<N?1%@*4KIm5
zx~QXC#9GwU$kkr{9T<SKfzMIkepWfL?JoD@tx+URu}h`R{6_IUE8-YCLs5++Oz(aU
zB2vq)@t_;+QJV?4b{KI*1-da@Jh!moxBbr19`i8i6ll#j5<=vs+kQJUGAmLGv!@__
zH(k@SAjoH4zJur91N=DoWj#W-{C{{VVAN;2xaTF-#VZJ!+%XkUs;#Bb2dYzV5H}w+
zoLc4f+ou86uC}df6LN-a%DYlIP2RK)JN(RtP4S?eHIU~{rJct$)FcEvI@|GKDBQPg
zEXFX*YMtz^?kzM*AUxaYymT1r2vW~YZ;Pd3V<bP34k^p=SKX0l=CDX%7g|1Omdle^
zMv54w+Vk60^hj2+hvLnfPg{e=*ti>Je18nT(d-d30iI2+VL!K5YJm~_An)b{s&lYw
zq#~v@?Q*cvK-Mq5Z`S7dQA!YU^v~6vQZXv8q0h#e#T)({aw^)iUA2PbBY+6=FzCq9
zcS4xU6%V?RwEa#BD<CP2-5JJ%*<Eti?fK<fCe%(Y9%(_I>QI8GNxE_xz?+xc<MK!R
zuki8{SBn3nXbyFb%G_k@z*q`AfRWfg*%FiwLPQdPSO&pW2#=6iu;CLO6MyLov*$R-
z2f%t^yM}ZqG)>T&)gQkC87=aCwVgc<W7D6-pD4PZfDkz;6P)?>Tl~xIAd9=R2YElg
zJsJMxHBZgu{SHS~ze%a9T#gO1a`Os#&}-Z}et)vx^JttM(;L5yf3}PK(dy|_zew-?
z!X;N1I&Hky*w%nvoJgq}cSZ>cTg@J;zX}{FcS?-*h+OY_yd>Pp?;Ra=@B@Rp1iYQ?
z%A-{tsz8R+l%QTzg?&(OegCvPC%r_`ccNj!ggAX`OXAB>I54xPCX~<oL8KG%498AO
z))S$iArn>4PRuwp{=56OfcFWo9VnMMO~=chQaT*Ev#vWUq4~Cz?LU)v^`k?J-{nh>
zpm_%kTB$=XWwCvuG}djA;l85G5p(@L4_QL?1C0Oo@#{_^?M?j}2SUX`B(TnIlgL8o
zr0avxm``oYvzsF^v|-O}pH!c1NDwL64n@vMFUo@E$m|`NWltI4!7K9TS8=3-m&76%
z-mQLX3l;=HEm!WQ@S^b%vn^=Z{W8QhrF~$@*+k*IDr_?nmksu$H)=ofc2T0*9N^>>
zz5ep@jd}X}^I(a7W*$#Lc<0NNa=RKTlhfaj&n^|_<nov#RAiLTYx}?N@Q9uw*!A<}
zSs%gI^j5C!iVr?Yr(8^~=YH!UR<xhZIZ^YJ#bIb%g;sOyULo2;@Y%55?v3y(YC@vs
zN~;8~%N);|%$V$b=bNscp~1L&Q%mXC_EDoX!-WXAj5=(8F#U(+JoRn?7)CjBxLm!E
zwnLot2uqJcd2E@kN2G$=oYS$Fr*;&<g%V-Dw@r^IA?*Too<KbvGwLg~&m3w0jxwc|
z!WIb!BM@jeS&fRJQ;>?kBr%dwI{Pcizwr6;?gKBAOHXAVdhE3_>>6!h4MtHs$iu?o
z@C~2Y9!C_JJPX=qTg78f-82#?WCS<C*CLP-$P)n%wD%18BX*&?d=^p@9SCaQT_wb-
z1dJJcig9m)_z;FM5sI_@CHd8}XQyGK1p1lN<7&(fk(h>ygETNPH0-u|Y=Q_kw~q#?
zTYKzXy{FHs+fv?wU`sn25zFM|#^uc7r(5L;%^qsO2JJHi?tA`O>G>K*pUR`R?TR{Q
z>W3K@gFdt}T7H$xrdKrE<LUA)fYEBbWaJ%-p8DHa0kBwG*K+XB0{-D#X@xOedTc_#
z*n9mxVx2TC>aD|eXxCSBakM=7_oE_1afeurl*ZND*^9qq*N=~K6d#6I)9wBP0_+A#
zaGWti64OOd8?l|8#{KTulLkw+D>oy&dyu`;_h0{gh^G>NTXpRb`{yb0&;Nr2=&j7V
z9lm?3U)h20j#X-?lQr+nn3WHK?dfDhsdTr5Flpue=8S^yb$TH2?J6!H&+t|1htO7Q
z^*#D0++yZRDc7&iwGDCErTCdVw<`QbQvKn<jMYhaozn_M0Lx))8ZA~Ds7zBoDo4Jl
zQUUtGJfAK<_i%6_y>(Ca(H3HLU7Mll9^}(pa6g`&tNU{pXT)bAqq0kMy}*B{VB$r?
zb*+fTWM0uGU{v2KBD2X~Ni(>WE1u1opOor*$4zi@qUaMd1a<$|sAmR>&4PXQi7%_z
zPCX}&aWcl6Mkf=}{=;mw+RjnAniKWvId>hbP1Ma0@nkq^ulxgdmgg-K*YNw8;zIeP
zR9Wy9l2|^HM8^u23XflsKL%8o3|O7S@ouj(;sE>TH~afo@LZ11|HJ}{rY6~1NI0sU
zpTM{TF*g7h;Q!|rzzk?DeaE5wZQNJ!EhWeP&CNTKWCJ#!2}`XU+xbOFxGp3=-KM@u
zXKaDFg?TFmLcA);u#*gwXras(@Aodv)Ff`nV(OpNaPQt-wqK^Nrl5g0WU2;q#CQtd
zw<Y@TdFkEM1xqt9+?i#q#Oe^;G-(gjNVODbryA9|Oo#`~aULt`?3cXEUYHJx6|wlW
z%S7sohS_Bt@!%i2bo7~=WdsWvSgD5nbYtHu^tL&%#LW1sV8MCZx`W5JV^q9dqR*d3
zVG{DQOe&p?Q^nZdhWF}obU}nPhC>(RkU&>kGjtn!%V)!V<`QZbXWBN4+L$K4dCYnK
z>ulDmb7$^U;*@i0(E=O@A&eJR_WatZ(;cM25`&Hxlr{^|HvNh#Ov^Rf@uoiW?`4nH
z(CHx2U7t?a88u=}!!A!iHDRn;jHg!2^%H@rbNI!e@oyk_?&9jgPGfZX>YN_Ab8VDy
z)5U}kcYb8~+*$q**`QNdX>W=1&8Q90KiGh}e*I8yCV1MzfMJ?-gih`LtZo^E9~sqS
z+0WI8(<=bgKvR!%Hwj@!VW#&eAt#!$%Vk=P_`|kDys@?vRv4H}88k7v@8>sNEP~u>
zvs*0XSGbIh3`_hcr%z^ZrX@sjpT&i+tuZdB@3mf_^Ly8yy#<qwyA2dY6^9tkZWnvZ
z+oNu?pX~+>)-<oPpl-O)HE<FrAp}j?-FM(1_j*j4mx``3sPf?p+Dh)E+^MLhKGP|8
zYy7q>{_w<drOej$J{F_fP7A^dmC4=xvdP!FRqxk&H>u3@<CCHob_wTaKnICOjIpus
zBG4q&z5$%aJ~Jgpmet)?S=G=bn3ZoByA2JsVhbuPov_>)aBrP3TcZE32?KNwutERI
zT2265f?X7m?J4L-)he-%nr9`5sF(+|g6(`kx{SL1R|`Ovyz|+c?zcn(gu<-a`&^ka
zfKC67)N0GI&0B#MPiloFEw-$DezgE0eyd&(uxyoKlr=Q^WGw=DE=%WE^J#@1BAI6&
zC&M@_H>Cewy(|OwaWxhQVuOHN&)&8mYO=TC{GHFfJ|^<XtE3ivvSal?8&dfn9C-Ed
zj&5XA_&`E+J*flz;O0h%)q2xw!{^>q4}DhSwxjBFf7P^1=|b`tKDN+{071YfKq9yH
z-Ug=t*abU4qvy3t<6K+RWKn`EDF0qfSF%uj5PY|V0ZcuVi4hwSBE5K>Wx#85{dLE2
zOtA~d9CIJJx+?uH0uCgcP)>CXL%?<5LW_Aub&gtM1AkY5LWB}qdLTFF`{Gv#0SUTr
zpV`fFOVFOg%;}Zq^2e4@^1f0f(v$tbIhyuo9=GL`laaZ%X?g_NeBr9f2a-l#RiVp>
zFQU%WG$Oc5;c|j=G`T?!wD<hNY9<R|OO;WMZz@?Qf8>7~p&5<PL~z|+p}?MdD6lHz
zZexwlb~{!FM}OG8DW6WPNG12Uw!H4GDKJ`W;~H0xRs$PM2z1$~HW2TQ-y>x^zF~hJ
z#lI@?#^xjve#%?|Q*$jnZ`aG^)+G2?>|kWIAvrRefb4@{-YPk3$9UOhMVSl+BFV6W
zPlu7!p!qbD!C+?rwLP(Tv?Cv$1c8<N#ZbR~GtBg*$CC#1Pl?Hjb(0(K{zGkfJ)DWv
z4a#ieI^ti20#%PYLHe>raCu<oV!5JxHjhXL)CC@rt(N_my>Qu*D|)Wi&lMf{SwhLK
zYYR6f)*mK#DPg>Kb8_WL8Qf3jTE+v<k49bX9Ykc08Q^(OUUNUJBF0~(jRl-4l|V{E
zGJ3_<<1aM#Zk-L6_)^a7^}4_B#AT+;Tu(d=Q0Iy7`g&hT%!&o56tXadT)^{eu(>vg
zM(*8~wpUB8uoEvA2K*#*&<A3O=KH|F)|Fk?5^v~P?hV57Utn@daqQTmK0nm**hR}T
z&AJ@zw5g!>xKi_QA;+$?!Hg!yJ$XZ|gHT~avle)j27#I04wFD_*$-AUGezxk_(q-|
zcbkOpnPTepUQzpAnIWWODTI4}A~D80O=fJ^`##;3cEJn{xDS2wUR2TEj&T3J==Zmk
zSz{^tOL6lwOy;JL+xIC|RmJWe@gUi)(YCWma3el($1m?jC$xd6yWR4>;uD7jdn5U0
z*M9=?4Jr4H-#3`pLLq5^6BHfDpx}oemZ`2k(vPDg0g{<Dmkn67y||*kpWIULZee@I
zt42quMuT>4w4w=%YM%On_<7ju2xIF>Zk8YM(~QhSd9;_oq*Q&3S1~I!X8has0d2R6
z49!R68@y0;nUM@PbpO%J&s^Dn@hpIN3pl?g;NUvYZDU)%a5Hx={!d&Hn}))9=CJ<X
z7gS-pcSnPy7vovko@k6+r>4<J{o3rm3%#sNm4y&Za=IFRCHz|UeM#9zPkC<NtoXT{
zAYA$;Jd5<(osz`xx7{XPF#Uk1=?wksOhzGM9W&&jp9E-(7l9ninye-wf9na;jiUb#
zgyACz?GNEfqa?RKPq!_jk4sxwuj+aOZMAylu>XND&|tJ#;=Ed;Li&a8u&U&RyhAP6
zSotf9ER6PD3$Zu_ETYyBgvkGmFl?Ft2!qt=2IqMDzeXsTt!%UO(F+qQN(Xhze$T89
z1$hK_{F{)q!}CdtM-x~;uz9Q-mFqS5I63%fSX_9$am{b8sCbJ%6cd(72cXh>`<2ZK
z1|&yh_o!F`N#Bq?Zn}5+jK=!wRzTb5us?1dEMuBaC0;{?rE2cIr$v31@jom$Rxpp=
znEGb&-BBTH;YJSCCk4Aw+tA5R{@2L3#MaX;QtpI^2a_JH0;=cc!r|LBv)@(Ea^i>!
zA$=*k(J3LJ>UcHGGub2@c5&+Xd~v@#!&D@8JW5vnBIq9c#b{-By2FHsah!%8O8JR@
zL29A9k#w~`RaVBnTfzeX(FY-=Nvi~|iH1yFmr1Zbd8eiMd%S(>yddTU`$zus+gs%?
zwmR`Z{8m&NI!~`)^%zjV`4g`f<o~R#?oqQbvcLN<X}5w;b~A0Z<@J;sn<Dw0QOIzf
zOiMlJ%@CxJ$?ICo#$&`=Z-M)GPcm!4Ngksa+k-gpNnF-zeqLQ%o+_9M?6Wc14wI)O
zWAQ>WQ~Tnw9dqku$k>U&=k#HALkuO&&t7pCy%L0DA4FA*<t%8zBiAuSQZxGLiy-f%
z9fNUR_+bb<xX@&Y*$_7B7;5w2=Qo>eu`QFHs0aw+Y-#taDemf+_*uzklk+x-s?w<v
z(>T#^&+#CfA&MY_n88l7lz2{?e&~uBaVP9x=h}BXqCE7Z8^#Uns~@@%>!|vrq^kC>
z%YQgo)FLj%U^U(A*nRiZv>3;!)THGwQKu*Em>_%CptSSh`)+rAN%!tlpQuf3%}}?H
z$>TCR{z4eNzWHwl^j1m^BGj6=gO>A-gHs-rD*E)&Z(&@)c!w2zA0Sa(;bjAqVO5ek
zlL7Ue?!v2v7b$=d?Al@NGZ*TQi8IHQA^4Er#`7`NK;rJgvY2hBH&y+5QW;KISH6HF
zsvCEV)Q5C{GRI&b5I4GQ##hF$Rp>D_EkEV$G;=vTTEF6I=Fh53)(RhI>wcqgV4)<|
zZ?Yqda?#FOt7IjD@}|@TdixYiE(_C|(xOuK3Rg1T;YWTt<cc1pl|DlNl;JQbXzzkf
zP;LnKnx2x|@rq2GMjY-HA(Y;4zE0^I3iQ9~R`~FDf`|iIai89c<XEvE0r>)1!q#l@
zg#{Z+8%(Vq`a^(J{a4sO9g)O+_}OR!BcOytXiDh$pt}v~fO?=AHy7@(dl7i`^sIkO
zgxvB>^+Bl2{bE!glEjd%sAl%oU|iu={*v_K$4+N~av8I`;JG&nS|1N2?3VM+zN_8Y
z=m2#C5lJbor)&C7vzcwe%kKuV*7!Q=X!>REVjHM7=-IQ}=uKr<EWP)dvkEu#Z>%Ri
zhZY@S6-ETc-8Zq=YsZXR5)UQ(k$Ud2%2tO&O^SV2;G5KCbnU_3t8?*f8P;PyB>DQX
zi)A0<VgFQ-*=bz@3b8W`bz54`@-;}CQgL$v|M=Z`FI#WTsbihP@gv^Ryg>~ao?M*b
zOQUf_>&i~kV~n6}uvA=DuL-Czy|?w=HF7~Fdq?xDo+mlNzBp?1&eIdQC`tU2{i8=I
zJ7q4}PYhQ6Vr$3kqO!5=f446<6^8kCeeL$Wz)<!(N0Z1AOXulBpfAfeRs?7<B6JJk
z8}R9PZrR5A&9G8vc=7)6BEUtMcAEm}@lSicZE5aCL({Kk8wnmOa@6}6Gy9fuyH?g~
zA&zN_#HrY0p`F9GV<yBo<J^rSr98_X;@k`&8tc1`Z3gng6w$V!KwGID6yz7UF5_;%
zhnQA6XX56He0GHvlFD4;%pXdHI=W@<vq}N_Wj3$<ye001aui_g)r2Pp-03Ojyc4xa
z>Uua8Dd}o-{5#Pv^4HzsT@q?9Nj73$dzV}Ni4D5pdUf4kLq;)&nQ^$fo66Ogfb+TA
zKCOJdrZJN%qp&Udy){4u{yyT*e|L!8@m6UEDzfkHsS2x22rfM?(r|@4G9h~HyzBhb
zl%+z~<Y2<5ocF+wGyPFYj$Xj@nX;Uwx#yu7JlK$k(`tj+X&)N>JU4X&p8?IVWV7eK
zN7=_$D7S;hq>CL+x{KeZpKPwQpTliFjJ=tEWcK&gIsCUFp~ZN&PgP#eH1;gS=eF<d
z{dh}R=2_PUW=sijoze?9p4BgqofAIECB4p2FU8cj_YTX&IT**cs3kD!87bZoYQ&g4
zka6}(xjSWoOqNT07f8OVEmJWAI)GV*btKRvP8oZV<NwJK0d%7PO~$sW^w;{@Gmqr%
z7t|U!Jh-C7&CC{1w^(Z86kDK4qp@+v@YC-LU@(wKQzG46ma+(JiZ@*%i;pDSBG_rw
zpo6TgB%==`oRd_62KJ*po9I~RtDTKwqe=fQK9b0`OpD|^lM6w?D%k3>!6)+glUu98
z&C+u2<!?*Dcar94@>B*7T~J>{=Q9*OUIaC7SzdO0@%l*Tf_cv7x->eP#S=l7uE(rY
z{^X<7jc1wnxk-597w>a?rCohOI-ejcBFYm&in9IgbW1YB;bq}JnmXehKh1D)C}UYP
z#3<8QptaiU>Ed$_?FLS@7nDq7i?3@|`$`=}#^nD;BfEwqbsulm4QkF0d!k}@aw!eI
zKP}n)-RoCDT9?J<n)_@20-GZRs^#w8JZR=Jw$qlVL9tCJ9-D@RF?Y`voh3*_!m(PI
z(HdAA>vCZNk|=U)?R}DatmN=}=bo<IzqY@RR`9Duk*?k2l9Iiuo1Eb<sRPE0$ksn_
zu4)`Q{fimFU)x(<p}nut7fngsTByn82b5p3tLIU^N3gH@{&jDs%3UTg15f1nM!Y8l
zK{94DseTB&n)%B&wg9jFPkD{E*hSgc3IIfW!`x0fO?0*@C3HW|&O1%L`z_n#75A@w
z>|)+5N7b2_$#K)29m_5PR#Cca{l<#qw9VWse8VnVlXDL0tc%*@7N%2@NlLB1(kJ(z
zPhRcIi$4@Q9v30~%t7jjSY@7Mpm18XXDlrBUnOP3($Dv+t$sbl5_9GZ{VqlhCqRPa
z>3g93wxI?q_ZL)*y)tdUrGf9`HMYH@`9t~4pusJ&z%pK~yxZfWlrE<Qzc3@K?a)!j
z!WF|O5v}|L^6LE3P>JUTtnLm3Azq*E`ppl5*%iMq<+B^U)J>T5!y$n;L5`?76;y;N
zblEuzHWgqp_5hLNotiiNigY@bR}1Godth>QVp?yfCgsyTT#{9&OQ~Dnm7=YfEYMqa
z=O{r(#BI3GHqj9!7^#<~P?^m(k@7(9eE<CP$G$zh#B<B^Y4i-pRH<R5#LUz5&FmQ|
z`{^w^=OFL7%qS0+4aScvRrR<ZpmtX~oRY`n<ZLm~ZgMNQSISt>y{22G(fjbl)H!F=
zb?CVYHuud55csS=DuRXWApi92eqlgWOsxdMjz;a9D(!atfq?J1w27I0XVlC0E8Mzn
z|LI+ZDuA1Z|LvsjlD$;KGORkxd=+Ik(k2=|=B3yVE6L^$9b|%H0((24k?$H73s_va
ztx{A<R@)@;`~c-U-sF1M7_#vLCj}Jp?TDMHh+^l~=LvjoisDh9sm<JnSG*Dkk5{uP
z(6LjM0$w*Nw(2FESv|E(T(PPJH5MDx1cwFa(NPzS;xGH(-|!7!I}1{rwQM`#_l(q-
zvaD)Yz^)9pH@y69w+@|7-{|av!dq3UJ^!l(d|gSaaSLY4Q=q4k{o4Iwd_QxZ<<0x&
z)PGe9DTK_VL`Fj<|9V9XJ*4^~e_m?0*PMC0o$~m~x*%yKq0y6#&GvqOUA%br67#TO
zN1EB2;T~DAL;jKhz+&`m_9n0ll>Cbf8Gi%qIxMU=*Zw<zfOhm}YpqJb&&r3=c7p@*
z-B4N;!DFojz7p+fR+`qYz|XkqZ*ib8zQA@P*DSv4M_Th<0o#wI>!}!MXhmwaN77$o
zC;OqGnMVK((4e|yz$_^bp)-z09jkyqK-8dF8Vb&^i9Y{ck39AU1Jwl4dG}WNJ=sPD
zkdcv{qnw!IrGyoOJIXM4S<X5G>b{WtEYP}64g9tLt95-j$o^mH`e^rkQ>q?HVkqA)
zIYp(~*dY^7#fWtlH_yxHt_!j%xE7!mqpl8p#Z_IAuG?1WditN*b^o(U$rGQM1Skn4
z7$kU1SDP4V;+?cV6E|_^e8|`*{Itl>Cgr%<Vf6Qlb9SRwZ0vRGJ21{AU<)i)n0?BO
z0J#pE68~{8GOR;}=#<kV!(JU9G$H&C%Jvgcs08t0tOz&}4p3eAy+E<8zO7!fg*ZxC
zlb|Y8A3X+_fDD;*i)<1!t)6)0h`FIyG5%Nz2(7hJM24w6^Z<@l2uQnk<x}X7@uO=j
zZ~sq!x_pqnWS->che8+=uktGzW#G}kLAUrmvejQ(r!h>zhxh#kZWB%9k1n{eFq(eg
zBYW}@J(29(@fq&b*u2{&(eP$^97qYi<xu^k<INk|0lxls_}kEDNW-aE7;)Ad80xhe
zhfyafpY>KmmBTkLx8A#E*6N3tiBgUHWq4+TTIbsxHa%G~{A$adAkjicFVBbr5j#{J
zvQuVgQN%9{oz9&-qr~A2$D*AYo|*k`)ol+o-+!Gs(E7lP&g<FWHd%j(lYk$<z8>VV
z?LWH^2zd@g1X9hzPy|+3l#R(b*<s)y^TXbQ?49#DGRHzVf_&!OkGiGs7j;qKf7aR_
zAVNO_y6Kb#V9I$<|96Pq69~~uD$X^g0tqq&0KQOAiVX(0(Hj2J>K9iZ2g*Sm#7Of6
zH7?|!8=pCN-f}T@J*6FMqgUd!<5*lXdZ6oem-KBs>0ieIPlZ!TCCwzBY>Tja)a}`?
z`QLzt^xI@#7>JsI+gmhS#UN0xZ8?$)gJI|7Mk?8`=<j#v?%96dmX#BL&jX8o0?`a3
zg-5Ff5omD$9^3+MnfyQi_H|cnOZz>1?=Yy3_s0FHAO$7yD+*d!XK(kFIfQ_9EUXAu
zU<b61qv?<46#qI-P-dMOb<ID^LT3w0Exe!fwBUSirt(V;{7by(B8M!;FCXJ*a#0>W
zT=e!qpZ>Dt;v?C<@Q1O=fvg5MsGrM-&=zC?#dKXmP9G+&{vl8ZRajUmas2Ye7ix0K
z2J6Zlvv7Rcxri88s5TR%u2XX10}8I%uqa2~dmA6FA`p=5fI3isdynPfq-o!oebSJA
zFu+5S^Xh&4r2*_x0GZnG=K!E%mz9?AGI=E^?bOZR*BBF|oG^r?@Dv<P!{nId$?Reo
z+Ai8sH8&FEyrTi=CHMM6B&ibuWB}z1H1gUj=X~5tChiEJZ46cjiR;%ZuQe%6y_MlW
z2a}G)!~vP-{}j;4vegQ&(Mw-byp#h0y40UIULN3~DMq+lGA}3PxD?CL*DYS$A<x!$
zpN;7r40CzRH+|LQ+qw;*Z$V-qNKC@{d@)vM4cwnHMYc%nfz>mQt&8^_g9;zd-_M4f
zbdv5BINv-SGT-0^3am{drSTavUNb|m%i#;&>Bqnw{$Cyg@{h*|!1l08s!?D%dwhuJ
zH9tI7Rx=-}OSo}FJOK8AN2{>TVeF3fR9=cd((Adb3@G+q=FH+N#~wWtZY_^8Y9Y}v
z*L*sBbX@|}Z?>I{7|U9#<;~&|u;4fJG;#u(dQI?IFBy7_H{d3Rg~)~O1tM`Dbbb?C
zyW_7#Nvu#eWt!b9I%lnJI1<=(riNWI*-g!zlhT4+W;_2Lgt2q4r6f*D_^`?^#mTP?
zF}=!#k(_6cfrSBHROI7KwCk*GhRLqN32m<KNR6G^Q&mHeP~KTFfhy!YrTuTmLZ2Rb
z)a67Vvhb+)&6hmq&diw=H)pl&T-*wjxUv9&EtMHA34%SDm!9mbL>(Bfe35;sh+_v%
zalu5LkHV9-`Ok^71VbOpC{(QYz<4$=Wp)wo;J;x+2Wi-sSWrKQg92xjTOu*jJD$|r
z4vF}Mrmy4^laZad0p4KvJ`X&+8nA6WW)4g}o-Yyw&x-;kXHVok(BLzSri#3leT(tN
zB<d=*u03rRrwXP(d+mc3TG24+bZj{Hyjm3W3Y)`DT}%7olAv=^tLyCUPt+gdoufvN
zP{NfLtzQGH7GyHXA7v^Y(r)Rn4=z7I!UssXePNo{y#>Muwq%7kR^Un<xe-d9o%Oit
zA-^vLfa+}k$`W$}DElD1HM5*0d2}P*byx@6k6ruM?#?r8Am^f~1+==#A`O(kfBRmR
zm(g#MtuE%`SSVk(M<J`OOk*75^_8hRST*&I2BC2P2&9|ApQ5fk1;+eV)<`8Wf$>?_
zBSP_~w3g#oSE`8cukWi*XtJZI3uJ+o4E!ln;<@QClhb6_PQddiZe+?LJy4Wae<-`k
z_}XXhK%tuXm<K5Xhz!v5;N|(6Q0q1gvA?4af+v>BnSF)KPDHY>pk?y)JnMSjeyu%b
z&vE9PE=Q5SenI=i^m28^x2Do=-zB_4pP9_I*veEa3Z5eI&hUwGU7NqQM>A-$e@B*3
zm$|(p0(^<9){NG=Ndui(=hy}`fm_EHi1&wD8K?s|a6?i1g0A~#Aj>uLq(`#JGXuOr
zfxmq*$-_lhEb%W*9D!v2R?q2wE8YG6UzP6TqyM|o{h;O4q?g)!{d8=jrQ(K$9K*u}
zB87mzS&sF@w!YaZ{jZt;J}vs&zt(UhAaA9sc^<&AD^tDnIr$U1?V#FYQ1;I);muZH
zyHc5@xi>Ae{raP$-aN1j3+d$ci`Snf`=CQ6zS;d=iF_==t0>>fW7VP3Y(i``dZVLy
z!>@L>aUnOuNQh59_#02+8pgtn#r`7TaM80}uY`H1HhVSRJ~DT@F#W-4d6r{Ww+W)h
z)G>u-OTza^NOubTNw2rw-%+kxr@HjWbQpv;0rJKBvF+vTz|cNrc)Sl<(Y2I0HNn?<
zUCT0sLx`HxK^SpI)WeHX@SPdg{F2eObo=91qdSsS9_d|LZ_mS5DJ3Wft<-+S@B9MG
z%qc7VVr=a-m03k|n42l8%;p`KDxys|T(5Eas`BcKV1O{HzT|a#68%s~S05l#^pd@q
z!2u7impFqLPu})f(;~c{S`UKV0>L^Dc01rTVBbwW;G|U(j5TfnMC3Y4JU{z^=#qfm
zvpXi0Xrg1sK08B!8m>#!?NRP^!VzZ?C5a6S?t2&Ky>Ylc1Ul)*<X>M+S?|bG!=X)4
zdl~??N!&mgyt`5X5=b84Oq$Q}0cug7CBL}kb)H5lQ+2BKI8p*kqA(Ge2buD?+;uIQ
zVk!Z3I$Y8Uuvv6v-MCoLDK%n))y^M+T$S=zBZpCH`JQF(icr^6Zx>69vw5KEFo|pj
zkBtt0nf_rXY=`ZZl1(u~PV8q()jiMp;mDg&-V1{ZvX^4as0Qn78x|mEqt{P>kR?6)
zaLPwTi*M-KrX|OSLKDVWnE%Ft9@vF$YU#MTjj-do5{;kPqC#|HjqNeTZ09+-3)u7B
zD2sx~9^W(~Uc&eWdMG6kl^a!~D!Yh8>|sq9AcO7W^r!{YTo@5%`uTkShv^sl+JVve
zz}bUoTn+r>;~9W*2M3)EP4C%*cbwZ>EykSxAFlp7tm*fC<HuE0L<OWf6qRNmokJ-B
zDFJDw0+P}lLj>uP?vVltOu9p)YmyTfAR|UMi~(ccC$G=%{X4$L_a6@qW5e;h@B6y1
z^SmBs;F9?ML@`+UWMh^oQdbPP4!oe#ejB{TF;kGEdPrIIC=(cbn0C{5$`LkpqtS9(
ziP4^?fSs!Hyoey}AI^Fu?c+b;D1Q<VNmSKOMw(#$oN+XsG}Y}%M{uG1SbP#$|MmDp
zsjFhS0L#O$n)u;n^b<qO<L6?}e^Yoxd>|*ZF`r%U_TXV-w3t^~klTrGS!w`^jz<8(
zF)P3{^*;;6myzpzXx*$cWaDdMT!j_j+lhPp>CBOKZAA2|9}#<gx{Xr45A}|D%6IZO
z_Sc>-ZrStPtDsX~l0#DFxI{+FycY(YKhx9u!4dPF^wH*1J5qqy_jfl;wPvhmPB1^r
z=YABe#*NCm7IqZ%!}6dfA)%>HLk}31&<+k&UlRF88Y$HTA0z;V&t7HhPdzq(^IiXu
z?|*RnUkxNSPXMEX#M*alkN+7Rf<GI+Yk2=vwS;8y`F#ov5lxOfil{Vgs<GVX9C`Y{
z$fZ6NYf_PhZfOWDB6L>b-&>_$aXA#mB03i`6pX*2`2_)2ARsEdhveqD=fP%)4~A5I
zeT;eGNBG@VDFGIRc8@5IrstOt_gAxDOHE@MOur*e8Ah*CBY4Z8tB;p<e#rd?dAyqD
z2|D@1VVK3vozKuG>$CDvMbugNI#JQhgyO?UlZQR~Y0E(R2K((+O|^v%)#)dN+R)cr
z55L%>R)|l^FQcuyud@f=dJ&B3qJZAOgxZC?19!E3Qope%wC2<_qw;|N!2Sz#DTcl~
z*k*b_`qpvc(R!HwhSrXF3rlV2@Sog;H{Z6q%znQPC^Pwnsyj>ofcF?@1mHS>Yj2Ur
zgzf{DDjVM0`&N+9aK!2Wq%|}hV|`nQY-lp9f>%TyZ(G#x^K|EG%c=*E2%B2FMJ@?d
zuumfS@AeOs%1)94qO?W{kD?y`K?68o&?2WVox*}f$%o=N<>80*w!qkok>EVe4eUPs
zqFba$>vSTJnw4qvi35zHG{%=O6ZwsAb<9;vU^bk1bozs!`OOuH7pb{1mf2NUE&y<<
z_8rsm_s7}D()z9Ty@kN*SM5Et4;}vL1uS}&8ZV1%d}<DyLugO%KF4Xa7D2>oT&RZF
zeg+tIYS~&52yULoaqdMIUp|sM7l!{VUC!7>@7&1AhqRqDkNd9LtvTKho?9^f;-R2e
z8^A4eP`pMc9`#*qT5*%x6t>b+nmlZ69<g0><9hyZzy*_%>Y4pe;;0S(hdi0Zt+l=U
z+2Q^P#JMZi+-2!cJ1?OF@OI8FtjwD%Tzh?<2HUrVg`UqHYI<K*2i_7V{M!9}RWWtr
z1VZW)$y6V?b6)+8SbMX>*}YR(phV6|h|1DE0HYM!_hj%lD~`V95|0011p&c3u$a5q
zJ7W#6+75Wz?i2P#`$_))nS%3yUBWr|mKYKOj)0?-IV#>|a6;o3dCkLn<u)GfgDQ5s
zXH6Dq!QK|Ay)$GFX**^H*rfu<EAVCu72~DRb@?QTz}<{#FFp*c+%uV_FL!>|phFjS
zM1O%s$Wj|z41nU?8e(DDU0mGFBPBdmU`fee$H2e#?st-*LedS?ddy?5lmCXbpMYAs
zYkl>-sG9ZwYm1CFlLu3flY(8_UQ?2WsTi&{_ChvQ3^4OXw0ckKe0kUAp*~sbND+4q
zxakTTv4RiG-k_Yebrh?!bzA^wz#>nfr;k$+)7)%>>bEwa;8p-gcP*g*CYx9Twq(3|
zwg!2fB+s1qF@smOiHCq~;@6dJ0v6f^yBaxYRe|yEcH>%G$J0Lod<364-BoK%Nb%{@
zA?e|ZCzq=J{+jfw!??@<ng#BD0OmlH+4%bC@5#R3{>y>0H|78NB=VK`xS))_ga7#?
zWWE=Rji1-M?fTJ!d&gPrQSWTjS{~~#?c3g}yl3_<A7)_h8Ul&!s#{2I_4f8Ku>QAG
z34os5WVVKP17f|aQ_C-0XmMg_cf@!@X<%q`UD3$fE0{y#Ht&9IqxBD7!A+|Xct=U)
z-(3@(9v*0RnAJakxCR8--9TGFdhhc=88_VL$F3qQTYG`w7II_0<-2YPd4JB$UAVi6
zR7{&C?!cvpjw&a#b>kL0Sn+j-7mQQAG+^>F`0=H;OFQr(YOJ{xw~ixsWqP0H$odj4
zTh7V~?2S<iSBM>gq2m9n5)-WuieXK*U|XtD88U;#Eg<<~y1;=W>x@|Dq$McKj9e@C
zBB&ZQt4)aHHSN~I_j@SJd^@Cd(Jya^Gn)ufJ_qhhVEVJetU|boFhp;QGvZC_Q{(eS
z0O=nUj%-~It;jqZJ~j~!zA+~I?;ZVKc;?<cU&_!E26F;AzX*XDn=@B;5#^J5ZrBYY
zLME?2**pih<#XvL<Ff!dsCeO-=7ufD|DpV6L$aY3k~Q!KKh;Qhp8tr+G<nC8hr>CE
znJ9QZ{!EtOi~z1+*`b`D<TgaGzq}7W#zQV1yqsj2;)XImPKgbl=qbUkJpP$Rbs4PR
z!f;)L;qULKtP*<``|K}yn&_T+e16Bt6qzlC2bstne2qg}6M8`o_nWuNoq~u_yE_di
zD-bVOzqS86bg9+42#+BgJvps~1l*82JV@2uIl&EC<D~>lQRN4v)VCAI1SLQI<zY~=
zl5!Wm9L`*Lk9mU|LL4!flNHeQPwy3O-zAM=W6i_<;ScGJNJ;X@@hn3Fx+<)fiT3iI
zMEk>|F*+IH%gOPgqn^QrlngtvkNJBXdUf#g40xy0<(ck&E3!4k%w#2)?NadSD)kR=
z>c`@xejWc8b)o@OABWT4sKlHb1dM1Hlu%5D2TkM<$~YIB7Vs>m{;d(#V1p=X0DT*^
z$_QO9VEgrP*B#`)#=+K8w-0MOjdC7!%ZY|JqYbV}bu_R(zxM3+9d6}>tIPH$t+PU{
zuHe9pordv`P`$0AbwB@8j=+ZpF9nnho}8ZoR|V~bcQC*a|JQ+dOzxNyDRn@{N$*)s
zT4W10ou1yh=8$?be_Gr*;lPzf%aw!E3gn`=-c#+0qz@M(s@mnuS50pux^Z{PQbGPI
zeAdP@*S%mSP9o_xlfjM0#GXp8yG3~8sP|=VDEAw-XnYtXy=u+SjQ4I2;u}TX!UD>P
zvYCN;I@W^V8ha{(>P5Kq8lo2N#Kanl467^FYQg7s9ZQy!KHL8<J78k-&Vx@lDcAP^
z{?9xv*VnGU?fH=4${ho~*W|%FW$!b-6O+FiGPI=6rKetJxDz*rm!qq?!@kvMM=DW7
zjt7$Ngw@_DJ_k6GIU^)B-sYbr=6(Yg4wna4Zi+QcwQtNq4*ZqB&Zs{EioI;{xpSwI
zt>44{Pig=+DPvGb8ZEmHkM3ZyEmruY$zO@Lp`v~`uNRYy-A=1jb<i<txCcjADE8Ka
zh_P_`Fm&1kkf#_;TWPZi5FswFh!Cr*{?d;#)>F}bl;Ko)x;((h*7#F9t3K74q(@*Q
ze<H_2s_zQ@AC8a;RoE*DYNFm^XYjw--q=gJDcV4%w|tV>KZ@FlOALEt8_Cnfo}cyu
z^V3vZ@Oscn;W@>%=VUjD=1u^n(#R+J6QWvCfMC5GIe2Y@yp!yTMaf3|j2z%WXfL?i
zfNyhp+@^DU`5#Ct)W*<1QkTH!rTfXjLmtoIx_+(i1Mw9c@hv;^S`{2;MbsnI@t*8z
zc!;b1Kl!PJZE3#?oPPfY7UeX-0Uc8XZb)ky-hIQ0-CtVq;A&^(k#qtvoiY9(G5T^D
zSD;B=wQJ(fqV=ev{y#JX5Fe268O`|&HbNs93F(^q{h8|ik`YR-pP93kQx(?_6lXC%
z$5V`3e{yn8Z&}O}z?EYQfSAp^+CH%XOc1q712rKm)b~j){E`we5@i|kD5I)Qf<nWs
z)rafBXcAhS_twlG^Ogh3+Sm;mwnr1zK>Z_75(CPxlWZc!dcg!!+zg^e)W%SToQ!>?
z40%zs+kEKO!imi%aXdD)Mzuti>6wAJGx2{r*cR~oL0vn`7ylbt&I^7hlKQrlVM_zq
z$%9MXaYoWFRZhmjw5QCiU-!nbjX&%hV7s`mz>dv@z0eXvT;`v;?Ma?|$G5_lhhV(h
zt(-{MaeAuL<*>(@EdL?o4|nz39y+j0XCSBi>ws0<t&b(k`hcHO=2BHF+3Nh_S!*S3
znN#L&>PIJsrqJruKXU50auZDf4{j7e&g)l9MIg&~`2k=<A4bbM@_I(GHB&(^UD{>t
zHlK+HQswL~L&6Ef(|r#U>bZ-C(V2U6(DnXmf^St3@hKq=>jpmm<Q?p-%R)SDj#eo-
z;+8r|0sHHku5Y&YY?K~I!!OKQ4$XEQVTp@X6ua#a@49P=mMoyn06t;>VpZdR{vuMV
z(o?V&#t|n>eg=f^Zd4ba-QPR|8g%F5IVfy>#CgR>P#}WW$!mzX00E4#><W42@t=xN
zYEWnZ4BPNYoK-Z#V7y8FY5HGkC)hRz0NNNi^~kVE#+QE&w~hh@qE`O2O+Z{;Xw<q;
z98-*<`UV{fX@|pwX%}wcag$)@n8Q}$HR60t2vzhZN^(aR*PZuO>Jb~GEYNib<JCBB
zdGymx{&y4mR&y>w=KmrMjNzHhm^oTD^jL2#nk=GH_~SPdnq(^?!1ysREBN`dlxXy`
zFAo76LpU8tGwrY(DEv`K#yh%usIQn!M%C}RiB}Dy;vy`(As>Z(U^=<vE0#A~D2tTL
z@nhKez}$|4_*5jnk2<`{i9WZ;`Hr~Sx8Ch6@Y$PGm-osHN&(G|QE33=B&WFRM-rC9
z-m8BhHIslDYPjwc8ZtB5v@l(_+N)XRA>c=wFt!S`XTI>8si>E45qELXL>b=^4JdTr
z&i4`7@nfEX4DgPWnDrvbkPKJ&7VFJ45*??k)YvxY!I|;qu1}ds7H0QWnMqH}LDT8k
zR)fO%+_(q%7rDcq=KE&a;!Iu}QX{iN0h~ZL$DgAo!9yT!!&YBNL-t1zuhH$wWQeAQ
zQHELUzc8h37d>zzB0ZqT^p(K2zBFKsGblW>`G^}ENk2C-K<X2Knug}AOwDw^Zug3U
z)sP?>w(k<G-zyj8{kL4*zn!C^i9;^NAQpc^$#+tRiVUa^^ykn7&Ud~0wpTU`la49Q
z&8PK_K~Pt~g@N0Ed@i>;!p#TlVzs<K`2fLlIh8u77i8Pg2gVo7SmB)pQ3ss;$@hAy
zjjiGyE&QOjf0@!;^ll3VNXF}Z{@zr)5sWM}Gxg({Uw>XThk~o_Rg8<CUmvTsAcP2C
z7QNX8ek${nL%Y{q!LcB7dMEF74O#i~yEh*+piR57Ep$A)Ovs<FhK=mKFN%{Gj}5&$
zCh}YP6$f>U-a0z>a(P)32tN4Ud2B(EN0J9*vRVI=>lJL5SnpK4mJ%B&{#w-mr%duV
z$>+<I_#muhW72yH4yjpf!OHH0Um=m@Dfg{ay4Wx63|gOEto|}iBn<_RXVUK&;4&Yu
zr;zum)vzh%xEGuPMyOxigvK^RB%$!((WUJ5l|*F`fx&R9$BQnX6`#2PHX`qQ#i}@Q
zuueABwAKg-p5S>9_~A9bRyJgB_mV&7Kpjj>z>sJ?N@$|8ai*mR9*z^E&$7I*rhwx<
zB0HRi*0rEBa8ZMK1CFL5An}&D4N!W(zO-#ij0V3EV02K!QL(>Tp<eBiHTo#37=-`H
zVYy>6F$!C8`Z@3%HzS=A5ozxj{Ux;G*(J;z%Aw)zc}6fg*#bh!W4+?-Z;Sn|KsD03
zCfi2p6V>Qka_6sTY!k6kFkP`?9=oahU(clR9?!|dX(_nTDL$zp`>V(;TOgK~4<MvI
z_$0?xAeW?mL$%t1&b{o`l0R*|*6S?GBa6dC86q#9=W6nReFNw~3_lD?GU$Bn{}(X#
zq*{o7C#Jq~a8&%i9UK95Ep*6KBkQ>^gY3?-1tf3t6%ym}|Bx8hd;lbdS6&2nSab$`
z9x3H80qjM%&b9C+g?I@eoa)+W;M+?}q1a)gn51R#KuPI4d-!ujirEE$h#qrx3O~Mw
zkrAz3T7178w_*%+BA)PMAVA7R0NLMl_Y#aauki9rpBDC89m-<!->jcMF2j`Dm$xF)
z-99WdT9<`oByG^+6g1R449UeQGX5w&S`JyVG)*TFCEd_A-yJXE&docuV&^=LgxvmK
z<EwXfB3Gay#{Nj>CU#i_Wpszj{^jIVvV(*2G}7&mYOo~5l@84BOMLSwu5s0BT~t)v
z)DG0Xl9nS$={WJ7U3G|ILZG8`uTLU)*pYXuK5Xz--*rLFi}Jg&C`&!8Lpey`NqOPZ
zofl#w1&udo%3@ROXanrY@vGkJ@S86_8X8cqhP~TzRY6VUpy2IBoDk_KFJpO5x~T2B
z40Y~qrG`Lj<{qs^wROz(9`h|PP0iR%Al$*?j}WcRc2C0ZhR>6{DR<w*9Sa^YPS~!j
zKbSpy?!kYvfR&L>hiy$TZ5DG)lc(<D%kn3C%?zSDg`b=`Vr1ei;s}2=-!4Ngp6T4{
z_{mzc`=sT9mg5>mX>gZwhJ)<wz~Y<B9Fs0m`{{rC;cq{BX6J0daKk%!NM;aTa<q}(
zJZ|6Hs9Wf0zxU8ooejLot2-(6U{=%;iKcb!lJ>u*YRS}FFufALdccda2DP)iv?gn|
zyBFnzo`CYf8<Ojk{`iGA4N9iFER&2j@)?s)W0YJrAG^tbZIyCyagD4gLf8c-<hTF%
z0#Z+Wa$H&i=<0{jTDc6;XI^JCcMbA=)rv*C$0Z*o{at{NEkh5AA3W(hMZf<_=xiys
z7lUn0ujC!uA59fL6B0JAB`q2sNIlw%j<KVi3sy{iUqB}h`)Xk56B*~y&$C@1TkjFO
zqzl)va-CaTjVD^hv+m8Gt_9)@x8I~E$y+Q--vsI^LP@Wz-RRvM!UZ_0ArjVoYuf*Y
z%j&?I%%;y0+-KOH&hok=bUd?rL7=)i2XxP!Qi@LF=%P)ZVL!mL+;Tb2gB8=R6LHw|
zZNB9wHRy5yg-3xdBHvUtpX+{tV3Q${_D(o4*R2}jppmJ~?)UCM0P6Jw@3T|_6UqnQ
z{<X{Dd?AoP?mf?jC!h9UnGlVbFKzRSCkmULTb=T5Vm+-m(rA8t+fF;qA&7CJb&~H%
zKC4^7ZX@{5%;m}MrB>G#W6tSmTnC5TR<Q7!UmJJh%<dF~ILD^8sUQzz-BX)U43LvA
zTB38@;DaSF3vPS4Au5+r()6F1%?!XjQk>B0;5cO0+Sf=@hBA7D%driUEz6NBl`qx1
zt;Dua)r{oxX1e%oozy0^V^T<v@7=TbQ@6T{^ssj0PxIS8@rEHet&jOHiJF=9DiDy1
zBt!estZuESdF36B!<|*B8~nvs$O!MQYhl8Vdfz{wCl!8@Y3(-0$B{6~fcbQU-+-GC
zHit@jd-|;C<bW5*osn~EBAbY=epbsiba)?$Te5F}gML&vxu#DPt=BmlRn1D&#T}`N
zh=GTz*n0Hyj-&0nn&WKmKV$hU7n}!7h~Qn1UL2sZ0)-vzQsHDp*iD}y%a_p(O>)09
z<IIDt%s`tZ@wN8c^KUq8pu<a@Cj%UMuE%oiFU=3Dvae+aq}89Q>ZJOc$Zhh?hq~|&
z6P$Olx$Ia1+2IY>l|%VkjxdU_LBYWNrJr+BWK+<tEaO*-0Rsv}&x@xomMg<kVL~q~
zwAXHLsB0YiwM(-4KDkrVjNzEzDX$K>bT?f;dSZraI$`{KSQQ81@N3uIzzg>YE&$)P
z(3&u7&oRnxAYj(~jJ5d0!l%3OjoQ>;W1yywI^`Vm27X3yLV9kqluD<a9cvIlHgo>w
z+3`@Z>Xhw?qyXpf^Pw(?^6~abiP2>z1zdE6E~ux@8eysXnqSq2&P_=X0Kq}lsj?-J
z!mCAr>hdg~G|M57{oqk+uJxs(2mXDcSSZqSe@zPUhj{d7s;*}6ju)KReZhT0u2&sa
z;x%eK9koA@xMrHNzOZ~CYtaf;rCAf!!QVR^(Cw>>MVtJ=G@8e4xwRbi7EC?sBX5;n
zYYJ%7Xx=T#YxT~b*LT46v>Xlo9G42+?<QA<D^<mgqkOzvb^~o7UCH7XcWW;xK=>yQ
zmlDmg>oQ*ZM^7O5eFAg?8Fx%mG$D%01c&#06~yK|iVH6$GW&`Zte94Kp_(`IG}l_4
zZA5Hsdah&L`$T)IXmbQ|ho*~++=dl=m=l&Hs$4Kh@vDPV5w&1hA{k}>19~Jgajktt
z8zbcS2y~ml=qGEv>(NQtG4tZWA#oewyqoZy)Gvb|?omOqED`s2mY!Ae1@1vP=4vN+
zQSH>Q#NxDz`8&+NWWc{5>0G4t<N2lj(kz8><`+`gdS*o6HWC)K3BlWK*=ynca{dDX
zp5jXEA@E)Lt938ie$4MwdcJp0c8(W}6DIHnr2S+q_W$@-7WWx}e}%gAtp5UfUUX+7
zm#ki%bi?pGq9ij^9zuiwkn_LWJjG>`&JI8q2Ckf3)?a`rOOdRlqFo9*y+?Q12o!Oh
z`1vK6o!A25jDRz_SUe<%Fuzo}zU)#W-|&?ISeW$b#JDJ@e366kJ4hh^P=1XZkW@-;
zQ5N1z_-K=DRXW#}a)3oWTTEO02`}7=YJC5aC;INgYo7~0F>xu46NxUwb{LZLtvp`2
zSJ)0PJ)qH)LY8xBcG^f+F3I*bT_KOj0pD)%QTyw@0SG+4#sZP;)K`3hK3QLuSq-1!
zhD6YainDem&+iy}eL6{BlS!$95!HV2kj223iomQ49wp^gEI>}fhT_@vT<QOE8fxVh
zWw@RC^>_|x!FLzy(tFQ8^RP4OWD&cmIIGAce<f;Ojn}qYGX9w}Dy-Syk;*>)y&FVi
z_WQ;5xCBUhNnV7dd&n&m;&k-}cS-a|uSNf1R7;fokTIqil<~x_Gi|z%f$2uxaqB>u
zS-cx1h?VhSHcXqtlsqk8B!uy+r-)3F0rRy-##fJ8bb?SxjW)|~U*H{DcRg4%BAp&l
zNUgqB&52fsDf9PDOxJc)qs&u2IrA@<A>Vxp&=uFUf_O?{BrUKcbS6Lq7~~zX&O!&o
zOLB^D%R6z1wkyWIlhszwQ)UgnW}LHqC;IqP<86=6+PX3_RGN~gLh*lHFO^00%%1_D
zwfn8Hf`Q;OPCkLhK=+D0Pf=pfib!4z{9k^d?{sg_Je}iKV`&H_)~&$a@OvyKB>*K?
zOxaE%H>B?$&D;7AW?l+TF))4jY&SA!D+5Z-*?YPC!W{agoOK#q&py#NFL2j2G4;}W
zVm`S(ZUIsIp!pt`>2oT@C>dZy55`05UE`g&LG7YaVarKbk3(@U_e*W?mmyS=H6HA7
zi!=s?l95jNV53PSQUO$<ckcSLU;(qXsex1bARD1jQ*kfNncuw-(!-K~8-o<6|FUV-
zQ8W{lv^SkC(j#9P{hLs}6os(Z2^cLY8peFp!3#DMx!<^5{&#L)j?+T*K#4a=7p7I+
zW7bg?Q5t!x&%!ov!y5W*erJ34o0S!-#<M6|o8dI+AGH<lnfLZ~ary@3&IGKl7O&?3
z_;Tr<6~aHG#82Q4k4zI3J?0|N_B(UoVpU1CVoITdiSsxLM&vZ{J=7<Pd=wMU?7IrT
zR*pbbcU7#D*Atet>WN=!ig6(4(X`vU&BGE|^7!X$dzaoFc<h2O(5q+<VRCF(yh(E%
zY~we?!S;Q8$o<d@(K08L0$@lqPS;_CZg-TB+{PmLuVE)>b;-I!)Ep?9KWH(Ca1oH@
zT70o~6xdn<U)1RsMe%BX^SB5}Z4=ad{||EZ|2u8EPC*VeGVN(in)?sGHAZC{Lj0*#
z#!tRN=`iL75Eb6&3rt7J=dyZ!!bDrvCUug*rFpaN`Q!S<3FwU+?)<d6Z^>OXdC?o@
zX%5Eu;Z4wAs?tgm$P;w2A|YW46KrSF6q;iq)ldYo+<XkcEgTij9UXa<C3B~Gqe?(4
zKFZ<#+Dxt(E~uJbddr85`-f+b>-NW(X1D8Oua?ylyT+!`{QBpN{AvMRMY8d{!M<#q
z`A`XicwcIAz0eN&gf6|{Cj3E5a7e4S-GM##g(d0z;3Lj|BhSj{Ont)Akcf;D0sH*a
zuQSVH%)Klt4$0QwdTR)x(m>6XrjZp6&@BYE%_@PXuvii9o(3THpiI7V3IY3r9a7>*
zL}Rbep_KpbOhOex0M0Kkc7iwcT+xqvq9R0bTz+*{2Wru;0zCw{8`D*d3y=DJ;f4Y;
z{e^G!I`^Kqn6+p^Zew>VDs+znrdEOK4d-VFr1Rd^$ZX4W|8?XRgn53nlInIIUSa~1
zqBvG)KvU=4*Z}B-H(MzsRWqU8;yPYo;yhaCyY*W5)Pn<QmY#GTvkDX5xByeK4L$v-
zf{pbpnIFgWQN(0h3Kci2B;<;`9k_2poU~|XRyHm^_idI4)%Q%95140ggYYICXBvBp
zO;HdMca12d1z*s7`VSoSxWVpacjozrPhgVO^Z+Wn*_f~J5>PP&{cZb}>(TUL5^@+Z
zhy95kfIc(#&<uBhtH@<XICJm%(-IMK4056@pyca^)C-E8$K}{`uO^|B{i8!i52t?E
zzAFEm<xJ`lcDnd-wgFNtOn!XW8AG{16LA87Nl&?T$XoQ%{!lfP-#B9<t}AFv<U&Y6
za|Ul&I)xRVdrMeBwS@NTZw&~?8O|HCrhZD)^j=Rbpn9MXSb3d%N`kgFoL!!vi{3W$
z<a6|D9M9fcj`Pc}zQMoCy+4m_;ykG}XdQs@Ju)>2Zd#4Ek$tq0k!fM89yoR<Uir4U
z-*BzrnEBaQ>X-HagIri;@MBa0$LZZWnO_T6i<fw#4?PkuY)+!kKg^FAFAm^%+LPK|
zxibo1iDg3a!^}-)vFa&<>aGK=(1`39FwR2m?)l81`TpID)j-0WvqiMcsO<Z9et#8M
zqci7@zESL&(tU;CjxlH&cnj2NMMd^P;kUKn;N8P}@6_LV!_F5FrJe)u%bq~CS&z6F
zYGP+(*9<I|DuOr?Na{e#olgXIs`3Qi6$4TnQp3KJRlyB_Mat1`9_UihsmYnEO^MTr
zx*7D`{PQm#J9pB4L6B`v8KzOmL-n)6jRLdi1S&VHP&L)0%unrXnRF?wr`(m9Kwn(#
z@v(x(kENDnPt9*RSqiWiO^c5Uh!sXmh6js%=|zqS7uyoUEkoorQQ~-eBEjDZAQScp
z5w9VohN`#pyNybv3gq?d8O$NBZw#ojK%qSr!*4XbH&z&YAK|F4e&!YeVgn`@&nPBX
zMZ5#4KOmz^K~NE%_=GLJ*LG@o&4OuyO}AZ4?jLERZ%v`RpKDS&=R9pubmx!SWCGfD
zM~4zI5?5!+^=y@x9&~C@xN><1m2bSmFYWH1g94e&7Za5uJo#;LVfS*mhV$*O-DV!;
z(%8(*is!!l@L!OmcZieH3yt72K2ZCheEEk~G9)jQVGa5FUAE*rP#4IF+;Ugh)2y76
z5`g#(8}LJrTix3;wi2QS1ILIrkC(R0RCI^y-JTsUUtL{oHutg~ZRn)t0pShn&VrmT
zrTWd2e)qvoe}$KYz40Ovsw9`-o~6}P13mmwmH2{$8})C#N1pr>3PFOu*M3Atv<`HM
zE)TTt-2k9id7cp^b{$PQ3m3P2S$~kkzDo?$Zdcz{bwTj^`TVeeM1WZy8Dh}^XGf63
z!tG%<(>vMYH$*KWY?k?<P}AY5!P=t}bOdYOUm8@)NSCDf8IenXMz2e_mq?yTXkUsa
zcY@ftlDB2WStsykOFH&!%f-mHu*92rv<){@wOy8z6<z_P>@m7k&e}UQr`(#`7W3<(
zl30jKok>D*tG5baq&<?pWIle@I>!L@%(S1MweC#yZLt$G(;a??67W4QQo4vq8`<VY
z<_W(*3i!Y;(%$`6Ghd&y;=}mOCV_1^u9bZweO8No-M3{9+QpbbTBFNBXCqBNS#%!T
z=Sej%%8nq{`|c7=_sgplDQo(nxCPh4v_FGvQ&wS}BoZyz%(2;|oKClJ7;0#7jAYI_
zuSJ>*duG2wngz<56VAj#^bx)ISEjxHTEcNLRTAw&+jq{nfn@uvDc*p*H@UUX0jj@z
zHdf6`>wmp~Y-I5D9-aFQ+wFUU?UCXw>oH`1xwU-JOEoIZM>t+sZAGF?dZQW*#m2>i
zsI8e|D@9{uN#I&A+f4$9pau>D<Eq>LrfO$3c^At>-g$(Y9zP8a3wXIT_)u<1u_(bO
z$2xmH=fXPhGL@#bd0{F0l4PfV_?Hpq(l?)>>~2F~4&X@FAA$82M;(3tQI?Yo%$OH7
zEZ&}bzTMeqE`ivS;F1<OkN3;&7fm!PAR9d&-%2uVH0@2l*SaH`+Uor;8LeNRN2V}1
z$rB}BCOS|uKcXf^aXjw)<Tb9$45-PNQu`+APpxw84O=vqTD&tG5l51A@Rq}uW(pqs
z)0;t1Th%g;WIXd4Bs$aw<GmhZo;vE%13Vr+N9Kp7&k#^^j2@85a6BT*>Cs~aj^CWL
z(6dOXZ?SJ~*VK2rm&&sf)WLjmc)%O2WOb=`d_43~$WC7<=D9#vuKIm^6kDu7Su%YM
z*8=CrET;0E1KoJKyoRu(-TfT;C0g^ddcLC<t@)%!MlZ#VKDN6kD>Sbb$e1)(OyMkH
zOL=U6!&)k|*7LvllXr4p|1qY_1Y=UTv5e&q^&dz#xOv%8Q+L;lfC#T#t<&CsZi%6_
zQEzHnZyM><ZLnC8zdT_0&a0Z(chDb0UU^;;HHiHb<BANWxOW}3q1xT-_#o6f+AorZ
zsXg^U#WSDZSY;}mG_c9kXC)bAUynT?KdLBK`fi`yDhK%u{0F5uM_N--p(MV6>&WuJ
zP$8`7OT}?eZ7KxdoFB>kPAW@0Y;#1E`>E4hU73xQCd3<)Hq4rlAYy&NP27(mI$zCi
zC)cr!yb)(_hpWQOaW}B8VZ3b@KchFPYj5=y1-jUqdL^d9MyGh=W<Gh&!7YG&!Tadk
z-{q%{6Gxmzg1MG3h!3B53vQcR;qsOgD&D->DbTQBOQ{25-S{Xoupt{EpL`GX+i9Yf
z`Al?2i$^J2R%VB$JC(q<TQ&0je1dS(ROOrc#MKM8sbuGEK(Y*2&BpucVfMdx08F+I
z#*5d4braKo@V5aoVT~V;u#HX89p+t@TaKJs8Wb0(r!N&P#7@}zn`5j_N(r9--H;2F
z34HE%HiA+qb+IWq3L6g#pN8mIu;(&ZbZKj?v1t_*S4$ePH)dMA2bwXU>o0lYFcO8_
zQ$S{JrDbRTDss!x)jZrn$BlH1LvL7uv(CcBZ}~UaJ)2x;@T+ry2;J}Ix#JPdp9UA)
z93_m4DI8rC<=*kP6mW4aMgB<B>aC#EsFvj?AmKHf`>IO|4KH~@@&QR_+n8nTYW&Cx
z+tF2JvQ_nlfRuX^Z-_=kHb`~q<JVsj3<B|l5J%)*tP{br0W-HiGJcAtkzRRg#3=CZ
z67o)N4blR+mlj6X^3Unt#n;!tO%mml?{!T2&t(bg0S}$&KD1z;m)O3iezkR9Gj`vJ
zfL-9W@xm52_qi}P_Gf?DI=))gEvvNk9Ra(C6>kucY+~(4Rv@DOy@ymqe+SgtnUXD%
ztff<F(^Z6V_V+b^KK%4YtHIqOV46vD8~u1OP%!0FdSC}|N`DURJ&3d~dCz_h95b1w
zY90gGD(t!J9%45Yr}7Ur8;^C#zWf>>O?v->l`C*eu0u}q8=H?*w4P9dj2nrGcZo>J
zU@=xYx;fNJ7<!A#Nv*hWgF~)1(`yUg%e)`ZR1d<$R_e(i_`CBy2y`&ozG;8U8aw|(
zSg#E@SIvE=-sRNOz8CO(S}}BUE%4QZUUo^-Kf^%H9ktC1=O}c>9nnWIpC}y1ek@(v
z2_VH|Bsi>NPY~(KFJh{y^4R|_W)(EN*Lxv0n5<AklSP}C;@8REj-l-wwun^egVU85
znLKKm1hyK>uH%z`sAUHzAmZO<*U`1RT??c=5XF~piv}CBKm2z6<wTO?;MY>Dtg8K$
zuumE=P5xqq5yy%Adtm>xxu=}j&YW2Ov7K^>OJ`+TaQGV>a0x~PRff>lQ0GaRV&1xc
zQj}ei{aO-5RjFckSCr!TkLoS0(5ymz?oZCZ?ehAK;M1U-*<&c4qcjcJCdOb?(&Ysf
z?Xea6OWICpap*+#BG^OMotAT-vxF~~M!`~WbY=-l^p?70y3Zi&RfW*O*9;@U;5wt#
zt$RmlT}~MJb*dmmv70F_?D$VzwleX)9e3&tVNYMg&~GeyK9?;Oy?+otE1B-=dRwRf
zL?{gi_M^BqeQ<3r`snW}5Roho(iIr&Yx_l9`Khe=mfdgv{DL&J!40!<^f5ym9br}I
z3Yf60eDN*uq(}yzD~`@{e#)b@W>CE75Xf<lpDo>|KXh1A3`$Zm_jzk`cz+Dr5ZMrQ
zI8gnW@`fP^eTgc&<Z4m-1F2%A<418A$`R++_VG#CrhS8O!2>UzX|w_?%W|Bp2hXkY
z%tF<o8^(%{_}-So>N|@30oOgLSV#OaSlg5WY$DKY$a=^}EUM~rCVn6X1q=)2NpS9T
zmT~&Z^31(4_bqraDXQC|Y~@K#=}Wp%yf{*3xseV(RsAz7_p;`8d6(=)ucFlP!`%<w
zS;_AQ=G}<XMDK@jL+bv7zxE$ow!3@(<B;s3@yFD6I)TMr{(dd9&2uJgv7UuGBF|z+
z%MeZw`;(<HExp!_$x9#%VGxs{Zt2G=3kzlYX6kl4sh;q!8|0&UDmjwKI-HBSH0nKL
zDtdOeuzvWpC*tG!?K&UFsKac^?7`PQvLK(udl1ucBmdoVe6`W6<b7=WLi4W1c_-aU
z(_vCxvzS68=d5ho_S{aS{Y>#C&xj#<ErZFdt3hL{d6|!Z1`!w``_X}M#j0&+hJ`<S
zf|nxQ#%=lC;PU-q*`-Ym$f7;u+!$nE+_I+Bgg9<}k|jV95W20TN(Vn2%^_WCAKAZM
z3pU7DDoqW$7&CJ#A38%D7pAcMaN>dm1v-K7P`yV*yH`37M#r{he!lICUwO)2W_7B$
z4MZL1$2yD5WvvY{Zmky}d9>SADm(J*l~5l_n_|@DvKF#0C>3xBYSnH<aOAfor_R45
z-B`4~YT}LBe}euRi>*yEU+Bhq5jsVO#FsBG?Q_P?oiO1kVkNBk*`KAq9%fOtV%}YC
z2~GE#Vk>fx-%cOQZc{<0=-Tf`CzsmP3p|Z!c*A5?mY1|aho)inc^|J_G9Ss@eJG`z
z5Dr^fr;yeF$5fbHR-YW0d>WA(67E%ZayPb6-8amHM^V@DV@^(Z0A?-Ui6AS;*tAS&
z^W$pzOxy~McwA%ZJkSRY)EpY$Tche%V=d=?r5-zl;X}4ZIh`2^M>FlcqBiK8QQqbo
zRa1`Cn7^?yd)5bODr&j7OT*ZD${_f<Cs*x-2itQ;RYkl5YC$&?7q$DM+!fFG7BKpq
zS<(LpZ&`1TM%w=joZ3gBy$P=t8?A<fot(h3Uc>J$15nlyN05O*Cz7+<1H#|o*@{Sy
z3(w{NKDp->s@|K%Pp~oHjSkp<B}g}RF>+f@`oO-}#|&&HTV>CgzG<}MH~xzEt1w#T
zPC|qORsJ8O#^j7Isc|CBM>DI1sQDl05BP5<q!n+EJz6j+#$gy*7x>REjEP%;=bvYO
z->y|o(1F>SGKw~Qfcf{$dE+i8J91=GQtE=O_U^op!B<>@AE3xr1CbH4EVY-G^mr!L
zKW-*rE%meS+vVrnf`U&eU^8^CHgjK#adcSOkNDf5_UhadxdA^$RxEUR*gqS~2Q_}&
zgG)H~Q{A9*hWF<mdo+Dz#&|=50YJhaI#U~)vK6iMAv?#w+@h@xdz^A`U=rDe3_Y%M
z>+)kh3C^fIh!SH8X&U+TV9(7))`j|d9&y;8@T(rO8$#kFQ7xMbEVzx4w`N`Chf*9h
zoqO{+7K(lEzIk&8b03`g=T#8n!}u4%8X}Rs4OE9lMV%){eIoroy687XxBlf=4qx<z
z$tqU3n)kY-D9|Rc-7)MEr?6|q&)DO|VTCi}3rF9?gWa=OVoVQdxQdj1<`#qHKMW-S
z5i)~v9;;g3<=4vO`@1O;ubPRy1<1RiJxzH{;XOU0j6{%Aw7)a8<%b4>Uu!epI=p{M
zu9g;jJ5}bb-}In)ka)WhHs;L|Bdvx-y{P!Y6KoSk8jfeFHdxMW6I~5ua_mrtoE(^~
zbe>eVpYopWu${K=n<eaC2C+GM(|eTxEq5&+&*k$9wwD(_+NTNYt#oI<9M6q^U28=E
z;;6vq$IoG!3JE5_5peLR<gd<!XU^bP4c>>gcgOldZ6tct+u4%u$nS>funas7DqMG=
za4!q_#|2{IWbn<2PaIKR(Z`}FalNK?@yvZ$tw&#Ibp64eI>p$`tJaw3&89aCfH7^1
zEp#ONoU!NYS)R;B^!96e{#Jskxz9;~n{n=ktmIOB2=h#{)ORt(35vA{MOn!S;0w=^
zh>|6GGVxn(EPS_~a4yf&P2s|Ug`%7Py?j%07wG;NQFPQ@y#5ZLz=EZM=)a7L@~z%S
zc=!uOKKqbyE#o=ydyS#zZ+WVm*1pLRJ8Sv_cM7fG`5@sUd46ljNIQK=1ck~$q)F_0
zI>(~&q@0kepPYT3olC@*aOGE$HVXGM?o57FyGoq!jCpuL5%cERx4zPsCk$kTZ1HI$
zj7-F@$+r}C-RKQ2)E-TQ9xGMGq(T{b1UR(LKugd7fj|WRYBucz_ZO?7qNIG2S?u9t
zS70n}5tQuh)-N35SHBC?Rhm;*i)_^GUQG`mKNM}{n0UH5JE%+)vMW(}%&hx|50OvS
zJ&5*ATYUDN++Q$FdKHkoY3+cd&O{QlA~Qe2GkQP=ybU~2sX@kqp&q%%=`iN&(FZq}
zm>u;O+y-yQsa&fo?8`|MJ2P7rBTYNdKKVT%bG3)LJ4P8?fxgE;z4|Rd^XDLpQS*ht
zw}ILO_M3KPTAxXjiXaTW4#+;Jn8Uw`w)le9C6zJTCq{I@d(m~2h=lJp+Nndb%x8_f
zCyi_~6(K<M#74imBC^V6!4g8(U7kpd<;;3{W4JAI^PQ3Zi>Tqi9P6AKKgWH}j_B;p
z7+J`>A$)V2N3lZHd}`nSb$7O0iaxG!=g|@k9|dSx9C-USD1rCJ^~@;vH5Fz1Zmw`>
zc+Qez%=-nQ(gr)u#-X?xy|$Sj6=!GwD*Sd!V#DU?M2Xv*kL5_8$lc%mZyEzjXAeqp
ze~@&3=Xf>Ydcv6$MrcdnNMb+Odhx`d-fKrkv30m0cQr_@%;DL0uZEKu6T?dRBtObs
zH}~8e@Vz9+QbNw908B_18s~=!P|Y|ENrlHPA%cwaa*h?oR9gzWz7uB`Y_i7EuLK`R
zG`j?J<@Nch%OxLa5|&wL@(%Tog}X$o<Md<9x}+O<fS}cu+K!)X-=1#=ueco)CuYGP
z@4nlfh%Bk{^X~QXZgxn_Wc*(*K!ODprQnbFsIsE>-N&!^e5I%%Z;<yXvOZ%+_^7e_
zbHIa~I{{=0cxF&QTm~sx8n(x3j@j@%(K7cbwB0XSh&ZV&*?9w=<+B0`qOfzaaQ~BJ
z>Nruh-!x19v*_~bq&c_2BonW)S8g<5Vxaa?DO;)AEX8a2l!*KlS1N8vPHp??N(*LY
z@HlHg&r+OOb&F~R<D%Zc;HNHYqAPNt`*Mh7i{`rW)}zZopOxvj5!;{)mp8x(l4D&H
zyI{YIUos!puFUxEGy}-wSk~-_57VHYY}+(|;BZNQ)E4UU-!?e%B6EGoBlMn+H;>@x
zk4cA=L0TVj#a_cHA7S$a?=my>{kpr)5A9irXX(01!*~DgmEnGl7<0y1VCK68J%N{c
zTw>DcqgJE3ooh(1Vw$@8awnVHsgU}6e6L5_7@cFKN@&$RVA&%gq(V&JnW*e93BF!=
zfV1Pt7g#Olss$Fa03vuxmym<;m|iYo%d<D$Y71%_m@?{w@)@AG%t<&=@UO?lwn;{i
z{JCY(0}&M1<o;C=%N8uR^bW<0HQzQkadXDhShASiqnYg~Z+@L0RXz{bPz*>^FP&ev
z=lb|)L&Y^fpU1GZTU<bC73R!6IWF!m@D?k1&I*_5pUp`UZyYS0{{no5u{zJOA;=|w
zjD2KqBS7=_)fZ7ZnV$2tgc|~MY=sqSL#}(xQ<8&~+18XXOrEWS{KuvX81s|45-)q>
z^dsqbEyC^8`9)XOz!wAI5wbfhlf38s4I^X6Q#e{@*ybN#bXmvx`|**_u{i*-Lf=gm
zI-p*N$*zdmeRn0JLZZ!sEw|x~n_Fm?omw&+9Xaru3lZ6BFy#{L{jg1=fkDvMGu&f1
zq1$^!)m=cn7)T_B>1)Q!p9@~?#t$&y#Uf0Wuiz?$+npELT+(U&RNOQl9r{Aw=n!FD
zC2KYF6e*@fu{S>3K(8gVg4ZQ!MaSB1s^X|FiQ|Z!d*g318$24xV5;AvNvYNM^Hpyg
zZ+sm8Ap9#M1#Y;qWDck4b@O-P3p?dJc@9#d`%Pa`p=5Al{<()2%+li}v7A3hjO!J@
zx#;e+E7d+mKrUAnY&04xl5e~*M)3TRx|az&^6!`v{WDRL6vG~}lC(fT3;%n=sKeH^
zZjjMoWB*6TfFB}4?_|lmUs=4ge`P^``1+QeHhCCOLHu&^`0+;g@5v$?<mi3&qp2Go
z|Lou3v#oDg5#=H%ipePrt@(lBx17H4Un1i@-b%;M&vuymQx$!MDYI)=%fIF3Bq1m$
zJo_t^Ba-T%u*qj=Qx7k?kgb2!5E<+s`310&a9)Yb5jI>bs&5C1IEqr^JA+tODPNxj
zc^lU$vR7VwvXES7mhWLoNW}DVQ7BBsl-~B>4@)@Ql%~-&C@%wg?X9%ANGxhWOZo(b
z3-z}HIl?qYEMjf450VXa+?F1iu5VX(5Zl0Hr3|JKK{K5t=KH_Deho8jLN-QZ{q-Yz
zkzFF;EDgeQk0ys+-C02)&QZg*V+B}J&<#gLmyFMbBc*r9E*ev*&Quy1kN`<sDDz+<
z$1dvw2%5fTOuO3;Or%^%@yy}hq=d_E+0Aa>XG>?I)jE2~WYv0&Cu!iHqCz2cP0pW}
zssJ#dki&o1_U3gG7ZFU3_w;XtmuqZ!%9gS>?Ho!N@_MM;$_|6VSI;CPD2l+hlq2Y`
zVWMpBcf^OO1)udF%_9XDGzEIAuGHtAF_B_LH??cS+(N)Fn1-W{4$X$INn{C^?W`k6
z#m*SiL@NH#UyXwi;3`d2dlUcaAHIm16Vc5JT53_<2ye_uG+9ks8|hA_tB7l34Q0N`
z2)-Xw3H})}sG7|_p+}c<>&Bg=Cl6kdnNq8+gcvLQcV_31XQv<C5xgYnCb@af)NS*z
zy(aE{<Lb4(Z~vL$b5muR?Gyq><)#$hH?so@9HvfB76CH3_;CF5!@f|(QK-Lf(WU&3
zSKX5B+wLb->WbAsoP<vM*7DaDG@1NvhQo14w^p1~l+GoMGc~;71^Xd2_<ls?m9yuH
zLQ-qy2H$+3xgk|^9G_wG*-LG*!Gj4f3k~vC^q$?MSwHg)r`<i?tv5hPRstfl;ktvX
zSvR>-iBC2SXQT!|z)c>m@*|s^dKB;0o7hjfPXcm(wwf!{_hpnJSyA?oCQ!XoQ+@E*
zy`h^w1)u#C%wHo>f%dQsXz~5b8_ptKSrbZ8|KjYM35H=WNdHObt4f~JRi@(_l-0@0
zEg*6%!FpBag+Aq^O$=R@=jO>^_Kthl>T(I?4;k<iDI|3CaD6rDIEqee$()NI>5uU`
zDNa85_6u||0AJD&M};$awD}}U4Oh~Z9p7QO?Z39G7UtS(_-v%w$7gucJPdX=4f)H9
zz-KQkygZ0BFbzYt@5eBmm7=GPJM8V~_gd^)-vbIMTLoLyF}L^!(8O;k40q*kXU8`6
zipJFpLFt~vsDBAs1HfogM$73F(0Ibk$g!-lV*SBW^5G8i3+A=mqTemR-m46s{ky*T
z#}JUQMggrEXnu{WaV$K=Vl7#|HTl<6L>>MeW?!H{+1GaYo_Uv>1Ng9U*Qj2G>~!mX
zu6&NyR$4`R5I2xxA9sEQ#Bz*~g=#N6#^q(CRODe&$Q;-2P5+mmF#D%1b2d_ktmJtA
z(S~{>LT%?O!VtB_+*5j~hmvLkl-sT*mTha`s0Y^OIrAz|SHo1wO<U`uN?<v>rA_Tm
zTXrbkR7T8U7@@=FGN`2GEK^9{nUv={L`$Rw-w$Ns)DbV<)xD-#?*i(GkZZT#pJG%W
z`#m$5YP-FHYOeRHm@dHT+HA(BUW%*@Rs1{aK`WH0SzSrnY`)2~@Giru{=tNjxe^R&
zDg5QbiVD>QVEH)Z@$`s<J{F33Hv|~J=2Xgd@6gqs`wa*#yf%j_mp^Lrl0X2jn6-xN
z9@^b7Z1+rQ>n+7Q@0eaP5ZUzrKnxZ)Lxi;hAa}v|&3eVNDo<~3IKIjr5p8OFO7k}R
z)kY>teE8428;&O*qht149$e)#D&G8g!ml~pmzZ?Jcx^_DPJc7`_1u};{(zrMPdYaW
zlPG8kPldHyj6_t_jKHh;SpPO4(@pIMZw;awfy=!V_M@j!Cmc=ZCMgADUlL7UdZq;O
zizmd9LaBTkih!O%#XFY(U|tapUQgalwjhBsM_dY&`q@2z`NmBFslbY@ZY6#q!nLO)
zSXrqWSd773fwuhuB^?&JHZIpI4f}F2Acx>ZEUxW72{3Q1W;)Ia``Naoa3s3nZjl@i
zTRi{6%Y1>WCr4PWU*C7bnq;<gFvB}~4$NU`rYz@%VaVTBkgJ8<Mm|;9oE>?{7F9v~
zXZ26{jxcIDdjdMbAJxPbs1r^vFV=N`r&3xs6o?v+%2g*@ih?jl%%aYw0I?Xqf&BCs
z%?6B;WA_hCLJg6sfo@>uj?c8`w)?Sep*|>>^DVTdS5pBq2^ajf$MDr;zXK6KHe-Ht
z)ROh-;w1;I*k{XA-;dXxQ#!8FB2vQx3|t?V*2*Wmd^&$_zWe#fb`dC0G6xuSG4A!^
zhu%^n7R@20h}pad@1X}$K2t8pbFlvYs~Bj%Ic^_w@k()0e#Hl%IDnd{7L>_Dx12bA
z<C#C7)N;MjuY6h2dcwG65BFc;wRYQ%s%^EqkNkiax@h`hy?)`O>UuovRIwsBLebRA
z?a7sJli1~PFd!`(%^yGhZsJe%pFNNw+?V>nr$U#k2P8bTg%9JD;HuA<KunMAn=!P4
z8;Li$gSreUQ34tZZt-K!JBhYp8BTdAU#oJBlD~Mgv4>r8v*>kc1$-c{!S3}^BkE5%
z$(7*x#kH}sh?Vcc<x;V8Pm>U0`0G+{#fZ6>KAB$S1Nctg$otl4A<)TUufs#X_%uKE
zUyfmJ9hH?{D&3=z-}mE0$+rNNN{!AZe7RT&FzN9_)9={DF}8s3R*$P`kU!VF;FKxb
zI*b(0Pd{SBc&{N(f}GZ)=RZ|i4yZ50Gh^PZgRYwmq5~K(R<K^c&{Aw28^WX_9Y(*X
zJUkLLLZ<%^<=RCXYtw2bFm}Iz{xu2xZ)zgJ#jM3VV#^}phxwzzogAn&hDD*<zCCH3
zF;~F=>=QEIgzihceZ=o?Z*Chh<IIv@SurTzPG-#ld(jq~0Z3K<t<7w)rq|akimB(w
z1avR9bT5n1$-OV1jm&KR(K}pTPL@YL{>OSul2C1`d^|6Z?>IujqqLm9fpvT0`twsz
z26I?i*OkOfk)@XvLd}yyt@d*9Hnxh`_u4X4a}9D@1O|lV>+y;g_xPZ`U5^RCMuAam
zs6FnMZirzL^X3xmgIFw(FJGQZ2ME^4whBkLCC@p1HfjEqc|HTZzQdeSQXrE9VKC};
zY4)tJ0&9Wew72d${yyDqxk!1q!P0gt>gYmM5w+%;Py<WQHA3R_>Q5I-YCpz>9gh34
zOdGtW3Nc;-94gJsAyXQ!H-~_GbrDP<Fh8PDEYpW<DcgKgm`n#qDu31J!Gf=jBs`ts
z*&xMD$gKj+Kg%{PK$X5SA;_@xaJHb=3)uqKnWAH#<is0=^%VUPd8yz-dg0f6bYR%&
zA+yoi9^PbE<4tia6emi$)vXm&-#A=FY>r$fbwfraZ{8PRS_<U+X5tEIKmO=QgTWkc
zx3ivCU9WH5{^&fOiBc?v+vf-HHa4w}NwkNbrJZLL>S+b+3%x+Bhn?W<Rmr#crYafW
zm<4`o-yNoLwi)GOiI<eEnqcWRjO=c#^xWdf`B(@Z16?!_NAnV>^QsSN)tq*G6>9L*
zGPKAI{306|yq>c!hn)(RgJi5Cxi4euo6Rhm7tajZjpy%<?C^*4eh8M{)P|wXQ+}X(
zP{^*cDstQpJ>7KAli7uny2@C&iUaA*kw1d-=#3x9{WtdyhxW&`_C4#H%k`Z+T+e6c
zJ_MK@DHR<4nO^^F<KR0SYI;}+8!?rNS>J8!PLF<)dKD(luQ@oy69swn{pW!7b_QEy
zn|PSefBr@ES&z@Ym>X=}O~Bm8&(aj3VSWa14JjB`LC`yAEuoj)<SJ`)H8RAQ@ye~0
zll4sr&&<;%$8mBGT^LE+?se%4<Oyy4D*uOJysT=|EmMJ}kA4ItnXG4lua-XDmPwMu
z^648Dp9;7S<ON)bkdyxpU+*1Hb@>1PSBjQdSs4jQLMqu#B9d&StW!xsIXHxabCR8v
zmF<`z<7Dr1itIg4_Bc2=IQHS3<DB11@6YEuez(u<`)7aXCOX%3Js;!#G$=_^m+b94
z@aDge!-C1DUo$Q5$s_3tWbHr_^8!5GKU*NLnR_l{6RZ?7Io(g1{)7oiXEt?0-BMHe
zy7k@GOtGEN&@#t#sl8_nF8*+Pa2vnFW>UC=-KGlal597ijE%kC?z+T@9Fy}XDBGLv
zZL*#LS_%fqp@iZOCxMN*K6>i(x#Z`fugm<t;w)E!C;nRtsKGWA<L+|CIdA=xUH95?
zseXn_y79eu+y&H&t)2qXV8A7dJRS(FJ6dl2yX>Y&k{P1#MMtiouZ;jJMN!I>eg(-F
ztqxv<3zHfvhqVuflzhA%r3RBdt2rW9y0-ecQbumis3JrS<E^;7#91-EbjS6b4pi-I
zF7bHCTG-p_!m()F?WsGhyVqG!8O<cJ0=*OKz%b?pt^x*12z7;zTz|naIVUwfSIFFB
z30R)~y`_if=rthXiN0X-bkk*g23E!g$4aoB#_Y+JURB+J#Y;HZL&%F@WVYhy^xqX%
zP`=}Yb-aHGUTso=1(`_gfU6eYiBPQl&g>&ljQ1iKtd_3_L#4DgnPa=*4u@x|u_|3$
z^;>6wfATc%*Uk1~J*{{n>aA?}y*5Icb7!@WWGXs1Ty&eyuocvlO}s`*WIa;J@PGFG
zx$>L(w%b;d^yN9B&7a3)WL?BM@_Kd#uV?E0f(~EKaQimk<(TMH+B|+us0!M#NEJEW
zE&gH)^U`l@7mIm374h}_Tr<q4`%Uia=gMp{d$mpb19axGwYlSI1@}J)cG&16lB;T-
z3HS)GyFH$WY>Lxs?0@$cy6V_%MuYyH*lT<&AU;&)bYA4(X>A0Mq9lfju3--6P%D@3
z%eBdL$)zbFjZi+_4G}_P@U!cDoOmyw6%mr_wSXp}xyEwTD$J)=J~*vOIvToiqUzSk
z=WU?uKbksZ27dU$c}S|KWp%?&Sh!D0<oul^y2L9zREfS^t#rGnVA!7DmU$Ep80W}2
z%XM$9f~l4Hy($cU-(G6lqy^d<vjvf_2#xWl|9*bL&fZa3*1gB~o$(b)($$sNB&I7@
zY~6aUT*-os9*?TXqr%c)S7Z)_KBY$7H&R=<r2nNFd;*x#>Vc8<&#)|rAAG#S)W|c&
z{l>j=E&zcfjSnU+G|-i+BAa)^4K8QmIrF!<9_g|yjHPA%{7;6`C@$z=Q9c9Vuc>`y
zR{jL@s1vY?yfGh?<7C^Zb)k>GWOx4UwcLj<g^{vGKMJHK{8zp*_G=6|A76)dd5B&8
za>0?$>9LxD@LeO0M|p-}%%^?>Gwf)6-mzl5DJ-!4G4LmSKLebZvfoIFxItNkhU>gs
ztIo7Af9n~!3adxL8HWG2$D5=k`IT+(n23Ex%0k=FxsOnVJ^?-o#cIKz_bur3r8`^t
z#q5dTJEO9UK}oyEqVjmy*GvF$p}9B2@HXRzhj{>lbdD*DL1ZOLy62IGWy;@{BH^LC
zhOC0nXa%u!mS~P{@#A-M|6D(QR~jx)c8gub0pDS7Na{$x49R-+E$~s!llzrSe@?_w
zOL<x?gvg1%$gy+tM|z)`vjqcI)XQfx-zOp_OxZ@P3ToFBDe}(u?s%VKXNr%n06Xf^
zseuay^jmYk?Bu_C9uuC(i~tPZpJ@i;zik2zXYOs>Q8Cd6g4KM$dLK5KP4F*%HJFL#
zm8)%s69NuVbQsGUmY1LSx`N0y&^+fWNt$R0-(tH>*b$R}ys$L=BydWFl#C6Yb{#;+
zQBrL{MX@@g7cxk#>HoZ6EUjQjdVYc=SK}@Hj{nVwaBt)oe;c}oFNh?CDMdySo@Di$
zHRC2Lsz@KIEv0a-Sv#bB;P_?<rF1(-bC0zL)KfM8ia!ly^>K;T1ufEst|s0ac)lk-
z_BL@vzx7Z%53T}R8m4KQ0zWX|qHcU_dXuoexL2{H`nlwdf+=@BQX{gB;MXO}MyhUi
zOKfyH4cyp$;xAZu{jM8kR(`-GF-0wB=lxLH)?K?(U*IN7xmM-pKGb&w?BK}78eHD3
zqM|xG{F*8<K=??#*Dq}5xhJ3i_1#g81tv|%uTE55&zZfBA{?TBN%3QNxc%**+mb8L
z&DP~zYR%K`{WQ5<0bsD5xPZPlo%iA~p8oNbBw96}Np;4TD26&b43PFbL)(a?i@5w9
z-)v2{zIlmwAU+THIDZ5|bbYRz+A7d&Me}ygCZ=-YHFsWd-Fj^`iRp)IZ^7E2E<t8O
zhST=eloKwznnpHFUXKNMIXxvTt$$@OT00IUj`8zYZz8BwLTfaX;`N}L=+de*;>t-M
z1vN;+Nv3eKE#v5_^WGEI0vQZTb9@a*c^&?F@qYXW-ni%+Xt&+x-FP);uFXT&rV@I6
z19dNpqrjVZl;m8D86aD_V|-Sm*PrXmkIqNksVq?Q5y!4rYcGH&Y?E?gyCy5b^JBf(
zN&;;_$C_jrCDrl-JcAyw?^dAqg_ej&T0n;<Ssv>TFIkzR?DSdDMn(}G8Q<<{C=bD;
zGU4Y<6Sh1xUM_q}!hh}){5-YY2Owc+v3W}B*zV!&Lg1(mug#bccI2uW?1QriNSH=B
zrdseiuU)Hst}Z_8zI8hg$+&A&A(CnI0~w9q4a<(gc-WVhC7iZ#n@k@g@>-WRsd9-m
zWL>RakWkgA36OPbsInc2Q^CId(Bq;Us8oQv2V9hu+()s_P8s)pioR!Y>)2GQqC*(4
z^>{~RF^L33uS6H^RbX<73ayh9?0a{<+eWCTB~4&&HwXvP7}CzT(q+AHZ}&P-ac^WI
zRtHkPn5Nx%ogE>B<sam3Q8wWn@;T{w@9K&efY<^&Z1tfZBdFseKnJtsMyB4Pt`(|+
z#?uDvbo6R=+az1iXrsTOS-5aOcmTH5N*o&PB(h+QscbvUC7qx()eAmP-K|PW26=eA
z)}bHMwvf0l0~G`B@KW_L6sb5pPH|a#DZlcM9N1O)V%Zz<ch2LUYN(V0{W-asOm&o+
zr9;Vs1C5~|i@-k2LORO#S(%mXQ56cML8v}8AvQ>HIFq&SDd4;pH@|C-UgQ`*Rq;7+
zd5|F817s9-m8*b9GNfou?st&Gkx;<8Vu|s9T4A4@KD>rk1da(LU)iJsu?Eq^(4~Vp
zJ&s*fTz|w;q_k48udwbl2Dbrk7ppHx(6aN&covi*+^4MP+xPd)xB-!lBjiVN!o;+B
z<))ro;I0kpl$+w)X^UFyd)D<~R!@kn_icg`&~!()qyo5x*XR~o9|G`yBl6+2aT9f1
zVF%{e@5V4TQJtdR?RJtKvLky7w${?4RSfJ`r?KroUGHOq72dts;C{`^a3z!?E`#h+
zz-Y7|6*$pIXsk5%BVeQ78Ikjh(ZLwcfWtKaG>-@XWgxx`p1$3}9DCxG-A4;HFf}@U
z4V<oATtl{>m_XR(uJ{f-{xf@Ux}-X)gMCW#^P8WS!cMmH^If1Qw>D}T>1PU!Mm+yp
zPmA+5O?TNnxHUth!-;;$R&JNRl?!_H^lA!}?;kED8CZv^J50=Q%SLdUux8z>V4$zX
z!!M!WYYtjg<84ayYm-jN=2N$y#N})NSZ(N%JG1n@gHP&Rrq;OUPq&Td01`hU^zzPU
z92M#kGkn&)zG)2?YcUS54LF|>+Medy)y8-HwynY*Us06J3yHClM@_ECf@-tv4>1^e
z5aN&Jx{FwQs;G56K?6*kSRzV`s7Y4~wa?5e7$|6Y#@KpxKTXUQe<XZ4a~7E0D25@&
zci`{b^g}v|IV{foPKaUFZ%lPbkXF#P$qlZ>b2=1mP264>VO|rq^898k7a|Sk`D-U=
zSpZq(1&KzJg_O5W^yoO^jUrcDw}0ROSiT!{3cptKjfsFgkrJ-nJY-mL1(>c4E*LW1
zea>}S7W!MfX3z%xSStMcBhgI$KMREsYTm1_x<dfv=EuDsra+8)$IjquW=QSglZN2h
zM`4XiydR-2M|ytl?4_AA@z=}BFr6BDbRVY>AW1*Up{BnD(D*lw(D?D-3~R||*4D5#
zAnG^b@_Jqbj2n3{>?(2WfkuoWKNGb4`%AZS58jaX4|<%&)ESaf%PbgqhWjnJvPcSH
zfFy@G??3i4;(C{UXbC}WY96lArFiJz?2P-~FxNs$<(z0AI&-IZ)#&jnpIp1D=Jn~*
zg~X&usZ>U{L%v`8sZMP=h_fO*wnhi-Ybj4uYR-KqyRQ%~%7vSe7bpodu!mWh9Oq)%
zW&L4(d%?xXR+_tuzbY2^o?mM(d^WqHW^|Hybi<^6ON4`a0r)gxIPy-te$J&RxZPCJ
z)Fc1$y_UmMl;QhXo3n-PE`IM4T=F%2B7N+o0PT&J6NP<V8W}(BV$png9`NMT9K`8y
z`7ZpywclBQ(sRUoFmbU@^1++Sc=fVQp>E@;mEyH?@~L(+a;?i|TN0E_3$HKA0iUp)
zZnObZ_O(D5P}MrsCo9^g_z#j#5{r9u;uW^(c0-j`sWXO#r`;;CofyL4)d7J9aiZ&Q
zKW0z~LgoUAMNjFBxbXvDeUKOJY-!Km?6x$Jbw=%2Wre=S^3OgyrghEs^Ho6tURMp-
z;0p-u#Te!0Kf;Pdv;KMS&Az)h_!I+49z>*9eT-b0DV)SgyS4RfLMk?^;9R4Q*0<+`
zD4|uIO?~=KFR8efg;d`<d1|b#r_9gbsfk5HcMg}KTs)z1-7U8OS03NSpn?H6W_%c9
z?G`Lkc32f`5CG|nY&$OaXUFVRgVbSNt)v4-w*vE7AwjAy&re(Gte_7Iu;s$L=(d0&
z0tFRdC$x;A&blgQC0*X8D(kSD_SR^zyY(7r3_;UyWoR75rPS8Dic(+jOjxYBz+rCq
zjK+HH45FFDgxIHYqEzIcIIl$gspgzim%*kNA4VMdgc}QH08=9{4CHsL!-JG2jstrY
z#5=n^Px*NlzwUPAX&Hrzn+nyPGvi;Q+)%mSaJc49=SRf@NIj2*U97{lkA+UT>a;kk
z{sPgk>;jZ%{=(W4{kmN?RPm_ad<n8!c9cYuWO9+b)+1+s9bFx}V)da|N8|8xaY|3o
z%baJ_6RJBZuBxU5JGp8Qo9g)ao)7(^eWlwIT@?$$o(n1h`Ex5psyjMgu)}x>ioz{K
zNe8S41jI*9`lK!68|GCjor$C5El`>%KlX8Zy#jH2&%!;hhjLZ9x2s0oRsGZr=NT5M
z7+7dfl67`SvFA$`-ke~8rhuA{6R<^xY))s69a@lQC{mz;2^lP8V9T5L;pCq3TeJI_
zrn#f9rKSzh0TVLc+)~4~!{f{NLaUyhNt!B&HXe(!Xy^qd^{wM+Ru;_%N8Lz{)|}ta
z(C;g0vi<kQZ|;`W7kQWX%z>Q)6c;wGO97@QQ0Xc&^ZhurBDJs}*YYT?=?b#ct9_tA
z2h?hF7E{{0-2s(f(Qz!F2hu146*nZ8s1^_FB`+Ca<M*%iVt?v^SeL5jUG=O`hr4DL
z)Yv@9chWV2cu91~UOV9{e0-n7t9carIghCF&4e~*%Heh)&ns2@>WTuX7N|E*pU0~s
zhL=7U5@d@%zi@BNaf=*y{oh)ENv~``uaVcmrDwW%cE#C`bL-W@Jy|k!5r)NQ4aH<`
z+?-i(7d5y{vO7~wQVuS%V97wXdZS*B6i-Y|kD)(xHZvu<`MukytN84O+^WdX-TRxn
zIA=XnX9eeaF8-gY@$&S{=c(D!DP-_%y)~L*DSA~5S8FOvWC5Z%94l7+p4GsL_CuGU
z#2@SR^r2$+Gg>qi?1{Lyfak*Vv6i#R8+a_0Emb_`9A6;RI?yF2@St)o)>uUPh~RT-
zbd;r4m08nAy@tT=;L+B9l~AdE5ams(3}A2cQ3Mvn;i3ldR#hgsWtuOYeM*AOZI|aL
zMIT_4_>C;-&kx+Q-UN;_z)ctr@*-<40Z!QV#(2d1bNy>#VoQ7+E}7C&$yl{}6i&V6
zM<-f1oGTB2eN(+N`k!9vQ#vtJhkEi;RC`{qR!>z}!r#F=TG(!$p{~CM$67$;CBSm<
z)!d)iDl-k!1vLthxjR=9)e|{)o$J#is`7@oFxM-yy?(nr+gb^LeFR{ToR!@kc&A%&
z68JsOfeRoGog|RmPBWNxe!{7VnVrbpDhSBjOPsg6&WU~Jr`BM$Df@zmJ&@S(@#QAf
z)!((0H^!=Nx<41)Uu^s$kdP$mVsD_2vTq+x1~c!eM{k-Ig&B^Y{@NBeaQsS)^g-Pl
zE4f6P$gC#EkpE6zd)iU9n)~$}*t?xButlQHL>kiSZao`X`HR9QX`^Je*xsMMvJ(W2
zzA|*;jM0e`%-UCJJUWG&-d{#uJSNsG+%KNH^0Y$RS$z1+r}Xz<ziK%(fBka#bWO7Q
z+c57>xay|ZCk=Dj?4&y{v%`c4fYBqv8V4B8q0!r;N|y{x!wZ4Kb~+22E$Dr*Fd{;Q
zL|PC+mW{U>0c?%$eD)*p!I}-$)mWp=qfV6K)zq?rtH7qdHf^d4%a2M%qN(wPvcONl
zwKw~%<#{0O*aHBB(12=Vl6xI7_?FEE|9gU+?~gH${M_sG^1e0>V4Z^h*VQ@o@n$@9
z`0>B+lKZO^uA|9xCH5z0-dd?~T5M!p)P)Gys#Er2YOhnOoYhujU-i7+X>jN4v1q-8
zc*jUqV3BS8EfEVElIn=-c=6Tq^^fCT3TB7KFSEZKcR~XtZjcfQ9pv_})7%pMf4a(%
z3;vh27e4tr3Fj+_z>JgPgHl&M`oS!5xf(e`z2|GB@u~Q|jGlCOr2^0eJ7Nr2N<0)R
zu2m4Lx^k`df=ji4863dmZ_jb5zvN@RIqPDC9ZO%VIL&AKNQA@JI?9A4Pgdk#jcXx8
zB1+(R3n)Y0_oc6cW9odS@@)y$be>Pzs(BA515YFzwIX$fNz|b^xvU_CDkyz1+R6^x
zoZK>!;!jCk=o!5Mxmu@j*9&ly>GSnloQ`U!==Zw;z(=yv(2IY5JS=(4^j8}OpMUgd
zXXd~uH_P=o#JyiKSJw8JRQ?q6rw^He<9{?d;&LRr?uZpo&qxgH?%oQJD6$!}g2w~%
z_E;*xd2-I!e+*s+eerBduTc5fJP_Xd(ztigMX72`=FQmU>sG&4a%Xy!yNv4%l$OgM
zKW$pbLRLTAOjv5^=jb}jz9oYd4ZX%2Ki0sdoh|##|A8lC{a;z^)Cp2UZ{3fc_4Obg
z%wZiykcWC&=G(=tvMx@Cc*nZQgF(5&mWeL1RpIgmD}Da~bp(oNeS=b-@tG<+sE){`
z0MN5HDO$ZKbAy#o@I~{1h8ab<j)Fh7-?mva6FEscL|o-2(*#|`8RdoE&P+k<aUlYT
z)G4}G6wyY(XB<JBdYH2g!z;~Z2$I#%eoY`$vA*2(sWmjIr#+${(Yfl`OOM$|Xi1L$
zo3Ut|GWJD(a~FkRfbYtsIqd3rlHBV^i)nLSjXgh0oL4XjUha=8_VnRI_nM&CI!Z5<
zD!sfhI6ZAV;MEu>cenB9Q8G#TGfhAx4ESxx!7MdfdAz3V%tv6!Eum0RSD4!3pho@H
z<J@gSS+{N<)0FUn)$4S?Zyvl|0V}GCloqg6_=)^%+y3ZBmT^u(%dNTDTs2F~&$}RY
zH%Zqn@f`9PF&6NgnYY6gOa=#JcP0jYOZo_zi^+U*bt0_2<vzH-X7LdjH=w0rz1ex6
z=>0r*pAA<z(zt31REzJ&g`)y~m{Xlh7<X0mG!Azxw1<O2_i9c-nioC%mkm1MkJrgP
zxhRvT8xNFq)_$f{sDrk*q<l7;`bSel35(Uq<GCp7=?~EY%XQuGvy<g58THd%MT5My
z+Uxy<dOp{jACQ}>f6TN;L&1zAH6AJoq@_4+ot9^)f}0_w1^9`q;9A?GOA&&r@mP>F
zsYz)0D)OCo$XWs@G<UOZb4>@B<-o56=bSo9c3e0#OF6LSB4G9C?_c_i#ye5WZadyV
ze(*_?vQPa?ao5M^Q&lOz85KXR&<`?K#GpR*>{ehywDXGzkgLU}F{KVa95EN!-6)a^
zTgLtXr=@z%xa;AgWVltx=e?~hf}!bT&BbL8nZ(%bm&I*u#(8|gM^YFx&fPpxO`+(W
zXD3{=PvQl3_{AmG_Y-))b%qe`0Z10~RNBpQQ>y?CfmHREoBY>}ceYqFUv=cb3YOu<
zp4ESWba+ol&xcKN*tp0Cn7cmFXdE4zi`1Hw+i`FIP~EG_6%Q+S=OhS7uX`!pkpoTo
ziOt64{u~BlB@PYqDkA2hTN?z)GDHh=a;Y>PD2|gYDD|~WnO1_>@q83{YHC^2IR&r+
z#ywUVV6DrG1Monau@WxEVnM3`&5EmpV%`F|OzGKTYfPucbaLHF4*yu$Lp<v{c$Nse
zea+jYXFG|Rql=zma;@`;<E;IKr1^_^9A=SaHnh0_*v!NGDuHJfV{VHNe~^a5T#sk=
z7AT1L^Qt|*BBcBoFrrx(-aC(P`b^;)erEf$y3=3ItC_dToHj`1<;hdCgxaOoUtLk5
z_X|>%8xUEi?P;-Nhtr*`^?7$=H5(R$yGM5dN~KptnxLnI)m*wwlcFd!htJZH2Yydd
zTyDM>5!P>JNO8LPK1{xR-*SImOjST<Tux<seA694k7OVz3+Az8UIKpHT{U|#+70ru
z?zUxv8l@rmoBJt9vL|%}LQkvTBSrc&;+$d%itR_)m-s|kX`e`~lBfnw${5LqUMBZi
zqLssymI2-rSH<TdSfnxQanFdcS|F-WiGY#<Bz;{7_d1a*z1TJ8K%ZwtECsDf9)@DJ
zE_+N~p86SKtKrlY7eCT_r9BFin6kQg8GSImaSBX(y8l_)i*a#-LhFpw5GakzT8W-0
zh`-!6g~AVLgZZlETSdTI9XfGe?{mO&)%3P5VQ#^~qhAROgq5&HUlE;Q{I|k3qFOyk
zb+y&y@DsZy#iRR5+@Aw4FR>g&y%7G^BRfdnHygg>=$0D!L{G2ZVbJdVQYXZIx;O4d
zk1Rovlz7r0b?wBOC4UX)v8yW~X^)0_8!bDH4rVzuV*CtxR=#}RZtkllRru#3m4zez
z_UK^FFAQ(J(_CPT^1L9+h>1SEM|jN<UcPnfJn<EudX`%1{iBKdPtlz|b!|R2U)i9s
zudIuEqZ@+b?PuJ(?*Cmp3PRnl_@^QZ<O<~C62-L|!_6ia(hKenpRVF72@p1eu-?GP
z28uK0`>#BImwR}+g8PquzpVeW1k3XbN|}a9BT;RE!7U~*e<q+et>~@8p+R^gmGncR
zG2@;^(9%18z&t#JCAhg>NxDd^|8-~qifPlHq@@}?*T~`O|Koir0X3Pr)#IFawRrVN
zSL0h0=CNIKd-vnupS3Hh7=MaTEAntCKt!F@5uflEuV9lI!xwgzyBP?5qS#-sn&F=P
z{-ZjR{oY(&yutrshu&GyY$rdjQHDb+$`D9Fg5?;`O*Z>%h0hnN@0tjmCu9`i9$%SY
z+|{MH?SC+`dxH)3(BiUhmJLV8S1He)&mpasIMT}7lHM6jKv+WeY|N7yj*2P8uksav
zr_@AkXLMo17oWOCqcr%xGWB2GezVn|`aorFS8tY_lxxX#X;iQ4X^`H{yZ3jOwVhvW
zHW@nbHxuz9zn>wkbZ{a$VBaI|d*{PKY@A!D;1}A-i`wZ6=8bDHG=Al(Rove4()58T
zAt4P&{CWeApBJFyzg*6efd_5nG4YW%YOGkbyP-Zw_V8m&^I#)q29~h3`x|i)I+N2p
zqMN}*t==3}?LeS>Xf0FB?FVyrxm5V?-VoYJR?c$Jeij}Fd=fpK9h-LF`C6@+A=rxn
zLxdkPlswr>+eAM9d3$Dx2$P=J`ar$)phU6i^x2!L%^T0}&hG{yLpw2BBAEW9yt3qR
z{oeLC2E{Zfr;a##LlP|T;D-KesYoBM3xD4*6fLy)4MxEUY(JVf<ez?JxPnE~cJ~Kz
z5zLPDGG&U8h0c?;m|-Xo_ny3?le=5(<tT0?B`lRwt5c}nLBk^sPI&jngPO$mIwT$8
zQ03Xp$o`5D6W*(xNt7<g$L-{1v0r<lltl2pP5s70>4;tV9)gl+EqdFhmz5fvtF*AT
z4l|t~s!Ur_Hg41xtp%%e?>34`&nqIYWlRMamNbv{Qo;2^FWkqf8n>37up>2Z6Nw=(
z&GFsQi|WYgzZ_*%He+n^fS@zav&pc2_?$McPZvWkjAJf?cCvbT+7_u5D6a;ir8Fm&
z1?Z}oR7WcG%9sUM2gbfz*?Ivg`mAQcv^#t%**WBi55RFr9h`IH`Nt+$`hZ6d;-3Rz
zX<XU<H6yHnrB0>vj!xS`1|sSQkn##j?{!!LP$~^o6PQENcrGouzDIIffs`_z_?><a
znGc+c4lr&xTL`%VgVDQG^{G?zsAA26zl80JgC-FYfOv4AYFP$=H-`&UFiL)}BH|Tw
zQ;!ebHBN6SQr?y6pnVH4`|2*)=4Qv?&7fXz$Br`LfFwg^Jtxg9M}g=I)1D9syBr)3
zR=2J45gSRn2>l8Ug@)zy`~l+WUPU9Q=GIaBK*tEv)KbB&@iT=uInQ^Dz%C~s3J{U)
zqkHB_xfFKWRh+CGL<2A+vauMfVA~~vV&DTy0o@#DY3H$|%YFqv@ZZjDb{KQ#W{;!x
zXA@8_d@KNR3ap5P4Lyo-L)5{3L+)9~7mrQ%3Zp3HYaUi^M@~Q-P@sr4CyiXKtr_xh
z1YRPkj`iEnOC5^j8wCf?QpT7j@P#5PezKhcut`2&ubQSyV0ZvwKi@|Q8)A3R6SD^-
z7ODh>0$q6zVSs9}8~79LzUOJT*k}j}(F9-kT^owRr|nO^wT`K$g`civt|Kg2-t=4Z
zWe}h-0JYfZJc$oGb>=NRR){<2x>Xm)Zj?n}S5@bJcK){(P-+A2s<UVvqjOY8Jc%zv
z0hy=@xuRU`Q4G`o&*`~~2CEYVYdOslI^w`UYwzAFqjM#y2CDM~lKx(u{@l;i0o2V}
zq11XywR)>wRv35`q()q|Ihx~*K$qv;^yoGdXn;KSzJ<!Opt<n*&vPU13qF$nqWke7
zsa9VCcfSaReJVB$L78`l&l!8+fcJoI^1jSvKz<L3VE`Y*v;zZ^$nh+Zjm-M3({?=b
z=Nu;kH5Pn7rcoeZ$%FZ`L+Is1`Wd;Eho6(~lsdRPaJ^UVtxxYjL?S$9LxC5=29t_`
zV{A3CC2ninAwQNrn{bINzm!-L@annUlUGY6Ka0u%O&zcC{m@b;&qK*e^-pzk_Vq(u
z2<(FQGMDPpB%4Dld>ex+1Cexqt$Apf6F0zYtUI^9GI&(Cq<ds2x{9nj-9aoAfCKao
z3wwhE(J!j>1-9FQ<|^UGvR=B~Kc_cz(LNlpFD!7iv<|b}4QaW9UN@idh!)c_rOygd
z&QN<XFkj#lXcFAaxKhCw!mrKy0DmTNV%ze;Jxt(yg2byp=^?ONO!7>I;FcOsnYH(b
zI~-)S6&>GraOU30bj6dlY@gPm@888pQtRL|K_%HL`)WkiXz_O*H>^B)Uq=h(fKK~5
z^Zg7rw>4b(2}BcI*gnNM9FJxQx|;uH<&xHaTkr4x%X%k~y1Nt#aW(K;QLo++dH>_S
zV<V>!Y2&SPWX(M0erV_r0H)y&LIJ@+Mx(eg7B`jSCvHt^=<NVEB7xmRm-&TUFwb|s
zS6|cy2h$}a5^J}9>vF3wiZfnk^sHrS{19q+Bm2V3iKd3$jWSfWylfTRuc`Z)edEUG
zmXw9+<O}a;@8uT&MLcCh3U20aw$A9M;^inbq5R#$p9=F$su0aIU&{eUxC-pi?s83j
z@h{~4q@kP711J?T%=a_D51qI7_2(81NlRewi`{7W&VEwlPtx{PixMT=U~$Rt;1e2e
zl}nzd<^SQj>xUR#Wt6l8TzA@>S3e8KZt(Pd36T{$l18SK-hS7E^zR|C6%7?07nfCi
zPUKYpST5R{0oHF<Mep0Z%&p~zPPRA(#>3@Sm^V3*@XqQ7J9pF$Zuj(WzF9f>N(>;z
zeN3;m!o<cDYaKf|+8Nt<yR_G(ZBAKCLqoOb`q#Ak*6Q64Sg&kk^0g@g9rP&E3mKZ{
zcb$|<(uM>WJ^xAiqioEf`p)*?U#U?$!5e#FZ$M1<_2jR4Hx+Z=x5{Pz=d!PN-pBr|
zMjzz>5z1t_m{+d7hi~uA$)%Qa>HAM{2X#G(1uu<HcQu|;sC&Bj0mw_VZwN~ZR(O5&
znFLDU4Q;4@pM5q%K}84Mmm)kscMky+t8IV<);ArK-$cZi#bp1Bm}~yE6PE-p#l*ZP
z%aC$8+smU`N|AzxXA010fo~R#)AME-DC6C5{zG)zW7At}%^CN~L$7{VMgW9Up=dMz
zi#^hPyIa8$pRKgb^@f1ibvj6bpKD~m?kubBd8KM(N0Ie{sYU$bkh_&0-Mm$eg|ANX
z{d(H8d;0<Iiq(^m%>=Z<So9sq98bN23Sj6L-1d(wZ?Za=oTjULAIj0RY)T7AF$raS
zsncVjGm(c_WDDXTO0f5?SBnFxhEX4uiNzG6(?G;_`FruekpP&=`<NGB=M^Eb3OO-)
zZ=8vT{KTK)X70fz)ZzqI?-@{#O?+?Po-v57v;SA0e6xP#DN5jnv~uqtVeq1~H!gX~
zzxSYCx@np=NncLg>r!3U793u;Tm3`w`E}@wSDJdIe{V(%zQ?rz#q1aO6jxR=ZpKb&
zFM67}3?<DuSmj-zTh<{+veSj5G};pEK6Vbv-h2)ln5cb_$|kt^^N?=dgsoq9+m{3H
zouBY%V)p#@L(tacg!iTnI1ov$0jG>Qq2QFdNoEp|hBrFY!%F@Ds7hml^xZ&|Ugldf
zWXs!ld~oOOIb({l>4P}J8gSV;nmMDU8ygsP_9cIgV*%l<)%l%4q*;r~$094HbeJUC
zBPDfC&g0-xCDnmGApOfJL`{e7hr{TPrP`}2<NzC`+^`h~iqtwWmloi#N=ypg&u^%<
zPI3Q#I`S9*-y)S&oLhi@!6o>*&Zn`Ld{oGMUHIgoTacaa?-My^&+A6rw>u%57b**4
z-%YI#12hSh&*yUYE^OBK7;5lT3?`gyw!o}rjLfESSlT3@_SqW3<`p<2E9_Kq@lRVN
zbV^!wA0LsG5(+FFk!0zGg(^O%bOT}&`a0GAS@&ZB9mviL9vuu|e?_J}%{f#1$>dD2
zNG5twA*#i4FV#X-m~sYiBZM@6aJ!`bS2|sVWeZ64%ls$R4-~GGZq4UNPlOxFZoMZZ
zkHugeiV)xbHLh=dU1Enxu8V{ilue>F4M+8CQS||X)Ew{^Rbx~cHB|63`c)upyrwrD
zT^S}irPdvuY++`p6fQOJaBpn_bzv(iH${2u;9{O^_|`R3b~n5rw4~3$0LxowP#;W|
zl4{+kb6N7T9L5rk`c_%JR=y5XdnJp;loRVQE4Yg6Z=jtta}(RPHQBk#AHA*{Ou|1`
zMh_BF$Bo>S>GY(b%l#Fox!i{h=6LtWry|?eNE0U-jE{PpyJEj%g?-2#IT{cW#N)IT
z`C*>d`}wM`>V$~uMNsQ*caP)WU!0f>ls8kx9(oXA4{pItMb<A*dv==xxg)<n@(>pU
zMEfwoy;i%hir)+ZK+t6fj7hUV<9hdq!z%gPyL+UeaCZ!|pRtteU`icAr>cYS&s|e}
z@5xEw4YtQlu|v8XJ{{M(YZ;-VHQo8IzNR_pv0m%Wwv@30JPlM7vhF>|IHqa;U_M4x
zn03*gX86i?=k%6~;VJe@=9V{q<$6zCa0*SHo;Wux(M#?jHbLQYwhOJXYViAtoA-Mq
z%@u~`>ncNGQU^%H<_Yi7K}^e+hg&lAt&-~QB1ledQ)1-ZOy^G`6VD!rTqrWX8e!h<
zoU=d7W0=qN(H>%eJ3sfU<r`CxZf`CgOg^RGTv1j1aC@8;lf{%BNlDOe47J*cu7KJo
zG0|`!G#jvgPHff`fvX|FDAytpJHi{qByU?w%hkAoXA;U=8G>P=YdUFrvip?1s;-r9
z=ENFZ-j{=E-}r>QdZu<-<mU3h8<#wW9jyF()~1Lq`t_YE#3;w7S9oIC`oEJ69C<qQ
zxh2>GxkBcG<|t^=p;NBXgzCU5FMI)uI0rr?B6-{%F=h$@2`xU%`en=|xO{Cv<p;st
zzgj<1wslNe6^)>e{F`MuJ5dH{?55rduQ^Pq*IlK~EuA{fJjzz7{Us*$+$^FmW&TvP
zdeCOOb|d}nr=j<f)^$VMA9;q88|J=Q=K^hiZ{RH)L4NhHdAQ$h>7Os3p|n-|EDcyo
zP?XdPu#6H8DBd~l>lgDzRV9omXB5ia-Aq0N=UI0M<tS>t3()ZSAGqWuK~J3|IIcfT
zXLOUvMg}WR00%;H#F{_p)UDc}qv!k8ileJKKE&)Z%;fw~y51GdSFX%rxUeTZf|(3I
zuPv4WZO)GbJ<+U*A3#hG!Mn3^rjRfkrfV!e{O?2ntQ$Z%I42SUuvnb3-ZNb#?aS3Q
zq^~;X|NqL{aapoF!<VC~f?-ZVId=RZ?@!;v-6tQX^ihoVDvp@Larg6>311qix56yf
zgMq_<vMWcJcd*?omQ2@?Yfz0>xs<w^`aQL8v&B(}L@Z66t6c;w+<w^5Sjq*27{cxl
zc%%OVEx(>yGJlID;!sXOZ9p$q{e5rH55Mv(=S!ylft5cmmN%;LzxDVL^osoH=>MBl
z{y3A<|CP@YA3&9q);!kZ_pO)sD?<L0c#!#lmm|Aep^abbc!on6VdqU};gpc$cg@R9
znjWJ^R^|y=+-B()pPkKIoLQ2KDLT&1N&m0p{2FiZA(u<J`~IWal<eVTr;Etfp~wpT
z!>WxuKG-lP=k%ZaLtrjUe#Ehp#v6S^f7zm*E(#K9yV&J~m<ti<0~V>g64%E}A^wrc
z{r{24<Lpye+sQA)2>);~Ti$s?&X%rA5ANo}RInv?lif}pe^VHB<<o)%`qwWo^oqhy
zUjr964LH!^XW-qrlzxssvQICx<Ga{<xKRI-13*A}Vxo4QaA`WAs_yW^=6)+&{##`)
zJsQ{wPhBU**X@n%EmLa`hqGW~<<S*W&`_$4iRr38h*X8((m#mpZ6Qo;FpiQ)1(1(-
zlo#3s`6FPon<i`DKsE6=#f@#3(ToKV*3y?w0w5(-IjQH5q07KC3g1_0Gv~9cVTS&)
z?5Zg%w}*ElA+}idf8-*f;zAds!5eZOT^G_$Wcgi9W^^;2K5q3O^KJ$<U5fKNccqK?
za1+e|b1?3)Z;kZF)0dH26VbCh?$r$F{d344hxWZ^H;QoH@G&HJzSf?Y>a6fAMQ>e+
zq64P6DATM#rw}9r?G+obuw(hbmyi5ve@U~Kr#3Xb0j)xc%GQsj%wIrKPjWr3dZr&x
zxjobq>9_y)H-IJ+kc~mMJl9Iu_ym2Ztj$`058e9)p|1=6xdXT)<<z#)9{hIMTZ!6l
z58X$G)`RvyR50R)^sPIg`jPM*Txl^>+r(QU-e|IJ_{*x8^W;{%p-*T7_3Suop-_rG
za4yH7Ru!=cT;iTOMFU92hVa>`Xr-!$TIrGts@+fp;0&na%YXgP+Yce^ZQ6jC7NyNz
z^d1R}k!ncW7EefxG?b`NGMH8b2KEOu+IcVE$tB$HmIscD-^#sCsbIMw*pwZ=QuUJ+
zNvpC|_H3`lbM5<4s%I4MVuWk%*uDcyU-lhz&?aD0<*Ki#B`<F;Ke6?AKA*5OY+t#U
zq%{%JuON!flPpUZv2gR-tuK1~bt=hUt68v#-`ZKz`cZ)(^lA0=2p5T?543h)>vuCN
zuf>AI(fdi$W@QOg-VSsI&t~RZx8Kj^fW%r1?fP<1kXu~8&hNtFj5He705V;Ejr}(t
zAyhr3pJKG~&GbrUv9>GXO!Gjae&GGwU2p$d<HG;2%gZA=uoc)}Y4JW(-cd@b5f}(`
zI_y^KjY@w88sXl(mJ*~7Udvu7N5~kwnfME7{1nAJdTG&sh`p9Mwalmo1n*DPV9vVs
zO;ttb+p6l8>Xk_^oHY`hPx#ZBhi;a_Joj_5)FEtP?>j9It~)ggc1aZfOwBkOw*6h@
zMmf2X3!(D>+3BRx%vv>5$oSt{fF{y6J96-HfqHQbp>WN-+C){}GA>~ueLJ-JO(`L@
zFX{53RHd`twY@XVK!iAR>Y;;;bc=+3CiI0<*1GTl7!lp!rOI^l*ufk;B_Ah0$4%|R
zvX4wc0k>;@)V?~e;&J?VImL>1EL3d8vhf=Pi1nRUDzfGVQ(x|wi4f$wQ%P*=+uUTx
zLdRwDgCfKq9fWq<5v;A~`$a+FU8s)L^bj&oDL!YAE3qF$;0F3>N{l`uP1Q%&!RuT|
zN)Hk&+$a0fRnfsZr1+e@WBqkgmP=h@N$$~e=hzq!DjS&(jM{j1vSiMTt|qBJ=z;33
zHZy!EyH1-^em3`B7Z%Y5nsJiN;~6zzBc~w-#FWp-HMHx#|0@AO&oX*1V10C`so4bZ
zuDy**FjRE$rq*48l=mR;_D7M&AirCE8g1tu(vnr4j|h<dYW-%FTy3y-`<7|_EqJ?V
zzS@X3d^*E+mGj=tgbQEm@ovIT3g1|z#`n!jS>}1)FYo6CfleYfN?-}4uM$o7AtfqX
z&Vr#wBY{5wg%MDEY?39$JEWo$6HJCn<znl}vipI+Mg(tat~ZMnd{RRA?eaz(c=J?s
zw<P3Dboyr?&&9^<1t$TVDeoz~_l<Am7<wyLi#iHK@8l}nmXF9jK7ZT0S)#bfSal6N
zi%p{_u~$L%(^)+b%Ip1+pUz$}E4b6yWY>BtIPwx?Hiu|<=fKXNz;P4`_>=3i72}Nb
zn!KPh28bhN8!wQg9FHc#?ydUf7!B%p;K++rnO^|28Qf%wXhK*RaR?qp2}X=hkw>lo
z@9n-`?GxeZ(5=(O+(ynEMyEe#54bSoyo04Lj<a(Ud~;H=y?uA&M8tX{4X*|kUIx$?
zW-Ow3tUJ(HF?#`taNjZ8Q4dZTc0NraO=cjR35ueZp??TETG+?FW8&2V?~np_P|zRV
z*QFRLa@>3X9;)-3`J9i@o;3-624Xi@o}`@?2{alUe654-F{fVlH!o)GSaRG!hXre1
z#JAVnarp{{K3aOPQ+S5=9>19PdliM`Xa7hvitzzsasMiI!b9?Gx>^d03Qee0HsOgp
z9^e(>H)fa;{KO#Z?TK)O?MLF*b@vkN9=|il{bMY2`NRM_+En)QCx7{*{{Yf~mICiA
z_1DE5p`qaNtl5nExnpeoH^9Jz5*wzL6R^TPA^{gN`3ak!445K~6>D$miacn2l&>I~
zWPIYCUWnm|cjy%L@SBK+_9y4(9)6lR;2j<B{S9E=jJ0nQ05tAV6viNb_fFV$?#2Ig
zQ<tW?T}{lBV1wPRY0<&m@OM+`o{{}z#v$t>bmA`$Q`p-7Ca3p6kCis9Y5b4m^non4
zAs}7=bXwSfHuV24to!gS`DEPNjK8+}kL`BIeWW1g-p44Ybd{x|=5$|Ea*kdM0d4gX
zjHM1_l@vZo%sEeBx`e$6o&Ibf>{WNY4G=tWhF+#qs&EkY!Kzfc(<xnG(=AX76Aapc
zRQOSW<K4kE?0>`48~#Uldeg=Kf~N~E5hNEDOi#-at>xS$J0DNATr>*(dd)hc0fO)T
z@IlV~d?JncjaIp_6M%FAVnggVidj%PVxx9t;_%Pkg@=vn&a@g$QRh+P`kt}1i<*~C
zH{dyx-s4IFeSPGJ4%yS6v>J|^>Y@7JqQ;KIBe>&!W-sNYK36A#k^^q`Q=RYkSgi8l
zvfBM&T2bAVR#BLQhrqX!H+3*u4jx@vKFYLh67>@@L+NGIk@cX)Dxms-KMOy`UUjj_
z^Y@ImTnDO;@|b1#n;PC>{l#nSPSAL&b;z4k(KP(#rq9+V3I?y%eu#;rL=X?9J!XR7
zC()aU(-D}%X$05iw!2n>TkZH}FKzDB{v2xGzP{H_AcDTJHeGZF^<)_Xp|0vvPI?0h
z>8%OA7q0{GbsM<dUqqiNhf&($Pog30FKGuwW~?`3#a~6CHN!=B!K@caq|?2S`b|yh
zFIGCY>c*?cCdlC)@kNEHqZh$^)*)>#pc}RJ#uCzqB`>NnEr^AkZ*;l@pr{}&!%z3g
zDDqY_>)2sczv{dpoddL&g8ZEf=`(#(K-`A<WMOSmw&KyN3;SPey;W4Vp_n)Q4KB&%
zlN`vcSTTiEDXljS!GV@dX*x1McjkGKvDHcvB?5iRoo6Ab`%Z;4ek^W89D)BB@*MS4
z?GLZsn%GQYW-nOTz^|5zvy~V7yg1g#QnAQF`Pq$|KoS0^O5X>s>8Q0UD|UeON+$mU
zE~q`RRh&`lZA=}twJqGeh&jKb2PAq}4dqhmiczS-XE(CQj8!qac#Wr#4^2|%g0gPs
zk({rt1VK;blR}LG=aTkd;=|qB^?q%_#L2$UQ-Rv#J5IJmWT^`lZkpGdzIGPs*y|Sd
zxJpzBHFWeoX@9fvgw0vSOsO2=V#`a0;Cq}$qYFBAtM^>iEyt9sRo;59sIVLi!DZIF
zp8j5P<JJK!<j6f+*aDK!OK!Vv(TUibh6N@7!JR$ofrVuZ8Z2I1yK=~>F;um6lxa|T
zm4Ml2^LeM^agfS!I40jE*K5tSY4!m@F9d{&0b-SsyI|Ear~>(g;{F(0<gMzkeKeMc
zt<y&JrjMIgsGyO#s2*|H=x6^)(DlDs8k6K5cEjoB1+hp~_%EI5TWF{9D_(yQ5ly;q
zn`sS&up>_t;J5SKuw2)dh;*}JS-Fv4s5Ly8==F>s6S4nGfZP&y|4wV}#Yo9!Hq+j+
zjd6$g-0gFflum<>x>-cr?9MaAecgrG0pM-edlYN<R~dp?kL{#=o)Q(<8uA+QQAcpy
zUB@lBU#UciFY%u>-4GiNb5Jdz2=I^Tw-ofeFtE+6->kS2)^G;zfiL6!>t*G6){SEp
zm~a<KU#BpDkp(8yYMHbW)?KqaRQ8f_`J{C|t;6$Q6JYlJi`ySt#OgXCFK<>-Wb3w=
zYmV@z@gZaH3o#=Vsp_hnmaOUB8Rp}*<w*DC$~`&vhI-8&zjq^EE@xfaU!?(+jBs4B
zn;o;Ee82Nv*``JH30K@wf4t`DWADC)XrBJcE&LBK{QirCswNK`ujsuwj(&;DBNA5o
z&ib$u0*7ruvtK_>?qYG%^dQ?=UqR|DVD!`6fgK2kr|O?Tq!><$WE+;<pL0Wb@dF(o
z8WVbM8qP1U@hfO9287$*z#}$I<+BeEvU_X2RK*GMHweS+ZPa}gKc+{F>$vBCZ|J|0
zYiGT+GTRs&5Ke#vf1?Dg;PRer@^opZ%{?hA{PPrMusJ!s7yg{w$K<z2SxCn0Ds85-
zdfimr$^x<Xl6$B9@U$LcD}yoi?=`uV*_LzQ{j1cd^<-Q6Uww^<Ce^u+{ol59d8_R)
zEK8|$vMNm`@(+d_rr&QhfOtO0yKU()Y##veXo;7idA)^<_!SVTG{F|kexDZZ9D0>!
zzhavFVc$5s_?1vWCeKDLg2uI93n4#K-k*(Z<pQlaI86d^GKICemRz4r{1J-48v1J8
zITeF158ClfBSvqH`-xz8^Spts|MtEkkt_x52#1%}$M4cfbgBw%m`jCOkQ&^IyG+L+
z8n<a12OEBBH&S*^1I_aKy$X~c{n`u`j;oqI1kLyF7YlmqWn#v243yVGL9FhzIDX|*
z%kSR@2PRuER!3cY)br{8MWml;Oa<V=%JHWji#qH5nvM*rUp+$FtrFaBj2$8E{6s2p
z3vnL*h%h}F(51U0!0Lr!=i(PwVC^NbCSXg(>iOdKF^9`}3ZE=4{~zdpKXGsWvFTs=
zo3rV%JWwc*IGd=Y!EaykRzgg9_x@E|C!~**)Gn`<XDC?vWQ7>>lw825to2GL<Z4c4
zYNhqNppSu?eu~G#g_24aHO&fuG&9%Rn+ma}7V0iv%@rS)UIp%V1un&^oGmYS%9A@!
zJZ(}}LiM9Q?OA4(02|^m4J9`G1w_nmnaJEM3vxK$A!!oy)*ve?iTl)DqnMFVk91dG
z{|cupTYs%;fF@vlekV*O+?Qe9{HwuWdIa!b|1VhmzlRlh*C_##Mk(KN8=+a6zl*nT
zD8|3xswy&X-K9y0mZM{S#57cYk0K4#Z}Dok5L1c^@{1Wnr);l!9$|ytF}GZFQqn5y
zZYh_>$4c;*b1mH30{&j)!#67Ly3J2rpnQrc{V<!o!(nt?Nj&yzBlG%)^E<~LIiC?f
z8SQuFj9hduq7hgkazz~RsougwjqR8=n|*xn55_`5^LP@&|3cTB6aHs({bpd9pHwD5
zN!;={0$Ucx&YL|e0i!ZJGPT+&Kaaz`4)}u!4vG=#-lPCWp{wR&IgiFxxn`qkR*uqp
zky=GQUy)W60X+_XvzfCZYRysVC)<RO+e+aAF=XKA2>_lr+Ud=J^CP&ehuW>7eJPua
zR$gmXBFn-q$rv;URrM;PsuvzDQclLjKhf*S90{m?YsKVQk9?rzc|^Dj`?M0vcJgb9
z=I3LJ)y(Qj8bgLOHbc|TOEQHuVjR0A0`^8ftN{XHyrKS>EA;-H)_dk=O|r!Aieo5E
zw&98)4N%6;lfa)yhNtIyJ;u1^RACo*nJP`uD^ET45Qo~{BY5~3femSa8=j{H$g_0d
zt?!KdlIz`ppUH@XotWA_F6d7|W0_{0^{E=()2xT5t(<4*pL=x7mOIGCLPTm0ao(1$
z80c*?0^O1&mCgE0)O>riAim=UtQ_&l=yiHG-Gciz__Q268eb^t<I45tTist2P69l}
z6~+#R1L3a=hOAPn<vk<GH)5+7#~d~q=*!8Q$B86F04-sbMBhiu6ks;ZH~-{%E7F!3
z1j3k<m)Jepf)ICAx3rOA`ujtO@K)8$m<>29{NmJt$`mUd%cQ~)+3&LrLGMV+R$H$q
zEFRS~_HRt$#vV>61!Y3_1w1HK2qo{|7~1*4<}H^=;!)7zcg*gt6OsbDz6W5wb~imb
z=)`=FiB|91s`pus6SGi}L5TU**+lxX*9L|*O>dB|;uqW#67*+9{0UnA7HoM6_C0(|
zdCt;eh<mWoVThSC&DZ7b<CH3_!?n~Fz>t0D=56IL+6clKtHL+wV+O-nl=o<DRz1+1
zwdxs?50Ui`gWE^JO@IAgF`(Uik9iz246z3n{NjZn`E9VNa34laZ>o5#5x|1ZI)One
z0-jyM0-0;eJM~N<!DK$s3z+}b0-CEi3VXjVY9hn`B|^ZAwSmoqyFH;*`ATZ|%1K*$
zU<=ZO^6inn@uP@X2(9_u(Mp-ArS02_J%D8hitLkqS3~S7LlW{_?dmx3&pWT_gT@#C
zVBznSzP6Hr)u=Zip4dG-wRK&=bGlOTf6ZUAP=HZDZ#xd1A+c~5Ye;2t4aq<pC6W4G
zldBIca=+j4O?rEFh+A2v1=t=3;aNJ>@_39K3Q6zPEX_d4kEYmu0RP&qRk+bx>ybXk
z5C{6XfAVlwxm+pvKrN3~n10mk7%RgINvbZIp|I6ykcAJ;mvV7`SHR@_X){oaZBw!N
zy%9s&wzBd?Ad6&Fer&CJ7^u3-ef(Nhi>*l3vae}VfSm_&6@qQ4J(;&e-AHR}OCeHm
zLi?~ODh|Cdk-3laOtTb}R_zd5=QaCOJ5tuZEsMhb190Q5I)N5TL+=h@hnzyWP2v&F
zT#g^>L^<(-VL+8dQGrO<o2aca>DSGiLOs>+0ma9_a-}<WE*XL(O&hz2s2kuVg~X%4
z2oQhrt7sR1Eu5R^<S*XeQpXYYTf{!5hE>i~m-jk*dGJF*@|fS5R?z<LU$t`XG=!|)
zI4s1xS4B<<Kx|>JN(2(i2ubtV;g{>1i@FyNB4VDVPTP!R`*!5`bnEW2464;1GE16R
z;Aq)K^P^3;DTB!^<U;EDEy^V$BAVHAS(@D~R<Q|g2^feD!?m!(lKMGUUEyhX@u?s0
ziJ<w^;!%!uhu4@bfV!Xde^K|dpZ&k6``5{}=W)Q+(U0Ung~Bp`3jBJ=RG)kmg$t;5
z37hNofpCjX#h`JfD!Ri*{3iJ`sgGpRaym3_wx5N)%hX}zJ`C=@p6Eh({y@48pWPbu
z{U$@oSp4=*7a;C$J%~=Ylb4z%Azq9o+ba`5-u&xMb>oQwqH-&F;H}bl+>vU#zcx)_
zppHRk?$qXUG+y}ik0y<3eYWs1u{j~ZEnk>bYDb)2OPQ|5{th_}#rM--Rf)5*J`NIQ
zaG4w$LG5-s$Mb*~au}{-!wdGd^HwUIN<F;$wmJ8@b>8b^j?SS4oBY${-3^8liBb~)
zua~RUXUnUXVoe=D(XRpRi!@d`|4qb$mB#kCnG2xxtj$6Q`NqWjHMtPsE1tJ*Ft>$y
z4O|ci(gLjtJ>$Pg11rNI2&xz&5KIfl&ynaGk+bw}oP!mq)(@&MW4Z3^?!6F?K<D<I
zIBsBhLbk|M_|}8bKeDeO=Rlr}9pl%XRX=}PJlT4kU*x1QvBu^crd=2E1#&Q!D|o2V
z%39|A5wSr9{YFs%HWn3F&{a>ZB{)3+c3DrK0Uz#2pQwM<?tD57cWj#@x2VRsBSY9P
z?(+5KXDUA@r|nyh*@(r&<hDNI@#~b)ah%N<NS8uR5lsNH;GK9YlB}UAKT7;y$gvo?
z+n5`(ogj?Xcjs#*@m=uhU9-;jPBZ_a-fi*8IO7}9mEaAeG4nfK1UY|upV9|<kR|f<
zr=V}(dyng=Y5}!{zOM&<2`@Z9zJFNCGEu6U?JOuX!T8ZwN&A%WgvOA}%oO(jBkaw?
zp$yyb;r5gyOO|Y9Nm&!Jn~G3E(qb1vC4^+1nUt~{TI@_&LY4{Hm#M7TChORT84Lzv
zW-w;|J>K_wf5-RFcYOcgV1~!@-1mK5*Lj}TdGQa#{2gTL3<Hi153UFv(#sAMe3)>n
z+p{5}y&!-zEIkt77Zdg$Q-`gVtNoMwgEw}_gcQEIXaVvNVBK)5|BH}W%+r1RnuVTs
zxMkZl_Qhu2RR_lXxqXrib2GVWlQ?(`Q+g)+&?T(?dqq#dG)I}LT+b@+>7K8ipx0(2
z33qT&xF;up;dgsL=wXw;BKPczPvQ+kB+go6_^sM=MZSsj8SQCHcDoPfp3u2jdUxME
zfI#nyjO1KJt%o6VKis=L`JYk<@O7wkF-7nC7i;yIlBOCQx74prh~SgA@0wbwL9a*`
z(R00z0$pYDPVjwP0cS<}$^oZu;=cAvpyI+i`2{O{PikI%k(U&c?AiY_B6c|B>^7h?
zIS3v8$`;HXIg?#{t|8&$is=>OHZ0JVpj9utKUtY~AIc2obMiHItjwe5bWQC9^sQ0m
z;(;1h!$E5%aFzd=b_*wkko+W@^1_=i%_dCGk9+e~{)v&2^#o1}(|5FfzPL63ShoBl
zrzGe;Zu68ELmnuedAmjs#<btx-KGP)aQT<0eGd*CdB$&+1e`8W15d46x^WFr>cCaW
zddLftfoUwvoLjZKL)<s7fG7WYOv3|Yhto73FjofQ5vzoi-!~Xyj*rKb89G2qcLhO^
zxQu3hwj2jK5f$qv5Nm&Z_N;2nQNsxQaL81R&%x)E$9sl1#p?t%N#WF<!o_f*xOF`9
zt$o&!NRwX&4fg2_74ILPYvgbIvHYc1&}#KS-R9OaNYzoaOx@RSZf)n`3%AM}f`oCO
z<p*(>Tu3&!sg`voQnnOLa+*3z?HTdgkF(fL#$r}@SSWUaRov*bh|JbB=ApZoz1PJi
ze5$3Ia>%)@8u5Q!u<ZdKhW@vjI$@~yAN_t{5?aed|E3RytO;aVEN{p1P`}XLj2U2>
z&ZZx7fwCzF=jhm$Z}~X8v^hJi7g~cm?BjO~uBE?B{n)Mro*5>MSaFP7Y!|e$gaS%7
z=Z*po10UVWUDvekQw4Z8`9$l5P`c|ItV#31*S4VV2JtIc$9N1SH@M5nfYG!E=?40q
z_Ch1ure=9SyE&Zwbq(9)_skWCAz<N<858A@0ysW^GBbiTkm&05&FV1uJn5U}GO_M0
z3RsDJBz%$yD!U&P*Oi<40{zp)wG^2I*z`Mjtd)I`UIm<w5=XvBLiWb-$So6l0nJFd
zUw5x>4rP7G&}Ko^b~2OoHMNq<U?ge&xL5}fJAiE8FyLhYF<~|2rG(QA+9j`qkUBf=
z3*Qvm!!~NNZSR431pRuxR6zM9Cw>}j8^UA4HcP<gsDKq0KIGG&=aox>{s+E?sJ(ny
z;Jr6WGEw2oEO5MpTXp%HhMs<xak1;GA>OD3-*vO15oQ2P5;6!&^R%1Fr+Qep?UAGY
zz!<wUNDQkdS~NgvC#!Di@|M`<i4m4&ZPtV$^1%lmobnIxwIP&&H_d<tNETF2c=2?g
zUZ-4sUnT&+)|IfpJXBCRU_vole80lw;Hy1Dy~?=mEOu{5OD)~&3`#kP>fM4*RYNtm
zu(qZ(qiMX0hQqFVdy9W7QDbXrK#z4hAF(nZ@2NDgP_=CT^yOWe_m#QdSLy}nmumti
zt$J&KDX^z66Ma=mldgI{1^OtJ$bvmy0Cf_&9PaRc{rLlTh7g0{_op+hu;BZT$4DM*
z3tw*+jPtqArc2n!L`BzoDmj;*F9z`bcTdOfq1>FYm~E4n<$$*pTO&lKGxURlSLAHN
zo;`odz_xtbq=On|8cDiVbKaJER-O(Bi>?Fi3}a|!JR`Rj@-_`)cPCtI(SQdQ4kCND
z4ulJVl=-K~v~cUy;nt7g7DDBS;lu@P2II^jqOOw==4xZz<2_@Bt!A=sTSPgLkOe$?
zz|9MtU4*R-T;86_BXIq<qePT@#W!l|N-llol|=Q-C;6*hxyuo`pIMjxQ8#`Jh^w|(
zYvqNPh5yIo!?mJKbWs4NQW$pI{ggGVgrm1-9@li%jo*bSzSl!??8ymhmPM33<szfo
zWl7Xh_hkK)6ERMT_M6!5E=jth=VIM3Ea3~2qUU<eyBn@nk{(^NQc_Lm)iNG^bB5RW
z`L4{FEXnf9`McU9(D2!w0EGy0SA-yB)wET3&t>0FHRRn-$ZK-87nIj<Cm(cqBSiIW
zpA()-BQ6)OWI7d?>W=zq!Vjmcz!SV6xQE!xQbg)f0HY{^DX^C>@PuS}BliDHwZ(mn
zF(_Y@Io9)e;n*D=lhByDmMJF^j<cw@>B<X9{_g0DB;;&FNii$Duqwf=0%qUq3(f)B
z*&<{7hZi4$`#s(kXy0`F1h_Lj-B*%v_?~kRN*R0L|IcvWXOMSZ8G-wYtzB%j*%R-v
ziiaA%#XO*tUx1~sqr`Q&gYH3Mie>%@#D)a`G`-9kV71VtChmKDN!RxHEz9l})iMen
zP{jgxsS7$d2iW@`rC<Bd3hwcm1ImsAYR7>=t9_!m6jIBK;lFFP0)eN}<JQC)OHd~V
zVts&>r@t(r9e8{sAT_`EK?X(KUlvi{rY7@c=`@$y;dtvL2keFIRQ<6(bWc+aX%$V8
z6P@Xu`^5YAM|a*S*;isbGJn26qg*D1CvxGJ2z3H5<-Ie_xVLrWf0_+9V4UUU1SgZ+
zEtgIf-2rGl?bA~(wmIILZhrAbT`dvM&Iwuub$t%lQva)?{a0HC@xN(#=bpH5+dHF_
zn{>2mWuDyy93ynsUm6-OML%=kGBN0TAv${05U^MX+$VpUyXNYff@2!{uO>%{JzY4g
zbDrdG`3RT@2FP1S-drj>nA3K}nV!%0nv%Cj)vJ<88ta)|o`m)j);qr?L$l;Y^qT(8
z>5dQXG^DX^eet$$j@Z*{xG&?<C}lGY;*w(4eeXBxXDYLn<E_@Ybtd&7viT}!s0JV7
z%IcODgZCE*@M6O&?1zMl&;dfuK@TQ{2GJS#$Mh60pp|CNYX9i}+iE{pWC|Zj-`+V#
zT*fSdEuZd9m5&hxI`w1;;MmVQ`~EB3Am1r;Gq}^M^M;TfmFvKDKs#2VTmNbvzp3+C
zoslwi4dXU4Fom$#<B{!AUmt@p#7nW2zm5s=rgFxBm6H)LG4D(3iIJR9)o&I@f*#+i
zo7KB=>v7uM<NY<45k|&fJyg-m<zDJ)so#6Q-N~YPb9TQM&Qq(U<a3$|6^f$%vSKe&
z=ONVaV1tj*1s@&7)BI!!*YGK*vb2D9T{W?Xip3Ef)UOp;^zKrzN|rHcbzZpm8tX;H
z*&sjbrb8Pg(M}-R8nFWp0!GVC?S8sl&@BCyh%SQA<vWe)8MVlp52-skoAbQ1N6c<2
zRBz+^(er7Qu0$dMNj4|lfKw-ISDKzXN2^r4MRvM>L$I6?6XKY<xfq+yt4<rgu<B2w
z;vXzfQqxjTyXX0&R)wpOIOi#L80P5imKD7oT&kPFiX<}jG5cT;)!F&=*#|l`Cgn!)
z_x!xZ>IG+;&u(WPLUPfczu!|c2w&^6f4QKL!I<t0Y-$1LhBI~)x2EqhUlhcZ)NNlw
zetO&r#6pU2d8;!C_s_fT<)jhJkl5$tlnZO1W~cvuS?kaKUu%8h%c~psYhDldw)_5L
zwa|k2iis@ujQAfG0K_6vv1a(<`>R%DaVHElBfT~0rGF;iMQhl(3Cj?Ab?&7_uPlt)
z*m+7eP=DtV&`+voIvU?VF>lV*M2DdRCr;+T0xkj_9&Dvzhu@**KTmACxr+PyHPk&5
zQu#y9Tr`xRm9Gmp)349Ok$2>}?N;9LUCf@`>j=7nCiv%YK*1cgFO-@S<VqcHIlgeK
z^vXh1`6uT|bH3v|XK%Irjxvfo!(Dm((CxF*$4(s>_sfjg|5Hv#<=n9gB2gdqh3)4r
zS>iX>fAlHr*RmfL7RTwP>;%Eox)?vl!VzuG-UgUxT88^9PO?h}Zy%0e*%2mCMKo}F
z;j?-D3;D894fv;Sq=p&Zpmu>{t|yZo1Ofn4IvUrsn+3l?{h`e~G*Rf2x`pZeJGE#O
z>ij6!=SnSDx!vqFvS@uBHpk9zbHc~eu_PDFnBtetU0=;6=&mEwRoGrYid2uR^gvCq
zX|MHl(p%H`xdO4?^O5?<eGj*f6j^Ui_$TyD8g)keBI>0^!?{K-8a_i!um1q22j@`I
zB?6=tL0BJ7#8nI@Ose0{MDifojvV4HJk>X-1qrd-P+Y%h8=@7~tCbMHC~@=8(oJR=
z+<Iq2W_E|N8(X_0M%&e@Z`X6UUqohTm1r>gS>msz+Zu?O1idmOwGCVt$c(FF`FH0$
zUxf#N(o!MKrS<Wu&?&LM-StaET)X?vioo_Mh-MgXw>WIWkVtB#R>DXA+I1E2K=Z)x
zqx`fiCjnDM9juS)3Fj#Si7i6ZeOKX;vFmo3?)BL;p9pcH0=MO}HmQ7=wR?Py^zW3U
z@QKCh^~h$z6;EiG2Iy@-Uk?QM6OyG|-dB1BuBB@QTn<?J!)S|G>#!+#Fsqas<WPYP
zShyur(dXjd&?wR=!d1ZHC)Qs_^ysT)b7#-j9&ZXz^1rD%PIGMdW0FnNV$)qpIa|>j
zA8;Fjc3+i&8Dsr~lc@wNrXutXl;pw@04Bq;_(P@q*47fiEpo@R<c`?aId%oLy#R(|
zo^cu;3MzMztBjwd<S?T6QMUu7xhXO6iquc0ot2k7aA(Rn^->J?tt`%p3xdOeZW5P+
z*{PUf&Z02ntFun)To>CGj6*PVSv68@&XS+=A`;z!E})*8m$=1;`VFVsK&l|i80LPK
zOvLW?x7Dxm32+lQa?`8TinEJgX0HATt(rPg>Da5fu11KGKGk(T4;j5<_wtk%ypT1f
z{DR{rk7Nb2AAm7bHiQOMUrt4x;viIj?=gi~6Cj!?U@pPLo#y))dwnbBRFqxJ<@%AZ
zulL6Nhg$UiXcqKn3Bp1QJ>wm}`+ZlsT`SN{Sr_O}-}(;ew;Bwe$M1WSk?A(?SLHNv
zsq@!6BCFrYJ#Rc!u}iSxzFS*MHrW!zvVZFP(gHWjzA(T?R%vvmOsQ2_-sxr-bd1x4
zD^978gvL>t*HOm7&S+riB9ASmL>t-t!>4BT$c*UUKHZpmRJ1Y<7O&q9Kij7r@2Pxu
zic)3xY~~^GVyJ9mYKNCv?OH>?AwtR=wn8IbgkZb8Rt=s{*;#t?PXEBVt4Q9N_<J#D
z3P;a)9R0x15ia2gKk;cOtPV-gxE0tkGI>%(+^54efOB~83OhU$f3qj-*RLg5yHZa4
zLSxC2ba`l|ZMs!8!w|i#C2mTwIZ>z_;JqCA<*4-6qi)8sTQW&ble--;za(#kw+N9v
zDRXYdN)bd37yMNaEMy8E`8*PSETZ+p5+4fdq(yF(Q3;gBkH<V##cAAqB@PY}UixTO
zk>7_*GXH%75v$a9=j3X4uJKK)KQTd|x{H#em!I^ELkd;<?2W(V;A+o3WW;_J9Nhj_
z*z0)LtUAU&$$cQ*E6>|u8Z%yn_kkXv_pb)cEICBrcxZ77j6|lg2?T$-^Iq{h2+Q{w
z!;aAl#cL+9`SNE)w@PG$pp-6|;A`;0jf?03XfCp3EpaHdj-`9T2bUBAv}A{ydV(6M
z+kBG0ahG?5BOw<A%E$I@kwiZ9V-M2$^gJYD>y+P?Gj@t|Jo^t(?;e!u4N;7%9Ee{1
z)ReZ^@5>zPn3#yV6^x0&zBiCh2tkB#HGX8oxHhK-1M}E5T)$K0xopB!5^m?1>T5<L
zxd?ycikA3+Cv~OL445+<UqI(kCCQpF{l98T-WorY9{KmG;q{+~P3;wO75;9@SA=v5
z2Pbt{ciyOlRChca>{t&~##5eZ-T3ZDQDu=;2Z^i!)QTzlEz|)?5`**)v#CBVq+t#(
zoeg5QkdfzhxRG>xugh)t4>4lfa=2QphP-j@%%7aV#CtPx0VrXVmuaafy6%2B<WMkA
zydq?tgXP|yLN02pfLH)7#{wZKQ(M*0rH7jzgkBlkfDBnNo3^G}SG1Nv`4}S2iz5oA
zr9n%=R1;_FIo^>=?9ALC#RwiTPo0H)au27_h1@~U$FQ8}!JHxZ=tIsMM8t9iXBLSk
zj!ALapjSa#!mTc#w+I2EUhq{8?|j6+gB~N)mU4!MOTJ<@&c`L0_<aNn<5amY@6%H_
z7~a(;2&#@iWRg__myOz`;vg(ExSYM}!q(b$fDUVI9+<DnR-y*-Y~YA<8y=+UPpP!e
zT=)lfx7{67vU7KH`%B+tRUYR0=<`D+>+J25jf;^fe_f(_*ta*31<Knuta>&6HF|t7
z?KqB!5^*>mTE-#<hSz-mDsB!LDrL1QdTC?Er=Mi``#}Y%f6?1nh{{}d2s7om<FbBN
z4M%kO6~M1IuXlA@W}q3zJXJ`imOLy^srx;F<uq3_B-J6iSzaR1(DQi3PY5rq+9juK
zx9}D?`GMmU!qltj7T#qk$#GQ=?N(Y@DE%Cq>$qA;bwPo-lPX%mw;P<_Zj7)J`_bci
zPdR*k3|ytJms6e6to75HFm&PQaj(>kAfrpaGA{H+2oW0-U*6VClP+1RT72r}N<Y4v
zv>Ad#c9jvNNVQ@UHz33pvzc|Q3}C{*cj875+Fot4b#4}_7p%-lxE4yk9g}=hvKG`!
zMA}pk7)kvuku-{~=^Dgz+9h&PMq6I!%9AX3@ugguvhhs!N1m6?yECpSX=l_jR(#uY
zX>*-OtdG?4?YLhGNZLj6g~lr>Nzr`Q2ikN#SEF#3i0J_>#3jV9=CA&_qzgZIyd9;2
z(QM<LC$jrcSeJUAliwqLCU|p3vwy7x9_Ig0jr+({uH6M!ZKq@+56rY-*`28daOiM+
zU8KVM;O+O$l|{{K&Y`ng$if>*$`ucngVw3R!-NKUP8&%aPFqG#qXt*+ZNodmrGn3e
z>wQc^v3{m;Vys%Zv6Ilgrh%?OOk1j<{?RIq5KH8?{!?-Mu8i|5;w%l4Cn79K%X0AH
zb)H)1l^pxi%Z@8GOrfze9-*ANc1#%P=5>VeNgW~@j0)s)pZEX#UL|+66_6FW?li2b
z`DX`=`!4dCanqaZN0F()*@LQ=O^99N%;8`9$Fd#;e0dxjo|~(Yr<u3Z9LYc$-8p3S
z;N6ySfwuYrD33Qv^h2^<=%I#EW=x<XE^+6MaktDL5p}4|qmwrd6@T0fgiN)rnInyn
zgehn=WDCLi(aK@8nj%-Un7XVHIFq^x?UbLhTkc$pXD1<zIB70q?rkR|Rd4Gdr$uVS
zg-(Iqa@nS^ts3B3&sr}2dnahQMz!EZZ(@=f0}i!xaJ8#j)(0rD3n)W7SDuId;OscQ
zm5`DNfwe{OWmAvS@{laQVJ&7RRG$O1sdqq`#8oP!i#YO-vI`NFI<ayP$Bmrh-r{9S
zK{MG>NR}1>#QX|Ea260u2f8>N#v!@L=1SX5;H!t8%<xxMPxqVV+=tlDu`w4Q93<U<
zuF78JU4b*E>sE_6EKmmCBCO?I=^~U8%sxcJtk8R*Br5`j^A#iy<r4Js>$$aM=WhIb
zjjuyyw#z&#HUtE6BQ-r}zv#z!(|#&AmZ7!9{)=FAZNVwmmRy*_m?8wHk(0&rqw5fb
zNSp&?FKCAq8V{M$@+ikp!&{9w4u-Oy{gkMD#odP`^`MljL4%Yw{fO(H$e?&>swiLF
zRp5B|p!awj)Kk52m)9cw6dE6N=FcajDoCtoe8-z@mcTV|7wo8&7t&t7d}ewqJ2*oi
zlWGsn3AcQc9=Id+e8`pOu;I-b;hRVG*LV3lt_Ba7)(0wo`d}@2>e~m0${3Og_A!59
zpMZPYx!Yw5ps0%`xxYIlRGaRJSY7+>yLtsGr=Tqpj}m><|ATK^D8Y%DRHT*KxOwg0
zk7`NMPZaxpna^x}<>CQYl9&kJ(7!~rt%qO2Z5t8Wlqy(=IO0~#dwsXSgL?^t1;2N?
z;i>BB@3X+ElF*Ricq!+%#^PP}y}%ORlBLU(t1{`D?bwU3A3|h>y$_k@w(<8C`Mf3H
zEFQ=!%Iu9ZKX1EOv{01jRz}_54{kZY3bO@AaBu5Ao837~1zNtmEyTAHk95ZJ59^5w
zgH)q*+1AYj5gBRXB;)E0RY}s*FX8VOGFV1@{@wnUg+WnICG`r7$0nv!1CQ&7#u$HM
z+-YJ4ha9R@gtmuDMoPr)i-qk=;o6J}pHgfpi0K8=ri9YnWI?{;H~GFYKaMkL#ZE{d
z-S^7V?}U&grhoIu>nAF;SF2D=HZUjcK6H?3iFax-enRp7e@u7RIQxQmxP8d=V<3sp
zscn~#_4Q9_Go{_&kI_`;5FibgP(X&qcU`#Wo>eq2|7F^0ZoY>lelQD@w8olYws1a~
zM!BuYYkM1K&-=ywU}+YIN{teM1fPo~X2EwZF|3Xhi>3#0uoc$ZLcUXiY`YF%ID*5D
z1EmGpt49=(S!Klx#A~BudL&8u1uqSSBU)pw3Ri8lePZgqtSBVd*8P%O{W;y4Bl6+g
zjZ^23d^;U=>~BVIb-n(Dflt(Pyj(WkDnRR2#6E&n^KLP$NFFY}q$?9QbeY)?kJQh}
zm{3l67uutCnH3ie17Axg`jd26ld84I#R$uO<yQtd?QqJ}7<>WpTNn}v`HkY-0(aGc
zOMzsZUQHk5FfnL2Gaq^ZR8ODw<18_if4I<K>;Uj-H4xs5qr@V+Fh>E0gH`WsWz1G0
zeI{a=G=t>8(JpLr&U?rfh~diW#V|NyAW|vv0cb^@)jnMWa(IOZTxR3fBve6R;z9iq
ze&P9u&4&^Fs-sX2hV_u1)y>(|I!<MR*z-t@4X!U6x=<I?w6zIZbw)AE)m}03k~!)L
zE1g4w{RM}pUUUaR1Eble-kJ8@Tzh|f#MO5fw)q={VTwUpR{LoVY(-9rOD1i$hypHp
zXQv?bmJqVxd75L$sZwRRvECy%@>@l_U$%hHoLqJma_8Ze7rR|*kVwx^I~DdnEMOWq
z>^L?qa1_ji)XPCdoZb0Mk7h^0ze3Y_J6o61*wWw`G&`SO)Xhl3&>Xgl*yF)?PQ|7l
z6Aj8k?)ov0vBv!9JoIq(21g?8>vZ&KI9{^g_3%Ep<f!nWN1Llhgw@p5d3k`ehI83a
zkX=LnDg{(Sb(~R`eqJ{7D+a;QMBZ{?Xd-VTmxY=7tZewU`qq6A6~D}(_d;SJGYGmp
zc&ZLk4Vh!KI)LahP#viIdN6pyVcQ1UgOMk`{r+x5CF$^t7BNt4*f;B)sqXrivL0Io
zx_EROM2^T<L^25S%!j))tYfbVhBXT)M^aEr6OwkzJJ-^2C&thA*|0lH7g20Gm#-LV
z6Vd|I6NpD}OhE-4loabNeY%eMtyvv2^N`bw=xbui0l{Uv6uO9BIQkArfYXFn4MdJR
z-H+4DF$3))INtOzKeh>YP?&`nH`)F&VG%}bp!_$!&vv?#Qd0FQyun9^hTKQ`)1MEr
z+FkA*_eO9N>rL}G(myMLfo*xR1y$2RTVJjoYpKsA7QDb(J_l{<d9K)~c{mWjaPKK+
zOxIcnga;9*vP&hYONA;X^@#6G>w|wRG=KIQ(xd4iWqLIVGr3olmz67Uz<&01q|Svw
z9JxDwuts2?5n|Kge@GpH9kc28A2hGSPgd~}g^Jl1yh5kE$}XH#Crkdi*y*@>Ej<Wz
z!BHv9F!?O&dEn2=4(e=UB}=TJ^SzCC8<nlt;B8A!Dl1B0j?Bcbqv+wy6kWEbq3@#s
z(Be}&+JEXN$7_bQ;;NN2<z<FrmlmkQHznG+a2nM@Y=HIJKEYvE#HLaG=ohbWxf<@|
zm(6{QnsVIU8)Mm`kDNHbQ6o+l_h$T&cSaHn*QoAyi(Qdp82_|E1EtZf7Et(~k1-8v
zVt=xCU){OFMbXSQ$!b-{MEtHy3$B;qjk^?!`#Ts>@s3CSB>|-!5j$d)ts}Zz_F4X?
zqPA9jY>_+paO{_XKcyRZ0k5{{&ML$btgGA5d`1F45SYZcHPb8VOHtbOlJFomAs?Zz
z+b2Kx^y{rf;l;9><3D$|h;$)SKGT*UXcd2=RH)1>^4Mqat7(+M)D%<`9%48coCMvE
zQb*9m0|zV}8H;*h$BBme-|RS_7&=RA^jy0k+P~lGUrX{t(nhl>Il{3?1vrw~cE7qY
zYnk=mKP=U`Zk}<01uo8X<#=c8V%2Mv94COe6`zQo7z1ebUJ$^xbN_8*1Cfn!K~g4O
zO5UB@v0Mz)Q&L&tWoZFF+~gwrs3t8qq=PRxv|)U~Z4P*4kak@EHc%f@cZJqecQ5$x
z^_Ts$H<FAb>MVcH3+v8*kTc&?x%-hnn5T6en+X*!4M+bsAyTD(hZngpN;zsQA;S^+
zfFDPKE(v_WCNi8^4N|-Aba&`3mC(ed5xX&eNYTPBz0t0qMIr-(_j})B{VZj!I(SCe
zZF6=vo7V!IxC46I^sSKKU={0_wrFoDZbLD;@Hx}uuk3xHrMPG(tw5q)`&G3A`IfR*
zU{Ba;Oso{=2K}%Ljdvxhl>{FFF`z(B8?O&yZ%Q$tD-6yqby=0ULL7#(aTs84HgRsS
zA~Dn)x<P~)9e{59{;4vfp%oA;W*hn7Pz&FyEV@kcb(Mq0(mh9$&$vVH%P#;*3(&4Q
z@;atF8W=Mk46(#ej<OH4N}$`kD=3cW03E?{Wu<_&803?!?|400>3EJKcqI)ITP$rY
zFL+QcLniha<0KUlVth&>5MnF~+vo87>CCS6#u>%04brKQQ=X5K#O~0Kf#!R+<7tlw
z4$xk|K0QWSLzC1d<$V+LBXrAU2)X5ibl^<av0ec}HD(xi5xAsn8~`$T@MeY#gndXp
zZatp0Zzh&cR$UKt082a2C)BX3ZSC+{eNd`@rVW6yD0j`(p{hrhFIrr{?+Q-sx>qpS
zExWJ=ccl$4!M5?~#>46i@+u2*LdRKXxe+LTuHl2=?@VXGC!jH)a}Q+I7MhcfbpCP(
z#VZ$oIbuF)<>rYS_SYyeBp0*)<cUk+4bvWMXWH2PX?@{vAYP>Ng2p2rW3z6V_ny;~
zU#C_OryJdBpLY3#e_jg*>M_ufj$#1?l!{58o5i>=U)z|_6FN2IuWD6{tG$5Ck9}pX
z7mRr{#Q2Ra36-4E{MT-F;<s(V^^vOrGHQpo3;xB~nH87m9BiqFzx9+ddUp8wC?#lf
z-s?VXaCY8J`(*d7O~Sz@mC4gRgWFjkfoczxpGPw60T@GFcfYG=i@reAF<t<7c_(tA
zFF_3!Gi2nZAbo1<s_fR)gqWyV=Bq7&OZx}lz-8ag9`6zilEl6IH3bnn0@AZ(R==%`
z5^7@`!k%z0R^cK}G{a+h+29CDOt)^Dwza5mr03xNNiQ9;iz`|MNfRpUdQq}!hQA}(
zASIZ5pP(IDw)SlYdPqikxXIF(6eDI0Aj=JxW!y$mPBzGRo`a0Z1sni?uh1!kk(!%a
zu^nglD)naw2q^#j7~9Lp*s^@#4K2iH=<r33-GE-2hp=BvJn71vch%5w;({96LMf3c
zuz^2795pfCNenTJ<Ez|?RKSYk*T$z*4dR1mv?}?O!9ue;(Rrx%hwwd(%bhZkeD(~P
ziUo<f-?4XPK<gbcZsS%VlQKO-j9bE!nfgQ*rVmt{uJv_nI}6E=X*a#_`wV+xKGAej
zybkq;V%C{T(0NL3INqWlbyV$q*ufWw`%`Cl<6Uc!AHvNEkbW0f3Z55p$b4@R{Wbp)
z)vgeFO!aQL>*JJ)x%S1!DKSR_tIRqIMayIPZ1;JdeRJC0CW*rIxg~FP#ZG<l(KMx2
zIBfCa2fNNCII0^zSkqETSd!{eXc|f3h#hVZ9&hyj1K6@NcB4j8m(nk9eDWR#C2hF+
z`{BH<tzJpXktEeZ59N6KYq|I4;^ntQ){ll5YnqeiMUvqkie|X6oHP5nvyFv~?Xc#h
zpC{X_%mxOm{#4=3+pJv&Fr-@KslcP9z&{b$T2zQ?*F1+~mrd|Wyi#(9dmz(-XFUqk
z*3;^jip<jC1`Qy~mv6#3q8sAoV>;wIiI+;{Ay=0A407hzAUMC=U^8Za#Fjyy3(cng
zo$~A3wKq+v?=I1}dxG@2JO@Zc(*{4us?!)3mT>iepKlhy5$krZtQa9qeIc)l7;G%0
z$^7$jL_cL8UvOO{1yLIrGPAGTK{G8#O+SXZTJSBK+{owJ6TdW4_iHA`rt{mS|9H9h
zA^Tm!3+c>!l^qSY{TWZA<z~CVei>TiEH6<NVpOoB`;jG{M-4m@IV&6LRVY$i>E|B_
zud<c7wW>#p)MkNHUC?R54Yo&HKn%t%rtShLq2`!D`h6eoT4mdC(4r4i%Bf~`MgZRz
z1k_PYm3q2FgIRxW`_jM)%JXu3eN7FtLopIRv&rjQo02H;M}G&`0EFqpf~Du|eSQ25
zcSIlW9G1NTJxnLrQlGY(yvjhFPO4@B;ob0MP?F14<lR(=O=~XI`vv>9QNCu~2AuDb
zKvQBJs~H-wtH8cY)J;_RQGwa<9`tg=1E&hy$TvyPCKopj>SxD+7F!?U>o_rZ>Y)Sc
zRAEBjN7?*CW(ivF9{@n^*`f>TrSesmtQz#2(*{u^4C!<oIpw5Ge>f;TxbIaM6d+mP
zIl6(f{n@3H3sQlYC-Kyo#zDJxV;8y&Yn#`lOdr<01QSvX>ej0jSSBxtdpU_tcT;Gy
z*XpDYX&?)@X?V;DnJ$KNJ?FiA4o)Iis0&?28G_0SGo0~K{-7cWG&=*<ikhG9{{|c&
zWYKENMLhb?`#M&N$ZG4m4pz(Z8AFnB&-mY_#fDeitSANOf}iKifF5EHMlwb&d6%Jg
z3o$_CZdt}>GG4JmRh%)(`o2Kbiw;zqKH43TPn=nv?flETzb6-<UY5(t7@96JR{ALB
zho3X;%lbIrt!>GA4%D|}?cGW<g!hl?<A`s&r}|nrx*HtdYgn0%JJV5z)ZdmR+u9Td
z#<?Y=Zy9NkxM44*J=j;sG77Erg8l~3k5@=be#Z@;3f&d4uCD{ddCyo$Uh`AK{$5s(
z<;$<=j1j2lkKqwujC!uI#PF^!y$tw)VTBSRF6TAe2E2S`(!)i2_K`kS*>S6uKe(9p
z(;n8)8MEAd+4#B6;i<|SiS<dKx1yC*dm)2gChwK@B>-GdPtMG0>;Sv+Ew9N+-#+b{
z5P2p<nONUz=6cgS+XQ1OJ^GZdI!bzbJU?8fTEeM2Xj-l<{tYO=IsSlNV2AZ-KDo;k
z%%?7-MC3Xe_p?M^V(*t1+0rf6+;!)CI3kS?XUs<@0wx1@I-nq8W6^S^5LIhH`srB1
z!KL2%C!P0pgb)7tWc%D)uuVKfHn`zCx});T_k<pQ0r~Wj`;c7MrLRkftBpQ%P0qbL
z6G4tVVYdAqA<`-DMDJESvP>-veZ24i`C_WQW9mcW0j{xRTll%k(kbTYWl15mg!mXI
zWu*ee&@Ro+Zf}UFV%}J?=^Z08*QajNzus<^y?7nYnM)E1?TJh&$!h34n^E#H;_tWO
z8wOYOqqKzYkojvuBpfdvQ?pHPOryxnjp!h0iq;81pyB~iEhakD+^&vn)!@Rd?9It^
zfH$ihNDz=yy5o!peXFd){XVw-SkQs5L^_7+#k2-C=W^vGbp)$lDwZ!Lc!(uEK#8d`
zZ3Z|fV+;4*u6nmD#I(^FYk1VwmwK_HC~509$vB?qOAl+qSvhDkB-d(Oibxz+43IOJ
zk}7OOhQ943q(za>?+{wCkUpuT4_AUTO{ik`yh57z89CFkO5sUQ)m3+?8^FDz{s=*K
zrkXe7D!S?--bTbCbJ5Pa?EX*oelf{fq3tjChu+rm4-QBS-j)8dm^>KV#S;JXSBcZ7
zw{fJ;vJ|jin-%k4N5ZS|Wy2RjIcjJ>hS<`-Nl9yctj$%bal4_+bv`-WIkrV%O!9jU
z*sz54jvK*zhX8mrHqRxTAiJrVSdIlU2N}9o7M<ru43-aJYQKcTQcMmtCMO>ibTYdj
zI|H~(KA<h%^<O!3L;YJ7T;$Z!4V5?PVds0^p1<7y)Bo^gZ~OcmqUma9kj);up0{}H
zTG2oxBo?Wmo**KwcbZ0xF$d@6WMfw@kTs$r68bcQdkG;>@~!<JigUK_n6h>#H1*C7
zm+Ue=C=b=Eoe;J(;E>PqZlyv$Rl9TQj&(=9kR52)K(k@_SGH$L9+Qono>f4y?}~C~
z>u~LJ%}W3%?7Kg(03aUlJL4&E36R%;N2*x=yd;FqYnAYe|Fuic4i+PJ)vu*t^@w4Q
z9ZDe^*Lin_cTA-d9Z$9}9xVP33n(_+s{s+e%QSWfyE3_2*Bu#Fe7&8}3@Yv}cqN$@
zoENC9FH=<!)SH-X3R_PwNQSl_a|`ISmip8D#%7oylRh-HTkFGY2e|QR^fR{YmbEr_
zxD&d@cRp^M9#9k|SBEGdn+Hz=ON1q&;g!V3s>%}}d&RFCtK&PpVFUPq&vFa8<=$*6
zqpy~c#7*1|p1s%@y;mxvP-{M9h0fTGk%trHN6K90qAr^ng3tBc#_GI2H|i*)XWtK-
z&>^MY_e%DqpV~4gBV2*%2OLrHDCy0S+}t{4yFByNsXw;AQ7bP{DG=U6ed}mn-rrU6
z+BH~(YzFGcFbA6%ENxKE`fmd?9B+qz(FV{(I)lv@@tQBWOwhhbZS4LEeOW(=j3+jq
z_G}jgN-*i86<t|uf}sz!Wqg*Y{~#7uPiC|#0*kHo`UU%b+)ywbta2CM*l(5MBv4=J
zw>t|}l}Dkk%ba(?YD|#A`ZIS!U;7Ab-JS&;BkZS{DcyY9<~dzKS@1mfdiYIIm+;1D
ztH4%oC9q>@!H#uUM?{#e)q$lU;D+}dbF+keh!CeK6mSKOh>07GVgPYLTz|SZO9I{f
z7RN|Cs(a(2sZ+=VLGnu*+uAaE&1Tth6c3*DhaU-eff4#OL6EM%%08YRHS>Y{B_ZDk
zVB<>-Z`v|_l`o+T;1Wg+bC{+qzm(vvPO&5p=!szE_*a}GX(7?QuQ(>3{E5`So}C>~
z0%f|tk@&?gXv1{xvEq{T0DMG(*6?!#Kht>-+EK%~k{zNnMgzDb{6AW2b-OiDb^stJ
z_2}o>CxZKfA}GdKft9pzW`_tZ%Td7eA|NjS!G3%D8n73E+{^hZbjJ=2fX-Vp2!bX@
zBRSeo>L{^`m4!wpZ`y@qU;0Fpv>Z4O?U;fbq-P;rv;sg2niy$5&1$>cxnmK6McdzY
zj{)oJ3#z4JczRc;^_1aty&Db(U<WM+AI$TFjwsXvW4<U20S|_Yr<kI<=V^g~V}F*=
zUjvn{@woRg9J5PTA2y3PNZMJQn2L<{M_29ISmD054+I`W{d4?o@?EJ<L$>M?=+|2Z
zS%aU~mgiEI1K$_K+%Y?FPvl_b%{Xm<6qoFXvBiG1<A|EMrX7~%lT&l+or3Us7T#}p
zm+$KJnUE`;n#g%2$w!vrNw{QGajnZ%16%IkyC81KXPzhnkZiK=qz}Yg=V=$>8_IQ$
z|211h_8ymhz#b{wIeqJ$guGLi#FBUkPG)R+3CjoTQpzyjzWMpx-&Y4hTfupvAD#C=
zTkthvVw&xTJ-VOW+OlK{>9W<Gr5kSoWWO;>NX%Yq_RmG)<}~8-k_r0q#ySiOn3ulN
zl)HkIa8H98Jp7l{fj8Dv6T5INJtSa>e915lwVeq%yvRq^DePYHSR!+2^4h$sz+W>d
z!{VZ%nMVWjf@EKbpYi4#!-Ro)ey*Gzn%g_?4;dtONt=`%3i=q>SGt4UlMHYht-ZgY
z3#)evNht0c0Ww-{YT$rUK~=u-GpU8j-sqykC(yiV*Edwx`OIVZ6p%+|d-SaC7I*%t
znA!o#C7DYOOMir}esiRrUJfj0h?8PYRU0cLMDpvOl9B!jNO(Rzpq+!o{5ro-!?{l~
z##~Ho9iBrO+i$90%^3y@`8vEf%Bt>fX{MZ^ZclDF%T4bCo5Qr<PEJU6FG9|2Un|$4
zzgHZ8_M<cLLahB)kqaxwfd?Y!b_%87a|-p|+yVJA76{x4k$h-UOk8}3WMe?o!;55I
zF5ZiF*ghX4!=CEPL9!Y*o5I{4V<KMz;Ta_0GzBny4`VPVoT(Q#kPV+|LcfN{I49Hr
z`Hc)dr}sNL^qt!2XS-RZ#yg?fL|}7?@a2QJ?(b1Pxa6iUsJlc9jZ{<PeO=AiNsjFa
zAA%<68j(+@62{~jc-;qiNn{xOr`k)}E#Qi%)(7gr!>p|PY@SjsDn36Z#9g(BofIx-
zIgj3$gfXsQ@<q~E6&|57jXwzEcN(?zEIgn$+e3Y;1EqUFuOmKWz~(BN_k=<0r(d4*
ze4;)T<hF5WzZ*Cn|3k$w;FgN3^4)&9zC!!9Zt0xOpL20!v(C*PY2M_EQ;YjupY<=M
zn0)HB<*SL)EgZE+X;^%(G$9Cu8%ityT)*jeD8*_kgni5js5%iTs#=B&;mhY_U-&K7
z`OJ?!M{l~IG*@-ohQMXeodU^14-8PD0YzUhPG^FV2@+&gR&k%4u%;o;h*Z28eqBWk
zTc#d6mdVm04|p#$m}^%4KIH!3IcN`7GutvKCuq9lYlY=nJqJ}EHO#e1-*HNFp5{&K
zGNw8iCJw){;hfxPskC^7f}}Ash|E^pb31NR)Z_7AdRRq|zka#he->1g*1FG~IxjXu
z{?(n0ll;p{D-CK<7B)~GzDh{FDS28kLcr~L#zN(8|IfIFg@;Kv=1at?PXn<>2rrf;
z=A*v1uM8&|Arwt=6nTMG6K213Bo{T)+211NPMJzM-Y3WVCqf^nS^PX<`F1l}mfvum
zt(2lHqdE>>HsYQ_V@l0hF3kIBO(U!&QKAJ894$@Hwo69uo0kUl`Z%mk1zRfQxuIxM
zu2a<dT*gS!25T?r6(F2%4$~Sf8B-39TJI!}G%k6N{)*GYUyc@9sZqv`dp|4;H)unp
zi-$_5VK=seon;bj`U}l~qfH;HK8Udy+XgV%#I?)FhuV9EAIcc1@&HUUp-n2hhhEv|
zi>>e|X&w&SQ4T69W1ZO03!2%$BbzEh87`6Ri6Jo4SmTOI{<kf1_8bB9b|COT`p2B+
z9g#Ycc1D}!p{NF&k6#~TM6@~1Wl5s$EUeMHKWJky2W`uU9y~sCYv)=6KNxL{qM^x2
z;pgebf#8jbQ0$z3%#-JEqj5;Pzn3F}SI62e`nB<fS|v>{M$xNF-gP4IHhf}5D+8Ui
zr!zX=Slhu+%l$|u`AQKZC!xv+ZG?W^AB-GoUXEk!JfS(ee+?fJ2r?}t$KZ5!Pt69M
zG37M4OcAf|H2zi01z2@I+QRJk6x4vIn>I*o99h&!W~DZFNJWgQvSa1rC;&7akd!vl
z6f9|_GEkj_VaPx~mg3%^sX?<r(};=tby$=?wGyb#@Jr#W9@T;8^K7{-tK{oy&rsNs
zWxdf&2}<lG{78<TrOxv@GFQQ2hJVd>X#14!LhM3DDAE6DISVz{5SV#M=W12EfmH6B
zmw6j}HUqWtuAy8=q?yOqYTM@ric%r(7GMX0^h}bgd*UxhR+^APBh1=whz#-@@tuQd
zi5l^_hVlDx#ByUgIN$CVKf2$E{CeXMoyD{u;=S>}jpA@Am@b4GyDY{y2C1V(a$Gc)
zbR8sbkWwF%&h=Do4m}$cMFwP3rab*$lZKPQ#3kMvxgRUgRrzt7f2X)-`;D$OE-~+j
zZ~nwt$g-83$wadBn-gbFCR~st=@v8r7$|qw`<8~Skcu))&|9IHWLNaTOM+RAgAtDa
z5<1-IBxSAor4&IZ<dB`RS3{k?+YnS0U#Q4XqCNQ&RnNx4FJ0a?%XV|vtHJq1e)G=c
zBM3JHVdMGKPM_>?JzpZS@8V~GhjwDzlpe%4$5gA|4^KJdDrA2x-D-ZrV}(vOdlMkQ
z-zRHck=8qBh}LYz#`HD+3!U9zB$rtWD=!z`*}nMLf_>|r5+g>s%oXR84vZu*<K|W`
zaQvOE^kVA7e4(7GY(YkR<&xrznmow?+McB6CHG(Y+1Ltzp6bBA!R@$^``<Me_|`Tw
zmsRo{08IV&XWWt8uMNq^E(cW%^hoYRi!}WDm96yju=k&zWJS|QqBif;?&#ztI4{bz
zKXUD{`g`Ze?bFezD>n0cwDZhbK27l-B6>8M``S~((6?ITSbm`)ve)P9ix}GZRf~D_
ziuOX(<Jl~Q4d>ZV!2SU!;|zEb{>!^Y+%w}-i^uAtV+J<~$ww<*q-3Q;S?salqs5c3
z@xVAC$w<gy*x8f+5A%HIZj@SWjI#6spKHQA`j>JvPdLpgbjl_Ax!Jjk(t>U$5@LAJ
z+}blW8#1s4zm{WO$bMQ<#cAeyI~B6Em#lI7zvIj)>B7-TU~a)wz?-&9k0!>RQ23ex
zm1ofO(!wz0V#74U-r3*z#zvOD+hl%uSQiq830MpcC*!+*Fe!nLceNZ7!f}7OhtS(s
zA{GHSw0l;ImKJJ!p%e0^+N9l1(v^`V?F`GL-e+ZD;@CXJG07$^Q@gTV4ho!fJ<sEu
zggK}{X(3HgmG(KfbwqE8kHu~yB&Sl?(g#|0qT?V3(_;Kqnop<ILROL$H*bD7Fne%G
z^zI>7H!onJBxg71$MwE-yWN1$KYP2pL4PQQ{AkPI&ixspK5tFS=1CRUz`?H+<b20)
z?qA`=ko&!`>#FYH4~^}bm^`MAR(WwwP=|cZ!oMQyODsNc!=jlcUz@<hnzvwk8k3rU
zd^Vq2SApK~PLZgTU!*yjW{1Lp3Svc0#&GO6o}huM%kpo)Vo!^@jYr0se%sUtdqL@T
z-Akc~2bCil7a7M;3W`vFV%D8ChYh{D78X!BncSV|s6^s6OnWH1$}}KAYP=HrRTsI+
zz5i0k;%3p#&oZn~()%1u3fVZ=U*WN{jDwmVN&T0uEsQ&-&ta1Nl(eCj+&ib6W^g?n
z_q_dTI%;0<8+hB7#ZR|Hs{vU%%otr&k0gbW)Ck$1167I5ofQ*I!M9z>e^VtC+5BYP
zEti5u<bOCmdw}D+0WTjQ?gC&r^CB_4G^_%Q7|D5PfF36?b03BGra;H>yEaMjI%^Zj
znYICtPhKhaTO{g=ZnGihOwKjke5jH>wyf;brne#Dlx}(C%6u0lC@n;9mWo>>MESs&
z6#epcFyyQl$v1M6_f`NLle!ct9O609(M*uv`GC>HhqX(Qej=FO8(`m%E}lMvFUWXs
zYJPnS=XFzbA?oo=6@IpQy?S%x7I@@vr{&P<7FK&GKoB}e%*y+djX{le<W7o00RmF|
z1J5XXdQatTP;e`?+atS+<l}P50o!wS)5J3K<B3H56UDar4vw`!?g6h{XUOM(pg|eY
z_shg2ZD-ajXhIL~c())er}y*{;&inOjGwfOLZ5YnWRN9e13!Zo1cb-i<qkX3wWzqw
z1vmQat+Rcx^0O43#4F$=?Q4CLHl3UIGrHdr!#e@QgU^bg0O`%KGz=P^)$Ss)@H$$Z
zwT?y1B7nV>Shxz1mzX7(=`7b$IR36y-?TPE*mc|eK%ami;Q@1_+TY9|_wBynSPVEs
zxc3nh8|TH0BeIron1B34M~~fvyW|$=CR^*LWa*9PxBrI)?D##m(8rC#P;0G-s}%{+
z&sV0Hf(=GHb>mW~39iK^6{3nK(q`5l{{mYHIOlBGn^6SX@y!$LeYr5qxYg>2h9~@M
z7Bp3stkrNn=}y3&+~f#IYy{^>Li=~wpKrBI*jA4t+=EOQeyvTWEH@GVgH<Z}V+)_m
zAZYy;T45f_`BGZ$+z~`*+Q;CxE*rfc!q4-5zKQzjZl=F@DAZHE+3L6TC&Px=**=Tq
zz#xe|tg~FZtGYA@{Hm<Z%)R{XrfI@eebD;|_PVs$=u>t`!QsFX#TJRpDpmGW2;M3B
z`8D>-s_=9NmwXoW1>RN{)98UZU0bp6pW~YMa!m!A2~M~bo6>W{`lDc{9muuKnH^)`
zdF;m8It&MBg#mh>c-l;+Zof3&;z2W>ft17i@zvi~^IW|wB;z7K49!Ns?$Tp#j?98~
zXL(^<dF}(Sm<7H^@ydHVt&_W)#>4g@-ajY${14tbr0)LZkZUXIn27&f!n?b!i`=Ke
zM<hh9@!K4fIh(8c>v>8%OrYklwgAf?Xu2+4Y6Og!R$r8{hUaXav(SNygdToqA7Fe5
z%@^_h>HE7ZJO!r>9`IuyKcS0YXn;EANU7I9;Eb5ZUf!%Djd#EU4r|&qswk)@qHcsf
zXT&6FR`woz++z}YHJ!eXs-uW`cfEg5w(`A*tIyeFr90Q<Nw#upW?x0TCDnP|l+HY1
zjaCuCz%!MKvz8y$F0GVXn6GIsjd3tO;o$Jaiv?t+Z9#6ayn)L{jBM@xN9nnz9JfAb
zk<flB;f8{7;?T3iDn^4~ZTsAZ49m53<gt>PSk(dD)%<xcgWir!!-6~K>|^-!Dw-Ou
z>->l2HofGqc-=g?B&cOccyK?LI>qYWktjQeBA0+9+0Lf@s%t9GGmn0mS`uGB^}@S?
zn5!E`$XpYpy+cs|TvQAeD>^v4Lru|YH-&UKb={ozdXtpcY>GGi#A60Err0bTTF3#W
zzs_Rxr7sit<rQ$!|A2pVW{7#LxD0htpe@e!XkMYyU94%ty&&0q{VJ8?-3n7HA1=T?
z&y285-Hcz^pc8?#%V>R9j$;U58y#GTpJ|t+v7e@@%<g61Gm9`QH0L!{8{7Umf!hOt
zsakssAkmc5|2U`R1v0jrnPo}K5{}dQ^G@%0tRiD-PGKRZBawAWa=2I>s~P|j4v|;S
z11!@c1ZCV-4&FBwdDU%qWv46f%upSnbp<$R&Tq{s>vs~GpZH1zw9C{B6tMV$$pce!
z?Wra$KZRj2u9yJM19xMZbiz8+kgiph%8n2uy@7rtSeU~%`~Verd^3qFl@k+h-5LjY
ziOhz2Cp;1mapavNk-u9VZuwZ5vj$|P?BjwKZ{%e6Xuc5mxg+N3X$to|yJa4x{<^FG
zShLxzY`*Z0!fk>0m$~L1X<Z5ff>wXHD}(=mvs~UrM8BL|I2@`(Zcx)SDD|au<%gS@
zI}uVhyk{=+xhtg%1U_W6_ij2USM(vH^}2?F%Al?0GqY8_fZV|}&)aT#Cd6_m`t4sC
zkMpBNO^*f@>#NZuG|4)bej4;}nMY}VAwV1kPcv<PP167!`NJ<9#e_oCC+ZXD9c*iT
z;B>H0I71jnl0wK4{fQHDjCliN@lP(;EV#5QM9EaDw4$kfz7FM9G$jw@0-{Yj4t0+m
z@o%*PUcnto=ntMQtxR@Ws}hHr*Avs262V7?KXHSvou7JSnhy*8amg#3;_we+#S&Ho
zx^|{*m>u3dM6@@wYieoNKsZ05Cqhl=r0Z<k&HUVla<6#Q$__q79tJM~0NBH`yfUz?
zCbW~53oeBIIC~w4x~OZq>VZXPKk~?n#k|W%H5OX3Xnv~>dzaB6Mr9u*g=JSCJ6+W5
zMOE$<wH&bkqHUbb46m?|_x(|D{~3RN8zDr0+Vaq|pa)NDX4_^uLgUA=VanmNJMLvp
zE<{Y1ORwHWSXs3a3D_G!ZO&lz(ZN#X#Kn@)ouOw=l&TS(fhmc~9Yl!SrhYia4^h49
z{cZeWm*MKyQ9%Ch=<d;U<EamHpJ%M&1)j@VU_jjjh7$~d%QktHgDK6fTk=7k%;~S>
zuA04q5I1LGS@r~YXqkh8AAyQGvLm{#We9*0onU0GOS~Z^4B78@&G!m%BxqpqGZgD3
z)H*3o93KzJ5V#3`AS^Gnu1|e<MQul5U*L}k(-Z^WRUvA_cT{TIi@}c)<4^<n4~Atj
zQtLKLkd5m2P!OQ0@sitYH{2nb?$<)khku>k+lvd1umzdioq1x9PrmDeT$(uEjBD8N
zEKV}E0w@f|I1fHTWExSU%*yVjpzV`|V?pH(?U?BV<+KpaQaY}M_>SQRct7DjkE2NJ
zy2gqHH_QaI9iaE3C4%3`aN1|LCF7<$zRd>d!x<S5Ngt^Z0KumtGC8KaK~(m@kYnZF
zukSF_ZW>xRR>Pz8h1W5pZcLv&lS&?FIzrHF-NEfH)#bq*h>JjMZwLX`ZEBkvX*r`h
zHfJOIw8q@OoPKz+g0r}cCpQuS1~x@LR~{uH7iKpl)!C33Ou(XUo>CumJll6KaN?BG
zLsIFR3uBbo-GL@a#i|FO1BIlTY==;(uA|QEypuPKznOIcnroZ|@G+gd@<Z*Fqj2b`
z^%C-CRtQDwaBBzWd4&@aNGB5cLJj+6Jj*}9Ncn33bp{Z6U@;KS-&qY$vRUR$+(m_{
z_WC~HFZ_?sOPA@rOvw{eDqK%I6WWh@WKy;UEH6H5J#i6$k`XoQx0nHTA=k@S{CwZy
zE_GhzdH#Rcdh>WF`}gnvDkVh;S+Yl^?2?eJ#ZoCMvScSD%UH56(_-I-vSyh|k?dq2
zlx-}-5SgqKgOOnvgE5Bjdynh;`Q4xU`?&wOdR%|?pz}Q6@8dXLuh;WvM(TrCxAmg*
z-xSyNmZLci5AJiG=3{ac`3cTo*;5fBGqMVcPnu>p4zRKeZA(iLS)x$QCnfFO{%(zX
zedO~Q#(idOH3sFHksD13dRBM!rvIi_S%U}$i8>Ac(Fk)*kDd;Ts-$Qo#Z@W(YC3H9
z3>}eNczo=Ie662?{H5v`UM6uP3pJj6^=tV{>3VOq*<z&cW=NiBP0<r$9ePeccBLdR
zh4%Y^@3Gxhgs|Ob=-IB(X5ivvV(`R{*_4y%!QivwOl&A_RJXShEFN{^>C8d5%zD&~
zgGQ?oSN23ZWf{$?!U9*g_R2MW@J`9gihbna`I*X)ykd)gh2AOh?duiOE$4lq#D=kD
zW==LxdHukzOiWV5`@ZUp;L>t&-cw11m+o{{SyoD=uS@Cu<}3Vae5>!rXY%GTd!ewx
znNRu)<YIE^oDk*MDTm1;lH_rDL#n~ll+8q0%P;3ZcMlJ@z4plS56_n`3BfpCFLNzE
z2VuGN70%M3-*ga_itbV)gaLCo@jBj&q4>F5RwQW6eTeoPz}?3a3Ta<<__OCxsrNv~
zOYvS4`*OG^T029(n>&^zP@50;!!j%AOwOD;7|b7cnKYefQ=Qr@dhmwubeODGE+FfI
zo*N{A6kD6L1Y+uq#g3Y$TIA1_lkkG6`PEa;x1<I%q={|_o2fNHBsF+%1F<<mg5<9^
za3CG{hPoQxxFXtkIYv#7ST196(OO_pD|*!vpV~yd=zV2|hX!W01`1-QG>5)Nlhr>i
zaiH}o;L-QBV@}jT#U;f)O=G>M%+T23*lDf#)Y>g9Zqs~6z^*f94c!?{ADzEP<n_wc
zOVOAKy!AK4vd;Ma&9ty({NqTp!iOYdO@|9-t<W*4CZvCbKd=1CX1<g8?X4jfdtT??
zt#A2Hb6BanKvj8_;g>Gbs*Vh0_a0b9TPnTdy%X^vNpGQT!ckjjfY4y=4fZ!Q-;9~&
zwQUxq<r%oE!j+xxLN5j9lAXr8<n}H?8VBJVWrWPy-A7#~cCqJ0xmr0?Ybk@9$Pa!S
zlf9Sb3ff2Rgsl9VgyC-eW^&LjP1X<Q7g>8TIpX#oPAIoTbmr|&9uZMrp7SY+4<-#G
zkZYyE@!zaA{QYYP34a#wV|hus##W0!V8^}=d{qI(gHBDly&~wQI{ScTSE!+JCV?AI
ztRkLpuc{-fe(U=gMo44Lo)-*W7i(74&G$FeWFa3jI1YbpJD<6g3jb$J23W2*gXOHM
zs1Ae3KgHzH*v6=cs27{Q20pFCSu08q+dBn4EmAt?ibFSKPqCc-@zJg&<7*IJ4>id}
zo8T`|GFc`1-Dr6`Rt3)*V0@i7M`@6G-zcBZ-1}9U6)=Al+4-&lx$w-}>Jsvw-u2q+
z6;Tx${cB2xc9Iu@&44BpFe|HqdYG=J@#pWE@`1*iS*k(vO4e)s6NjJQYiEC^n;52u
z1efw4ce!tNLIyjna60xBn9x;y)f$hkH}$XfWyp;;la}E{4p|*Yh5k!35WMDTb02zQ
zZIc2dfE&BX?G&NNNH=18!O)f_&u+nrzwYI7=XyqP?s=a1^TZ6J0}?*%B0kOE78<v(
zbEn+)E+!)T6=e1P8M1k0jxBSic=tRgAQ<A5Jg1kj&APH)ux}LC7Br3#rGj0<jyD*P
zjn*>>)`B*{h$w#{eA;sj%uWbbt{`fxfWmBNpib#!whK$5nWG{^MnuB+A7NRuMV*!}
z`uKtIsq;?zobY!PLE{(i0fI`EQpl+@@mJY##;AsfQcK$CS`AcFl=sj0!8!rrfpgTp
zTczl#SyHEDO=ccs$64jPjq!$IYip>J@H2y!xa=OY&5#V|-&B8N@S{Z_;&>jBk|(OA
z*=fpkA2<KvvkCnznR9AS_Ntnwn$62n>xGy=Fp_N)9#soX-|C$}mw-a%##E@_2C&Uw
zrf2;Hsth`mTTWXsWs(P)$}9pjPdI258ad=>jk`h4(2JXP4Lcc5SCwbC$ui7ZwZk~8
zO{6EL@@|L%AHkWEQn(F%49feJpqzgVdRv`;w>OmDU>}pcR_SgKExX^mdq@@Er)JfI
z7dwl$-JwTx<b4vs5L51K-udGiapmt$zA_;nEECNwJdM1<#oJ8b6}cV`&8AI_Y&aSC
zj%UF^C`@ieeE^?Jo0S=R1>g%zW#t`k2Z>n2w)TKvvF7DPWi6OJB#rOs<eGwPzv-@}
zzACCjU0|~9Azb&dTGH=P$e+{i^ncw-jmV4y^%+RR8Chl)sK@Gg!^MB{2?&!eO!+2O
zjLFgG(bv36eJ4Q;8!Z3zrK##(bd)^~c4RfW_|oD>39V~1>GcFrCs>X7n8&2|%OOjS
zVS%55;{RLqOVoa`vgN4N`iZT=q(64J0`!RZTYBoP3J<BrJH&HgqhjfcS(2=8mk+Il
z(6klLH+{u&z*~c-Kfkrj2QTX}3O#~G+xpf6@fg=mmN9K^zB_Gw&R+eMQKU~$Nki#v
z+GVrapF5|!lIQ8Apvsq?n0)!4SwNVE?#S^I_kD5CN>3^p2fk@l<SjaHOGeII(8NH1
zwo+f2tA3-e&G-Y7^xnRB@dN8oRHwP0AQaW?^KNP*w>JP?Q|8C;Sw44<qqwT`Fg%YF
zu}&N~gw`cy%J=yQ>ox;~$hC*BkI8=P{C=_~%8cpaH+vq=XI<#)CK2J`#CfkX(3L1>
z<}OropCL!w>r-p=_6vwq*M8FrdcUp<fp6(MP(6PcDy7d9d&4hR$iw?Xr|Q}7{G0gI
z|F6U^p`MRJ2%Uxc@JLhp4iVD<X5nm_%ZzhT>!3@fR^wek-&gYJH5Rx=9qS&-76IIU
z7j=sXX~G<DZg5Bq-l^S<u_SCCtKls662HUm+n@KXS|6{X>vW<0eQxnf*7QT^$k*~>
zMMVT%5WH59+`_qstBcw9+PxGP8wh91u6OU!tJhxE`Bo&ME1FxTOZoQPX5U`+U`82=
zsqQB$PbHOoS;KZzeIMO%-AgDb+}715N_YT4qz(<C9c%g<J;=^T;BIt{nrw7ng~eO{
zs_P^agb4~j$*syj4(`*6{LwtZ@OV3~n<we5MGrJs9}?u?e9*8<KVA_1gG=H@?vF;|
zD|*7$&svZSJjA<+xnR|GSHQU>41Cb8r`qrVa1a1ac<ONbP}cW{_4aajDofVxe1FWB
ztpi)BIF5-_jPE<>y9@6W=R!|+v<~O8iW@~dRf5&e4p;(bSKE1>qbKH{4Dx+>Szy-n
zEFf9$i}8J7XZd^eCq30nbW1*(yHuA3n!jRE$bDH+BtSQ~&>7wZFOs-p(U0$Sfu0S!
z(E%EK*LBU<xTfUq&8QM?gEsmFD8?)5&7#q^vwMl2*QhVq8DLW;`T`6#o55#QG?2g|
z_+9Z(<vV)WL6a22X*F*%0`AZC7md^}YItmy8YIGe`q-2gOdFiI)?_7bi$FNTfEcIe
zxC}j1P%(aBH0KTaM(qbb%@cUfm6lw?i8zTU+r8XUDD$M6RsBiLfo_wPRnyqFe~;Kb
zOb{A9WakY~YVoKg$XPC{9i4oj!?LW~RHj`e+L>>EYZ=h&ZMTk>d8?k5p+7M=Hhj{d
zJ4$|K`qP}%X|)#O{ZYesa3sJ(7_@}RF0NKZO4Ixm%`6|Gu%P-!_CN^Cxs<NXLiRKG
zIa{pze0XBwz({C;;_IyR&$+$*Q09UlO%E$A)yChR{I!!$YdI7t#OjYFqf>OFZ<q(%
z(9sr{f9YrP{%p}yKc`deVtp<x1%wR1XBNs6ECMTCI6;J{&$ugZ8eFA=3)ySoPSenh
zvYL_R*vwj!=ydZ2%<&)pIDeETn*(mcPlaEWv7g@QdyS|+WQ6JQbm4Erp^$_rpr7D!
zW5P--F*X6Y_F>EG=wpeldrA`(`V%fqO?wX}pasvdrT9i`@+KpW3-1M)Vp<HCu^q4D
zH?cM}6AJl$)Hc7$S}WT3ILpwcyXFs+oy5V`2~rLFdNa$bM-v<rpC4Y!S~_CCvGxoX
zF38u$dsjpKGH5%e$~`jOJuyp2TBTEXer=%r<JEHP%+l#Q2h>f7v!5D-@B8ZRX6Ahp
zQNo|gy$&DjfJm0r0`SDYCy;~ND7i+U7ug6!h}6$JQhLZ|cdP~iV*Do(x_rJ!Ldch=
z9_$N(Q5X_Ct_fBk>YV2hCi5bYXEoYTlh)G$)}VFWdtyl@05PyMxLqQbFR=<sYmPL{
zHbjDrM0_oUkNk4ovLRMwJMQdZX<rbDT6l`<<`}fy-Jf0%p?)JUmk7;`<70)vFFz*@
zZwgt@8%6Yy=82~MOILgB8dLS&Ta*$&PTb}!aXQC8KKmlOx7O8As}`#HUGX?}CKUNh
zh|QDIW<d`}{?1fKfRg~7zV-fRb>8NPugz=fAkiYMvy&I0_2yG`{W&q)8Ka78pQ4kZ
zLLnD8k~fvPbx#4`Z<*KFub~C<G2_H8a!hm213cy^hHqKqd7>KH0S^%tSC7<kvhLBC
zP~|a|XN;=gFKO1`RyO^heCN*#F9*KP_@{=a#cC`?{+PS;vqxBDPrD$qqP4t$kNBMK
zA?~O9E>1!cG1hEb$Sa0#rahXaELQ%REgK^Dttc$|pCk#}3!ffM-p`&>Sn|&c7A5Sk
zRCR@Md|=Uzt~ghJGg5;(AoMl_e2!cfdqhjS^|`}U$(uB=ix<{@F)fU%gE7w2vkl*4
zU04LF7d}vXRGdGj%{}DBTSgq!s<(1juEm|5C#G2{*-4g|T}YH+dHW9|WoQScJ176I
z|LM-u_n}mxEaT7Cirv0jIU7{ZM)b+SIU?VBeV7SG%wmxcRX3wrYC+7g{`MI%vl*96
z&(zK-CL@&v^?cuD*tc@|oA&pvCyXT6NyYibDLc7QMPX*Y@|{F~DS*5|ZbYd&7&FKO
zdyLa6(RJx@(*`rcok<UieidI<ILQ8;KT^Ur&FYtX*sJ=NmY)BAMs=}p-n*-}XcU^}
zz$Vt2f{cvvoI7~O+E!wrV0LV3C-p*SgNQM{&hz()PavR=Y4e?oz{?a;FJHNodOG;x
ziWe<k6%qr@`>@QFe-!F7Tugg9<(t5f48=dUF(xXV+zWZYN4oP|F7Eg13T>}kDT<Rb
zwG4m#smfn5&hi*F;KR~>q*Z~h`j`Xl5MRxi=J=h=auRwdTKk2>1k!BuoX+=Tmiv;W
zi~zS-3iP|aI!iRm%;#u~*m3SRVmHoovL<`{{0dj^_snws0dK&TRR5f4m=i0jB?>+x
zL8AC9-pS2Lh0W`bk2~W-+KHC>m<o^jb|JE4VH095aIz}!gXwheTcjftIT=lMXy`Kv
zqi`F3xSz1*aN+8X$h3Jq?KPuD6c4uf#lEt85XKV07Xyi9IULC0nj$u`bAhPfx4aE5
zcI9p5Y_S{s)ZhtPZMO0svT~z+e=YW7u_;|#Gs3277h+#6NUE`cacnfd2yQe4c@2!X
z47q-Q#_(?O*Kfo=8o^(^PDs0d>+0Hg#U>ayAi;m$3Zi#oI%>2PP%rho(=9+datEc@
zpOqB5qTsiwR;PZIJv^u+Y~*YiW;Oop{MPaG9$Bk)WrZ!vtW>!_q`|`a&sv4mMDz=^
z*En!?f)iySj1c4wnYB0sA7#xvnfSi7x+T%r@Aw`+h3;D4SZ~n5t5~4Jl>~p1alzq6
z#_N;E?9LyNkajp>#P9z2PP$8nqH70;9NaJ8nZheg_!H|AZ2~ZXLff1pyIERHb4*6R
zcV8fsak(I^PkC}SL)B&a$-}b1so#1k^~9>->usHnLrW|I@&j6`LUKv!uPLgt;A#+G
zu#8)2Wzb2qqG-RtP0JX<BIIxtTNl48+D-g*nP3#r2#5HIHinlAdUjh*mk<P=3Vy)9
zwg&v$%Uz(qGQs<4VmuZ7`x~YLiNe7ohnAYjE^=_Y<X#f2p$fj@p&F&3d{<~k6*8B(
zZUEL0bX}S|KfJ@U&VwQKLG(7iJEb9dvn|N!e#CKDFuB!o2+kj&B{C>rxl%+uy6us~
zMN>%^VZvnYwp-8in<JGC&uS%a#~hiUG;cZ^+Cy#xxy_W#_E)T*E(UsA@VC&k2heHF
z1I5eg8@9MpPx~lzE+F1@`=+Y4EVJg<tSLheS5}j%nKH^@zBXAX>`l1mver!A<quDl
z^!|z!Q@kX^P|57qG748uQvY7Ve)^1i^0CSyC4TzYTA(-Y%2la}VT;i!x}$a3OMOc)
zgN8DL)I%8Swt-aGj4z_!j;JO(T&~rF^_?jCw4KttZdK<F=brBFvD`dim+Kvmx(Hv=
z6bPr98T|MPAkkU_dX<#20OB&6q1px~NkZ5g^18}5n;DKff~D3gCH_IIiFoPN?KvM%
zJz20sp4G_)qagX`Qcntbou+PW%C+`5v^Jo)tOJGQsgqbzVv2jmMYYygvg{*ry8u-}
zeT{(lLBoC@+Y_)z570FIf}twHzoJojo2uldy~7CN^HEc>(UY<z=L&4E8q8n3YRZv_
zPuUUVBe`lWFX>JAFCjLy5`tmTgo60p&&@SZ-F3c}(O)$1IxuXUAsYP{DuslvcQrrX
ztjD)o)l&j&dgOOdeihQeDq=8@kd)SREGlO7ZF^Rb6rX2qi<w44!H{6_E6Q#9Hpo%C
z_6I}ZNn*vkDjcdl=5tm^J(4OzROMgSD8;?g5*)3jp?t}b_2!AWemms|yuLclgd{Mv
zDJ8G98ieyv*qlL^9QS|URngvsL1D|KIorZ!A;CD%!$#OkSD!&?lo_(ulEUXS<Ae9A
z0j55&HkY$rwznFA<1b8lCad$%(XNNx+|JC3WbAWP;kWGvT}!qQ_}eQplA1Fc7j)Zy
z@_vn$R~NikR|tNWW}VH;o7L4umzL)kDYf#d+_?|8)LhS0+_>=|1hy3({&8pF#tj8>
z^ox$8FcuxQ!S51YzLPJ(2ZQ<WE#WQ7;^~I0=`HU8>7RkJsa988Sz;B&MGn{z0}tt<
zkJzX6bd1M6JL>#V3r3^4Z~QsO8gW}|<-^t#q#qr0T9E@W*R#@V<VNN#&4ErQRy@}r
zq|MuBFkPy-+;U{Jd8jfs6|hO(+ik=kdielZ;H1<WK5xrgOb&la5M&<X`>#JQN+?tf
zZW#-96v5QLwv-2W+!vN=DSR#8eF22=S3Kc9%QkgfH~(7~Jb2tzro=?ZGgxN1)??IX
z-1;1Cs!t@&emEw@U;O{1{uUn56V*DquEuEvX0P#i#hl?|P@SIIpN+JYet72D`<P_D
zSBD=y?T|ieJd%Azi(<x`@@<;LVL&|JqEhr#jz4T<*8aC_#IeB}sx|7eTfPgR@56u#
z3d%gs<83D;YDDx=x_Z(sx0`itRLrVAqagZaD~j*N6QBmR=5rne#jeeVZ?QI`xT}pe
z7UHk?xv@LkDue#9pI0t#g)Z#bk3H1tHBK-xU=3p~Z<>wPbKB(rj%_YaXx#2&VUA1;
ziKD}ONEn3vfX@${g6!`{Hn`nn5R!mff_(o6_EVO-^V(lc*+;ogQjlMp|BlgFgn#5(
zJ+*E3RsT36#{A5dtU=tBn8->J(-pcsB8E6&^-%l5C!I|}bSJdcw4QTnTsz)3bRl0C
z92dc62oc=wOiLgly=iNAzIqLEg&W%5D?1g<JN@96^%%0H@H6`w-<~cI^`g5pIhdlf
z>{ksBs5XhE(fbTZGPwQ8=#=*L+mLH#Kc3Zf3mn%9FLn7~Gg6V*egJ06errDmh{@QH
zc$~OX11aC(P?(v*(`As+u?g~iJGj9X>bG@V32EnE$!9|vJO=VOHs_1oe`W#O4Tj{4
zJ5}uh%9iwbdlipfA=kh*S2y!Ip?)d#6@0^TnyUq{a6?b7Av~4clW;a2YQ#XkdRUUd
zeZJTGs$oF#v*Y4%&ksw;O2lcaXS~&sly&DYwSADt=lUU1gZT>de5Cp_?oi-q?Ca&!
zjt04(e@qnJ2hzTaMJg~KG-Kl6T#FulHVNXUQhOD-HmV_s_g-yTLL0bpT>pj;(qi6q
za{g8KA2LLUS`-JM%<(+Wi$4?0_lj>%&Q}ulQzxrQfw|l(DEQRX{-5fDtTTptFHweq
zFPXNU*M55(7+EL!GC1*~Ge*C)ay40DtuQ=&Gz8X^*R&g>?qA37<<V8L*K#o%A&~iq
zIed-o1Z~2ffB^R`elqcL{=^&1&ZRf=$V)4!TnbI_bL=glY4NWm!0YL>GzOV`<JE2f
zCY1feD&JpKcQ}2}WMaAh4oVN62@6xi(oEHVSuU_%a?w9Rc_~kg>-{%2xZ(wcZrIe-
zkfvT=YS~Tn%AwSI8y8=)iI2FMLGk?g1^+0<>LwfE+8E?IJWvR{++A%wI0DfZ(}z*X
z)jSP`pr*FO_<Z2!u&sRQBF*%SpG)CfrM%tWo;l8yKk*KBvVpgw|M@pMNbu@AE9qGY
zq@>kKX?iBtTr<V<E7dOVRrS}(Qimcc|IzaW($-lb&glgvrcxy)KBndlfzPbQ^=-yW
zuoBgTa}>}v3g;O@Aj=&^Xcv7u8vG@(9JEQ}9!o-3A$=fZc(t<M+}9+8@7RKI?CWF=
zLoR*8SDAgBD`3iz(P8#Z>p;~L*<TWmc$};Uc!pAX^_D=-*$*xh<;q5?(jQ<!#n=(W
zfVIUJVdJ{1nBW^n-mQA++nZ)O*|8Tu%q48sdSm}yWel77*SQ>p{BsR=P(N)PI(e|R
zgih3aMWtruFyY|w9hE;Sz2kJjC$ROhzH+%QG(oRM44t5wJc{?t@W0bICMPil2oklS
zy27cFZ4Qx_#`T)KT)&;BhpMaQ`Utlt;{(Q`;IGUJ-LwBlOQ-{65~VT#(%HiO2^&qU
z0yU);b09|UtHUoTk4dp9FGbnP4Rp)VD;Tq#(uS>FWzBBHa?Gw^qSP*Ji%E8~sT4bb
zb{RL^`l3h^=}{fepK=J$q*QtQ$_jDXa!^<gYg(fP-|onno_ZUxdrv)C5Fen$++7gk
zO5uvepP&OhF-U!-0bg!SNT)L{l#g&%B8EiqB5iw2d!<EsSl00onFP1%of?NAbKsvQ
za{*7>w^gXl#{BK}(TlMLA=KH*E56gJ3YU!f4!7P_;$;D<;*~?axejBfb$sO|Pyv)x
z=wE4x=YCKGL413RK}d((bB@EmFDeDb`<fL6#+6%Dp?rn9`DC~>3=C<!55YgVD(&<=
z*BM2>`zwZVYM0fF1WtWnp4!Wr_b#ANZ;1-Q4o~u10zdMeZMDwXek5+cqJ@@v9DAXq
zGy19KDqtc%Xbf0#IZ$<Z-^U#vJvR6q1hrt-o*^s>b~ODDT~&)=G13WNV}E*6`=1Zd
z|0v08#-B?1HvC|O9l*X|o_Mi}B1NB&8}ERf{<zL`RGmJ+EFKPb0amaY)w2q#VuPe$
zHXXCgO$W{88DMl4i7{IJsj_YO2c*I2Eb)J$R+n&7zH+5;<`Hu(x&Ar5ASb90|KFmb
z<lwPZX<6p*!lE7flPKfPxC3@QmcmK$N4d@>M;v`?RX@=kT6#|FIb;6ti8g@^1;aU;
zm&dRM|D3ykO7cGJQ)$^JE)FB}wm7uw{C?ALV~mx~HLf`?B&^0re)<eZc+PPu+$rMj
zk<~AI1RNa<T^Hm92WUU|8iQVsOE%2iWRpB%kT2YSE<OJ7utVF;0G|Wr<Q~Lfew=%I
z@^wUEa6P&Sc!6Br^AVcw=iq=kPkwG*FjIyLn_Lbc@Q`DU-%BZXQ`Kb~T53UI{YdF5
zpQ(YOYtlsWUEzvlE}-5DKTp(In*6<{Y3jDyGj$;4y?ons^vy@1gX5ePxH0c5ZI+{&
ze_-zo@UJ=Wb>pcTtpT7fATRWASocC?S_x_6oE%G=RM3!t_XHd9l_PQxz0&2O(yW2}
zR1fbIg+4tD6hbj6i6U$SbK?9Iuolr7ohiiwsDmMsQuT0*b=r;$RPi(V1k&NuQ2!K|
z3jlo($Iu5~(^QQj7nRA0!J?4@jv7HP``Us70c`^!DD`b!b)JKpm!$pNofV&Gw*95v
z{g%&O{zL6sZF`#dlBJ!#5<U_Vu_#Sfg5ScfDZAJ2l|sgG@*k)CJw+(6x<ox=%XV_o
z&)7c?>mJ>_Z98=5&rgRsW8Y7$d>6RW4elo<rv!63csBj>H{Vwzuz34jF1dC$XzAmV
z_s?Ww{m!A~*Fp@Re7J~Ai_%0DeLcuF!gxK=tM}M6vGa-nXSmj`rqt}d(-KyF(!ZGg
zOm;`K9kA_=|2PPyZ$2Fon=7OJ&nx7IQo34qR0>#zOyA0sSnMd&4#MB@&X>BCst7uw
zjhFQ3HOfTXc=LPqxjp;5#o%*MVZih5eKP&XSGhZDFk2ITntu+cS`H6(IcyyETzRUz
z)`0BCCF+HZV|9>^C#ZsBPA)CJy@&hl>LM$6XR;igRAQ3Z?W}(kPWzlhsdKfgab0U%
zoZQx{2;TpTkndp+@Lz&fd`e#|%aB-sBQ((^OpUoCGY`I{ALH80Optq~4;%#ASpQ$-
z%*8NN=zMF8;&@m|3r;pK*sNV%xMvkj2T{K1H&7JS+fg=*#mDp8J1*W<)GOQ5=21c=
z^X?O=BY})l?0s!rA}I7)L{z1+wEFQUl<5w+!pFFSC{Gpj&{tvCo6D`-)5JCX4j9{{
zp#E+J*ZGW4yQ`i}I(ql#L<6nS1H<@h46i5R8e}x@5IQv|$?kB+bm$W0cK17+KXCGd
zh;&EKGuSAKgOqZH@)0KBZPt%mt~(q~J%LR15^7oPr>TtK>V{pKuk%Cd+T8V@_>ahl
z%nXmt-K73(Cyu$<(jG@AzX)3nxxDS1=*s|f1t*D<8Z`e!1IJ+%;#&H**``7*8{27K
zEoi;z?jOaWLC}+6d(z!eQ53s3^d<S)62Yi$n{AInBHBE-E5l0NU_KDKxfHOf?thh9
zwFj)-cm*|2cKZMk@cY2o7iiWidDOlIMR9#$$ZV-<0}b^bLU6xlaqoI#4=e6vw36DO
zTtw|&=&V)sVEzn<RhTYdQ+k3Lp;c0FwRP9Mwz`!OUjYZ;Fh9K>(Z5SlhN@Sl-`h1J
z;`@J6xP)mz^B}0&n3IX!)V<U{Hom86(AWSX^D75{s27?`sY6$90=uozige{()n?un
z`<OVi%5~=HIq)M!{BRA{m=eKR6%15MbJ;x6-7B^Sln3nV=5gO#>i+DQ%SN~qZTb%^
zDss!qWs*hWy}edfqk+R_ffHG=OTW^2`FP7w7v4Z5_nQZbS#vSOnbcuw9v@@y1_WRm
zQ2#Hz7`JmSd?Anb4SClzWUTpTrQv<i6ID#kxyF7JJ(jTXrUmD5?L>WyusY*rGOAO)
zLi3BBQS{em`{qIA1N_A56r2nONq%sJf(^2t4MHsKuB<+vdpHNWzWg%)FQz6DbFmcV
z!$Tq!FTXhEU>hkp^LWZDfwluC8@lZmk=dc}n9H7lqMQ$e6U{Tpj&|kLi}s^ippxMg
zJmQ5bj-v~YIS*dX4ow4IGRr?>)U4k6uD<N-Xi=F93`OYx$j|cm6>i)plxMy}S!2N@
zNn-D-&rmaDybGHPE9FNGMA5Z|mmPi<Z7XT%tVHmh+b8zY!<y!S18pTc=8ueNV$8P8
zm2V!12&1X#dK;;}gi^<eagh$ygOtT*cR=gYBH~~q;@8E!6w!g#RZ=kWl2-M3uv*}R
z@)DWOV>!3a#=Ca`=5AHbbw1BKJjCE=$`L-M<254QYB!M7>k($u!H7dnIO%uQx7^Xa
z+h2Tb80dy%u%-{*0Y*bT9L0LC;u?QS+ZQ{0s6uZ>=#6Eu@~p9Zi?WM;#^~-+Ok7ih
zZV~bKKV4Z;xPON*NiQ9`02{EBOAHJ$0nBX2&~92X@_^~+1`Fz8{jJh;NmlaT3A`mm
zwfE>#+QrD9JoS&(uMIFI4=^c+ac*-UW!-n|wQboyH(9d=Rt0)0i1C1|bhu$7LsUm!
ztND&Tq-k@T9PLah6$r#~q^l<TxM^3Wd+}dXOKfgnCEq@ac`$E-{A?SE0kZAI^dr8<
zgXDF!)0P{64JH>xJURU+c8BT8k(;1LJA3xzY7*}4DTSG{z)*VsR-EO`PtGEKLWl*5
z5k>nOwm;LYYKIt<xhi941R!0e#-rfroAMcb*v9^Dc%!FHEFd$uD;Sk+o%kKa1tUFa
zV7t*Hz5=8vqtcu`b*Ry(z-JkNX5t&`1ZgdikCa44hL0ew{tD^1BzJH(`;QI%cyVIp
z)5!)Bc=?bE*yoS8NmqR7^CO&Cy6K-&VQ^eR)rcmjDq#27R%&<e=Xg^p5u*v%hK0WK
z#tmfgSb@!K`I)9?5&8(eekPMJMXL@gmz@8xa%QYG$J^U2a`Ilkdx98aGIYq4V<bZV
z_c^&~ov%vq(wu^*ZZUSi^S#KC`&H*sz7%h_r7#TlsL<p=%eQM>xcY^~>%4<9P8<$)
z2Zokdzsay3wFtQzaLG-QE!V~+#Gv1K`^Nbv*9+@^mj3A2Iuv*o?JfO?*Ab;5GLP2J
z@N0ZV_bP5BTpf|w<U@B)G4N-+4GJ+#0g=~CssMI(v|Xa4%46=C=2gMYm0dO9-E10~
zcb1phx0W^6`oia3iwRk4XKR3;#lBN@KLfMmW-7NwKDKgp8K`^nE?XuyON#eY`dz;0
zYpi6h^^p^EQALhdrWY5o7q4aCg|LZOgabm0K9#98M3Q3jGfnejx+5_DUh2-XkAU1@
z=y)S^N`2G+=y+vw&El<9xfS(;O7X$8ygI{X#--u0R8UJEVR%L0!3=U)=yksyOO>(6
zn;B+-V!;veCG|G^Wiy8q(gRo&19@FF2Pk!$%7)5)@NVjzzA`I{f6MHWPs06`gMYuY
zCPMZcm%gUj6cweIfXb<6xElSxu(?wIPi!u^+{2|1iW)cSa>@7{Jb9AM^L)=Gct@j$
zxX{0OzPlnyEkuO+Yg%w`1H=2mKk5!}xy{SKr59#ZtVt|=i|OB_IWs9}w&pYrXI5gQ
z>h=u&YEEMP-RQ^G(P_ZqsV@C`Smi&nfEJ09PoWxm6_$U(eiq}(@WcJ*MKvy!QBM$9
zqw4G+VX^9}mad7xfY}RcL)`443LiVqv`$?(F$tZh%<new$e?|5f{OXOK5=-uWnMdR
zrABjYAlkMmRqZedwS7SkWcg_Ogxq`h|03iX^*09nz-jfiN^LS|mgF6)pA6~F_e+>W
zGT!#l)O<A-{kMA01wrxRt)wUhQYQ?9sj#itM$yt;B!UnkNC-wgETHl;khm2Hk#ShS
zXj5>me)~$`EX0F!Xg0f)!a~F>EpqK3R*#B3iQ81`-_?`>-a3(nQD-l^st_^QSW&=N
znt@UXD_mYJUzlq=warh8l{4CI`sBRE{}e8|EnR#$&Te!UQRMtb@5IBbS@s?(BSyKp
zX>82Fn&DcXZmqCbE~c6ku|FD{C7|n^z5UHG43=*4y-Li_XHAq-{ZqvGK6pSA$$U(}
zYRXTARQP+mr*s<1EUDMEt1U7IkSl`8Me`~NgPYg==_-E|S{=4<N$CzG5g(+PpdCZw
z)MBDEfm31S1|+-v0FGH9{`6q(sC>!+QyM_hhCFr>{v{x6eiayY5(3)1`XKGm?++ek
zW*8TQep+#W3a;Q5n^)W}C_T>b_lh61>f)03^Ucx{Z1R5sxCocF_5M_R7mxI~E33nn
z6%WH1bAC?#N?1XHA>+k><PWEfxOy*di7T}3efHV#ngl%??`r!B;KjPNppNzhmo)cR
zAG*TG%<VF#_$m2YzS}+a{C2hS?bi|?C1PI^GxWT_KC?nMM3}gw>v5(WzmZ`!7ZB*C
z67J$dJ#&|={yIU;+OJSP_m%PFusg`?dFt}O6~DiG`e1WDU4iAO#PRr-S0Yl_P~8V>
z`%YRvZZ%2cu65*rd<*TgsP{49tXPcDI7taQ4A2rZb1k`au}wN5P-ldHExPYG3*+{}
ze=LfVJp+5}8!3gHkvP;F+h(lWol$D}NeIT2>vt3qa3EE@I0Dhb_+y@PMC?&u`@1OH
z`WFj;!!h&bs0p=@>hgh)Kp&Vu@2B^W1!b7Q8EamU;LFHA)(hu&|K1dtiqmKb9kML2
zCim_7U&Cp~0GZBsQIDQ8unA}?4)M_lLa7Moz5pJKty_^6B{q|UdjiU3GQY4m@e=2)
zy>q41zAs%@d&uuuT_)>hIJQdvaI~M{5G8SlavsR_thE6uo#p%)`V-5JD8~I2%Q6RV
zpGWI0Z|?_#=M*;IuKYgXp)&3A<V>z_rn2{*U)LMyL{o^jOZ+CS&pyjwiv_+b@~70U
zTXVRA{<q7*n({Mvy1LfL8n{#`_k{c97!}5eRBTg+!>O+oeM75U_lXj#o^xS|FB#$u
z-Ge>_?Ge8L{M*?|V*RViI=|`s!wA?S<D?I#C*<$P_f#Mzct}u3mmHD5Cy2GyU95Oj
z28Tf`(KFlkcue)ly?ldOSt_PfGwBUp;RjwE=$m)YyW$5!$3?hmI_R3f?|>_@_`~V@
z*aK(4)}18A!o@UntTlWVHD_)qe9F0pmUJY%P$^xH|ABCP7~7YxMAPi^cNG{uO@&n^
zOJS=c;XyfsmNrF?IcU27#OtI>42qnZAGf1M8HDbZiN;geth>Uc7YyHE$@=44z@1Wn
zK>z7cAh`rcI!sHj&5QmM9`okyQ^+}Axjw~k$F`%tSJw-Yjmi}ADrL{udckS@L^VH4
zqzJi`rao&tfq&RSRZP;AW!+l;()=P^M&chSpDm2K_)sEqWg<;4_-sKMZNBfl0Ktnt
z)U9e2b*s_0x2Qh2G`!b#e8~?GOC8ZC=Y3QnTx^;wTDU{g3EBH|O%T&F3qf6V?%2=#
zi;G}-5y0V2j~i%UBtBKwLra#yGa>PQYdC_zJ(l%GN{42<l5kHMXGNKpNEME%@h4}i
zX<wJa+SCqfv?-9jS?!pT*uDl8&L1ub;OF%yx%;aC@H}}4z_BhKY^$h0<=F4;t!Mu}
zx$79(H)2Yt=B8Hj5{>_f1CiNSE2RpttY~s7>U1FcpHmL98=|NN{}hBN1@0R}^o8!0
zxR*LL|L~$n_$@jDDe;_tX-Dwo{!44TQ#ny{U0A<TQE|w89y%ME>D+$ykyh!1|BW!<
z_Wt(qOpad5e68r{l>La8HQ8wC<hx%e#5v+Cc(!}!&x$_kh)hbi3W28%o~ND?_U`xL
zH;(YR^ICzl0L*(8pGWC+teZgz7BdXj^xbvzAz<u=T*vBl7$Ooes(rg=r=I;T+wh-o
ze9o@F;kAO!U43FNON*2@RMnkNv0>9x+!yEW?Pk)7y4j!is;N_I));M&T=G`?O`^Nk
zNaB!hw#6(<e^G!du}YMKsJbWvx+BcE>OTe6+W=LEg&|128q!oX54ht*`mYp4_2s5N
zkY6g)NoT2>v9z3`OP5#5xr7sOR^{5n4i$QWbg<+~m)4Sa^WJfp<p52+FXQwgYCE|*
zFu`<3;PKRoWeeHkyE<8tp5fyM*zd8yd%zqWaJLG3k>YbVjN%R4&qK1M)T0eNm&OOJ
zD9P#~1*NR#MQHj>?(j45JAI`wMUpN6eON}?P%)iiY-^5@JLb^ani{&Js82Ph7m2E7
zOj9#eNUtgx)ec=V7TGm}?EZbwl+X$D{#Uefc2O(4Rd1>y=|j4i!Hrs+6;L_NknD2s
zd0T@1fZXK+ls`tch5e?%bhD3!O6@yX;23uLbnRM8ubM}~<;mIN&=Cq_NrlowHS~y}
zn}=Y_^f^t%7OS0!V)T$yEtQ`z)ZVdofhe3->a1}tMP5$9^)nbKDRbuhtJKB9*ff6d
zMN2XZ9Q)qcS}rMfrt_sp)y=b~kOw5=(?9TW=xcouYhCsH^e3ND|IoUGk(yGaDn+H!
zAG%aVUOpXmkV%w1d#ZyHZFuWK4`k9iQZHOA^68(v0L<wwr&AT{FXWkgCSGv<K&f0i
zDp9q|`GjW-9W?s6HI`TO$mC0ovkCyq**ZaHiO*$kmrezVy<eRD+R)4X?7cNaZAIwb
z;f3y6pA?^vV|ZD*LurVR*$#3-frp|PYv<-M`N|x2BN6ZI)5H+k?FRy_Ak)eIB5fjI
zT^ILlHdVP#FBMizrUF?dzx;T(@it?0>$%{)ulq{f1thW_4R|v1#%bkp6Z=ZZvE%<L
zB_B>x)aA9eT_Z{}+{e831v>BuVAmBE!+WaYII7IJHg(#|s}BdIw%~Z!@EwUa+crD*
z1A50VEBtRT=Y^7y3u>NeG*!OM_UJ~|?oegOid_HKMVPLptG9w%`i+RE9|U1DW4{2f
z2cSvIeL+}n7yLG-OGHs9t?L3Oov0<EcLOf0NZ;>xAwLv(+hjyt%uO=+`~3TFGb1v;
zaaYy}F535t*7m>5?BAGEz0LVQR&Gv-VrO}g?dX3#HxfBuUoxVNo<vPx3!4_b{)rId
z+0$$e)b6mF(ROTNxg2)_xbKqpjy3vG@%6)-`;9fm3*;nxF2E+(k9B?Z%~m(@Goop|
z_~gUP%jYW|t2Yrn)`3N(p619)eBLFbz)Gr;P3DT;=OGHka!6gD90oDU=j?HmedCx7
zjGonXHE24F{Ftho0~RUcuwCBTG}aD*Suu@cg>N@i=_O14{|a<r+8Z%^DmxsnwGOD}
zh^1{Kv#U5UbfXCxXb~yrublsT95CSV9{{9tx01bq6s=b-0Wy20z=nwm<0{b&8;jFx
zFK<EbTEug33)oF`%F%1IPV5Ri0tc2&3}j|`)Ao4F3aK+87la$8W)&Ql+!1SOA!L?g
zAL@j^<K}+(vPM}1Gvdrs4C)BRVYcaz>CA5U7MFc0;*kEW;y3B5V!!xxc>vVL(tsx>
z0JM3=mhT4N@x453%PeO0K}q2t>vy(xvX@yZP~`T*DnOC*I^p2Fr^4QF_)#h!Qi^?1
z&01#(0isN<#<y;12RzcgbxbGx(|vkmIv-p#7j^?v36yBKQl_7P2c7Nty*LYg=j(Po
zm6UVHAC^1kRhU;@JY1^R?kQ`L4#kkxp)yGehg}lifi1+>J9BJTp02BrTE6ExTW>H_
z#k1Q}X+enJmF(n7UP^~m+wN1<QXDK0(-glEAPsoR3XMN6`9qm0bj9o{IbYb0`w>Oq
zb)O64mGUmRimpFKcOR**cyL3z^sufwr{A$!{FCVxCsfZK-fa_7io4Emkk1i6RE6!U
zZC6|B-Al<a*_cbz7NNZU){ZY`pRMA9Ra{o)S3q1C?zL}Czx6MuGe{Z~+6j7wSb$sc
zDR8rYmu361ik4mek}oq|^*ZYAowMQ!jHM-OC#_*vV7xI`F_#pbM3jBX_U|;FB8kk|
z`J3d!fOTf6`c2wkf0g63Q_ZF<cuo9cOWi7v3=2++FyWN`PE`QLs(dr72WScFdDZ)^
z=ep489A}2cJ@7ckC&$@U17A|ID`kCDeI*j=si@~0<~5SA2X=6QO$f%a)o5d%K)5pt
z>yYVve<nN4c$zh4<6T*@)x2vY&J9B6d;TcV=o<WCnx;{+Fs&M~eJ}ExISH+@Np(Kt
z<KU&pp?n4yC+J7dhj2Z-&>2ks8Z6jCv6<1tH88Xa)!F$vMK9*&#|1{xdzWc(a$X%d
zt{iQ@56+q6)nvP$Zl{XyRy{Y#wl25<;i-rSj}JckGd%Mbmw86PgoLL}_T5b<CfX}`
zjG*3_7IeVB-(x=XO3Uf`P)sJ-W8UrML4CRcC81_(%0l^S(E$J9Q6yM-gj-llD+OnD
zjM{va*siY63S$YGDp-i-8#nI60W|`;+g8&GRk@=TisPy_*!`E$NwA#5B1JqaR*IFu
zqO|Oq-EjX2qol^s;U*Z~M~h%g2ec(|h09dgzZPZ_SpCvzF2n5joc!Xd`7kyfqVlUi
z;z<!|mU%6?-*sub4`WugtiM0_9YiZpmUqaOh-Qm`iBBH{%JBAe>`7EzY~x^40$88|
zh#$x)EP&`h9D$#cKd?1mKD~JPye|GULwkyx_}L)x?YyqjUu)$<Z6(<$LxHZzd0W7p
z#%*3yhuRNkZV|>Cp~o9~8z5w*O%Fk5nnEq+LFiX-ZCZ8i9G9cMl?yxs50B$e{%A0h
zDjsR&(EdHrA`s6l?D+50&i@L-%qbFi%6^Td{w=4nVC&sRKI-*+4pMx%snnjYrGvKd
z&imNk-fVNvg7b7O$%+{qQZ(>z#TCS!MKOT`Q=O@>zR+TVSMbDvg#XL}cwhD#h_xDn
zH5E)_CpoTN5W5CCFc3KHy>$TKIxE9$Z-lGA(8GAiJehBsQWvX)eA_)w9A3S#d2LPH
z-m`Jw$dOZC--p6ZVK)h0W5c+t?E`??Hgih9C8l}k0EC7dXj-)X+E2?~?(*W;If-t5
zAr*+x(7}`&TdjQ7W*c`7Jd=(d+5J8rv&Bi-JmQsJxP96Fis|W8@nvaLZ?<T@3AK4B
zA_^o`|JM9vL`sZ}O+-vz3Y++x&IQQC$P}rJw{y>gPuI`NO<eIJ)qE=b=atgg5$9V=
zU>^zS5_Q-dSW~Q&6rc5eW}4d6#Xo*$(;52(U|!ZaADX@6Q(hHSmlFIlrB#<VhY&)Z
z{Uvs~Y|WMJRp#rY<G`oK6o=1^IxcPJ+~vB@%R0Q_F<ZFu%!k3sl)4}9EAj;;@;cC>
zD5zkfEFx{ul&(~(nQ;8H#0}|0c)4M>x%^#a&pk>%A>d(PC~Tr=c^Nw{@<TjL^UFG7
zU!elg!poQ#GamwD%#1*DTeMU<0cL01Wlx{OP;G3QhD7w~xTl}hR+!XZJqE5Dv4bB$
zEdf@QoQnKb$f)OBL<NQ$%IZYOQF)*4StShaGXK)ChCKG&+UfTY*v?^OS6=E(yF<@4
zq<2^-?vtyLwTS$4^dRddwSS4758I>vCOleYnpNP&$paYAzv`SZrI;ReBGYBddCE)K
zwr&8Fs6$zGn^D195&m%HMDEAi(v0k$9FWdEi7eYE1`m{BzaMki!r~G2g1*hM76Ef|
zA;4Qig1k6gu!^0tD%b~hE`~-C8IAGAEqxv7&<AhHqA&P4kKLYAjJ)x4Biqb{8z#$;
z=T13G5`Y?OJu4Pn2zI7CZB3zdfqlC-lkM+*{knZE!+y*92`({R$Z)KUgVS{s-ev`!
z=yUKyAD5iz+q|`0Zwa2wQ@`UW*O<&oQZHl5W9?w2^NA;15@Eyrq}pxi;5DeeX!FKI
z%+>BZKA#@Lm<OE`yS8Uld{hpwa5>&(@kx5c4N@toto?Uyg2jSN*@{V_YkzCpquCd>
zmnj7_3W?~WVM06COjR7fTVgaoFU=fkNT?Ifm6&}s4vjUtLhnV0NKpKDXP%nlb)P3j
z;C)7bO*Yw;7uxQF9)^HrQi3ZhmI!z7<oCWTxq`MH8#Qqdzh;dAO_1fqQc?gX67kj)
zer^w^exXy4#sO6&X~JJ`@D_b$ynXHq8kkVyDcXdyU$zLm)qMxBWDEvXL47?b7U`7+
zM7q&8Pz^L*SbzQ}Z|dKbd(Bd8V8Zcx@L3qjAWEUAUo>TE4X8Srn5$(}T(U+mK2lrw
zwKh?nlu;0MoI9xYX_O!~e=2oCHLc!bjuhceknTguzTi+66aHJE;#0^zT^aHc#${@Q
zac9(6tft8QbYrd*@}3*v4CQt-Vjs7u>!Bw8?lqWG3Z@GU2kui<LQxN^XH_3Z$lK)|
z-e2fxr!1Zr4f@Smahsqlaksi)bIZ*`qp4t#r&ipMtx*f@E`sPI<5p+gnA^Lnhy*?+
zJu$uMyS^td?qRWsg~4CyU_N_yE7rZ1-;~<WiAK#ep^r1Ll+ouDhP9PtyU6j~Y_2)P
zlfdKAY1pIV7bb{uNfy`{eOq>z^5LIrLII<HQC8QYcJs1N6a^8DLm8Vc!5&b{a0u@o
z*+u()?}I<Xlpgltvv6g9!nbC=8glZqs2xX<O*AFayi=w&TMdo7{Oq$#H=Fi!n?dZZ
zUCpwTfQ`PSxrAMa9ZQG5Egj!*?)On%R(=n0$ieQAx~4`k57Yg*%4Wm*sRk=QVvzPZ
zj6Umhlj)QBJR*uzkCstiX(A+H)k)w=)cF^%$=KiduQT&MfXyra0yZ5g0PbYyn($hP
zAVP!!v9>X4b)NQWz26+HqMEhC4WS*sV0}5GT6ygqBsu!ssI=kgA<fvKAfp{{bBYhZ
z+CY|(Yke|6!mW>Vlzp!GQJlbO3xmMmW3I}dgPYogeDXX`XT@`)J)8r^>fzcuG3fzF
zs~DUzqTPAB`4iIa(c8tLdqS|^^&bCMtnNs_h3vl8l$Z(~L3xmFy?pA8e33k}{o7Ms
zV1T3n$oK6xtLTbJt+K4zVt4G@K|LUhx>FRys@K*p2`&g}fxTsQu~{vCKD$WE*NGKR
z+bwD*x>U2p()jg2k`k1vhfYTD1LD;u4I~d^0h4K1rZ~rMWwGkA`;tp4e;*4^|8KM=
z5a>lL;?n<ULqW#Q2IMz|shfuKMn=**_iEz!JNfEXH`S1pbIDkWJA@<8SNt*!%(h#b
zFp0`nlpE3*`}Nq5l@OF$gv3`a>o%Q)-YC9h-xYd;pO5KWg!7l(*cp)Q<9{F$m$zlf
zsAO(lfF+?X>KMo=rt5tP%#eJp!G6h}TSP*ARx5+6M7#nwU`8|C8lgSNzgL#T%($!0
zEx7!fvCGOP1U{MKY?*5n_#Zv)<*COCtVdIooZs^@D4S>9K17jJO48F9p=$dxiAogl
zNXj{e&oaL5yAqAtKK!c90Y@Su`Z0QmSJ|Zch2mRvuF(E^&HqQVE;tb60KS}g@*_yb
zk}idHUW=g{8AEZGw-l3kcGw=^ec%z}JQF&5OKZ|ozLQ1a0`DPzIh^mSjaRAo&e0!l
zyYz9pDVgDPQ!X!_x)WigcNM8{>E;<`YVl8Il3U%k4gK_hLrU#@d|pDZFLlxQ4^nyo
zsbYICR+HYG>z}wXo2M>iq<7<{-$r{^Gt<l1n-xO07$=H8rJC+W%KAYN?$}k%tmNT^
ze3#NA)xt<5$kUjXGbMzM%Zn$V<mj$2cDxmZdHtMr{O*fB5g5QZ(6gSOE2~R{N;AV4
z?Gx9!b#kgze_XN%$MyvnOUGAhZSrl71>gh%z9`7`J*T(OHp$lAK#QwTBf>D&tE?UP
zB)<#z8_}LM>nR}0nwnHSQmr>)<@WMTy=dBU@4i0AYiHxHl<m%cN?v)yejV&k1sA~H
z<@=W%duW$qBf1aIqRvGswA;q`AS@+K*;1Tj&HK*XDN=H?Pd<|Iwquy%i=Cxc6LOBj
zI%&M((tmYmB$jxqocA?{$pfg?=SbZ7=7i>0((Lc{lDY{R@R2wF=j#I?v(E~er?<>s
zxYTz43*=_)^r@sMK`+cpWQA1uJ!q%>Gyiw*neBNKUBs`HBI*})B*@d1J!lL8o~&RS
z#wbA>JH!ap1=-+L<@z14oBk7EKf<#5p3gC2@nY4`62_MYMDN<v4;#t{4Pd!i5if(w
zSQ^hk3YC3AO2^gFx2Sq+&yscO`6a=|wbrBd{S#SM<QKsFcyCVY4NdM5A;>~D=yCqb
z5g^1#nrxkK|9z?3ft2OK?bBTbxB-8ye~o)%Q)T+W=QZZUP`*PeeRqK@h!=!i(mj8t
z-!iu^w4VrZ3sb8!ntyY|4zNE{0yn*Ns~RA$G7__>{cw*HlXN}LX0gHr-H}Q)8>HHa
zYRqo@eeXL()oWwGt~mZkZSRu*>_col{*##GX7(OOO(;ysf0s~ixV$j6k~aQ$V~l?5
z`J6A9-1s@HbOpKsG_*a|XhWuE-6Fs>V*DwRd`Q-`EbAmol~oMbCF>tiIDf-Asow2$
zYY0DulE(OXpO{iLW}q`ft5bsY?)l5D6MMdN2qzLhS)KE{Xz${S`y!u&t1ruxkilw{
z!!Q2n_Q>(KM~*gk03Ode!TuNNYf4$kM{3gnPhNjn{k}$&Gd6{iQV;(TTGKziv2)s|
zA1r!Z57x(!5}e&M^|bQWRA2rxURwvrt%qhgU%B&Y7FBomm<_H6eRliQkq<WB@#|da
z{9Y$6V}9I1Zpu5)G*U<C;AzE|KZd6(+hDJ(1fsReX0ze0L+W0hWsNGXLbSThq14x9
z>8XwgnOtYr4@$+^lvm^7b!E%@(dNqen%%P4mM6Jop>YiR;RH_^vQEb4S95GrpH#m%
z<@%QS&wx1p3C)zf?dX(Hm@-8pA=5hW1a6}D>@TP0>OI;1$GoHt@{}R%4IJUWw2Vco
zp?4R2au+?>pM>I%f&`>$tZ!}|m?<I#iu`l`m?ey>ugTS4l?@2>4~Y+~h@&YrE}HBp
z5wF&?aE@x1LW?}8I`I+Yw1F0}h>yQ4y<E51ltRXLv@`Hqk7Jxp$Yb;Hp@J7Hx@rMk
z`gncCgd%MBd|9jdf!IOSq$e?^RL|hhLZ_3D#h+~!tmeJR?OZDe`TT34Fa1h~#@ogo
z^*tT{c5rrESI4z$H3T{PjP(0tsZ|oviByfU=i}}QQ&KoNM5|KLYKu<NnyJ#@dA0E7
z4lhRtl(W(j?|xiN@U(D}zO;S<{~&F^NBZOGmWcaTF%#8UBC*uo{K~|qrH8YF+k4jJ
zMFRWDdC#n;lYils*nMVrqWynh=-e<CrzD00UHHLfG%k5DHe<~|PymQyb(>i9#k*s<
zyknrMIds#jUuu&pwn#lPRQZj5mlGnCM`t9CMMpH2RhT1|Pb}|dd{<Ne-i6I28CEb-
zOcR{lEitItk?4V!t`3!pyyQUq&7A|ZQ7^geyDBAQ#CZ07o##U6rt{ZPN;IJ>E{ahH
z;b+s5KmOnv<kGq6k4m1Xm;RLYz~lD)c$tABdR5M~2A7WO3zz`nkLztM9lgLwf96)2
zPOi+<rs?}v8kYj#2Ta%n9;|$i&qeAz=36*3$KvGtV%&*^UB>zrq4Q*4TN3MDx!OqO
znx6FTbVjDO_B_lk`25vco#9J0#ew4zmU@CnDWillwYI)x*G)No-SALaJZ4(c4Ns|4
z%$GWHSJX;?Uaq0tdw}_8#QDd3H{;nJo{_Zjc<K1uX!zu7+II^}Z}|snCC;aqtia6e
zV;|u<FX1Wu&N?CJ7rAhl@P*pVs-v2!ij}%{9hNACoPbQuL=U;q1(?ZPMh3qr-Zu()
zsiz0Yn_#B56x4_3;|M%{70Sq%eYg=DU3Gz3q-K7s@AZJ^o5tj$ae)?y<;Dlq!WB`c
z?x`OPJ@S9RoaI!0lFsiHcR+DHQ_JG;{}J}4;ZU}5AMo9VBKwvsAxm~4`;xufkyNtp
zN!GDs#+oSmF1t|_g~+~}vJGM;#3Z|6M%j&R%-}tz`+45uc#ikO`$Zi-m}{=<I?wa}
z|80K>rBy2PL!F>Y_Y4U^j?);*%rxK2yEe!l%e#w;O*iHgtvBVb1OF@O+&;&h-~Ido
zwWaG{!zCR(+}5R|JzKvxaLP!!XAoni{UmKLhmEO?Q(5j9OD{qkK@``~@2PR3ve6X!
zA!Lue(eQ)iP}g1m0|snpm3*3}xFU7lY;r}Y?8yz_xC_iZD2cgiJ<k+zDUG!8zgR%~
zQI#Gs;qh+XZ2U3phZy_7`eTxk-L>cwfj^#uvp7_6(Z3EuIZd;9KgTKgYRrOvf+Ge*
z^sMnrE`WQ!_oodWqgA#0wrKXN(1KOaOoEXSqApKW=BiHI6@NN^aT=a9_2}ZJDMS6N
zm4S=em|$zKOHtc5cj~Xix6B0aJ`J8fW9_A0Why9b?PX7QR+}t+H$jV2hc`9CU22}z
z*`6-r^SNzV)*%bWD_SV6sHmyaYhgPToAQq@JH4T@^$pgoHPEe}THpz!o&96}C%t1}
zEdz0Z!0P{Xt-c+b=iYX!xwjv8ZOPGN#*Cd?P#w#H+2Z`2&Ziyi$}Xd-1F7;`_g=RH
zcwHgzET>5N&X{$8qxC{7-Q1|wZp1&FYB=SR?Id;A626PhgRth}Xr)WOwu0g^-djVD
zc`8<v7CdU}rdyWArW9N|9enchdq3Y?9?j+7!TT_qbv$hhqYW(~WP|k~INU5z>Fr@b
zXfRp!9M|}^C%OSkET|<4>DyxZXTY2h25o}M(8kR|j9LfrNL1s^n6eTd(l=f8aT&H5
z(~X(S4fV1@RzNkV+gQT)l3}hIxcp|m(x1<Kw3|Fj4{X#T#lp*AS}cv3dt7yt9k9UH
zYj(l2Fs1!&;6jGoX8lQ;UrYWiw9&JdjYk_1w)T}#iI*Fj(EjTiO>&17KzfbIM$ay|
z1xj`&SDiyP%&mS?!z68pG5d|pY`LFM1=1UBd~I<VYJWV5?);Q-*hiZ%;I>N%<g8%}
zAJsHoP&-L0b-{s;)MTEx%E0@~Fcd!x8st}lsE^7iuJMhbof3Bj^3Trn=iqL=(wB-J
zv%HXmi={=0(a#sSzM7#r_j}4fE_l3kXr<mO&K=;T?#F6CND0y3!2G-p*=n&NxfNC)
zg?VW7nh0)q`d>5}+p;{~kIIYH_;guY6H=9RQ9GPoWUC0pE)rww-p8rQ75bK`P}4Yw
z*a-dQx@E2m8=ZkB1qN+5+F+DLdbhdFkBw&bPI#PkR)Z|P3D{KW7s{Ax-r3DQ<I<hW
z?x*ur$rV;xjhJ5k0Cnn9#vEZ7V%ZH26qM`n)O-jw<1t>25Ab^hYvl*^Adl1Ao@a0N
zrwRmF&ATzN5`510taZ)Db#`>EL+DyKl`H={{Aw-zEHnL%a+57-<0}hB9$P@`78U`x
zwg$d0?d!0P#R3kGV?<PHcz?jchuaNc>Yu}At_`MrVIKr=8mm1@2&;0;Kfnx5?zu15
z7EU$-ReG$5Z5(blcQ#S2>}gVOfLwzQm|w&I*+${M1>5%>{xtpl<6qTR-A2YK!NOf6
zR_<FL)8m(Wre4mN<7K^o;US^oDf~o$q4m+hyhfwnR6;2@>f2M##ve4GAv}Ips?-zN
zQUawnnp_1Kgexz&UtX~!G#&<+ZEqatK8>GrbwliC^g+1RK?itd^kz#&WX<~lt*kYS
z>}oD?AF?5+t0Q|lN93=e3Ts*yb4~g_lLJ)cp1o-)(Wx&N+2S4s(YL_@%N<rr9*3OZ
z?UL$$cGc9=ZvGb~eG{vuDUfFHT(Y6gi!2(Llyldb$xNL_T?WY`%Jgq?1as7}hKPOl
ztxrG}pkVj>Q8Diq8sT9DnbQl$rw5spp{k}v&qs%ov0=6q`2>}5*sosM{X#0uo)JW$
zcwuzuf#*7B{K{p$yy5`b$Let&$Wb%_+|uOkH`{8n><n87M!_`B?f<6h0dpZ{E8?rV
zeus?dLAZkgwOqQBsn<7hk#@kU@0s5<re2IK8ec+_6lP<!hjhGTu@U^N366AEWp!yE
z(Vb26+-g9^ToCTI2(K@Buq3ImIufJFt``ruya3B_>j@9f>aT}KoRuu2Z8FhPGEuK@
zih(J6AO>89iZW$S*NE;bCy3+}{nRVky3zhwh$?H)-@*ID#;{V49FP?7Lq`z4CB`wd
zl18EPJd%As;k<z^F~Z_Hbte7DQd?lL$d#QH!kX6d67XW4+PwQGLX0cQw&9&=kfFcc
z*%!PqQM`Rrw-08vkfbm~rT$rEu}Y%cmTtS*zq`h&Fr;LvbT^XxzI|pgV@TEr#X7_C
z({@D75v*tJXJ4A{Ow|hrckC%9$K(gbv%H2dJz>9C=LM#QktEznJl4vEY{IYDWa)K{
zTHkdi`+nRu)NgjNWlb?{FcUKMl572V1d=!(n&CkbCq(2a8zM4TKgwXhNLg?pZSwl9
z|Bc~{E`CBFf3MiO;C~T3GAp3lOD@*T8FV$7vU@D9`8xvvdwZa5-Bg^?RD-x!+1dCy
zTqHRW%s%NQ(;_y`bp$7V2m*0q!vZBLclE4&W97ci03GXv^p2G_H&EJ2?fjBlb<&W|
zos3>xV&ccg%4#}_Y&4yN8!F&R+o8I2q%=|$m*4=0gU1QiT5ZJ|z@3DC+%J?4#wIEl
z6MuzY?QkoTLkC|#m_xA_GQ#8IA5!u-nPvz$&aVP8N_<}|pg$CERyj+EtbiwjIIWjz
zzuBTK|Ej6?n~?QRid7O_#Cs@+UP<BX(s_G7TbSy%3b3CyTI64YM{zh-y;-?|h;Vu-
z+jT`RBqq2)&smmIDWUs%)K}oaSJ1x-7^VOp&llHAk0QQx;=9edHd6I~oQsfM$=e+*
z+h+GBr7l~uOMivl0a=_<M!pPvISejZM{k-ovr6^hQ-myo6wW}P-PC0;^!u^O!gr~c
z>>u=`qt|xp*ReKS91hsw3p>qs0-#$iJUAC=TVyoKVq#{>9IqmhsYW_lIf%t1`u0z1
zI8?@^H3w~8*w2+%?NX1#O||r({_XPlsw(}2kN>r6UhN@We?9Z88hV|J4;DzmY{|i&
z(o39rS4;PBu7y#BFQJm~<(4LC7Hc=rq3I)uwJ}o;U-Mp9Mz!LKUYjV})y3*8C;OD7
zqKlbTqo0gN)XhfD5Y)oJ6Es}B?yGLojtYuzoNj7rS7#GcCvZ-NOQhwj`x4q%khi>1
zUNy5ls!9Zz?{c@Wzrq<odYfL~qhukB<Tp0sA2!DU<b?ETWNeS6OMp$SetvgG50<^~
zan{4)+Kh)--gU90yl!^1H#oaBlj_Uej*HvyYsg>USb=r#k;v+>YE>Msr<;UHVnfzL
zY<|}JJ;?NWOmldz`|14&QdqEhIj>xgl=5CG!>2=Vo+T<w3f*=mMPz^UeRI|j9aN=N
zh;2iG$E4sqhR27I@@Au(;|9$Lds|^cyTLpw?CAaA(<|xsJNm=asw_)GjsgpoRD?+?
zUhyP}g3_a*tiIx%t50nWW(_xbvQGTrvs3urutuc^&5sl4HC%SUq@NqIy3E}%##bJi
zyeL-heLzGJ;+@{9ZlraMptMRGF4}&}_Wlzv_YQpoy}rH?*`Z&7YeV4zi}#I-2yHx5
zB62;oQ9a~X*Zk0!PqZkQl#(p&%cBU_Y@X!T0Rxld6QNb<qF|Gu<esXQO!STT`yh+X
zs_n$L!clJ>zF`9GY3D<(X|Gr7O&Lp#7ZCKxcfdVx3RBNY`3RgIsK-Dwfks-Q$`8^p
zZIOXfvYeK<YwP&T8fjwe<*sL>&^u{`#@v2BeN*ClB47?#$hN`p`|+bTyu!01oL>cI
zwah!15S)5v>lc}g$rqIT1RV}Y&&#3h2VV754wGm-g4%N!Z%+;>K><6^yM^FxPlHWM
z&O8%TgsYP5rEO*P56=arteNOMmEP{Eb$VBt+x5bJq9^cNY6YoyOWj-Zp>tvf2<3c)
zdf&!w<7pcXUb1BuE~^IUny1NLT*a1U$b($+<dke?5Zu4=V)caLvu`&;b|bS2Jwnwa
zjXIp~0b`w?rLJ5U?b|wXqyxry{ZuuGFfO9*-g+(^?xt{?>HS#Kkb-5ma*c$mZAR4l
zx^`11TY`8tlN`kes{7*tHAUn}mFAb)*u)@py5O~L)JK5?*}G@*s<tx2*%5u0;iA`A
znbJ~{-{37D!it(h4GA%CoaYid86c&cu)geq5T*z&rQhS|>)0fpz6lO(y#z^~a80<O
zJ|7X9`||r37*2dGb2k^vlxzEqQmK4^$C9%ruyRlgWSx1~y6XLkqAM&PA)G4ABXT4o
zl{P$9f9|b#^ApCFZhNbuC%7+8Z6fJ!9x#>+P`~{qnHu5s6rr}daCW%#;O_d(RAB}{
z1l*j472v9LGquohv2^}Qv`#yzR~vol0y9(kaz_GkBO~6SV@@ja_$1;j7rnwHf~fgF
zZ6k9UU2EzdHeqHVq-p_oy5@7`6!z{3-`v-o!KR2V?<(%VNEU&yE0@f-ZoIeg0^bm|
zhvV$()q+qvZ9=o<Qv3ZA@8>OB1@i((;8^l*9n9v#;6~TflE;k3I_7JcT)Tc=;iE6H
ztm#@l`KY~Qzwi%vctM2?YJq+GU=n6e5ZZm8`gLxPAn#3d^^-+F<Rpt{Ze^*lGSREh
z2dEdeBn?!3y=GiEAwSAP5OuXZ+pKjdmB#N{v-aPvk9)Abk7MM)%$|3Igdw42fx8lz
zE|KZ^27<HaZd)EGSRxt3pyja~<P03)`|Ll37sZ!eg|B%581!Pixd)|F@Wxt&&9~1Y
zl4f!BnR|$wdn;7%hsThM#cQg~^4kdqd7v^uk_qZ#d#W;RSc?#Xk@KhSJ9`E&bZd9a
zU8u<!!Ai<_KsCOeAOSF3?^pkd^n2|AXooxs@gwf*k;a0g-_xZk7}&zmlqq}hGT3Y6
zoZ~xH-8366WtRbAM>LF8)7fbBAA-K&U~pURy=$0@oJHn{58;Z9dfwBr_WvFTD!RGM
zVa@qFNN6Cj$iKOA3XIr$d3H4C{lJ;OF9TdYHKJoqI0k*|>NVYOO<x4KIRBCOntl7t
z#b7#l`%h{SkI!(PiTI+jFM^bse9x_OSR!hfz{dGjj=iKG#FwdEAI<R2Q|)DDVy?a6
zvUc(h1LhI|Rx(<#)f=mE>B<i7BkpeI{Y%SWlHQwHbdE0GLZ-FCid@?;j7a0y)-~S4
z!tm4j12y^m2=ERty-NWxL<(h!`JWfh+P`NwQCE{2!YLqhCAwvOA#LGx48A9wMwxyc
z3yY{W@w%Z-8;Al*!-xdtd-=rqSr@Z!S><18F}JE_JY+MbuVN563e`N7k+-b?!Zjs9
zGgrOr`58l)iEn-N(nyQ=t5n&60r)@pA{}>3O+rMsR7!}T85pPjRE8%5>>&9Kx)ulX
zu9x=PXx{9GdxDe^m{{pb%wvy_E$Jt9+q38uI#tbt6=iht%Xb(uY(w^4a=@Dr9%};s
z&e!2GzOIilK}(mT9&jVuK{gByDd>*#DQU|mQkgJBytL){l~aswOTQ=R>5ycNp&nLd
zVwOpB`k_jwso@M+7EO=}lR;N3p0g=7wM{|%FBY&;I@54wxV#YW6((9!;7;_Yg{t<}
zCLEBO13N1SWK|eC&*5=XCq>TEJV;Osr(1FBB0dd+7>nQe+>P@f-ZT~#9z~KpQ92cw
z+A`CPhY#S8vsYCLcF)y3os@73&ye$0;2UW9tg1-+0aFs&hyYQ&VGJ_uj|;c!o7W5k
ztc3P65JVxB5>(f&yJzwy3fnAHfL1>7>b!HaDj>*{@lXh9sJZn>lrO3yoizL<0!@(1
z(ZDfiz8VORWYMi^R(54eP7mubv93Hd2x~8CAznhxRLl#WcUV+TNS7tBtN49#?Vmgj
z)S~}Vdd}xY{+R)=Ks^^}rzXhpN+B~F6Jal%wr{!|{ZRLTE2CR_W@or41!tln**%aT
z6gDQ;<Yzg4a<NijUwu*OMDIZn`l?ddhX5YjMw{G@ES%s3*aa`mnk<X3-#7N#<(E#%
za4*55CT(`B;E148o4M=@k6v%v-)y6IQvaClq@n3~zyhkuW>4viKE$F*^;jCth|aca
zB}jU$)WMF#hYdrU5#5hLeZaKrE{h%oX#p-MzrdrBBgU;9_RPeU&d3it4kwHvNXO%Z
z#v}S4ZeY47vv`bbq@MxfVYJdW>p{M#5$6(6dMeIDcF+?J<oM!2<LQ2KY6=gnOmA)I
ziA|KW^<3$-nv(UiK%zr+T$yxKs~iC;c?rF04*k`i8FL~wv+X@}`5A8rH@kRy`hJ^1
z%2SUXMSTCs{pW`SUcVQ|^d{!?-NR-sZ@Ly|$9#YGoG-GAO&-MZEo;lO3Z^`JI|ydN
zh<Vu4{rCc~5KmS~$88-p2zU@oSF20Uq{gIiRxbj4Q*KlOG+!@uxv^Sx4BIhxV=_78
zw4$taCMAN8lIs220=~t$i)7&ico6-uu{518Qc_ssXs$>xc6~PbWM|;!mbJGXbLC+f
zwCg_{RmN=TZUDHZ+I%gzx29==@u#xJ9+Ua{&3r={8xg8QI?Qn_qMx99(P=a4sfUH%
zC-T6vxFnO?)5s>wDqVp$%G3Lp&Y2cQWkbO)H1%;8nS-bKk2xH5nRQ$cix)iT)(qa4
zGG(agUQB?9^7W%&d3>=m=D2jLC-KqK7wR?Fad4(u;<9#UZ0D~OHinDA9&?f><83Q@
z0S(|bxEA?YwcW!u#IVcVT&nYDAFd<`I{Ap?zC1t3d1hBOVTB-TZkqubzYowW%^S^z
zo<E)5WQ=!_3j$wR@GEomiDFuHC1_7THF|3x<jWTv8i-gU7gavut_;C)IhRd<q76+n
z&9!qB^-MLo$#7Pk@w_@^%$_%7b)-|;^6cK-Uq>yROv^ob@pDGM85{5mZVyU{TDFAp
zW2XFj@gY`foeGidq@!0`rZWU7Sx0!|P7Ju=P=mT{p1!3PF5*qk%?8a^BffC|M5lMP
z?8A?uS$8(GMH}mixuckFUO)U2vqF)Jm}o!yJ;=oSp5kcOq!BydqhSCSvN<>`q(|5K
zE`^opf?JwZejlvu;Z~6(Ir2;mg>J~KbeaYn1dq`1btrsAB^(>SA18M5HH55K-z`!y
zs0q#2FJMcKu{I$I(l1Z|q=4=|hV><$M!ty^2}B6HV$;K8+)Hn<j0<_;bddo=1ki>T
z4!i3mEi%1@b;PVph0n7_Y)FXcsYM3PoIlEXU>4euG=x|@yaBy{*h5tBmw^LgMl^SS
zOC!+h+vVZjG@3ZakIhAU0UDjCFhBHv`I>7q>w^Tfp%Y_KcAYGY8-SgSy6=VljF&OC
z-p=4Is^jVc?c9rR7tJ%M*=x9X7ytXgn{ufnw`+ucG?=i+E-3JC%Fo3Jb7)~Siu*p}
z(9hF7za-vlN!bNq1vJ=e(;-_d(&{c2Bv<RCrq0nMX{M70ZA-JcimP1NZ{D0et<U<@
z{>A6_j;up5?|5<nBV+BL&SDX+Wn8X2R2YGBgWPiZmX8h~0dOO5-cVjE5$?W)xGe*E
z$RmLXTbb~Qv#lGr;%(();~4_i#I46q=m9ds7pqYU>%hHild0k58|F2ZN9IpZZ7-<j
zox~LCN--!&rxD>1QUu$X`fyD=Yg<4!@l<7VtAZ0LwAa9o52F@N(4|tj%-?Ag`JMQs
zX3-Wu#mji8ye>G!S5!h2D1HBDa^_f@BvH!bI_;Y_$?6xcY8lU6bO)Sk2F>VKzwu;0
zuV7F%2Wp^OdnUaqf|JVW-WEHf=O?D{!@G$?8wL+=7vgR%@B0Z4mky;neC6Nix7&Z}
ztDP8dd@0IhJ8S8Y@eTOpYhClo;l88F$l+(j)B1ygV&;jqKaY)8Evz8!C!Xv7niW`@
zPS}3Jh?V>T=iBdP_+;Dn;(f=Bt>uKuxx-%2Bsf*Q!%|Qo9oIjv*@Nop#~%!~)oZuy
zjHpY|P$}`a{F#k2%hK>XrH%Nj@bnu7-(30dJ1F!tS&q0=(TJWS+b@u{@TlN*`3-s7
zLXiqGa;xg9e|zPM9Q?ne&HYRQc_`E=6IJ{5ygp+AhLuIB>H^qSCf6T15zm)w%nu5l
z`Rb2ELno<K<ZgbBn_Tdm)t7pqs4EP@8*ZaomF48nkYzui$w$dwS30l%sXO`IXVJ9X
zhI)Y}yYWroE%NJYS3#9Dx8m+niXdF?fk|)I^Q^)lcfMHVr<~-hOTWg)1E5xuxBRfa
zt-*rZp-p&+RJP~2RTI3Zab8oL3j->Zw{`h}IBfO!)V}qD%7ZQ_#*KSL84vQf`z&*^
z_BFDDPc<I&*Sj9a2Ez4?1+cjr2AWxe1g|X?#c1s6e#`!59AUkwF`Ex7T|clcZR=@A
zn&fR;pXBqX{EU-swyRYwJhGbF+Y6_4W@#?8MFvPYN?2>UEia4{E=}V~FQ_8(T5WCQ
z@TNB=KXFG$DWgY2l3skb;BfEjd<l0YWr8w7SK1YhAU^n4P)CYuHH^ki<oBX|i|=#)
zS+sbKeqo540t#kftU({wMrGq-+eqZLpmVQrX|_a*yH8-+@OPG<7(5_5dw1;3;^4|l
zkadyRQQr#>7#66}FEC=lCz1I-a-8gs=ax#XOGz|AAhGpPBRI3sX#t<WMsBm*!>sfL
zajmn2cNkuyC(%rged`nJ*P%rC%##TsHisr>pj~`Sx+&2A!|-`gVm5W-X_EiOY)+wb
zt~CBn%%;W6U271t$x!Tmg+OF_oVp9j_n3tjP7if6p3J=n9{5}ut|@ZwowizGsSwT4
z;AD8GAtn_X_i-k6vGgL~8e}?8PPhC~vHOot)JM<DYkbMc#ajjxfOvWkvq>GVJG~-+
z%CD@Hq$#j(VT+=FYjty(@&Ej%AFktvsmX7Ca%){rcsNH0|INW?V}(mv6`nxLW``Z*
zE9%jo3Q!%_BZJyR{4Re`AIU{N6*43{f?ee}^)?$)E|(;o@+U&>?iqjT^oWT|b9<bf
zI<x^JVT{Q%AN?XCvJt0kx<+;@tj4Dr_FdGmrc$}$v1T%_GAt7xzmH{y{?jX?c1mtd
z!ka)lcy96e%7v0^(c7iDIxZ#((RXZZ3yv5d!sjmO2VVcdNs|$mX49b{D<pd(Tqy2F
z74=X+`{^SUrK;K<6Wc2hB7FB8ukHIF;V9T21q@lYjOAH4ja(5fIKLRUSM;M!)WgPa
zF14N6BE@&cblOrvB`H07H<$2zc?P|+QE*O%ZFu12Yjci&GrA;TlZvK_3!pwqwqIxC
zrRb2h44xaFg??>c&9S+6mOJ*J_X|K(KP8||)ZAoeI4$r3dTpWJ@FvBS9<!(YE?2%>
zq*2nV@En34vGq4+QyA^-&YiP>pugopH+1Ck`3^_Ozq4z0NJLk`Xj(vQt(OHQt?dCx
zGI>&=5jvqB_fxTX2n(<;+4~xkfAUWT(U`XFL-@UhWP%SI#UQ1$VzHTnSR<v@OW|g5
zOu*VmTO~xy6VPVK62OJ5X=b|DCxI7N|Kz2auA$R07v@-fO7?ZMbSX9w^Scpn5GM1O
z)$L%^jg6)w&fyKyd^?zAz9u-!t8{Kl{sFb*hJI|Dr0l3?q><cY+9XpNzaC>tS;JKt
zn|{5>??P0Q%zARvUfZe*`CjlUqPXln)HdpVNMd!3=9i^$f|gl?gV6V==lqs$Xiw?X
zX>ptefov4eljlW|-s2HYTAiS*cy`@?5>9n%dCvU`&r?l*lEi9JC=4@;`l0Yx&7<}2
zK^VRuIRiNZ)5pf%m7l5jo-UCpVmZ}mIJ-llZrL^`v+q|CK*n)*@XU%#V~_Szb>0cy
zwlxFCW50ixgAmVYFMeoQLnL*7mg*&_Ar;UpdBhFe;HMC0-TjcN(d=iF5-=9~danrA
z{D5zYxcK@S3d>Dl@iZ8)ycWp6rzFZ{OC?d#-4?0TisMvi_};iUbpm)jlB}<!8JHCG
zMw4@BMLwJ%)YcEE3rJB5XUx_{2@`wMQ+_yNr61-|eAU{o8+iAVIJ{q{>Xz$Cwjvf3
z^XPNw)JA*3FykQC;{lMbNmMqi(|(v<$t}|!ZM!fvOAhnr7rXo@qpFx-3|oD4=ny7~
zZ{Y!SJX~-qT-y2OjO5)F?OS0HZcB7Zj0Q71RoE(@!VP7HV_d9iGdh&F(A{a>=4bF9
zm};~8qacQHN%wVyUtyW4;R`b$XHx@L&0b+_?y-iLD=3w9MdJW-_oIdPCulrMdY!0c
zEXEr9SD*~-UCrU~$v>is9`JpPmkCQqfBx-e*xpDB(;wQDj<1BU&t6}{xn1{Bw`5gZ
z=Htnm_2E4$^&9Wtlr|i2dmu@H0Ggr|=-MP9Wc(%9UNN}<S%16C__x`#=Xy4x+(&M>
zv|eX9i(Bxh+v#Hn<6(7v)a%*gh8ENG#-jxHlLS(Jj&9+ni{ZcebD-(LDg;&I$U;0r
z$F|>fiDAM3qK9WbfGmCGvSU_zp;}CN8<t)tOS>e*0r%4RNFc$QrT3%VrmVMaK6$P7
z#PadiTdJME3LUyx!yfQMJ`O@rR$Eop#OBb*{cs)kquHO9gf{a&%$93dnTjiKeUh9V
z$?l8tb*YKEN?cZ-r3KnKJY&DDszb>*Yj?>#pNKh5YE3GgP-AvWS5+JdD<rBN%NQpP
z(yHLwY_}UulI;@^tAFY@K()#cx&KeVw0Ia_V8v3m)70|5=zh_@LLr81H5bc~O+hO6
zru&L39D6>&K(+y3acxj-FK6?)ZG$H-S8qLkXA(wpl;-3gcs(U{%)BjOP@`KTEq_G;
zK^<C2IKV{<mirg@*`lERp<*-!8P66RV4pB*YjP(qfbi1UG@hG!+d3G3<}a5R(6ky-
zq3{A;`@dK~IZ?gOBXc$WRZ1z5>7bXv8J5S{#dXGpg`u1R-Sb->`#$~=6CbhRSCZHi
zmkd>pW0xI!DJDP{EqI;-2L5JNUv6(p=CgbH(3CY@q3hpu_$^U7XD+?ht<$}x98~nH
zqqF|x0ua6+mF;w|CjVpQ;WiDG$?`)vgJz5G_BW;9T#ZB8#2qW?)C*2;{0qQ*vIdz>
z<#&4qf29XX^l}gArTFTj#MSQ5`8$?084&Yy;h89NvhGMTf_N?SIMyhs5L$8Y3o%sC
zHA2*tqjvUiJEo~oH~ALw5LgQ$Upx@`L#9rqO?Z6*8XV#KF}&L<oOgD_xO>XrQ`(F{
z^H-SJUGgUQ7H3Ky6NQbvR)@|^LpZFx_NZ<<XK)&oL*gghDN#(hlY3$o7yw(wJyg91
zfBgi)?%t^p`=p^kD-f7QFAEa>Jzj+LJ9P`avIlY%ke`{!`9jw4<%bAiOGldCD{Mvj
zZVLJnp;a#>Wt*H!XoE=`+P;zt@p4JzCkL0(<8dwbJ}^q^#$UD;Ke=HpYJ~?JJBZR`
z_O-uu#ir6vG3c~*74adXidsf6-TmP!J9Q3eua%Q&@@`-C0o?7S+qFcwVCzPbf`UM{
z*)e#ZTo+;k@*ORaZkwd<C-;7J;#>2*r)w6QpbYlG{p`t)4h3`V1jO;&A|zX0Cgm!u
zV4Pfu`stw}An5~02A|dtLHv;=^nR2qiaYYf$+fk64s;p3*n30i3BGwtiUpH}Uj=_g
zvM?kxp#%qb|H9M|u$M@Q=_ROLI99|jrwP2Wxd*)MFXhv-fB%#w|9t0?P?r}EnqZqj
zimd!%JjN-+n%pnw>P?qEYiA26zWdAU(ya$YHc<xrgb|J7Jd49C$-Ci^-!Qow_43<|
zngTUp-7Bfn;*MpLWaioHUNxEn!83V=qM)A2ML5{{($SviOeshNnV}k!x~Y=wFM?Ff
zXB6KaS>$#S(bLYJDCpSTjy^I^q&W9h53s}GrV3+N_n%OwM6&|P@X2JYllPtVYNeaO
z(Tc`R<73wHNa<!LNpEPPBuir#;X)&MFB8p$^iFZNa67)>OtPjmf3N_ye1Z)7u8xY|
z%@_Pv_4{>X4nhF$_q=$F^Yo>wcefdNul8=<6=f@ly(uOo2|_iQJQFP^@-$g=ycFUN
z-;XKbUCs;W%JpjfQ=Y^A#K@j$i1W;;iU^wX&3aE2Dq;39IpNW$9&26DjKB8R@S#)#
ztcg7N1RVn#p}1$iF=Dniv!mrKZ!TN@)ax?DP_I?z&Q3i-dz3vB`!4=nK|<<ro3Jgt
z=BD!1_b@<5Adb%j9@xZ+xSD87;j{S6_x1{1p*NTMtHYXgJ%gR9J`ibT%r(kufw+Ww
zd*SvpOrtOl=0H>yN}?^OtqzSRRp5_f<+4<geJ+@J<$`@)gMakVM(dP&jq}uNC`khN
zLM%4n)W7guRz!>T#-zDHc-J{}t&ussMCciVV?XkT;KWjK>MSQAW7x~m*a#GL<~1+W
z8STHEpfY{<oMmtD#Q~ywxE~raBV^vNeGMOf1447egp%Ke-FL(@4ymN<1%D5QBS9v#
zFRa<yx*gR*<VLQgLmI$ua08+PJiVvWh2R;z*Wb`%kx-QIrBFawhyavrF~COd+NGZs
zWy%sz3*i%xqq(cr*^m3CPv!pF1&(}3P-Y&?uYr1WsJE&qs93ovtj||2G~M#pA|u~F
zR38dw-)NhB6r4jrb<y1_4#^rhWsAd^V0!zLU^gJAYH~&4hoC|W8dirx+z*m-95Dyk
zKTpx;_`3@t#xlT~?4^7B<oN7hhVuOa0A@EQyB47XKs&>2F-B~j-D_{d?m1KntlTGS
z%v3dpNjpt15W`ID!J>T~xXp*Q@q>p;?@yrc0OHuVIjcozS|N7_v-7Tr6lPQ}rD5l}
zWL2(hJ&}WZ^wx6eOh7hecHapqyE{vw9uecsGT`H&S+9qv(rY84<x*7=%3+Ueo%hv^
z>-~<vmC5=3fd}H8+Fd*L?0nGACRC&g%j(@UG_(gty?C~irIlbD`2pFkAE*}}<lmcU
zwM{$OdW(RrdwKvAA=0jX&}`~P{Emj^iO{1TWsS|6^RbrVi@e+aqFdwKPbh>SQ9s0Q
zcC^86Gb#8&4L*=ic|?NFka8LqOlIWBkLcP9tH`@k^8wcLw&^c-3z|OWqqjP!`b|Wn
z;=Qk|E09yea{|;h+AyDOv89LL?gtO==dO76R2^X`gZX?qM!qMqa0~@J4<zr29Th=V
z6I$j#+#dXDWphn)(uPa%#a`S7zhX%+4wBz*mZJBG;OKZ}!fYtwN>G`y7DxyAeC5$N
z_h?b6W^@h_91>irE`-TPObS8xzsqx8wm=9TiBbW522fnJx7A>Nw(Zr31nZ42AD~7b
z!MU=+CMA;O8?1daIYXShV@FY;$smjNr*fX=DZi@PwxL8~WR~6O5K|mb);(J>VM-f0
z%A0!W?3ur_qhPZ0T=!?WDtYB##kyE8!_LM5sB<7ZvwN2w<HRY2tnQCED*eA_VH0(1
zsA31XNbgN;TFmoXz}CknYN-qMXwx&;F2mEe%y?ZWVyD*c&5Sjs0$2I{D8Bh7Z6?zX
z5qt~AY;jtwj4hON442aVC0-X<CClnyF}Y6|eHunEpSuPv<J&cvbK4Y@eW5s?gQ@>x
zozGW$;TurQ!FzYf4XqDjpP&%e+)pB`R|_Z|rA_QZ#vsV>75}yEczqe0OVV6XQhv=h
zJFouBDD%)d8gf1Q37vl`hIFIoHXXpIszI>^WYNyIb}BOZv>2`#$f$NXs9jGdl=^&c
zc$b7fy=C{avd8o1cr&Oe3L|GC<g#KOS|;9oXcv?il(OG;^e9!~)zph$)K1oD*YXdU
zS)BJ9zUPXs_MJNSt~?<P!jUDGVc()3f1RE7tM5NT45pDtO3-E^Kh^o=yY(FHXkr_V
z!;sMi{W<;yn%3sW1VC7#ZQHL`Jz*j>*@d5XwQYZOLsRxd_d@(psT?w9o_C$W1dQ)C
zK0m{7)_rSb-%r*tN3#gpEx4@AUj5AJ8_BwQN8FwIZjmVB)zP&N5=AjWjy{lcC!?D}
zVk4CezahL|r{E0w)>tX?JsK=UOrT>PxA|ymT;RonjwJU7-e4zp$Y3o>3_7NI_H|AB
z2Vm62r*O4%njl5@Q*E`&(4>aX8W;((PLX9xj~z6%5u04Mm8$ChC1jC@GE~I5F`~xe
z!G!v7ku3cVrrD|eyHd^vXix)p`@9`QT7IGEiYZ6r<;e>#_p<{UfgxW{jj3R=GYE)e
zo_bv#nF{~N$~3ZxKof)HPkhDo$v3Lh(!)_8&yvHTH#3%`{x#1y<Jv3|ri;LTY-1up
zDSv?B)+d@9-#&8PKArdYbXL;*y(LQFcHg>1OIiP3<(;~(yQkmf;sO?Ll)DEF&F&rj
zyp<DC=6A2IK&>kq@8`&#TO$cu?rN(M`(mGu2d^vQd<|XIw#1NvL=kNI*ANfS$m5WA
z$YXXZOGVpFweFN`*n{z7Rj86HGLkmQ`>X4514qz<uZ+q-0MNt=R8wzSWoMSu1h>zM
zb0K1e(>blka)E#7{6$Sx>7&0hEEWW64-9U%a((+|C(MUD<has^H~YC1Q5K&@HXIyu
z(nNt;qM8x8{8HRx*?2t^jkm))|78Ui1~A`m{6`Aj=xQ*K1R0#~g6o$ezX$sGLha6u
zR&}GvXYYCq%#sCv)~g~x86dmt`9ni&mXt4O4>JRMv#k?S9>Ev6_?H%hpfL8Kck})L
z5;1h<H9EMAAiEEzHCdh5Yd=nMw?=yhFZuHfC*;-a%?_>5p@{@p^)ckPUCE^Qq$U5C
z*pFWL5yWQ>2X4rdv01z`cl!dB!=JRqBc`28gMUv1gYo6pT$KW@EuXy!J9nGDm+Pte
z?F{<S9d;)Fi@IH{>?Bt#mGtuD(v-5KZG^1LLrvxKCTfo6YyiC;v+l?y{dzsC`uX9D
zc-x?)a%hr$Y51Z#+77Tuhp_IPyh!CUs{vrI*JQD<{FJiWWK2NHn906&_Wx;k{%sYY
zAwuZ?_2t{rEorZ&!M*~KqSciv&fZ~c*FJxiRw`GEN=JTs%UDoKl~#GMtpM4sS~KuL
z>}TV_8Vo;6S(%cy8!SqE4XX#Sh0t)Hp-P9@l?^4l*l(4}-9Q#E`k+sv?vdY3)Tjoi
z-iD`;Op)g-@FI}0OUIJNjP2tovgOeHot5K?iLJSS_1}Y<B)%neZ@$NRC_VYAa^mdy
z&>6z6JmPY@fpad0?~EL>5tkj3V*UEZ)48_mm5&as?(8&<eN1o|if(qGthdU|@(UKm
zN(8WE*;Gnh_QNAVZ#dPGMe?u+pNR*1VLjjaG#ooS&$F-OD_lz+KwK?T{kl68Dt(8D
zcp9G-x-AWx+@FsP7{n`rPgPu0W0;1`VrTZJ5Iv*D9p!z8Rlgb+G@m4szg4nWiG!OU
zO=laqa>&<T@XdGO=Hs1UR%|Zi$%3<fjgp3=wzUa44jTN?)zh{rXZ*z(+oC=IUas*{
zV}iISa&R>m#Bn}k?v=<?eg1u8aj*{_X<nbL**6h(cE1@-@PItb2$(#PH)g9s5<`>B
z+MPAL-UT@6S&29Ii2tcf)st9oRV!Ej;>W9c%lY_!SO>N9zPS}-Dq#0cS(Rw7%*2B(
z*4*&I#_Is~eM1yzjH`ScOAim`y~*4-DF%M7Gt=^V#BaHDw@IVWitXqrfdvp-aDg=d
z9{}_wrsvcKV0m@|?BiWZ3t+OPpf<myqv&ZS-;18LtGlY>BVZh<c;!VYq`=zjP!0>z
zzqBPFt3vl5NCf9Ao2Tt}#S$V$iq$|*nCmUdyA=X-pZBLh{Ujlhf}b>DEjBCv1GxRF
zmm*hR{8s7do^@{R1NrnUcBDL2WURAMrAMhxCG%z8rFZ)~)>W^S15semS3`>HZ~!=H
z6z?{!@mFbz-sjA-<`4P+5+#E_K(j>;W|zfz`4*h6e-uZ9g>56+=wjQ<EL>dkvd!dt
z#$`$pr#DFAoFqij$r6ewqxEW+D_+(=f=tq91ng0|FF^XeIJ!h3m098_J<sA#Tq<OZ
zLt>Hr3CQ5|pc^^ud0t}7Oy^wj!gD9(^Ieym1U2_|p35!>C$Sg3{KJd+0zk{xtOMh_
z;09U<P~VR5S3VK{PRhkhEVzltnBH4>fpkv)&bKs}{+OWS#T0R;ZwbN0F1avbTUEeU
zTlkRDniob$MC?<|7=YkSTw<8?f?p88F9w((c`P}YtN-<SCX&==%l;P&Sj@$n8%EAX
zk6gF?)pfooT3i0l09O;vx6AAMSI*S2A23SJ0G|zir{EGBnZbkp6(zpR@XDMpQskOr
z_pJ+{BuNo&?s<Rh;TVqKDGPj$uRzNGUkIH!+(I2a9TMvu!f$8lLcvkA@ik9&XMeQx
z2nt|WN>g1y7fY!#(BE5=ICm-hF*3D%aN8&g^uz4Zq`V97J8}CCpOc7WP$#37>jf!e
z^wjLmhDcV-0+LU5zkqd%W&<|4jL6UZv(@8vyfn^AN#eXlwmj*zb>{(9qm^hbW-{!9
z6qtK5v)b!z^W!noZFNtko{K0BSx9Hh{)bC5+v1aka(P*}bActWDe&aQ@3OxAwsJi#
zqSDIx?C^t_hoN~!^h5l&%Vj+rQ|9cSQ8fd|``=g}^NVS+Hp+%LU)3b@5-z>tk<)kT
z%)wk9QKJBNp{%x5^`}hJ<E<%q4osTZoTF24!Xpa-Le&C=CU(GlIeSis(Pv2Z7VpSS
zx+7UBuJqpnA-w$l?k+E!(WgdlF4w!3akDbDZO4dcbRR9Al5Nl$JLJN2fO{1ET`x!J
z3g)zW;K|B!x$4d;=&M@pUgQN7@ga~iw2$D-W#k4a6Q4C2fi%l+=aMZJm<2dCsu_@^
zBr#nhl5IG$x+Y(7XkWTsMn$90^Ke)*p*h}S2CLM{FHLOImsY?e{yx`s+u1ZJ>GeAm
zMv-aSF7p*x1}YUkYq9m5DZa82a#6{W{P&intBrAN9W0I>%Ke_};f0gsdi293M8-qg
z^;!Wn!X^Baa<1l?b^>e$FmBkUqd&R$7tMQb2!kN|<LW)(_<#cNb<XG9EL8gSLTCAr
zTsS=d{)bD6j6vJRGa+x#p6lLlFZzv~e1j*p2AIJ1#R|V9i3l$v1GZ;s^S=>^sCf$o
zMDKpHQ%PG={m-W!A8D)*1r?ajg{1r3Htze&q3u*QA6G8tp{vbDDEJ88p<pB<Jg>1d
zW%|3(e$y4sIsc50;W6ot-NPm?tJWzS?z6-GeND)jLQ4`T4Id`u0nRUm@Dr#(modmP
z>>m}xt3&mOCu^E7R52O&jC$Lz2%JVqkcJZ`RQND-A2`j>__L?i_Aj<ZlOE?FH}E+H
zNGijj{4BkB@vAW!6Z|_YBC*i*806;~Cs-VUz#9#F^^Ty-`dKjpoU=B+^9yUOeNa`f
zh0WjsjB?iVfJV(R?vSI3)g6{U<bT-IlVBg*RZCVqO}0;d&Pf;Gt)BixRe*F_ifCT%
zoyew2%;N}JJbYEilh_DFuIadSL!`}dUk%zN5gYR`vO^mNas}63Nc?%ZDXTE#M(qKh
z^^%JVt#GhB^e|?w`wmuVa(_FH;MEK$Jz|zsNKSu8{sztZ{)Go3(85hNrW#!m4?bx2
zf?ggbT58<F`lp25(nEK)#s>7=F2yaD$H*TF)ix6zjo0}jIECroYIYX5X@IJCT9itK
zWS<BUA_KLgT|1I+=CX-&Gju-d(VIGH`C0PDDlnJI;k^;#nH$HLqVge%p8B%IRd>lx
zy#|5v6TxMH$CF!0tGln)$tH}Yi>xRGc#rA^UFZdiUuX6}&}HMCzv9v>hDMwp*aG>q
zIqVmnS5T|($L!IKMySaZ67<Gi8Dz!@fpJDNKGp<PS%E&S7ZD(4*f#pUdH4M)q7bvr
z)L*2R@#PYGgw*1B&hoY)27@XdWqiHYrCq_zM{`U%io#g}ukQ3>m2z~SzT1Xh@oztE
z^3_bTXW62Pn94aH{@XerUvWVtSv0ttU4^<d05FbGxaNm8=z4!p=U?ePIF&ks<}di0
zuX*FvWwo^fW<8z#{A8b+CmORYFMqgYSutmv(_RJvo6V9+QC=Wm)1P2nn<)NYz^1d!
zA|+t+vjNqH+?PL;fXzk_uxSGP>Yf*_UCJ&v<(0>;Ru}b&PR{F_MceniOB+jYx%3zd
z$<>IaaSAGAgFXysW~<)Yz_VF6^+~deTzS+d`5hjQk}8XudisN{(j&c)Q9_R1?2?dE
zi*L$9wHwf1LT&S>?l*j9-xh5IKeBZm#ou3I_v3xB^iL7c(<T@RKU%UPSOFP-fR>+4
zl@>zkAy1)pJ3P0r?MjAO4x#-N>&|kM?-Vw0HMZ?I5Y@|a&3MDd`bRt&^E^p4E|Awr
zchSNi#K?awWy+7|ZOqR_C5nS<w#%t|TL1J%%^n5BWwsoHW<G!ZPnTWQPS4Ww-sEOJ
z#msj~fNAbrAQ6yq-JZM);Xo)VqX(S=wdLug76~o>YXYoA7ZYO6VQ7`c6vpN!nTJ1o
z`#`2Lufu(q$RkZ!U(N;b1B=B;PE05DG(PJ?r8{ilIK9%P(C4b9Jw1T<0h`6V)jHnt
z*z((=x9zg&U}$<Co&!)r8#+t14NZF5W0{1yc~|Y13?~LqC9_#Gd*Cx_m)y1k+NOlv
zv%&E(;^aF_4G5|LTZ6GlP+$&+4}-p|FOUzvGDbG4;v~eYMqi)p_Edd28{D?lF(-+|
zhpgFc!yEa43-1MrGV1|oG}}1Z5HVUD*T;G?LimCzT?YK%BB`b4{=YUnb4askf>f0e
zFm%GBG|XzsSJ+B9ZR&6!!+?(bPnH$_)LULO5rq6H5<tk``jxAR6njx}fnH8kZ;F*Y
z6Np*?-pnr|?>@^X3-Ri7p2+vd-&g1ic($1!cmw1qTD4)HIY!lj{Ez%#5s|^+xIT+F
zW^a(pvt;*<+3@z$U_Xf17FU;+5N$ZqpRC2Kd~t62ZBn@Y_W&RJcMK#2xZG$m)%ESN
zrQIT){{E#y)YNhSTp93IvvGmb5!_VYTwV`R?{Ps!kQVci-;?LB7KMy?9og=v;Qaug
zZ_~AK*z37<!@ZD=ATa|Ip{u-9Ak@-vkaF+m%99hh?|e}>O6^ni7Ngt<b`J02eW^Rg
zlWpjsU85>L8$!S9iNbF=@7Xx_o?C|a+(h8(N>5gEMevm_Hg(FThHq~yT)I!ZH>3wV
zU?Lz{6KJK>mze>}vM=avFFOj%w4;j&x;jn*f@;W1K><H+939lGH{N9b^G9pU;4dBb
zZ?8sg<#XAMQ<~|&M?+`|xE8hh{dQGQhf^B<nzr~bS2?@6prOG~3{d>ep&Yij5?wEC
zv23ti{00;b+&A@Sh71Y_<ViKb$6Mgwwtm&t>mgSSF2XMtsfg&7O3f>{GtqyZ@a~$l
zNYvWkCo9o($hf4>Z1IfKfSGbR<j#fRW=U^C(5Ku5U@t3-4U?7u3YE!@?ond<x2bhM
z(T*Kb?$4Ryqc*~nKAvpH=Ed8x5zkE1?!R$fTXQLLZX#bhUd6Qo`ldQF5LyWVW<NK4
ziQ!cZNP4iv14V4F(`9j^I-bPl1X|QJ+a>tC+FGH~r9ML7g2(gGobh_lPbzKeN#Iq6
z>>wlwY{;TF1V7bs4lysmk?(y6WxVmN?f7XY&J1^?Vq|wL&vI9ZFu8`fee0^-!obOE
zarH)qusEi`NPK%IIcavWw5)a#k)-+DPuIHBjfcgxYSB9^)}5k;gWRc|5ps>lC?s!e
zv0$F9dxu3-zRX`+h6i3nul$02U33cl*tix>BY0A?(rx-$9sx+WvjGL}GoH4PQrW5n
z&)R%w%4I9z%7p#ktnF!BhZK0oRbNJ9@q$#CK=mJLcm<F~2~0J1rECLj=T4%PVC;mU
z{@?9&HY^73ffs)rPB-q{dpSR5Re2C+gBP4o_5wAm`?9+X<-Oy3wb~hgCeG!H?bAlj
zw4@gIf$URgFNhskNV1^S<52b@Vzxl%rf^SWe}voPSn@M{UOMN>&%b8M$G@%5ZX~LK
zvZFQCy0Y;SVy}y!EP|OAk{xXT0!|4{yrl^5n>u_Tyt9!8-qfrKGV(L#vl>5A93}=S
z+Hm^6!7BhC2z5p|+Cucl)a1zt<}lF_loF#SJKu1~8B7>dH$_3LFd$yCHxu+4Jcbax
zZi~AVDps8)nfk6HvpUu7l-j$;6<Ic770^?@-_JQVJ<U?l=#(9iq~!e~9ZCkiE){3`
zP*8m1LDoRNz>D8}k7KVM@BjNxGptjqxz}XAIXyhj2(C$NY<8010sIrLXo7yZxNk2X
zmk-32M}~A_Xu=(}?Nz4(9kO(H%+*(Fe-kxrDMVdL<lAj9{BG;FQrvx><_Dn;rVYt{
z8%DK2v3R{iADPw5S#)lOljbVWN+tVcyt-jwN!n|wZvcRF(U|RPSANU<p4`tS0=b_g
zzuO!q<;kc?Kb-pUOeTR}|NmI-v{)o%&pM@CFfFd*Dqj8aU_JQyYAn+}>(zY$Z;1Yb
zP;le=_2N^IY#0Y?3-198IVW4lFU4A9jQgFk3Co%G)&GG(m(;{*jxI0|6WD$`(&UuJ
zywaAo8hNkj2;PaKWz1;IHHwKT2kOXE%837x^=r;8vN1Fk?(}hAv~+@OhO0)8gst5C
zw4&ztJNZdiY(=(O)-z0E_UcL#j>*;lWa9i=gM+dk%W>r56)YR&!~dzz4KFYPdSU>+
z)g>FTiP-2gF9qGz(jUSu-l)y{b;6Wj&tNPg^Ir`@_0$ECC+@17pf(~L*liJ`xx(ys
z`me=o|Lqf5mLGb@zz&W13{~&V1aE!Vjz}tOr~7E>^LDy15hzi5I2MZ9FW#TGVoejl
z(l5v!U$)>P3X~alf0<9_B%c$t?7q)XM&pM%>+wH}vpu#mZRWY5E{r$GoBfXq&x)bP
zCe3(M-CxsP?_hY*Vs_!)0+a0OhTq8pC*2->&aAC;#2WJL$+jC{M8vo5gye7~%<t29
z=PxUG6)xTJDotol#<VSwX_)7IG@h?44Z}c=raL7^({=)=3_y-%^I3z1-KYb*7}IS=
zI)2&Pyq%Hvoj5PO<H>JYrDNU#&DzH%e|`6&bL`J~W9(m!>(Wa61M<ePpRbRJ{s9iK
z{4Aju#x<_qfnx~oecBo^*#-kCN{(hl8wJh(kdhL!`GKO0rMdO?|L33EDYEZ$hqakx
z85s|O4+`nvY?CT;|LOddY^wcV_lD*@80uF4?qL!B_Y5R^QWj3Jpc=_S|EgICtc$#2
zzaJ(fUg$Z*qJHK0!Nu>3(x3EkE&rTyPr4S2HtGC~YyM}I<0qTJG3^QMYICUtrEd}(
z#>+2ZdolyEv)Z9NmsMO{NbGnqNC-SppSSm-aplYKy!7Y3=?LPHA=kL(P-|zquu-ok
zagttz0>1c>=yod3)dcY^w~7}0FBWhvEo!;5UK4%8MtP36FJV>iM7a{CQV`bN$n(ww
zc4dc_m-DxqA}E5qi!oO;?5mwJuP2kl911~jBmW?zvFQn0`Jmu0IVCp^BHz457r^+y
zWu`jeRa$}yc0mXSWJ*KX8wFG%gRk#psJ=QUayc6ib|tb*W&&q;GAp^gw&+n!+@GKC
z<TDtxrDJx#-Ey`U0Zh%D%h%+w0F>Hm@x6d4wsi~Tf_P_8>nW-vR%1nG#%-s;(J-xV
zUZXT}(DXy9gos`!2<)^ZdCou#7M2ut&i}N0GPFC>6<09~c|R7mj)f~1Dq>&9wE7=V
zEBf76e-*dXwCSWA7YG+|EJ3{;FL+9C1Q(`iNq&Q(($-8MS>uVh=+p-Vg(Oe!FbSMk
zjq#G?I%X3$E;*Dqbj16$rFykAq@cmG-=yTgI3^{1N)27z3koLSE%uy^*D%AZflA_y
zcg)&>+4|^lfHeeu%4cNa_KLn}V8N_Orn5YzuOmISy=V9?r>D1OjEjS2j5!4Fn%KN)
z%JC=2Dy$W-uf;BK1jFH=#YHOzZ_yqzhtDuK?~`+fgE^3f*`bg1*@&U`BKAVR6@9c=
zoxb)s(A=LWskFW)fHHR>iD;L4T-1!Az`oq%GMAZ!28(w>fVktFy$G9T*%whub&vBt
zX;tE_MfoXst<CoLw8+iIc&`Wl+M}I;{I&A!bHbBf4q6e7|8jSd1h#!Y(}`KUh*wd9
zdck$HTW{z^;q}XL!PMc4c8{mg0II}$YaoL@!T$j2QZudtW8DZ)_J!T)&VY<pUQ=j2
zKb|?YS^Uftbl|f7Zw^n&KDqp!Vmx7Jj+i3wuPU(=6FBquk~G8@^D!+ii~QY%7=wQE
za-8jwH12ajD7aN2uzOB=<Dxh0EED}~*)==b4>51b2Ul){GXw{~@lCOL6Tez1;Me5x
zZFU3T^-%MEhUz%VYI`P2<XdbGr3%8S{NpEGs|F5ab(R(7$essirvgkc)<8Op$t><k
znDWzzKb_tpNv95s%1v9F_2ZXwTw)&iGB-HIa)D`7XZ(64fS+1M;OWc%abty?&1ucH
zo1$iqK;8Z?f|Kw6orOnL37hm5Jb(2LWPluTp2_#0WE9pK_;rIp;#JG=UTah7E9%D#
z&SAQAUL1#1$cmVG6YE|lu4CXUV@dywCxWuTVBs3{@ST#4$g9y@hMB$Ox9(%WsiV7D
zqP8M&lx;D}N}=tH{OKu9YF+muvC1QA-|E1YmdY#sLO?3e1LS+J!vJ@u-nrDfsASU1
z*cUNH8d0|UKon1T8Xp8c!9?#C3aw=j&n8`-_|f8g-5>t9XYZ+B&Cn`~j$)2c`l$<}
z8%*W8JwNE3H*U?(BU(K$29Oah_TdD{yAQ_(KNNs>UL7++4y(9C;qB_V6RHOkn?4nB
zH9kKpcG<XP9mkajoO?tEx(8>RBBKR49S@w+v0rXsXr>cq@F6pQ!M8dX&xgU}o~d04
zZwP|^VZm>OrsnD+5q5vaf%6ii>oa?!4>a|K^RolB)g$iOVuHi^PSz*(MmJR#yS30@
zn2RQ}paA;a%6};)O|Kd(bSvGT<h=(rxDCIak*bOU{U3ONbJo^hPjsg<t@3Z}Wb4XJ
z!`A1R2H7NKS(${zf81;%us(iY5y-aztJ1nr3FE1@C3KmN2vmWY+L3>R@ssgM3e4V0
z@rVEomJ9`?{01-(c}G;bZ5<|18por9OuOeMTO`=n`hlXE@BhQrnTJE!hJU{zOJps3
zgk;~zZVFL^v{(ugvP6s}*@^7?zB86eNhXn<vF{97M%HXI_H8f*GxOfl^E|)b`yR)8
zbR6Z6{upy#*L|JW_xyf8XA`e3qqqSiHU#pgRyzmqryG>}Pn2wvw%5Jij%omplc&XX
z?)O>LV;Voq?o@tT!w}HC)Azhd0tT@Hdg7!Pxo1R=|0*NzWy_%8t13$1$J$#kl)iZu
zWYGie8AH4<;C(45-77yDLU<4h_{<JjUy!7Ygw!V;Pgv!ZSkI3oKD;LamA;aE<YE1B
zWAD-Lj~Yz&mS1Wes@Z{=xZU!=pl#a0jUMN+?zf{h-&2wqpBiLGruW=t9YkM03v+ly
zFIE(MzJ)3F3;ERd?%QM&easHG-boL?^W3J#RKEun&in;4<8qmYz!c&t<6q|OBH3zx
zn|ey>j~cq1D;0ss<)}VQy8D`R%L}=A^sfVXd~I79UeXNDvhgf3_Tz>Jup<5#ILq#I
zuanT!4BZN=tPX~65&BDNlAg;&uyFLkQ+ffMjubFrRK?K4@=_D8e(s|VeJ*D~;syeA
zIL!m!KpH|1MiKDUh#de|OeEA0aIl?&gdn^g@eB=TBD&ElPqdwV#cWnq&DYy@66;dX
z99i>w4N4x3%}#p&7K>D;R&S*p&HzVNcj87@bK@r*FvK>9P<aNpC<zH^K{;OeOS{lA
zzf!EltY29P;06hLga*%Gh$q{A_#T@-CD6bTL2hO^kr2_m&-R7hT2Nhzx-Kk!PxB2s
z8lB%)d4PE+fd1c2%Kq;rWzDsRrXZDH9uv<nk^u{4fw;5#AlJ9^LBwK0uNh&fVdo$y
z_gkm^Sx|0;XFsq-l8z16he)9pP)M^E8UtL9iLC^bC+XrBZ5b1`p$=QZ7`pKMnz6S#
z70*vFw9IKHE>Pl+F$mo8ffEuOgzt2+noXU_Yvz|!^b(!5T-?==*}nJY2*`!}EeM^u
z(osR~+Uj4ypn##uQw95D$)SBH@k9Z(Gq1moSR^`}W+i0G^0)y{K5n^xV+Od&TslLS
zlJ@WEF~l+_u`xoh%x{vbaE=B0TRG^o#s^);Lrgj>A#s(M-SgCtZSoio-4i<Wyzq`1
zNJmk@yLFmy;lRVtk{R~icQB!Y_<Y4VFe>-*M&>3^h+${FFB257TV9%y2ZXa{XI{yN
z*}$($-|8=h7<%c7u09Tk*%K3mL)(Yc%V*VQ5~Sx(m7tBC@KGjW0K<-ISm5>-W$a$Q
zf(~>9PQbr!K3&kUv<d7*q{8ug5odE!U{9ZRAMzu6D>(FRGq3_?73Uapm%LmxynC@<
zogL+mr`LWtzMTIUyVu5ZvH^pg<W-&=;5-89h=gwFF&E)I0XGXjq`$F4pPvv1<o5A0
zi|I%C@T2+Ox{^HP4mz$G9%tXYfBMsT8>lDtTGbIaf^n{_MHw1!o^ZDlmt;-y3<pVs
zonmBsF0RJ|b)1Xk-bRP|_+zy81s(}j;9^D)L6{R#+b<A`Kn!7|=X@>^_YiHwQxhu;
z{~mEEpjQ=)@!KPM2cB%tgZ9seDS;<zCiph{IAAH!BZy#=c}VW9I;aS~(Q^LzZlf=g
zVK=R+XF9A_Ji){L^@@`pf7lP8yJ!ln=vgy8L;5JOQv*J(j*(J&KgKQ<CD|Y77RO6U
zy#py^pMcs^7J)pwU>3JDbkttw^~!BgBcaYhLU)bZ<Em_b(~Q#gm0L}j(o1Fmln6!R
zynFtOKzH-~YIgw!^JhuQ4A+A^yLUt7qkkI1I&ew9zfh@&2zn=rJT0vsh&bg+=Th->
zWsL6DYt8^Npo0;^u>Be;;^NJ_=0y&SDc7>y0E|-|Ekl%0gpHkD5EDmFB!``7tQRhb
zcv=#OKf4RsZC#%4kpvM-5#Yd4p2h`&Bsewz-}f}NXW9qITU@Y_;(M=CFfF6Ak^Zx(
zE+CyV*E;$-F%f7jtKA6WyAY{yxr2rASGG+|OT5-QS@=K_)uwF4RI|pH?@J$=RNFj0
z#3y8W<izN3C1lA&l&1VsFDm!bF8c%uLXocmqb%Rc0bV0sEgRST>A<LAj)(q8Xmj9r
z5aHx;&>5PZn;Co{3%U^0ozYGt?CId!B1S-jQ!ozW7~}AbvoMEX&V2qFa>gNtu_izG
zH6*D9hiA(YG+hlMoJoR|{U@-wgV?is$NiG<)fxnR4U{_zJ-g?vJkDtWtTpeQ5fZ*H
z=^n08qI{<j*m68~5I?=4UFFD`TY4VQmC8D&fenF@Rna8(Y@|~&D@Ol3Oh0IUX+4N=
zoS^Oj!~NWtpYa2o?WP3c5AFs!Ge5nMRqUxZ{SC}IVtw;7e+JXtX>`KVvt$|wpdZt<
zGyG=zpc(`A8QTB7yyVe1bh=4cq&3VHu<CGP`t%DlbYCN5r%vmsiU+5378yJC!Pwt7
zg{)LYBALp?HTOJ|0)&rc2~L1CVNmY>nlM<by3E43%)sOxL-mHY^>#%6dWzB4v%v(d
zj7;=2s&0YykYSI++WI8}o+k64K5ws9^qMi__|wNNp>0*cb$0&JuH5OlGxg>7BDhbu
z(^|yRl|qH5jgvJS(Z;JmaopdJg1Gq8aeV(o>FM*7+KMNAu3uNZad5k(b>5pSU=fco
zv3!2Ufmy-q>~CPO{#{l6i!{T;eS(tpKne>+bE@;MN_SBMcnNTxDc5u!#$kJc6lsWL
zSAfw6ewk4G$$(!r$QyzY1l~LD>5C7rD~&%xei99a<iC0zG+r&o12+{cBr3Pp+5&jZ
zdC`XRJgqBFY<Xy|<FBDnfiNsfeE3AQKJnq}{m2$h`yik=WUj|OHT!FJ&}gdL#y6tX
zm{(ZyE7XHI&Mw?-=r*iH?e(%NgGwJ|@M-)uRvnz=3x{4Ox)KGU_#m{>z`QV_0}xa}
z0BjR+JhVrjk5u-jSH`Hi0QL9t0wLXhlaBEp>)%|J)_uFeFu^y@)n;BQ9ZUP`YP_1t
z`<a$a+E4jOj&!EC>tB=l72Oqf6GHpx|6Qf2Vq;YA9JQ2ouoVL<S$=auyr$M>`-)3=
zXDmCyQN_Ef;+NJUGY~wZEFALDqLF7633a(xsJRNbod5pt1MP|e#FgpxUQN01O(pYP
zHn)gEEC-(xT{P9Q^w1NO0fv=J1A4}wocqiws&X4U=DvXqW?hAJQkhOm+k!3!G11dw
zj22Xhq}1bSo-=^kxN3KV@*C#SQV+uM1??TSCxF&yz@hjI)|-LGWqr$e=sl&ag=_X@
zOR7oqykLx;`RNYYQh`VOJdCN=H_v{N{2}3<f%02LpgZ9Ajq2+m%e{viDjxo3MHITf
zcZP#0k3~CEcSO4HAx^r?gG+Kvg(KUqVK8+GZJqAd%%-~mQE2{8O9*_!OUgaILI%CM
zorynxKm(Z!T&}?2u^?2&*1BZu-YNKo8JElJER4Ad#pyXnccQ~{U}C$N^hRv~Mgdxk
z*kU2}y(A9rUISa7b>vJMs+OE}=1jtF9C35s{e*^}tds5tLG}kzVq9swSlf?vp1@wm
z{kPY-3Y#wu{rX$2!@9j;$C?wY+nxUY`(!`C8wO{8`cjy`<a%y}-{SpG3xF{Ms-H*r
z<YLNJdm}NK?1fqLqM|N_W}qQM^OvBT_=`5pLqRzGz&tNIy>YiKJ+srlI{h!FDpI0p
zF6}TBLYjCOV;~>F_eEwHW39?uC%#@@Or-{<ndm8HAz5GZqkekF_j2}Xa3|_`yX4kw
zBT*&uWap2b%WLo`7f8=bL7~EGljk|gac(|KYx}#j+vvD~{yP~%l}t1uvnzvo>z>VT
zPID-!kM>fUAEBT5PjiaS1CtB1jk`8BNTP9HZ7%`n7x3upn8`uuTLjP=1!bh$o&^rz
zrA`36RF+6oig?zs@D?g)pMR3oGA8hN&mPyEXSh1Fp?W0vqg!iUXLZ{|DZXmww#E-H
z|73`wHv;;*A!zv|sd6{#m<Q_LF3|M(;N%i8>T6CV$*-KwdH@)-*cf+6wGdocI!$Ou
z<cc|7jO7P$1a>XsR{bMWc+s;7&BT&=2ehhKRHXxvYjo*R`+OsV&Q!pm2>3V5RUP)2
zE@J5&rJ|(ygIpANWm(^kf8+Tsklig4fhX)zt~&W3317Kv5IW!FJ+eI=o?+yecbrys
zmxYkS2qN@YdLBU}o)82BPWBs`ee*c?GVwqDr06wvVkBM^*q?FbEpw2jEN|qagEC4|
zT4OG%B3!#}0Ezd(Kq}A;>i&g_*3Z9-L_GlN(f<-uPvsBZqK;5l8~e4#wS(7`#`g?#
zRV)2b6R|vr{=?0(^W}}7j2Y^`=G&4?9Yepl2AYDiI7uD3n<u6y9Cklm)|W>cEqx0>
za%^TuL)-ml@eroiXfDqv!j}j2-<_%=^L=j7+P1h5dpzP3N`1m~KE+pp2BMx{pSuV?
zHBsfuyi*j+$eEjnIIB(Lkx>swC+<KmJl9%2i(E>qigs21M~KAdYJAx8DI_URQdiK*
z)<K2$xUqa5VXucO5k;SYV&24COUODhHs4xHy-#*0m0mxS!95~$k-#)oYKZ}iuzYVW
z$G)qD4JQ;DLP2W{z<mM+R`1`ETfF4cSD#`}9iE@?tiMN<!<Y6o;hb)c(v{;Ip3Z}c
zDt%3a)A{)glOqC9V)r=(FmreF@+{;#t@(ejSgt|*I^rKb%_Z62Kuk&!e?#j4FpROj
zQKFb_wVqSJuy<kI|J54OfqazmJj+WEg5IQY0=I{Y;`y?nPtn_0Q5H)_QIw?>Du>og
zcz*nDUP-*%{x5X0HeN_#PAI?*7U&;nw?kkO|4{KGKxoRJP7eKV=ZvK9-YgfKX_b|W
z=*t%&Q@b2RdoT^~PW<0RC699@%MK%EYUbogs8<J!@<ZTdh<)&cJO0W@bg5cfUfUvV
zCGM3>%>@o2A+s#EC$E$2?yM&4C03(!LM`lr{z;;e;&T!poee_Fr)o)@Fj5Lv<AZQ2
z^MC9=4Jk&O@|k1ZtS-9ervveo`;WIt^Z;wVJ{~vvk_&sW(YyXt9o`vB7RQ>p1l<n>
zsKbtW*k1K1?A#g0q2U}T2vsR8Y2n`3)yQw;f^IAiJwGHAc>ZZM>OR}{GGm?ZO=E0O
zLP-_JApYa7;L(ZX9OzVX_Uy#mvTNlHEm895@Fo;63*>n>huh3mdZV46?1IX@JfsSI
zsj})ay>fIy7tJNF1OxEYYX13iA8lt*Ui|ai+M#m$YZ4Ml>H=tZd#`9vqCV|~Bqc)?
zl-8-(prkaQ*iUxzi%2Z`td2204*bf<tL%Oae+ET_%@cd*!H4+!oiR%3`S!CHGQttw
zJlKvzTH%mk>EUnJ-`qRmieGf+XSXO9RiLuiajUas=%XC5*JJT)+E5)kYNM>3@wF`0
zwyd3LVWR@H?E<!7sc=<3GNgGMYflTCkQL3cDF98ixqkby>{VSAX=AsVI@uW1J?RG9
zUgyiNQ1Iu7m_Rih#hn3ohCP=Db5_t*2o8a1EPfH0+j?6EjN||Qn>qAmxQ>;vqfpp$
zLN!lBmazMk6@joLYl1?f7KZcQJ8;{&{-%ynR4(0Tf1%!;*4(W5^1|R)f6iR^#^oEf
zQ+qemd(@CcLz;0)HSzw0t(ay`$ai=kUiTof9gPX8Q0uba8&XNsG#z_C+|3;sJPd8W
z{{T1Tw1F)`yjCv(rfmGr^8JUIO6uyC{j}HzY%q0o7Lx)@IlwFn7;ya&Kd@QHlt}JJ
zm=g8$yK!KZQ)3C$75jA{)r!G&b{iYSHJ5*bEGXM`{{AC_O%Ixk!os`oNO;gNuoPHR
z)_jKMmXN-e{4!LAJYwS&<`%CZYvW5^=R1?Q39v$sp)KIp)ZxpJLkt||c>!h6&bygQ
z+jTCm?vBX~NWLG(d%V3$s7r$WOv`VcMYS&&i=`5nU;s*|V5gaA3HBBr2(!0EEE4k9
zETedWx>$5f!Pj#vT;0Wvr{Jw>-HY;oA#ldY5zMD&$mMxo5<WzXQ46$&H4ZFUjk9CT
z53(B6KQ_J|?U1i&cSCf{$Xx`+H~0;208tkZR~|#5NAM3Q(8g|xNUea5QGa6Y1{%)K
zPe^9h@EHHUP*ta`$L1K5>y#;!Yuzy$fGhykgueRi(f$SXf>NU-99wf>qCbr}2TT#3
zcgtAKWl0{%YarK<oF%}E%aF_P2iepAHQ3YT(QW&Ii*M4Eyf(SF710XHbG1;}VwdlY
z%`^AOHl9J;8u`mnP^vex#EVy82&g(S9clz39zEY~-_Y)j*xl=)Ps~N6Dh&9$K7~z6
z%oS=wYbsXWaQH+lU^3=cu-Bo#H=YQ2J!1sOPO9BkLGoZ53Usy}CjjX)YQ&t0CpAe<
z90Cg=;SMM~z_3~letYM#()5TLntukn?H{;5M01M>)&?O4kn=!MKhlXw!;Ccs%v7+%
zKLT1<FnIoA;6CNE^#PypGT&;zyb8>eR7c@*c3NSZ7^ES514?iSM)zd%yS&=I7jNDA
zo8Xqq5#x_4zWElU({38E#n#9YYsM3;YseqTJI?jTsc{9|E$LH!U0><V50AVfc!VX%
z&O1$z`k{>cor@@C4fKY3OxdfFR#2ReTnzhGR^nZ8zWmPK9KZ9G+_k`eeK3$SSt2!2
z@i#=0P!|B4jkBxrd}!}CNbw<Ii-o}LtkWD5A?_>MC3l7g9*cmxB)zAJ+{Y|NkemGR
zoqH*q4}FaG7f#udZOULMR{Jq|?&vC6IxQRZCC_+ZHli_MF$jNXLeO~+!k=Uzktuvd
zT1I=aBxHC|u+H9)Y~o^crsM6^V5RNbQ7?RHQ?DOjmCo}UkQ}yUxC<Q|hv&4VqRN9A
z6B!P0nIGME--cuxYP?#$_4e9E@-<%eN2-}It$NI4BIn<TDk!-XG3tGO3Ghe;>O5lx
zwTr55tB4h;Mb=S#@|r_|4Z(*SFsSzcz6?Y>dkh?NP0K#b;($4aSNn$avJWpXhpNVV
z6$U4a8G`U_^cK(?&G)^yiJCvPgUaXIRknr395DX3<ZE1{6{`JH{pR!fCsiLL(!>u2
z)XcZ`C~?ouHUjww!X<O$9I2`R?pvp~s>|xO2n!n~mNY@jmPbpE*FP&gtBHJjtsQfr
zhB4BKt*s9TVNzr}MDen{e-g>zQ1ow7Gu7B8^;#k^?br}R6oU`N&?i*mxc#q^00ZN|
zIcQ(h`07%vdI3tuI=$zP``i<cL==!kJ=l1w!f>JvCu3CJ<K2<ID|f~BcY!fV)ta4W
z<m{3RXfaw%YwGr#PUkPcF(@?g&1nAf<+&rQG;;;}m&GHujNER8gwHsNQy_+UCybA8
zL;KyOyB+%6j8{tlI6)1i4?^XFVcClQBdt~avsKrtAAukh$&emx>@$xJwZ+@N&{Et|
zB0<Ylk}5rlBBddeUN1v+Y^#1!CFr^I-;nOqjW%_=&pUX-?qsIf5W7(cZU;0Vd&^Nm
z>T~bg`EjW|bDqgkGmD`!n}M)Be!qP`dUd|CMaWZATpdMP!B(8@_!JS?fW-8kEU~{^
z(TkVW!9Ex1G9sh?FGZENP)LiFDH^LJt-*(K%XjbP4;gN`&*Q800_e#@-jsdB?R~DX
zC7>b}@7JdrLfX~Op63doWaGW7x@!f0fHfyHqNud%J;?Oo7kvdV^(ewG9IHAMzl)K?
zok8GRu+GnZ=@_F(?)8)CR)McdTCe28^=X;728OP;3eYdyv8JU5EKS*L9~OVHe~V%<
zJ?DEp<m$7>)#$xG^Wvd2GW{w)DdRmXrl9mL*|&%pYpc2!<^y3{X1R^~x-Dgte+^tC
zJ>El<*E~~&rapqd9*dX1sE-hQQMT{07x^%Z&L1e=uUjwz_i^KeH=CsU`K^3_95;LH
zSw7x@a!LieMVd~7dps^yl61=XE+Xg{kWGr;K2SqrW1^FwN)-uUWsKsmGcR5AX)?x0
zdJC}1R4Bn15kNBg)}wa^z}s5yM(m-%5oImXp;vVP$WFR$dbt}T&PyTc6gN@or@Cp{
z>FVEOryDVwEwsJC0`Cq6RCH*!sYGq4g|_p*^Zd4y@RJ5TUVedT11&mxBpoT#G`x|M
zWXY_hUcCR;_&~~*oL-yk?>`xM?m_JSgeMLXSNeCnF^Y8U=FOBc_2p0b$GWriWPrg4
z+BPKOH2Qd@W`2ce{CkIpOE_aSBShF^3y|^&fF=p2yyoOa__v3`v!bqpe)Vcwwt6dM
zI&$-fc_T1h;m*MGg60P%wp+jw_`5MTZdK=wO>OLfX8PxefQ)pyRb$j>V*k3L|3qNF
z>=pkblJ&qO7rD1IijW5cF*w>UI4sYz8}QJ8LizXJmDTi&(s3pQJ}9sQV?06*WXe#W
z%^g)r>rZ`!6IuVtZITy$dnhKKa-ng6793aRzV~e8Onsm<3w_e~6YdS}4wM{IWmf9=
zMg0w4^9O(sl(<>Iw^XDvHmy3I9}>1T=zyVwX^-DsR~AK?o$o|nGT%KTdbW%Zl(1kP
z@w%~@NrKJ8#so!Mf{%Iyd~pRLk-dfWu)Q|o*xamy{T(y0@hVWk-T1>o`r=7(?ps%#
z{EcNUgVfXW^7b_#MjI<ziP^5JHPmiiwCu9T4rl2GdSbiNZ#d=<hxKUglUV_70>p+t
zkU-*qWn&4vJ9}N%8D_gha>=W>&7`13@xVspJT-74JXwCg0#LV$6j>6eFqjc4>km0;
z*EFED^7&$uRya`Cef>|uU^h_BlQ{wG{_7f$S{=FApXBL>Z@YahPw@%0+>2n*dDK}J
zl=Vj5(sv-9f^YGK5T=6CYz`=$(RaSd7tFL%V*_cGcz`eAJAx~K`tg^_@pqmN`Tx@b
z^n5Ix>C0LUzi||vEF}=v!JxA;N$`4u-t-n?I{qEd>dp_hBy%5v%(n5ZP3W?ak4iMt
zS<e;0@PMjS!vkP?wpk$1v^_SPMrhFMe0!vB+0#R(8O!N7%TE=yF%WxE!?>Ym&*G5Y
z{{UB6bl4OG`n}n#dqk}+7D}Sjfk0bureDqqX?+PycwCD4nvV!82fsDAqGI!V#2Mt_
z^5G&FhYwhq0lCRAkjPU0F@FRVFXf%GK>Uik8Uaf@KOh3ZS|UGRrHd8fuHXR$oRk6W
zjXqVzox%2+T~=(Cc0md+--D|_jD%y-KduG{XGW!%{t`fb4kAy^V{%J>_<>t`mti{<
z<KM|2vU$GndCjDC3MpE73oGf3{+;k_kd%Ho9sUd%`=et`et#{ka_FO{4Y`5WGMmIx
z?svHcl2ek<z;PH9)PE+oIq`T`uo@p_UM}4a|1+5*$dnU_XPqEyz~FsOSkNUu^81yU
zK(P@>eqxUH0V*`ivFi78$jTGP&5ewoX5Cpf1z+nN5UA9ie9uQV?}m-?N0D^^HWmp6
ztsxD;igbR924myLeSmlxyJ|$k0ywMPGLEBu`q8KL6PQL&w}gHISh`KhUq=k_<YW?<
zs`g$+5XCzW(sqkC9fWs7AA4M9zn1}AApry>$!`J)28M2E*aq^TB<8bfj#y3J(>$wr
zW3`cfktf{a46kZGfC9U6?v4sjjB1IZD6O>=J;$jvZzNbH)J6b#AD^=4+e;;7Yd!)c
zrbD31M8@M!C;i_d1(a(@t=Y0rEd5o#8(wo%x0ENAW*AZaRQj|e&Q7eG6p{~o&%|e%
zNY`^g9vq>_iaAYcimsNQmsn<1?>?y%b3BZf{N!N~7artrk?^UY3cy;Gje57k-zv;&
z!0@bdHV-Zm=$=_tc(MHW8;$(miy(00pWbO1kcydKTzJ+I2Gihs#uwfJ2vaULS`Xzv
z1OsW?d77lf=z{gcCUb~<$>K)=dU4zU6k})3tGmGk!c5z}g3me5iAwXy!B`n(5~$QT
zE%^AJc&4JSFp6+9XN0?SNCdo-HOU^-$%xiF$=Z>^vv>DX)dDyE&btg2Fs(YHR0(7n
zAfq-UzEG|NMv58KJE&7CISfAih6m0$p=B23<P_&5$-4fYY<JqVoFWHl;}@YrrkOWQ
z;&pa=9z1R)(eC+UbCOxbZ^)Ez^|ULg@JybmAC!jh_OSeoNdmLB-!PKO)=L9<<ounh
z$tDi!y8~{&K3c&LK<wx>fVCV_#D|&S-*ibr&Yo!NUP<tG^vOjJBq4DCE`nu|tujA|
z(Y$M^ZgeLothEe4sJ<Lh1rVx5y#!Ln6_bGwvzbHz4)=KAD07RJL_yp_RxO>!Lxy?&
zSdz89)RiW_Nyg&2p{Lv9HSRTdwgY37pYZk!OMI>^vMvjG#Iulxb$iJRr~;T>E9p0a
z9Y^Nd9<E8i6g>V_Oc~Cyp=M#@Vg1$?EIWnhW?82OzZg@KM%*gk2_iftJe+CPy1>*V
z*FW1>KCVQ`sj`s;nKl#(IQ~LYi2h(Ms|6zL#{^=6XsF=G?I72;<jE3<A`B^!Nr&+V
zytcX4dAu~PO{jVDCJLI)wK|Dn7_8!>QlYWW?UxE_;VHd8->n126GJv&dx6^}!Og3J
z+nzg_I^<vXR(m+_Me<KzURNIfi3R+;Sd#7xKL(Upf4i+ri*<izNkxj2WraP7JHAte
zlI`YV7x9zl8nZ$Hi2oc?)eyi4Vda5<`KZAQK0(*08DSctTduqL&Jdc<oPy=Hq2Fmh
z_^8v$6|WC@Ay-Q5-9+d&>$iwh$}9eaj;0c2%F}7}g((u1sQl@pLtU&T(O?mNI~xWt
zT_%I1QD?~gpY!Vd;zN1ur%|J3NABG|m$i`<S4>bpntZG*L`UKmp7d~j+kG?C0GNeT
zUd&b6<XMuEZ?}Hv?7u$Q^CXa(X9)P&dI{G}x68YED(DP1=h{Cb`E8@o8J--FW8^kU
zZ#n*BEOPT_<*IOyW6V{Xx|B+tn<L$gfcCqcGK{6jSw1#C9q^rGimLsmnB8h`RPj)|
z3arQGsG(p|{eV&K1}_8-WuF4?Kxj{~7^&46lq3h6_m48iz&1mFif`rmOd$!~-h`)P
z07R68OKn16<bp1qD3&N6e$S~zOy3&HTq>JftX3WBt>{r$YA1*yh#<mQlnOIX=W6pf
z%$*ZWK<V8mQl_4bk;-O>HpWW~xwG!Q&;6&3u8zeu{tr7fSLFsQ2ASf!l{>(^WIC#B
zmOg?#EqP!cH<*9;^k)?eFPs0hu5Hwy92nk4%Gh)$s~RgV0{W)Pg)c)B>mrI^%xU5k
zb<QIr%#j-inY*NxVY|5y`r`?o&Y4B-ixW8>ji5}VJ=KvOlW$<W;-z^$Z<F43;UF0@
z{&YZzcwv{n0^z<y4UEqCUr_3mUoDXj35ZE+niENX>Z5L+piJSA&n$y)rU81fuyuAN
zKxK^}#V3K-|0JJAeP>kEb(forJ06dc-*WT6lGd48WXu;#o0mcdD@py*G4F6w1punJ
z$AebAqkwDXP?cHuPdquFkE`0<Ql%^O;y|t~Rc)LLK$`sM&MXOb9kFKmx<4GUA(Zcw
zx$@j~6Ug=xBCLbX_8J10BOK6(Egv?|Z$n$BJ`PF{kO@${<ACXjeLM{W%qh=4r4NjF
z?}~FieYR)3)=od}S+(NyP~s6!Yo1NMq>ph@LJc{8)0<cH+#LK<jp}lke??3C9%U@>
zuz6-SK)5|61Ky(-kwO%&f~(2X*S{2ozh@d@VqXoOyx4V{`gsqQp;$vh!-IgqdCoQS
zN<U;O72&?70d^fh1v;F7gZHh4mQUVggP1E{(j{+v$bK(}eq~(%8r%+mVv6P99S^7Y
zGD5hie6KV4Uf0&rm`B`=Sv^jiL7P7cjYH^MG742Ex!8DuC7${;cHbM<oED^&94HS4
ziW}BtkvoMM+>Gcm#-z8jQH-7QPuPr(9|RU@qZMv}C~&tG_f48NW=^4}l0JjXgKp<`
z_}g}+w8hZ>kdC~WPM%e!L<+-!8=NleXXI^om$T+j;G6r5*AgUVQO~-Z<iS;$)TILn
zUGqKxge)Z5$8v)-6ZRi|DkT_Wj>P3O8pG<Wk)kKp(Hvs?fueJsaBBDPoe2w4n{bDX
z7NqPx%Ntx+8-E-cY7K>&@)myfe#2X+h>3jHsc(?UXMHn&pB9kc#&R~y_koFQhc{o9
zb(1cxvNHMuqml5I1KBE`pVq1N5;X^F0TOw5bBT%iMW#SoJ<ybnlrbg;ejy00G6=;D
zEFHp43>DYb6#*~}U;28xWvJU?a>?@l)kNgDEZ_H@_ocjQkNDreRIkfEkdOFiG1cj0
z7guEPm*p5jHIfgYBRI!?yx`6@yS=38ucX4x3UW*GvLmrl^F6{!u7UXoe<LYH#%|N*
zRS!?YF8x24!$iQI@2zMS*_Egkk)ztx*gkB}_)iN_xjPK9zq7P_NlyyPF$Emop8cmY
zP|eb28$51V(SONa@##{DnkYed@H2qK2JTVa`RuK_2w0TyA3)LA$S}ARdxliBtOjp<
zpPvCw;=5=xF&frAHbkS`HUmm;<UQ1mGPB^jT6_0jr_bU}jO#jA$K<4M0RB70wKDmw
z0j&9E^<-#@OS*Qo)Ud(Vug9v7r+0QuqH|LL&-E1h>d%{o!NX0iC=OH6w<%SCFu%uB
z(-3Z3y7WyMQW(I(atHeQW_3-=+H~OJ3|g9UUp2+7`C|9n8T%^yrTZMn`!%5_r+TI+
z!U$Q4_c&0pAa$lsz@JXKC14GpVIr&$k+P(Q72lS9`|vd3&yX}CW9Dw+#1?2{auy4K
zT1cwOhBQI4&zB@>b%6-Sh+{p;e0BUen<do^>ACJaCv}MAj-rjpn|!4jd<i%(4XW4Y
zq9@^2cD&U1L*FMG{6g|in>4Kxv1W1XqakMq;N1W;-P4L48kF)NdX>4ci$sa5M*;Bw
z6T{_q{)XqajxA<9nnrRdfl6Nxd;8r|8ONdYwp<<H{4DkW?K=3K$NF{oH0clBNrg=u
zdUoM`{o{~uDb+9dQ{4R_g-%02edD@<Gi*K=<#d`2TguAB+-%@pR@+fL@QFcroU6Ut
zXc%``vDoM;c^m8`zTqv<)I2%>J!&<R;=rh~z5<A6`L8}&yPWi*&hnFb2+Y!DjE|41
z1+8j3seg~-Pd2fi8bY8~-bC9jI?Xtp<zbond*I9so_CK<RLU!`lV^99xxYTJA&^=N
z%a(}xK~N|#mJP1RPp_IlMQZwe{-^1u4f1;6Ic$uXO2|sdJo6Z`#;3X+DM-G&e8jdd
zSzM-=U^uS0v<6YBeUG_tw*Ygl1F~0DLwtU{9|O*JF6YP765eec78;9{thUefM`7g2
z_OlhcLzY(G=)AC0qvwY`MF-H=U7PU;h?kW<YDD?%(jdNo65t0@%sYS}kv@3do`)=*
zwmu~D$IhX>lxBCa9lTT4;nqukI;SNGOIfFbn*jK1sK3odxU%_QlxkD1jyGaD!Q!Lg
z$}O+u)Oi)*y@CC!#P8db5s;a58q2SWNVnhd@&KG!p?#*GjO0cLparP6^P12R;3`&C
zVR&kV<C5o{YJ)Em{N<rFgHHMQ^hWpPpDuNs*GBi#L4!WwA;iMt68YQT87}9OAjeC}
z&0A#rA(6uWc9#B`nMgQU^9ZD7QRGt<!N-z~{Nm<8-AH_{b*`rc@P<$V>J5oh5o;+b
z1Ld(|Nv^n?!Ic3>p=7Kx!r^N81o!({$Upu?m${CPKx9`XSc_8Ksn#4~uM0O}v~RCE
zaR-m!W0P5C$VWecpLJ=f*|I<#>9$nph{sD_he4w;Kl)^ZoKl^Wr^^2upJ+5g94wzV
zEe7?#ljf*a9R}o6Y5^!N(4ytaLXq?caBvZog=K~j?VE3PQonw33Phk>J@cy$oa92*
z-k+n{ciRp~TA5M7|D|=gyq3m-eOHL~swGSccfUpgV;-Dng=LWr#@PoOK<|U&u4qH#
zlj>scn>MTdpOL5E-u(>fdOTS82#8=N*9a#C=b!(tq4y9uj9r}hJB{>;vn8bnP-E^(
zeJC%{pQC%aLET=aHdBFCq_Uv0_%VCQK}tvebYX`2zCp=@>&X$=zo-}Hyy?XiHodcY
zb|c?V;;Hcps8A;)cCP6^EkLzR6e$OAJMAPG%N6c-d_XKcv;Wu#os2g-MXU1N(Dwj%
z0jc8F^n&eTbe|$|{$j3ORWU4#eZ=60cW>y;pmc-oNorntWocMvuy$3b#!PM0XZE6D
z+ilh2<-0KxT=J*U#G#CQ_`aD!0QZ^mJ2xOia;t_ofZK0<jPMsCJ1!ix+|nj0G<<?@
z{@R$bNIUuN_X`k7<;yWY@dkhcPI?E>`pnLkrRmIu54L_^;(dv-o^u9H=#vRPRb58y
z8vwJH!13Y4T5V8r_uGVr74ka_uTmTN#sASdr#az|<Gh*O-Ycg-kap;&vqxGzs(c5I
zZ+asiB7br)KJ&=o3;8+WYcw*yz(h!o&vARTmT{}@0`x<v@T;M_K%#dwDzj#{pC_mX
zil{!@`JD$u)PNb4N&_46VC&U(|0`cqmmAug^MKydR2G!&(K0drJ!!5@<+B2Ejus$-
zsVgxRFf-CB7Kf8|&6(!U=D+)<A8^iD4a6`#LT2uL-@5eA)L@|SoQ<<IlhQJNQBVxU
z{P|()+VX(0gDUC>CcSypN>_Y>aOyLZNfMcW*^gpNo^Q{%1Ff%Nj<HIhRK}p99$_QZ
zZ)n5UjW!qAqk5#Je^wO>I8Fi}kwe3v!~P;2a!#9-N|%uyr`Zcwc(r0bGcH3CK6?gv
zyTaXA&MU^v+~7da`oOSKYP_KhjoZsE3m|pTiag93C2ab$Jzi!yg0EF-LHxE!dKSK?
zZH5uagH^8)qVN**<#7KhxexgK16=-Lr_SZ{S14f{g**Tb*?w;Fd-P95vyJXWGy;48
zXqK;Q%JtLVDqZol%+S&q*piLc-NDgW$5oqt>$SU;jL`l{rf>!hJQXMASiC(YgA>nB
z$uE;*Xx<$GS|V5znMo2icRI0)N*9MZ#+8_<@FI}YdB(b0Qi~6<Eb?RU>)Y5jjk&=(
zRI}NSKf1+uJtRFGKU4CQz(F1J953EG2f0~2x8c3lZ1%L{#0Nn^3wymbtq5t=HmQW9
z97hLR8|(dQ1)#BWOREgenv2=Z&4({wJ;IUU4M&-K0~ejY&z4r;WD`FsJ8#2Mxgh)b
z_6N#wO3WJe{Jl&$pliZ^Fc(TC`Z@x(q^7%m{c@R2_W!E_vP<kEHp>S!R&%j0v1UMW
z@-Ko;i>0e@#3QMWu_s{lOPZiUYANMT#rOR!G$3!P!MD^$lS?0;Jh5M_##?j-70Q99
zffAbZjse%<VxKSO*ly=|?5uIr%zDHgan>j?dcJpys@pEJ2hxVD=)QzwK>Hvx_k>U4
zt4KE3_F;O^%Rc)MR}25U!=>$d?EEuOub|T{tjzKByI=0A&bzlVpej-_=C;s1xdHF4
zZ^tIvp>+Yf^WKQvEX3m6Xpee<m)x%0Lo!k&3W?fut|%wH+m`RiLNE!uCchNmDL3=$
zoURW_GC*ON-+||_9su9NeV-s%Nc{1tc@FqEN4y#R2}(ns{tio29bAP+*0VO%0AR2A
z3rz|CQdHfH%XpY(l9qUlZyiq&B?P<MKugY$5AjeY3tlHHBC*bo=G^_#4Zq`=-*=g2
zsIzZhAlJA~P7{2Nm)F}hM9<aBi)uSYC8l9|vAp&Eb?WWr{<agBAoPq$O?~Mnzfbnn
z_BcE|+iTtjJ>_>;S`YkbC}HI3!`in;#HIG8^n$e(sGU}629#|ak2;td1wS8(oKQkk
z9Jl3uz0Rc*C^svv4HnAza9+~XvnK_4Ol?w~TiG$Gvr~sMhEXG00<-sq4eu>SyM1+i
z`MWj*OU^#X>%?!ADd;_&R3~4q3W;)}>Lf5H_@IYcA8N~l%TL>?jE{{h3P*pgzHug~
z`Uy*W82Ef;0jWO5)^b|*O8pH_HJSg(-K#O+fLnK_X6S`Z9#1E74jh&-i=<oE%_XZV
zIv22st^KCxe4(TuE3=WF!#*H$Cwz9d!lv7L)oZ?&(=Lqd%GB6<Yh$FF)RU{;cE!n^
z4%I9S1<WzFREghHm9A!SM^-0Vq${#f2z#7oqO8}HrKk*rvQz7&<rsbWrG4<k@>OPf
z{p%Ks&gd|8Pq?MWJ0A@`@S+Ucbyp(+I^%WvvdIr*F&tM|m{{cNe~!|duj-lHrjpS5
zDd2eN%Ux>Q#CLj<Bd0IDmoKaHet(Z=Ii;RsK09hCWK*#dOVxRtIGnvZjAW!>(d=mD
zzzlmu*mT9W4j0bf*}?wgw&1M|&C{1`4SPghD$WirKYWs(XqP+sN5TqG=T!LWUHaaL
zs4<hzSpM*%EtTWY+lRa($~2m#ss~#wjxK1+kDGHZI~OnM7>hM6`iig0Tm9x<a=0$5
zt0CV}1xsTnh~jXfl%d3|nkEflqTcJRvoeIlB$f*pcup&gQ8Rx9U3dmO3c3Sc?~6iE
z1+$8SSkZTF$%|tJ-xE3guf^%RGKMGi2{q8vW!+Evprg8Y$uwGW_3{8DRi>?eS?-6c
z{{k{2QWw<f7tw6ZrJA_N>EUTs<%JR+5@Se&o9$9iz0VrQzmTeQsml@o-H_9p9MR);
zQ)}fo6+2Nt`9Ds>3HTZMoESf$%<c?R=biNqu%ZfbHG-2Pu@|$mexY!K93GV)6#5gV
zb%X8LVb<ewQKB4D{fky-qVCn_Gi`m(QM3%axP7N=_)~LAo^rt^S=B&m=cP6~;amTF
zRo<Z%y)})-*JSM;m`GSmR#CDHdX{t2?5fHAelJK4x&6*g?;Z&0#nu(i{T>n#Xvj}f
z!|23P{Qcl+LL*TyX~UAk1me?ivCE%ghktBRz*qjtaEPAHtFA#>U`_H)7qFGt=Sml3
zUR_FU`)qJwBfI3`d$W7TH9W1z3k|&|f4^Lo<+w3zpMs3Ku8iOBJyO+&WJ+#f>|@?e
zsIAcM<z5_{i40c<KCDf5XCUw_6nGgnJ4~~>bgfc43*4Ru)1&r+%HoMnI3A=wseJXN
zbE+jejOxbA(MiCn<4}-xb(s3&dDh~v7V9f%&F!g5<1gS}($@J5If^N3t3r(THu5<u
zIg9@|_{?5|`PqrP43wq0S0$aA^6^x#(+BJ@nAcMH1U~w9UxDkYidg5k(WOf?AAm1W
zckWN#LmT<HHqlJmNZRQZwJ?*-h@K0TJ(77HpP9oCQgzH<$g3YvJEadtw7&hSdNviT
zJa`2|4kOY_s>zUNq$e2;t`2p_mhz4%eTO6lxS4mJt=$)DcpEUAe-Jg=xA6V)C47j-
z_j3C3oEOnwH`?KzFEu`WJylpLgz>j4HcQlXNw~o&2tV$(l~;f0;Exx2p8epPOjt*Z
z$*en6)ax)>6B1%ZtP7fe@NeIQjWwa93rh;}J5PoAu8O2CBf_IEJl8SMS$}`|roELa
zjmiD{<N_+Q9Vy@EnOF;jdhR|=s{F?1c@OyD7ryQl?wmiVXE}RsNHwOA6OAXAESjV8
z>W)|~F;ip}n{lvg<N%ky8o6~OzS;Yk*Vv~?cGt?px3b)ARK-s-!G-bnFEI&Ow2yDU
zO*4NpJKC{cZ_;D?8Q2CAmta}JB*1hlxm5h0#aJ6k3`$(Dms=`?P|~ezjDlrzTlhr0
z__=)xkK_u^LR<afqyKDRRMcZpiccP?uUBeQ`1bba>NQem7_H=ywaK>M%N_YdSYS0h
zqz~X6dF<0U6e*U=AZd9hfK+9{Q0`n((#=Z_xU_<djcArXF!G*Tp69^ck-A=P8{)_J
zF>%-uouxr$@_5q4Z+T1LB=L#uo+C>)PoqvxlrT<Vc{9;KESIr)>i2LXlk%P$H`M=4
zvlxbh!!5x2;YstI-Nu1E4|CxlB$xSe39Bi)Q6HH^Z~Oyddtvp(+755vSU~qES+RNX
z4$>nPorjfSQz~wESr;8lKKTYtt@3UA{uJJPm!GAdTju1qpZ4|agb8RR;6LLvqlXYp
z8*rag7r86nS{pR+SG=XmH{N<uoJQ-+aa&iz(0<0?y&le<fLXNou{STWuK&2SN!~!x
zAja_$1}SI9mnLRy+a$LpKWm`YU=3fJENr~2*nQ>gt(8HmVH0tn^UHm|%sl{e-_2@A
z9t*K{`&#`@^*rBB1fkV0cGJKoyX)!JWu-J<GML-<Ecc2LW&^JT(HGf|MN)GZ{57sC
z$YRgG?JFVxn^SOkyLizj+PtsYJuc~&oTRg6GiUgW!FJgD7ki&f1T^&19zPXv!Il<m
zi*ozq*!=kLOf=`&7m583d&QT#XB9q|{oUe%%YSNn$8?!gzx5y6L9X!N-)J8SC*5T$
zvazb-Eb=NAVLp!(!8)f!fL|<A%~7syJnP{+i)eX6yZEBfm7Lv?V{#x~x)8mod%w85
zLj1!7{vfbax`Z;|c})hMzx--yg4Pnlk?}#cP#49{a4|?dwEeg!tF=WyQ`V_xFnO*_
z@ZP)x{_9bP5=Umm<xA3vm;8?-8QJ6=<pyZqwGNzP`~Us(P)5$CfhIn>NuZpKI<w&&
zi@CC{tL#!@tg)V=rMWPz-4!<Kn5kru3<HUHZPCt4gmOri=Dc!IDm|4tFN3+{OFT`|
z-rFMflph~*pQ$ljjecYI`t!qQOSkvQm}DM?B`Y$le)&kru%$hDK6P_z+4sHq05URx
zUH;O10vjEVh$stP<lW1cXrfqQ&sK&t>>t}P7czWnOWLz)kFZ%@H5x8*JED+>ch=eg
z=b{$yD)k@qUKJ#_do1c|^f6HBiF{!xOtDHzDdt(+M?IUR#PX_fV3^?QbX1?f$Z;s|
zQ|=REH#x+&leG`akg1oc6Aar~j_+BDKY4wI>h5D2+k~}^da*u?x~snrnBEGOm8x<w
zh?}jYULU2DtBg=jB+MO%FhYJ<2cK-|jrjsQk;uzv9*s{aVx$iMa2snr$w5wBy_fA?
zf4`l~)H0pt{iz4vfZjIRg><c4Fc#aK9(%2lorcMlN7>znOfaXywAxw1-wb-@%hSvs
z=nGd4HKwnfTu@0odFpcCE7yq}_w-}wPIL}?;-RSASC18WW^|5$&ikx8F<HaDJtJ{J
zzg=$kf{sJA=+1Q#S`J;pBEbDrw|$aUD5+`EKHaR!G)ea`3WYNpFPCk6WQOH50+VPy
z{!%hRYYU8C4r$gt<c$g(OLw5<h&lLn-;?R&?>=n4Tv^+^n54jvM$niiJD}Z0uq4S3
zGrSUB^Xumyn!J259nfitTk2Qrv?X;_jOuRmnct?PurmX9*m0fQe9~%(y4^p6xpLO<
zr%!m#Wi2B93NpjNP6(wSE4OGzu{KB>5T@&FXa35SGt9J5{F>6k;W$Z3TA^hd&U;*|
zp;GJT95P@3Sm^vpJ?J?gJ_ibBp$oaVdujEWOy<RBTxJ!Do-aFp31lP{`COn(sw*CF
zK2xfaqVIh>5BX0ExZ^1e#|#sB?$D9FGXFvs|A0o~M}e&bge?0c=lS}Pa)tq4oK(la
zIc@p0(k9B8RE4uB0fXmJteb^~pOe@{F;s8%i>bT%OgWA2I#{?@{>ZCZ<~fVd0yEnT
z-uZrxgV)D*=bQw^S~s*fwZv}L12;CQL^ChArWUKUQ}K6+ZI8ego|5s*?<H|KX-8I!
zYnBVv$M!98dZ3OPucjKbxqYa0+1yVHg-<14Lccg(mg&Fi=PF|MfhS_8`8410r~C=+
z+E=&XKY?YY4)g&pCV1k+Y*nt(!q7Bx1_#paVo9>zenwxDCiqvjvP%}m@XygnHJ)R>
zNQ`FiBYlSDPm+hsjd^UCJoi$SEgOw*U%!{AE|QKvlkFR0$GM+;4C<|)^ZdwuXby>u
z!CypzUR*ON?lkEZ<*7u)`SDSHOI}M!_C(amNJR>CUiEP{zYIk6)a1AaO&~@X(^%4e
zH&}l5QEBO1Y7IL*KJ>OhwXTGtH=KiCz<VNApHJlR^EyG>j|A#3iQhlG<y?0x2R5to
zotsvBI3`E=P+l3W>7=VMWB2cwKFVpuH5XThb`|<N#}?m#-MtVn{tLzXYiJ7F#3W*z
zf3ZQQs-<1>dzVf7!+>NXC3eGILKmfyTo~FXq=q@*vt@-SUyQM^=bg4+_NvY$zVKE~
zKFUYq0B*^#ckcO+;^l}aGsT?;&sLs{&-A=vw0o;>dLOU@UPPapq>eeU@|Wd4nJak2
zx|F?F<&q11%@xp^_PA(|id1xi$k#dVbq40_4cCw@<=Cv7;6lENe{tWIZZ!DpnOxc|
zTHf3yA?ALVrP!EIpZBeb%q?ZSKmhj&z7`FXOyi&f>NMdMabOvOZyUU$qb4uc%cep<
zIiO|#dibT=E$>Ue(zJj|9jgl^QpIXqyu`2~H6$i{?q@_GC{`0?z8fAYGsabiR(8+h
z0(PB5p}XF}7NgZ*mlc<N6G6Z7^@^e(2aO-%`sgU~>bEK2E8^fe;UTXx_!vk!OeYfk
zE|laoXN$&5dM6}R%v5BC)lD8Pg(PwyE4NJl?Dw7)HVJSC1`nX!S_P#}nk`mkz1izn
zF#*M0SqEDSeF9ckhW*YJ(-ok8`Q&+T$)p*0f&o#_3=xQh54UP#+!Ayfu1~YWrn+Nf
z?S-3LH0Lk6dp*5xQw*hwn2w52=T&>OH&h$WE)%@bl<f2g(&f}hshr!OTOX9HBrAaf
zioc!9jtu}?*1bIXtZj(Vs9pY$BB@OLs7Le3gm2K0BI_JYMUCpB?>jE7jJb;q3FQ~J
z1I=l4P82$}HwPDGns%xNk}TiPJj`nDYlkU(_7U#-+1D;v2vZZSkTdw1s=%vno*+>-
z5%=f->5DSI_3=n`z~s+s8F@8Xzl>b%bQD4E$Jo{lu_n}-npQw#t6#`E7<-5L)8Xr|
z{*pQRV{Yw736R$rhEBf<bzCWm0hrOS40(%=Getkc?U<Q?7k?HVq>A7DqWYLp<(L7x
zaW<a*L^0d7Cu1M~eWCd=IX&@HuC$%DLUGJ_sZ91(WnR*~^sUDALR+eX^c-Qz#KntI
zIfrV#td<`Gn|h<e+NE{pH^%Q*!2jeK*_>bZh4|Y3Y18$2_G9$gfuS{>CHrM2jfUC;
z;eAHE+<=QaG@C*PC1-!nz4goP70^HObHm(S$RDWLM;|##*Jrw7>{}mX?O(xpwMSUx
z&NU8`OK`BB|5oHL@HA+!;efZb(q%ZqJm3mO1$|rhURy{r(_53iS)h`XG^!JLW@2?O
zEu#6F>EN}-Z#^%?)Mxlg#YZR@P;C_dZdtP`#1p0CDYjd$*#c;L4N@f|DaLyaThC__
z%Hro7dtMdh%coMBGi76Tek&LrjI}A%-ca!!wAvNeCx-|Ezca9BX`*qYBHWkdRM?Fp
z#7q1AhS=rV0pDJBN~v@Q>ekMI&t#pZ6^WYqyys+-j`*2nh4s?mz%>S3P;cP#GajY?
z)b3O8mn^FW?`3I}K^ujhV~%GRz`G6TOsnZ4gxP&T@MWlbBN8EJnK15o4s-|R403Y4
zfnSk+oz<La{c*H*`u>-sgC)dZpU)tZ!iL`ydb`qA`CCAZG;%JJ9k}v^O{R`gw1{EI
zUYr}Cr5O9DLN^vr*eSv_)Y>T|;@qVQch}<sUf<ib{wKO;WY1M~*6l)0?)9kUE7){F
zb@Fc?10!NGi^r7<oXBR`f+bP%wfaDjpT*5y?MM%Aar9peVpy(EJ=p@v$LE@(T)0}=
z>l_2XTQMn%UzDZ4?wQbW4lwkd!o?1N$PJPoNO?L-(X5Fl)V4S_4<kpg&Km=o^BIwJ
z=X{;bG~^ZvA<?vynCmgDcLfccd-H3vlntGSUD9hc(?$mmgJ*xY!|pyobdr`#5EZ$K
zZE%+`xhTsMrOz+#XjDIXHFUnt*Y-=AV@mYZ+b;fo#!J%PioZ0PSdGiC`&vEy^WuiT
z@alBO<E|&~@gLGFE=n*njc0_;{_y&l{04QOM_zZXaEsA>$!iV#-47z}ie2jATAOER
zs8opQKj;}g-z6c`AyRVb;R?mc_k;NNH1Ey+;GU#>|D5*ZhGk<>ss85*KM|NR`rA~m
z*?Qm&v7u{b6>m^aezXh-J^M-<=gg|->qL({Wq6y0F0=I!Brm0pI$;fe0`RV=p7WDu
z6y=ZMD<R%V`_ZE?$aLsW-TXgyU&0#cJ4?J?-!pWbV_$3c_YB}Xu5}AcG{n0Pss(`y
z60&!!vpD~1JVIhO#2g=*-ZLfXAm2aVvEsE_;L=i$%kzDe+((_mZoK9ENBFK<kSid&
zn7hT_lei)FYG8S$M<k%HZa?fy{R;X%_|NMJPcAOKD3dJ<cXr`Ut`CR)e5ov3>h^E2
z-qumFI=js+ZefH}VEr~dgrtTo%*Q^zd~!V#zK|Al97j*LL?+qfhOWAf(lcE#|CZe3
zH$*Gu31UkBBd`9NlMqmEI(GbVM_5GrQQWAiE)SFHj=Iy!M9ar-TqsTAt%HUtXGY?2
zgFfT=ZXxCu1H$uj)4DWz^wQAbL`shF3Q8!$XZ0J|H?8=;Ow}*WZyfd_qxV-YPFg-e
zFy%wY>&8SND0j`KB#KAqapUnh6V-hRcdoxRuJ2P+xpimJ7k!vCQ+l=AHDJpE7e5*$
zUC>S8@*ZIEW!?<_3iT?R6XKxd-BfScTj|TfYPLN>=(YV~HGicB<Jg4W72Onh8qn+X
zU?>^O+8BLur2T9B2PPm+Q?CeP!S8nx3Z8`zIW@W@HlvjIEZ?pO7oCXhm*$b7y&Zj;
z|Ku@ln;@}(JhPPW%*%D;gxSCR=9P&_qXY0#Oj$==JGqzGWK1sEr@ONGHxwT?G<W9)
z_Zi;XE9+O?(4or;RV$8-oFIaX(DqH*Rd4H!qzWGf1a>=-9h#)Cvj{!+Ywj$?g<zTL
zBug0OqhM2{WAj!KED3EB(~~{=E&JC+<c3<1b3ORDhTik_7i_!ngyCu!S6O%~^7W6J
zz7(GB(tE9nolc^xM&Yq0TjH+yu9@Gtd1jIT9_+mIF?}$XfMkABLNRa2BM9&)Z>2~o
zVzc>0W{lA@PZABkrEd<c8EbTXaHc{PCVhOl!)s#Lc?=w~8v5{u|A(jZ3}o|t<9$_2
z?Uvd~RZ*L&+MyIJReP@*r8P>Z9b&7!YSrFbP<!v#dv9WIBE-yj`a9=;-aRkkg(r8e
z@x4CZ>jt+24`ifuSIJa7Ix=A-6<Dep%=@3U1y+`cXxlD_2&qT-V*?s9USGN|y1NH|
zs?vO2h5plf`uRhtVaTljB7@R0L8=Q6C|v~QWH=NC+R+YQ3or5(JYLEdQObS*T5LVZ
z!D#2A;Hwo3CGRseh%((Xx%I)<mbCt9Wx{#>C&ia@lbT<PaP^PUf-jShzqOo#+*Fh2
zNWuT5hLjlt1`YRPV)1SSwwO;_zQA9+fPG?f)EyAWuSQ^{4A4@{Vh&kRA|F={$;cN;
zMp#?2UW1B<a<J=QCnqYe+VA!cAnbZ8b4vj}MSfocm4x|wZ`D~IWsVsg1D&I&@w))?
zmz)|uWOL-z9w=7;cVH=PkQ<0=<_GY0u5eQ{-p*jHdu)f<bLe~0#4F#mpKQ2sK_yHc
z)E3e`ULhilo4}!D6_>#&=fzJ|)94o1H13c)rCAz&{TMeM&znXHNSI`#ZA04W;74u2
z4>gF{bw;cnJl)mk5bL3!(RnTP+}N0jgIUTzNmx2qW>060I;heksE<n}zMVm;(8IaQ
z)e*Nz^UY^Ft7_WS5Wc@OxxpqQ7?SZW>W>K0(y)>q(icYf|N2B7AhmaqhZk$tZ&r*2
zJ=`6BqCC#ARjh4a>H#CC_mp_xqfl<7`b+7NpAzvG3ZiW0tR6lqGq2BgiHyDhPP0_3
zb`3NJc7L8r)Cm{9%lXn+OZtjrbl^8T%Jja&k8|ntt2fz5h-H$%mcZNq(A6lFJEl$*
z4Hcbl>hqEEqsHA=AJrP7&@Tk}?>Q#vBo;w~bjFgHjs9v1@l)Qkb`{gh;r|_4XqA}8
zHn;X&n+Xl{Y-f~5V09Wn5iLTezyI0|>};8==a2H*_1=ugnrTiT8M*v#N}oH2ve%LX
z_pMmF6&wpLxxuG5w#SFO>EAG}EhK6H@2tDwm{fDCua+$XGD@LY_w(Q}3h%t+=4-)c
zsoCI@)XJV^g@KyyF@UlYw%{HL=>*PtlbkHYY0_q6`=EaRAY=BM^^7#$p0?Id4{s@J
zKpY8wwt?1Xa4k9~#Z_Lz0aHdOov)108ed6Ei3aP}=Zc+HhMNbtdA1Hb|6#surA}!c
zuq~&^FYT<)ZQfm;ds2~D71H<xx6cXa0p+kCa6dPGcZNqwA>wkvz6HeoJ~z9J=!XW~
zz62@SBRwR#-^{%CN7nqpP9&S;t~@(GuoxGtkGiRaZ1aFc%Dohh{UoLO?ZkvC-_yS+
z*cF3PF5KdubGxFe@Dg#l?tl;}2=BQ+9RE*L!1?V5WL4mS2zba539`igcEo=YroNrk
zs(AZ$r8I9a$_akxg0A{y-e=i7m%G4aUk}VU=w;OLt4oL;VUPO=_@$0E9zMBv)Lj+4
z(}Y`_a50V#qh2%~5t@v<=eFD)Xrdlh_cOYzh--&U>yyC@(S*{6V@+O<ju1J~Mcz#Z
zSrD7qt@O#ZpmeFpcd?h8sFSF&V@u&1cdw3sh%Z;aLq2Nvx#qu`{TC{v2EVH?K%~;I
zBJ-if4x^U2t{*@iT}-wPpG-^U|FuD6ZG%Pwl#Lt{5b^_{l1O5z9phYp#wtZd`l@EA
z*FknKpK@em0i)v5v5S<@@e$-*YoNr)o6WIU1KWg<^A)L*G-W4aXMInm%Riem4)-|m
zM`|H!JshtTRqJA=+BFPSCh-eHo-hSSBTVlbZQ=RTWL`zw`CwZ7zTXLt)4d^}HEd)D
zmzo8|lug_go>K@J$e*-5%R2q+^RqhvQ|9L$5jn(}+8#x|<A~kzKP^C^MjsRnA*N<5
z<r6;t&Ht<G!WeET7R%`<il-2PwrkcLL!;R>cyX71S#^9^CO)IJ)TKO%pyoH5o^aaC
zuze^VtMy67%vkC_>Gfv)a`s!dW4K)s<jp72xOOLn`F2Od*9ftatj$_b^P5&#F+l7z
zm6~X|`ra*VBpW7P;;aG_R&2CZ^7yYy&vRG*43sZ-Ew8QuRKW{v|G%86YtA5jn_-BS
z3W7AOoksbkl{pR#e8)wwY~DpSITaj4JHR+*eK~xujs_B=ZYK^rhR20=Z$s(DX#$h&
zXi6Ip^k;k1Br%`FRL)5!zcIoCk~wy-mYCG|J;q(;-tahzlC#f33U;Ip6Es@TJ9I9q
zlhD;a^M~z;ltxjG(bNyw3Uoi#BMvt{FUe~NiZQ5d%7LsqA8kV|cVvB<7a6U)J!q)|
ze?T5SqBc4kKFA;`Mw8Hj#Attb(3Pe`mzl2jE7A&^fQD_(w|V-yR;}4wfByMFQev9P
ztJP)V2Kx_<3>$IjOKH{^SkTe6Zp5d5zZ2QRCWO%V!04Z*-LzU0W_c#U0_3sPvnuhM
zFcCN_A&5~K!F@i?PSW!F6pd*3v#E1%-(DozHkW~Ch%U$Fq!>2hkQQ+_V^%Q#QTvT@
z7n|e^@Y$sdH<K++wr1*hP?Hw>^+y<r^mPzPGtfKCkBELk=HJa`1_%VsJj>HM)lkH6
z*Fg%~V_$Xsw18dJ01ag1ExP_8D-MQH8ICe(0S>v|yFsf_podm*kp501mvq&8ur6}`
za;VBOw!vsNjXl?#<v{NxC&t3XjpPa9;gM1tocjDk4y7`@ENnE%ZS;{Q;xLJ&0313N
zsP4K=W?4F^6@0KDH$xV8@NC7DkKeFdm9RS$=kKR4i}w7!IxIb9z&m_xw#8et_0o7}
zpumi;UQa>Da)2uIndn<2E>))q_5GK1W!H^d9<jd0kriaBqsk<HEr}4X!&;qFek%qy
zc3?!3!}w+esNJN}>WzkLuOi?4!c7niqG7Z3##U{}e{E;X+%iO$-dkjLk*l=`CNbj;
zxyB8o(5m1|-8TI~GpuOcEuF>)h>-ZV9MEIDAV8tr=W($GpUv=5iMtWD9+(xF*buqq
zescQu(K8*V`RA})ICU7GsS6z#O0P{FE%59OY^kTvT&!KhIJYNV==JbStl`@rI{$y-
zE5rRFQ#|0C_4rV^)ZQFvc^Hr^PjR#qMXoSkXD?q#h9_<R`5{4NgoynEAaU-xk;WOG
zltW5FH?3IKu%wsLyhDU7m^#?ya!K~*K*56Yw_+sfYxk%iDwu**0jXumZ3DN5uUZ6~
z?guYu6l?2__eZry-%S4h87CvPfaO!!aJrx<CfTcbj>3gN?)O>G@g(0I_XHd>3|i%N
z-^m&&>&j`*{?~23faHw1w1PA6NIa;iBQN7ol4~07Yxrz)N#MW7wqCpmi5I3*_l$Y@
zmspFywBhZ)qO$0K@9ZAV-};|$QRNE({s*v3oztRS_jap+QLNU1#<WhNuj@-X6&G>X
zOtN8{3!$BMLs2aN7stj>o9)@K`4f2(M)D`I9VuoWRtMy3fp;&P!o53CZd-0)>wKe}
zJ6wO05-%)Lg!E0#M>6Mfu$;wH=)OA>4sjYdjAYdjHXfSaTr6Jj4gOX$$>VzK6KC>I
zx%t<yy+@F}B^9rnx6LbA{5i?xykdm8OsnbF5Rgt1u2I?L=~pO4BJ)R0Z#S_;I2lDq
zt9wc`&jl4+2VM{Cn|E8GMj;HP5ryEF>&4!9!BdJ*4R;4n@RrOoJ-Oorksox^z0*uL
z(B~6WFL@>ItgNG>#E2!YK6QsZgPSr86VP3MTcYGk7!J`1SUfpqvZVhF?aYtz#C|-H
z$QGeW^PN<CxHj+0S99K&_mJx+bJHcMfUxM1_Jv5<@Mo)v;Dw08<%dvm0(e+BAzr~?
zz?omb0_us9YFJ+I_~0Lzw^D$P*Ze-LGC{(H{FcV~?1MyF#D<4=rpMXL&s2tw?qM*E
z4URcIMEC7us;=qi({E{8u~?zVtUhh(dD6E!jWVC)6-v};e-+<*k>00{RjjB1Xf;LJ
zSV7odvwQQsdEzGVqIS4CR-_jDsdBDaM@$M|iNl{pS(c?u$UAC@xl%E;%6y|H%@@Fb
zg~JtB<yYe1nzSH3_h)(mufD9k*yI3c+$E{x0M*<}>V4Yt+Na2vxT}wJt{5P~%m>nu
ze_3ho3(-oc>)vF6QK`257fF9{qC7une~CjWn1NFtTPtu%S22rk1b;WM)I7HV6j;i9
zH5oozyPcQ7owQ?tkuT=jhZYv--O>e?+KNcG7j$Ky9k|?(Pu*MKH$~hI6`z!7Z~uT(
z9{uLoA9P*cp`Ya&pS%U4FeUiq^3A01_%|HLO)?%u7|bkQam|zH=4(IVn=|)A|1JkS
zrlo^jfBCpF2b<%*B20UZmVOB0Gl-z!(BYBO;<fS(q7$oj{nYAYA%utH*CFBQnnsG;
zQfsk9ntNS9YL9BLRkt*cnHRo4(^t@2^;cg%`{ToD0EtUufQdEd#JKPs6Tz*vkAuip
zrFIB8_aAF(wtx{<vD0wet9tS^pzgR}KIKZxHOc}L8ooC$6I{zUQkZB3^dslMohmM#
z;3JY^?Veh-0v2PH{)-s(DAnF*;i^u#Fe;fAw^5h9&_ppK1G0JkH*FmyWahzy!Az*9
z20LG4dQ_-XH^!F1N7zCL9|eO$_jT}*oZDsdao=8PyocnbS|@>PvD?Zh>+!Plk}o~)
zdwpBG<4D^ko(&R}mSsZv%#1T_5c=2@_{Fi%IV}{-xVChZ4Ibit!7wSc7Hk<lD2ZpF
zbWg6j_JTIwuzwccGTC=WgO|46$)))@@HCM+FJgGlS~g!u+ird+?-FVnt=}1P2d{Y{
z>%s#~r*9)#fm;B*^p0r!q8h!Q+yzJdgl~|I4G5k!wLO9OYDXYW^ix!#(uWF63hWDB
zxf(xJ_&oW_ZZPa<U@Y+Ieks18j9^9KF5H*n?3M)7y|KVbB7UyE-|1n$XPqV%cHJ*=
zsaq6=5c#VYrg!Jz-4Cnci_>;}7C#Kas2ZS!C2w~UUf%47z>Xu-hP!E!egraW$~Onk
z8mCD+KpAqAXO-#NkU#xR>pWqNcQ`|h$M$q~6G1ah!@gyUhPa4y)6Z=Wv0>fr43PX|
zDSD^YwUn{w7V{i}QYY}eq3`NZOLgq*-GLl3S|=Lrg8Bsz8U7X^N)bhojVmiLhiE1k
zOdPjnDVdyDClM5=_a6M2&V=%VhOQAHd5e@I9|BZCgJc(_>$ZFN3eg2kAy}-T{%&6Z
z)=j--6fn+HOK5xC)+W@7GRCD0%W@~aacvqDmfKUEYP)9eh~8*>AUF7|HXH1)o@_M+
zp))?Bs4IEue3M9NpEA{zxo{_X=uTDB;3Tv;xbK?!Ss(Pf7%Ec-<WpP^w*6Lq|IfNr
zi`l_buj2!0zp)|Y(mcW)a10TB1~qdJVw6CMHMCuOEL%)U;voo^yLsQOB`z21#S<?k
zJM>43HA|587|I{_Z?MbTq`1^|tKaY8$Z>9}N4;Is3)=RVi<vELrwUx&<&CRu>ueSd
zeY(^tY%*z&Q}{y!sU|*}4ryig_StMD)Iyj?IO5!@VkQoP#{}VHRg%Td>BZ42ioEl<
zqu(QXZ;H-YZqDD4pwETFrmN>Zi?=Z@6MwxZXb~q7jf3$tbx(DrG!7wfCgs=9m%y9h
zVA1nbiQ}1=OSEUhY5i=iYIDDB<D|_PgJYjg@@O_-I|E-l5FqLMyWO|98V)#TJXOV#
z2J%c5`;+(R?yTAWbga%yyr>P^PV{fAjx=Jr1C~#&mEzL3m1A?azHNlPXhbyQp7dH6
z*^7eT8+6GTzHqiW-eH8dmC+ynvZ78jyj{Nort%`I-|4KK&hskFY+DOXh2%6fpoL?}
z6^yhQ|AgPnw`zRQWA@UPj#O>G>y;NprGZFTeX2VlB&pZ-q9fe*tYZ1Dwd0M;iM*3=
zO|Sy&@5iO#Jfm!@9Wg@(88-V-&Dv|34PQK|V*5h*t^-5ziIS5jCOHef)n$iIPYR~8
zb2SSa)_Q$mG7RsQ(<}agUF4QRGVUpXZ>I`@qO4vH^)f1tH@nZnVmh2+jfbYhmBptF
z517rAhHdYu_GoSDn$qY@$V;=HtdVPY1peu!iYTL2atj{`lv09s>RfMv8Fqd5Zh!ww
z5f(Trns@JJ`b?GSnaQ;u-k-;sIsIX@1?IADLoPZHI^2ElZ)s$8v^dy~&y@D*3$}q7
z9Dgc0F66I0`qj%lPatW82w6TQ+0}ulz`zv3f7QO$QE^uBS4wVVp2hk0A6zU%C{{0#
zLzllAB|EN4F1TDTx}4Tg9#0^7RyIYC+GZ&Y!k?WBJ*KrTXZq22z}@`Caz90!=8O45
zHoFfDjlmTk3$HfmmXsEkfSEwbBkV{N&-?CqU$4^yJ~o2aZ<vhVvHY9qXY-p%`;XD!
zMl&eOD8+7NB--q>%FKK^%WnK;#X3zpY0|tRg<|{N#1mN*X0o)hXzXUwAJQ)Dr}Sn_
zbyXL4-ANiq+w9@=;`qAJ^g0l$Z<4+LRb6Yh5n|p7rS)waCwZwzaDhab+d-J10nc?;
zqSBM$HSl-a=2;_XQA*iU+fa-n!p81~dds-hvoPR<b7ZY2SVp}dqp;^_Eh%DK&f`Pp
zQ3icj+@sPNV10!2e%VD^qfSeSgiC!G$yut)d74WqN#>!)whCe6x%rJp&28CR+s&4n
zxfbNMW&KLYTFcT6&(!LP4hi2`y3Jz-`a-3WY1epzFl-E%bjmEv87b>!FF#QS91H2?
zM~?K`9$6*e^^e$glZrK~Cl+aN(_yi|A{T7LG1;(}b<MG{cGisM&&l!!3=DJ!B&(m2
zQosL_eeUqst%HMxaHs04b<ty;d$4;MK>f<z_>)tz+K;0^ut~l%$uR1#%XrcI#@^tE
zU8TCKN2l+?k7AN+LSioM_TDaia~GRuJz531vN8DBba~j93|4n=EU;EBbv3rld%xn`
z?eHfj_ziu;AO>qeao2`VQy+PtRqj^QjSo8lZXO*jvxDviklIOmH9!tR_;A3w3`jse
z7KRXNrIusTpU9m7h0;!%BpVWO_3O1F*zdT@Stf#)6A3cDeqEu-52ftowq88lNh#W;
zzW628_@^(8X*{;}{x`EW^zPs%w$uMt$~yY@2DF>R{WNcXTsHiTpkY%)BB__>BbSxZ
zBXx#o@9D)*0$B6X#$e5|4DQ*-mU=rPmuI6ia^ThaR}vKvjo*U<=`uDW!<=CLjJARF
zu20_-UHHY>@51V^m?f}j?0!@5`>L3ld-&w96D`p;Zf=U+&a?6>s>_{z`kxjc@oY-h
zQHBa0#@QkWtcYzuao9Ez^_Tvob`sfsrQhbT>Jb6*-ZF9}ia1Sh=rFigV`ya2@mw4P
zFL)vO><6e^=)2w6o*duV5^0@1PXlcuT-hhBY;WKf3I}P^3vOCn`1@s-0j2H-5}2;P
zJWXo{4D~c!NQV<y8RT1|?*hk+)*trh^oyskQ2r1F^|w;29y9#wpnFEI4N<VUq+@pm
z&)4&^g6CAYd)`_Cu!tayZ9PdNUmv5CzcS)htx;TZ>2SJG8RHYNi6<)Mi9#qTewgtT
zO`HQ?ZkG`Mm5(YwsggHc@%BT4+D4;(%9IA0$Q^s1_9a<|c(~kpbPd)ZdZEn^Rz2aV
z!IL#JSQp|~FU1tu=zEZLAn?x1)rjzHm;<)_U2pgR?AbqHgYSR91{wZjY$7;k)uAvq
zvF+aD*L+l7Q^FqJ-FK2>*m#NBt|~hDpU-jJMtXdfo(B`el%*GmjYzRl0Akt)ZRPcm
zHTk!0{)8sRZ&VFQDeOKXrQ4-~SEM|!)gMt|TK&I0c#WGO7+UhlmKs0*;A3O2#M&<)
z#6cgemqC7a2b9ZvDbb8x>8V_KL7=;N`u6#Spsm2#*vEB7!UB7=EbqO<%BUn@E3^p^
zOuGN!8>VlW3Ln`t*6IkSP9SfMq>R)6Y@-~&HtLq-D&zSb7;OjVCBst69#6(m)o-4%
z1urR)yAIE7G@FE?=mz&Q7#Q|P9=_uqiTNN;ei_j2A+`KsiyiGt9r5)Oz-YKsC2uep
zfA{7Ov>#2(*;jfv?y!FrRLu*FfI~NuQuwmu8elG3s$u_1bXq!)HPyNJI)l(Ddi;13
zvn1=>KY!E|f%q&=D|+PcsCna|v+iQ$(r%0JG<!dfvdzci)U3_YB?h_A?V0aiquA`H
z*)~X)L?>oq!>^x)kfi2ce!A>CuMBs@OaV1~Xdj~rwEeML?kd`4!b0aPqv)8tI%aS1
z2cHq}E}Sx_8WLbY>Rh2}Zia_bD-_}}q5a;<4pLf-hXCFAnGBt%6Q`_&5k|?){7d|j
z8o{f06Mf(hK{7-lF(wj!>OU=#ZjbjdKyL6#SCjfs)pOLtEojSBDOVY~#K9<X0_v@B
zREjUXNlKs7?BMhAOwdh^76>kd0<IA=>9BF?8pl8i(rp$X7g-VIsKaYS>9uN0Rj}T%
z=5Yo*wOzB}5cgRc$9MU&5LnBmFD&MEo<B97JOmc3Ok~V$UG^cx&+nmy;hV>DNU?NC
z4l({Z64u=P1VZI>_*E-Md#-Yr4Mh1?dyFsFgq3UOpFZi6B^TjuC`uDp?N+qS(aL@^
zYvwG#kaqfjgih3)uKQR!vbLeZWVDYo8xTI!AM1#bCz=BPujYyHVGONZ8l(^iog9ZT
z&c{{C127cDQK&$gZ**$7qhVG5w$(OyNi3R%yYWVZ@a|l%#<{g@8wT}{jl*DT>KF@i
zmiNH;p_>_jLs3idTFKQcF1;Glrg^s{frbu*dlh1rHw4<4qlT4|nq^a?eYu?IcpRth
z=pEl0ve^0r9v6!<tokDM!H-g<EGYoX6R6jP*gffE{OH=TL}pehrBZrA?txv9koB(+
z`eGbg$^V7UXl9o+yKkp6>8wgWxbcsIaJ!+*Y~^9Fir)DO-gtFXlhslR1HXe&{?<oG
z8qktRLG_;zl#~TXBoMoYg-sZpDkS$wMTzgs3Zj6}mA9qR3<STR2JJDeTetqiNWC0T
zDsV=;-JaVc#V^2qtvFDFhqu=#q?mEMF(ItONqqYoo%7T~s;k=zRe{)1Q#d;8aL{Q9
z7ohl5F2>EwK5gZuZqEOV_uy+x;OU<fnBc|mY<6c7aIgHBUUZ5uZDJ?vixpp=1$F3L
zY=73Sve4fe;6tDb8DZ2}>=*}y<pFz-qVwaT6)M9lg-R|DuSzACiDdc4EkpHC6qsy0
zRcH9g6~%~=&BK4KgD`tQv_n`%&+ODqy+QTWcCB&2;QmV)0`WRf<>j8itFV6=T8VSx
z#jrzV`5^0<e#slp4W82%416XpokY*5wxJkuExWNG)}aE=UB}^$2sluZ`}M>`awAk3
z43NhPuZ-}trjaLp6HcG@sBYV~GG~-#{B2vVu_$iFY0xNqXjjFa4e{m2WvzVF`3;?+
zWd|HC4)`GakaJ9;rhhI0bnsb$(O9E$mw24;%$Hu2rI1Bebay<Pho5={??{N2;}Av2
zf&-&P@6C*S4sB|3X3Ib#Lh)+lp!1Cc>ZZ-#6rK8gfNE~+QLQCi;<q%rP3}#_CY27H
zy|Th<H$ASw0N!j-dQWl5&$7J@txYu)wbx*Ax}Bqc1P|HO=K;`|RV07>29bxTGE#M5
z9H{H~a%YuO&5j;U*Q=bmR59yAc`U8)Kg^hEo$V7@@G6L>`sGaPA5jLMl$-*htZ<(G
zay|4y|3W|HE=Z0J-TYCtU-=+4WJ>%LpBCxHV9aAW7l%SmxdbM*agx0OBn+9M0xzAo
z7%D*D!~Vj{@5B5)U?P!Pd1E3`MTw7zV*hbof{M{&fex05Bzj{5FE_n%$)bhgZCF|7
zpsw`o%XUrCgRnq)D1P}TiGw#YCr3$ZnOLkVskAt2OG&U+W{VWR#hPV&{$XC}+Etw;
zv3W?K_{n9wk$tT!*4OqIqUsshp0moMlI+{;ur~s{wr*W4Q8Gj{Iv=!sd<o`1+T#0b
z;dseosr!2=RQhK(Rq;1vuAbcU5q(|5q&$Ufv-(VuP3fQbX{xvXFNlf)l;`D#(O-eh
zzp`9Ru}5(3$5TWarbFja9Wlw$A&j+A;hX-(YhFUNl`$L^d}$7-QMvX?!{FQ6Ol3tu
z)PxYSwnMZx!~Gx>g{fz!FkFdGsD(l!(CG2uvPF8_wMqvb`_e|sHyzGP*Y~ahenVJR
zX~z_&^$4U+rZGr~M&#kO<)*_ywyH-ju2=(ui`gCE@bNrjvaTAvs@)%mu{&~%HyJ_2
zudXu@cbd}{`xoRTk7YS_?7sp%b=zCK5ZMSXuV*S+(YOI_bFkY6=WX6vrV=kXu<APw
zvAL{I6@kZ@E!<lO29OTsA2+V%4^K^NMYw=W7c~bU^j2xL=ehIXRr2Ya_r;V3-`>$x
zYz@^quGH0TR5;8o;e}+=ey_a0W#|?Q<(NU1nW)UYe95W2MC$fZ-p!8fDyqIIZyN(w
zNNG!lpwOFiEIiL|M*RW}TgFMa5{<Uqedu?|$)4z>qf=MnA+2?KU(*&u=2>wKoC}U(
z^6b(U8tau(#qQZUq=nuA$+Cu@M&ANd=_b0RIgMpa%dsBf4aIRG_WFjNhTer}pU<5f
z)o!05>~1oy*JgY#y5A<*d|*(fdLZOhtQF+T!mkk|adq}r=)kA{aep!Yu%EB<GS+ko
zRD{0yQhuTP_B{XA39icl`{fy&g%E_SR8K#Fn`C?5S1ZWoc@DUHE*=*4n=FZ3c-MW5
z)%oWbv44@!&*}1PFw`KCj&87+(dqfl)*sWi*1aCq{ix|~P1<7Yzu6=WI>WAEd{1~d
z?fE_MN0cW5n=E<+^#(MC)iz&oAI9%Xo&k+lFEKX_NroDp2mc%X2)qUz(;snX<_FS?
zBUJs)UZhV?3vu};y)GG!8)PVbsvFEUHsZY#IV)J-5h>FLo&JeEFh{`ud16>-PDXH-
zE_%oy$DpV6@0!|nITQ}Smahz5t{!5a@J8@hDtLBSMUE3MGt?N`Q>3ofUHtj0)P^N$
z>$}WzMVn|~xP|JJ_$&&apOlxdnofeq3G`|W8f|?idaL71q$LiVTJ-LoZDUHInUc+<
z`1*o*uv8v(|Ec=HLy#=SB1T`3thif?{(^+R|A+lqq@4akcqlElQ9fpMWTwim^|V2T
zqPq@GKUFdCrsK>j!btdKK2OHcLmI+Yoz%sQf(mZ^`zd8#(j3lb%O<a^F2Ry;=!m&F
zsxhAj2m2d8|NVzkUJ74%IS8tH;-iVkmo;6{lTV)Q{&n}9%F$YDV@>mp`<|P8-`%>2
z`Ue8Mdf8yxnu0ytcG{w+&jPwGxJ30{GeFz<RAV<HJl%Y@U%_#Y_+AqU5u07U9}QB|
zt6=>B;M*gbrfP7<pdV&FBK+*%hn|->B-OsAL{<a1p+W6=ABP>(Xk2E?&&06Q(l8sB
zgW}tQR9S_3K>#~8r6%WxWG;%Ql=c+sPLhf+&MH+K)$;p2L5AAz2u2AwRNV5PYj}+)
z8e*-DjJXdP_~7lHn0AM<pO}>w=Q(A%N))#3OZD@fbQ0<ga23dAa49<LgT$X666XB6
zf3c*yatMzS8Cxy~I!>1Nskr)tZN@9@?0;*9s97um+Es|~71may+V9sC0fHz;!G}f{
z8I2_6y|scypG1|3q5_loSC)U+tHUyL|9dpo{$&wU9h@p3=aX8_!nf<kXn>@NDO=|g
z2&wf0s_<*Tx{-N;CtXOV-_G*VpVtghdv$*R>8-FPNnN5P=FvgmCemG`d#uQ~{Qk+!
z&evx}=cx`XX7#^Jjh2)w=sgdlo%&HB5YrnyYSi7=HQm3;tS{`;ecRW{XI;K#@)N+h
zqvs3yYM0*RvV^e*ld~|73%8ZCrUhY|kf}J^6-$4L)~c<zyW^6qy^JuHo}UD7D-+@b
z6QKea$c&3`6}Vr3(j+8o%F#%J0dmF{E_C=N6sfdc4n6N!yY!zZ8~o!ZL$p<R^~XwM
z@7AtT|LaLMkKNln5s~uWE|W_DM6NpUPIs79>ig)S!+YllRvc$DVt8S*B1E5A>G;Ji
z(RU8O@DxOs+JdEt>6-@-38^)0XxLx5A54d5hK-ipJM8XrsXtBFPJ#_K`5M_GZ#H&_
zo860;8%(Eq(&e1G0L0Q_>_zldDRuoy)4Q$@zl(lZ27Y?o+o^3CBy)1@^9xorCokkB
zSjHoae6K%%i@LgG><UF}pCP@kzH6S8t`EK2(bGKDu`HM2oi&r_KBB~w<cD~k4$vB?
z#~VTUo2Ql7#^gvEa8A9)x#z6|jCgn%%-08lsB_bZp*J0>Gp5%qh(@(L@9(+tBu!`h
z#FPe}&*b`BrGn}nX&kesf>$LWg4PKQgSX?t-~$=#GGg12Tl;2LUgqU*nEgBlmlo_{
zVR8-(Sm#152NU(Oc$16-&)v@B!&-3&EOPGa<uXr@!)FnED_Aq>Pc_reOEa3wTd6lB
zH^#kP3v!cQ1U&GOqvqjhmCNiSE_O}Q6HA3c{rbXfHNTH?ws8}hitU-2qyVrpv`gW-
zBo}g*!V<9Pny(e)5<?!+vaQ#~QQDAGsbttjTPEs|rvGc}=Rpkr=lFw|`P*ld-_i!?
zJ1x^1y{@ynb3A`?ZW9A+TDPAOKexv($fV|7YXrJX*QVF@l2=2!vZh_&a6P`|9nJr=
z04-n7AvK%cMu*!8hI_D@?!tr%N{4GJ<?90)=p`BPva=Rl6^4F$dX!PC5qTF_i)_aA
zC}m26r5AU37a7ofVE`XVX~Y?=AXI$aD8gf>{mH!cXvVJ*o!L&if>i>cx=x;P%>i}L
zx2)&upz7;$J(HS)>XouRr^QEV$wLScbHOcv7Gdq0X&{5-LL5cqI!}HMcfi7rYfFVp
zK9Y@fGL-2O>Atxex-?@`IF*ir@moG?W4-|<HZ`=fj_k8;94%AIucQ^PacD*4_InSw
zb)3Uu>vk(1e~W=yM!h!%?MT=D<yCtvKW#ds9ASmEvnF#_vw-xf!Bp&zB?ND&u=>km
zV)l0R4toUlN>3^EhxQ^QZdWf7+=qmDH=f2Iw2-&=X<<z`L*jRjI;Hs^F1+0aE+Bh%
z1@&HwZj)|CVNf~MW)LKsob#z%YKuj(InB0jg7Y?1!jX~}YyXN@>rRnd;aPS2Mgc87
z9%{(TU6T>Cqk)|T50wu)O_fQh7RwM7zff^44<uv<i&yc7l<LJBuGMJ&nXXYl&W)E7
zfOcNSlwHfW3?P`Vj!3EJTR+>x#dFQ+2(I6;bI&9pX*Nes(%@cAF8j+44TIuF=ooZl
z7Jid5oYdHD@bAVg_`Tt-*hPO$QU!CvDSv3(Yb7_9XqlD#fE%i#<+2y`sWaH1@MggU
z;a~3x=-gXVXRd7bOb%x)E@;0x42f{y(78VLM1`C&z7c<1e-Q<5BcsC>!Z~OjSiK39
z48PyyNo&t;nrxk0?voUZ7_J@KvD}n`+HinvVw|$vxHkb)S6XC}p8sB(;|bO|ouHmG
z*M8H1=1fS%#0vs<kVdMJFh6)GxJ$Gkvq7bI?L1&1ws@hy%i0aEiA>XG)#l@x?<)6d
zPhUtlrYlxa{6t`9s#)eM&-p*Y-xJFO8IR*sQ?pU)Z|dS(!M|UrCcJm-%hQB)8UeSl
zM}8EAeE3(HXd?Zay_!pj{)KS?uC5!Pk|(ote-tZ6)yS_JQ(|$-;qc5oCN*&ZmMFfn
zcQ;rEfk>Exs-Uk%se(OfV)BHsmz~?<R}NZ<`F$}@ViyM<@N#5^30mCW3=<0gx~>CB
z-;G<ZJyTwQP6)56Tbhx|JtEy1Pg(pl%ekSU=Q9M5^5!ELuq!Y|d)z;j^yAm9)AAEC
zC9$aa!EM}NEc4B=79;3>;{nBtDZJ!KNb`=P`0`mIGlS3dA8Lb88)edpj2ALe05*&l
zi1o#uLe8u)<y&_)XU|CJ`yBYA^ryH#;Y|dv?cMUQkrnQ#o~b{j*x&w0+j57To9nxU
zNxy=wqU|>#--GPf?5mj7vkdb2D3Jn)E8xOd=7!4~tb?v{fLh=~XL?Q~kMwA$zB?lT
ztVZIp6Y-Xi#c16hN{Z{Z&-K3Pdy%-7iXFWfNNbAvz47}mPrDH4cYKQr_nDTSZR<}l
zb-mNAjW~*x;eOVqb=P-tD@R`MUyr(3C<bobT?S_rqVDS1ZQTY-&6jMZQjo5jchuqH
zE(|qAZpY=U<Ctem{|aO%`3BRdpfbJZ&G$qDr!As~9tv93g=c%b`z`b5=#%W2`XgX^
z6>8f|y?<HMJc!QGTJ%Ei<UZWI6#gs*fqt53Y1vX%?ZRVC&6oJRNqco!o4O_)K-|@8
z^<#IP@=jc4<M;dIf3Ce!c2o4+M-jKb=|Y9{c52DqAzEhdc>?%MyQ5jjG_2FDKC@Cd
z+dt^LQ?IC1&G%4x#cF)a4nnr~|N4r37~^pJ)5$-5m$lU66fMnuz5Z);o4sYNz0^~8
z^^`!RcrKV=LJ6yYD-lw`fTvukF#1d`&Sj=-)#YIDO0e5$1J$1$b1G|WE|>a2$6G_|
zhN*hauIat@vL_FNORtuc;hA&n+T?Tmg;H7Xzj!-2PU^n$?;>jNKc#%cO)bcu<HP<I
z?>{P{iY!(k^KdU8S(@k)ZQdAnIl<XA{l^}ODxBBb3XV$HiE(%2E2{Yl!<Xya3)}>~
z;vRT7;W0?~t#vRuLZ>2$IebkjC2`*?aYQ~J{D-<S0gvl1Q^#x8{<B{Cg?rP}qwI~A
zN_1WRx3qPMZMu@`H}_;Rn$-`e;SVGk9$ZrkI&m7hiQhs8m$~Z8ik@_28{p5P+U`|d
zJO2EV_6$?X5;^+>@X=q^$WvZU-ehzgK(;qt_Rqgb11PMkB*!S&%ACPpUxeYAV2cxQ
z{iy5WNnmOB?gI7l{#qD$7+iOyS4qI-uhbEt-?7Yz<u*%@T`|TwPB-}zmfNpnC`m}|
z$p#zso;97px<f=6SqfYzp-o}C;l1p6&kx?Ld~CVuX9acu#AEdCCGiV<f+}8QJ^T^X
zZb;j}hry^SrdG{&%fFFsvjbkoM_8EMB->+~bF#dvfNfQg0A701VR-SaNZGnAr4(lx
z^pdEZ_@Mc8(BIH?Ub!Z)8Q?547Y9c01^Ii12S&Jyso@&0<ZWb`r-uhxrFOV{%A<d2
z=}8fry)_=Ly-)PG*2~WypF#kD><t@tpU8Raa1V*^blwlc26W*_2eS~4S$d_3x5gCj
z@46QrU-^k|Ej+yUUjO+GeZgJ^^VxgVNmuB@!>fNf6b?#$hxP%bsZ)PsB;VQNlC@=r
zQhMg#rz|Qq_x@h!LYUqR8TaXx)$}b!l!u4f{#u+x3Y8?5zmAa16(smfHuIysAdcMp
z466$`*a{)dl1FSuB>Dr_SZ)CV#NiLWk!n@dv|HhD<7{Y%1~D?ew&vlv@Rwh9r1$(s
z{*GSZ|5pHOcAgROfJDX>;e~cr028Lf8WUM|j4y;_HQu2e>fCQ$vOP{spUT_j0XYp&
z70yYRZ^ZEmE6_MIai^^ND8M#ZK5l3shkR|SXLv)#EvFH}lZl|8t+IP1LCh4rOAlUm
zb;TR?$4tx&@N_M^9%0v_hTPeFd9BfQbJ2H$m_~nv(pn05@=ul_5e(@9co-Y7;3Ujz
z6to;3FFG&71q2rY)P@^dk@}EJ0hiSrEfs{~f%%E^Y4_y8tV@7{*b2+Nl$JX;UV686
z@Mir8+(GabbhS-J9LFK+juwy_G*w|}{8a@OXvDP1QJt-13Ed`#fKREn5PxWGJCGQN
z@S@+A&_vkj1Y$xk@VT@(W{Uv!Wo1%u#ZPUxEhsN7kfXGTny2N8N2J^gbZGbub5!DN
zH=p9GzphuMb@>+q>GdE--r+J>x!p+Xow{$<Q98`yGO#3_4L70jxoh_=>4w4L=$@Fm
z7VBuRek`;Z&CcC&&cblPmzNqAQrjXnjKbQIb-Mg`X0EQUy>Zldja9nwR^qalz$1wx
zu(}RJ&5HR&P}~iOZ5?Y#CTJIOhDHwcq0A;~h7Q5~6&%I$vwAj%uTh{#+7boK&^aHV
zTArT}zWFPJVFY*PkJd)Oa**6jIC3W_k6mHP)$aMDHmzmC)j4oB;O_u^W=k1=DkFB*
zK7w1H(g_IQiRST=?LIrXDLB^$<=Er}+gtZ-H?52=&6ISfUUH(h`eCav!!7Ce@Aw1y
z?>zBrF{{oY*TcYKqdU3?KFh%D16o4#eh81l>uXN_B2k8ftH_Mt5YEc<3)cCb(X12V
z2r_*3%c!y*nOw27pV3-|P$mpcgy)+14l{*=#H_w{`FcHDUc&vBguT2}rAf?^tHkVf
zXS6MCi5`>ZG&Tvxz}H&=Eg9hYlces8EomNcw1b7F^AbjxO+tgnb^970ep-d_HP1l}
zu*T}=XbfqUHMn*4;&apW)8?xCf4@-<dd2BVA11nG4LB{1*FeHW=O0DNo^GaOaiKBh
z8Ah?^z0S)R-pkj&{0}NH4v=&wwqXT$vJ-K*C_;>I9ekH^@s!Lng>SIDx>S>OcKK#`
zzILPZ9e0*&#An$lUwY34M`QQ3ovo+q2<6l(VKt6-F(eh?X`WGr)1NkEU<zG)SSi}C
zF)uK;CLy)3LQEryJ7uO2-D|{to0fJ>?@35W*hnLHoZviH7r#=kci0*TN#Jxp9iJI<
z16{N$)C%h<-L|w8Ha&qR?-ir87OXICzT8o;a9iY`?Lt~x|Dg!ER0s?Aia^xq^v$0S
z9?o&|xZ*3ODoa1ZG<`QcA5U+cA$fdHw`U53x%+xlveFOim%eI&Q*c+F8cr|RT`!`q
zlG;GknYNXv19B9T%H4=y`<AOBcr<p}6_aNVvTfM%#4yNQvBcbjIG_)48BWDgrxefg
z(%joFC{Zz`YL-8yuXe6B_Z3Q8@vw&iJ;zWeC<YEM658O(oQp<xC(MQUxyv?X6CK|6
zY6({%U6SCwxbz;RTl#J}!?VJ4@D3$0-*SQTR-wxYvT_-NU<;gTooj7>CLzoP(h*F&
zWi-ESHi&uVj1&`1@IHHW$y%DW-57MeIOx0_=w9m~Y?=z|{^jhtR2OswJr;m0ZD=9x
z<kDJKGL|=-!lXSTB#>h3d14G6r_@Ypt|ybwt*f#K1l5Z}3EP&Wd7~A9qBGm$Id#`{
z4C$~j8`<$FYubx5Zy;-s2S6@7K1xh1^H1F540ylo<e|>HiLxM!;LwdQzmvIbaTOcG
zOpn%57`U`?wou9J$)YRmn$w(i3;1Ru#yc*>NIV)xjJ}zpZ%t5XZ*PY6jy?_&{Z9W5
z61?tdBKPI9idHhzNwa+Wd%>_{twm?Vz|ierxwAOUCq+J-Z#-`Zn4#q1YF{xJhK>(D
zIN&eI?AAN8?SvnrdSbuyPKDe?mYqGc7*f5vA8|SHoO$pD-)(uXiyv&*7jtSwJl3qe
zC1OOhCU8{;8FmsHCSy%=e^QDlmu7%iuER{*!kkG?k$!9Ih}&{oTZ`@6G7q>1$>p9p
zd|A$Q37_E^=GL*tbfifHI1bjyKTBM>Gp2Ekel%@)CU^4D_g;ii8aXf-x+7ZlgPC4+
z2DX&_E((gcc{$vOe$BmB)jukB_^jWdJ!g9H!EI&TQhXmhu()XkmSxloy6O&YVO_sA
z*!bl7jRmTE<U6aLXnQEknB*rtJa6D2`#Pc}YLFMDG95uTh(s|dt<WuRTC8Rxx!Z{#
zM!7bnwZ|llN9C-wO-CJy3x~c`lvn01xUfCjW{yjV^D`tmn&jGNdDwwoZtd$#Pt-u-
zP5a#ybh)pZRb-W)r-{%8ne|x$7k+Fw%sjp9S99y8K5ul#=;)brE)jm6>wef#_Jk=x
z4I}^&Fnfdp=7gttFn(@2R$b`kgSI+^ZR+fGX?@sCx(T@vO|?pOM+p!%u4>YOcV~q{
zrrn&yjvs>%molDiJKzUwhF0<$F+7b4Q?UrN*F}t(lBa#Xf`L&-ypd;^x8QPsDNb@A
zVhFU{a&X;CX=EqK{%N<1BUfH~xRXNTG&{=Qj~OkvOx&ipAe(3KlbRT@=h>R0CAs{H
zPS`TL!6o+6>a*^u)LgpO|FnSBX}yUiDwJ9ngSaNeU?|S}r)ZjTF6&nQkm6aVSKp&S
zmfg<AiiULRy?HPpWUg?2+x4DLppj9gQmXlLS~*~bD4UOZwfk??)oaVp-wSCrs3aka
zg3bbFC79zf*7l#B+Gaz1r?-1fq;V`_D76~QvHlTrFamGMbE3X|`6ypvQBE=6H5QcZ
zUOH1hk-%?~6~PX>R=?h-jwr7RXvR#uiCbR|b(mN%(stnGv}VN+^NVv?bAIa2b9JP}
z3sJEVm-HIqoO*yoqti|tx!%6IagdEm$^w1-JP)|B$F5^J^xglpQ!%XWVLZtgjsplQ
zzDA_f$hLSsqYF@x+@Zf%_)6P(N^bj83^`1x0A@XYaheY>E9>*Nf%d);9c^-{USTzh
zL>2}@j|Bl{oV#upht6}MK-=b)3rxhrl5j6KySQ@qOBYLPuwvuIs@#k#%(wiILUbjY
ze;6JsxUl9r)VytP-EfViZH2HoUXU=7LW}wkAOupGK8tn0`Og}Tp3e(3zN_4I)BBRv
z5suQQ8D@m1`k>w}(^Dcd7G}Vvs{{ylUmgIa)YP?5E3Vq97K+>h9naB%Q2=c7-f+aa
zW%}KW3B2jJ&kEx+rFcoZYTC$F(Y7i2r9qseb7$+se6GZK?N5>|ya19=HpzYcW!%OI
z(b25+)Ua>--C)cxh@|B2x)Vs7b2Hwc@z?a?Pq{<P7zfO?xy;C6{GjeY<50pEm!!=z
zkRE{$xrpWfKZB!yq5c?d$7wA*6@s&8Th3Iyh`5*Bo%EXKf~aQkp$$*Tuu)ypnKE~G
zhG69`?AH-8V2XJ5tpwxzrl9?@O1Mph&D{V2k1Mdx#DxB{3~R&BRao_VeX23N!(|qq
zcY6=1B0t)F&n|NKKG39p#AT07$@G^HZ-@|q-jtooRw2?|0R#%w_YJT}o*z)EqUo{b
zK!!jES3ZyNl#Aodi$S5Q-~8pL^+||tON8`8g3r77p2Bmh-=DuIH27WEM2$i5Y;{Eg
zJk;-&wJSYwMYO0fv*C?!M^3!<Q;9p3dN8xTTW{BPto$g?_db-;Rsxrn*dQX(ev8(h
zV(Z~VO?tSv83SGUaH&x8>)Q#ncX!MZq!i!4W?e7XwIC;xT1%R!@mX{K-xY!Cb?0>j
zf74VS#4CZWKXFGcnQE86SwA|?tzTN_BaFeI;pqNT=(laHP$O6WuTPd=U8DaF-!_r~
zp3rmJMi_XZ7VL$CC3!2Y&^^kc&XC&2;UsDH4j=-5s1QG;h&b|7Ro0F+0QSZNU$65o
zu(pw#Kaq5bEPM1Ebn>2T6>Xh1;VHcMMvZB<#4kepmUC*=^}AIn{IfVlRlgsBnH1wm
zfgE;eJA@pR6Af!IAOn1Kgog$op*<AX7($n`0t+zJ@G$9Oe$T+ju%kSseXoF^HzTiU
zq`aWeHK)Woj3+8d$<4qAoZm@)c^^59fPE~%G&flL0u^SN5>B}v1I!iNJ2{QuX>^*s
z{)GUu40{WnCOG2_pJ0S;^^41QoMsNvv&MXX9)+}Vy0y~n+4r2}eRchwP7>nqSA;>>
z^387vlV<c4EivPMzy-R@q@jtV?T_B!FNBNQx96~+A1jyO)-J6t9I4J)^JaQt{ejT{
zZ$n3D{xMwmU;#1|c<S8_ML#ylIygVR<6f(08`d()xf>wV<whvND~I5#oVT{kqDTHe
zp3=Ma>7bErdMn#8!|jijW_E!^K`u**=-#}vEsqq>rJTCv?F$@R&)cwRem(HA@NK)d
zGUm^)udoty_6vvD#aK}&c4-~z$FSq83rY{|j5riiWArrdm{qgks-rya3b^P;B~kU#
z^_OJPV;cQ7tFkN?gk{IGi%u-Lv~?2a^*pp>KnAc(=gFkgs*qnW$6ALHC`3bWiK5||
z6XDS2V8x!W#g-kNC<El_)SA@?%=pK<WZuC1fq|qbrFGIFOz^_ix!8-r7JGws+A2A_
zJ51;0G<KPbvT58JQ2?ND68@nKx;y%9A4Vfg6G-Pwqd9LaT4OLceSGf_-hgy-Q8YA_
zK+mX!KKS=?nhwn`)WWCnF&0PX*YpFZijO}P(_i(f4L3#3+phWw_^v)Nr0rA6q|NQ)
zaoq^RtTzLnAalb9eG=J<F0!8&Cjs?w+5ubJ@}HjQg8VcZ*MZ5ZECy%!J@*wQV!VSv
z5+0FgkpMc91Ce&!TAyEC-T^R7H*i<_Z^ai4W$Z;Tv>aWpLzCI!q$X!#LtkJ3)4e~N
z{ngZexat<m(CsZwJmOD1E;=Hb!h9CVn>L<IV;2LCi$ku(voFcZk9M#u8_iK@*~Yh@
z<?OIUeR$4r|84le$p@)u%Ok$67*!T=ozR^Pj+b$Hu*fz{ov&Hhwx_w!ElO{3fH;-l
z;d*wRY!-+Jv0S<~(_i7wPH{~K2PE!+w}Y_ldOl*O*WzA!R(>OqSXG21R52_|^k48A
z9_^u6ni5x;3@zk&gi$yB_e?XELW!PCQ1T=AuE~pQN2i32{l>w)jy007jTqOIa;%71
z=+^bSXTt-8oWDh;{+7uwDfDue;)0=z_N>-jVtM*@)TNv5V;n9A_G@+VUj$O+YSsk?
z1JgYJz%!UOj_^K<4yvPj&&C}dw`v>O-W@evsDw>pF4*biD987dS)Zfwh-BZ#C-3l!
z>J1Fnw^~6~^&yL4+8GstJev^uZshXm!e(Ha8%4lg2Cj4yPbTQhp0}o^v*t2JNv%I~
z;lUuIHxhf>c)NLF^Hluzd?N#_>a73CS~R~4C<?YN3KEJgeMKS$+~U}aKa9&A0YcJE
z%~-Np_Z~Q?#?Rv_=XaC2JUtSXxyxuAX1a}q{K~#{cTVN!X*hYSZ-)w-NxMkVTsDzQ
zhE6(C!LP+mIX0h6V^+m~P17rsHZ#6mMo7}Z-MObv=XN<kLJJo&YUQtCCph}{!dtcv
z;KsjPs9eIpxF&QwcYDj~DtM1obU)ExGvqG%NZ3{og^TV<>4W=IsCxDive1v6aulmO
zj3Fc?4psNLkj}p|V-l=Bd0Kl&SU(`%z%G^eQASP-a=kaS1^C9McZ9X{1I1mGEOiX|
z^*zT+L=49Dy3|$NBEAb2z;SKKQA>DqEh?lwAqihUqz}GIr>fMRBGs%@G5(<>@ZFo)
zAZN3i^ZQjWKhGPA%nLa{j#{SiA>gMtW!z(BtbKZrUCDHD^rxeJ$@2|!jhmrW`ygTO
zZ)3oku3+Y^a|S=0d})!<{EvtxvI6DS+XB9D!+wJef(FRTMX+6z(Id8HXu+m5Q)z^*
zG1-01a>1>+w=$U5f)COjZ!aIOv7dP9Nh?KSF=JLzqJDh&A#QH<OT!(zR67Vh{%_4-
zfvxxS&x{gnqJlM}{@PTU++0y`tRG0U@DH+Qo@gm6ZEMVq4PZ;KDfCz32YM$$O^uV7
zjN<|5xi1-i05vXrf=nCiB`hGU$EYwzvKgyh59WS%9pC?rMY*yRxE-?-a?Hi^=`(2W
zKHV^Ztz(g+QoHBIhmG;!W-qSlWiq!~Mh&LRNWmGW&A~J)V32N_j*HOFs}}SMy1sz_
z9RK9Y<kDtOYWsMnW{+QuIIBDKB=EIGvctzQ4P<4jZQU*Xe(f~lW!?|9O#54r<ptYe
zf`aKg6ocTm!^uaDew57a&meD>+%VV$w0$j?k>BM?k%|xp25>w0jDqx(RG;en#b&sU
z?{xpwJ?**N#Lv9_q5Ny#maN@Y%2{O;G9keY=)S$O>34Dn8-wk5vEBFcR`ZJ&O3Uh5
zy5J{D_%_Hv=b55;n`W}DOI=W;TH{*btCZ|Q67HmIg9W3O1#f|2R7%8k#gX89N6oSZ
zT|mG4@d_Q7s$CRj`hb@6Q1ji+OZA4dIgNrjV4fw|9+f3)Yzsn*h1trs(7%4qo$?;W
zCw_0<rD5@8uts{Zv^@Vwesy+V&R&Ui?fI_jb|3@PhYw<~6<o|`zy4|g(}SSK*3@qX
zWER!Zgxki9ITEp}2kS5=rbOtH(YmF__(3I-yGwcL1M$~ly(jTTSI*j|vE(OOeWCnA
zE2T0GPYq5k0U<qn!PYt6MsQjAFz0~Fe=Q_aFndhl4BFMsLT_UnD{(Q#p<2gTf9x}&
z)Iol0mVe4{vby@B<u3LUH&Fl6)ET|W&d#1Dq}3^~H>w-hR1UK3GUQ+hL%+=$LZ*&!
zg#YeQ6{E|}Q0-m2YHkJ8lwa3%=e@RdN|yM+w+|_~;U1?jfI1PVQaZho^c-{Gy3tQJ
zz5anqKe^$$BMeH`h9()DR6wn~it=85dh9xLMk*(mU8FtjXdsh0pn#V{D$mSmC*FG9
zHN3n0O>84MB!dLHopf%0LC%g2QCfh$D6acIOr7;xlW*L=Ra8{UKoE(26s1F?YeP{H
zK@bILkPxIh24jdwmw<E(L?mSb(lL7UNC(oj(KTvg@x6VX<2jD+Kd}9<d)Iwk@9TV>
zuYE)SC4?ksyB1H3S(LC6=O*|{{+N_-5kc?mzQMe+GOKLd|I2B2?iMWtBDREmvVO`7
z{ybC@eOFv{8X4~Q>lVwIf^5qxG@6)2U;_3D=T0qqHhkfJzJq`QdOc`j9M-+$wyAlF
z`us934WOH7-o4DHJfXBkLfOW*#V>X1(mcn{EHSFFt%5ULcqCpG#Z)uyMm3)ORklaU
z#Ti5mR&*%%uiXd>(pEawcC4GCo*Wyy*z&x;Mc%5JpnM6O|9K2<`I`9h?L#3J{=rkh
z+cpb(y0R8E3&CZ`i!5U4`$zw{^{r$14y?q=qwE5`Sc8%CDT_$F*W`8>R}2fZU3NP1
zWH1c0u+snv4<uO3^-F5%OA%AQ56K-2M9<VwXE3y;6Ha{K159OeOj?e@ab>?0??L5n
z&aL14&Kw74lobHqIL9W-D$inYQTOO%N!^cUZ!Tp(hYz!=^~ye!TX1v3l&ONp&B~{U
zjCIvsm8$!TJ~wCarA_w4g#=iA!U@Ni`OU#KJ=z5vMPA`uozWB?fY$n;d7(JC6OZw|
zKGCFRbpV?fWQR7i%iB;c|L8V*gGBAkZBI)!*vL6393-omaHH4${;5#T=deLm8BO?i
z6Idj>+ytXA#{=_vr6m0=<&}60{)?Vqwnu_T^~zLqU)OG9EyyaI#D?BhGOzO7oN#7g
z#FZ!0gKSEH2U{#kPv1aByM+GA+&;x`f(}Ak)L0GDk#qk2$9@-a?mZ1oUU=1pdoC8B
zQ2nL$da4^~ZFg1;WEBTslKR2)wtpWgwQmf)^qysRX+DgtFNjaGKR;u9XZdM>22%Rk
z2)s23Yh~LkzO}A=SSgN*^s1TU7DoYlFoc`tg{#oV9;N$03UT2At}kqV*+bkfbJIM4
z!W4^d3Y%e3<g1~*Ps@LR7J=ll=&gsn+SL9nS@2doaT+yv__J(=S(%NWuwYr~z}h6<
zKppfiKU-4=cQ>)Jx>#C4t}uw1GIi>SFUZ=!NBugjAI)Jw-K-&YIsA+SENK~1w!dqP
z?jm+SmGo;c2>stI0EyNTbwqgi#`>$zdE4?wj^b`6_@&iCb_klvOw5aPqgE$Z)i>5d
zALpMc6_~>=Xn}XGZ{Lx6aGBvr^9hdAv3V+}cBPrV?r&MXYF+fa|C~o1WXq?&=*phl
z@j>yt#^CE$V;Lm9*i)W>1Z0+mgu5ptg{e(-=?`7;&m;L;bMGPXX+CUPOyw6%&7Err
zv$YG`kC;4!H6abq%}I8PojmP%Z{gU7f0fm?62KhmAA^}@AI2u~n~xg8Za?y`tzacw
z5dT*HQfb_)tjeC1n^X}vQoRUro5^#3u`K8)H2bqyliV3!RrgZ&Mft<J*8nc0akT5e
z3uG<#0dWlCOQBuqF`8pht}_wr_6H_f^kZnSUZUWon+2AF?#kpj_&L=FEa%NAHnOTX
zqYmVM3?HTuq}7O~^*JDZ-vWr_gbTfdNx+A>Fx8FAqkA*R#!K8be(eAR+GW)D9Gwuj
z>wQ;^4pUIB^C=^3gDLqJy@`i)awoL$wI|NzS;=tsx9TUii^h_5>pY+ON2u}4o6bt9
zRFmO7PlsD&6Fo!HbX3&4L$Bob7rkm7(GZI@nDskWe%`}+IX)RNAWy%|b&wM%Y}ebv
zj}{6v;z4uOg9a6dA2#b}l2fhz7$)#;Y`8Ss@FAR2g}&2$z`+2fkQp`uPu$kNMXgVA
zcq~8iU#Qo>bT!GE#xiI@c!b4j7)5uZ65n8&uZp9N6msT8SSsEhP1<w@us~v`b^^|f
zYD(XiF~TEjeOoTqQqrSb+ZIl({-oJH7QxQBhtWDBM?OOPb<dtFEDGg)wTuYd3kj@z
z$}T)#v7k`0v`^6Lq{x~FDV8<evgPu>g~L$MU&QK<AY_Bp(9n^5B_If?6e20kwYt&H
z3NACPp5(%3dP)r{EnM2H9p_86_-psREw$Xrja+1_I@i0N^9=g<IpMD9xY=?YFK0bX
z;Ig6~l!HX^@lBO|%(p!^hk9DMy)JB3fO3iK3~YD+NHbaVyTFG)UVI!Pj@fD!7gO4j
z+eDo*r*82}`Zv2k310l*U;cXR$jm-w`*CD5Q^ni@dS%Mwv`1$ehc$O+yXcl7tnHS8
z=y#%itA?^^f86&BNss#mV1jq&k?!A>{#-2*1yJ|M^~b~*;UVMm!G`C>iZd%MAGx~P
zbz$Z?i|Ijukvu98W^0P{+s>!cUBP9ba87YW`mpULh94Pz_BAMgz>zxu@e`KK-`E#E
z{F-uIJiY>Cl;c6jh1IS}@3*267rk^zz&QUlU`WD|)e<#7y@%J-hOU@+yRGGanF9vp
zrWG3EkcCiKA~FD26!NjtACs_i=lu6`tKgQKJ+|3l&WzoVC-C8Ira@)=rh!#Hq>k*J
zYfhY~?<Euk_O0LW+Sq@?!_saZ`GKK?oQP@u+WXXHY)pV8z3iD<?#e3*w~V!~3vP(E
z(w%X8@{Z?f45RU{0tVIxH?s_LLOzUHU$`u)nj_784<&c*OlwKuq4m-9zkFRyA*c3u
zfcyQe#Ky~k3oF?92;0hlgkXzD<sjFh{jd`wNRz9Xk$ZfIn+(R*#}s;Jy9swab1zPH
zw-0Dwe}1xIKgSyv1|NJ5{m!UsZ292q!GF)o6M9a*j3t#aPkQiU1e>f=e##ak-w!$a
zqOkg^$>*ERTQ-49Q1urovVzQDs%~ioa41_%O?0~nI^P6<okP%W<tuwxwXDApt@NfO
z>xce?iiyVzi!C$N=oZOXw0hW9+`u2xQHTL=p7Y-=x7FcW4-XVU>%W10>)hUtFOCWR
zAZY(#aq8_Ln;(1^mC5HViISjZZKdHSWmxIqSv4+w1qhG-yjg7;9v$Y~$d$5xtMT<h
z`s%&eu_5XBw0*vy{C-GQz*{rK%vlO+d|5>D>CE+J=7#-DFsDmf8pmMmyZ?CRp{Caq
z25B*9=;7X(I6{q?A2YK!7k-X9uR6FT*yw$>|DZ?F<B5et$p(sNUzB;iI-K6W7e&2Y
zGB20CgS_RM5Xfs2lArR)d2rLS<r*MGsbqV&SCza{d@brC<@<WMZDttr#{A2v71zHy
z^pBRBR+j_cMTCsj7%d}R4AxrpBej=a8=t!;CMEgbQbk$>uX+D<*&FF|Uz9^B8w&-Q
zKhk0Dn=Ju*BF)bR<&Rt)Pq2Cv<1_yx#}ttT@}zVwtQFq>HB5BTP6-2U@nESv;H7cm
z@eiGs=*v)yHEz_nX$L%6se}mGO?|U^*(P@g^8S;!g6(R--8tB)X}|KR<3!99(HmDA
zayr<oNL8jiE6Y6mXo9GHOBOSBimZ$UpT8Zr7pOytIeolJN9<y@x%lQfa_o#}0R6hY
z5tSudjr#Xb&lQpS`Ezw<lx{Evga0&aAqxJ8t*?w=H#=oNNYot(CUU+1@@1oSz#mjV
z$Q+z2A@8wN+{;y#uBd0#<R)V07%k{hlXtE)>Xd$9&&p(pkTJAnk~W=Pi6My|0bpaF
zPv>w!R&d64GYf4oSkrW>K~+|-f#5Z2+QT(R`V%~ukSo~3cc<p~-?qjJUY))p_#tvq
zrhiL$S)~c`p=a?LX<l!0(CpBqr3pWz2DWB6w2+-NTG=0XE$5qgwqw2AN)_VG6&2>S
zS-b4W8prLjHxZ!XO*hv9=>nQC94ZG>!O{6H53{>HA~>AVOn(B=Y<ks7&i#KDoC%Kx
zQR|SjQrwb?g@oh@=$hjlW888()|6S{c5oPTClW`z;5}=}3*2RH*U}xeD8OD##}na$
z^w&?hyzU-&1mz6&e`KbccqTHIc0Via5gIcpR-cK_PxmJ~$A`FzAx*dI_RlG`9Mcs3
z^wS8Wsy;Kd%#T1AJ7oXiw2qT{mShrXYc<-~xt2Mp2*?O&z~Rc<n*>UR1D#7fx0{&(
zl=$9tG56G(xHfkWLAr1%A$cjD2!tqxGB~tGrC%(-a-G1tQceU7H??4=W?K0g>>8AL
z(#oH;hIkooa$Yj;qve;mYgyIA<lko@v`H?xjn!Z`nUyc5HL4<Sv}DpY266Jsj(_ht
z>^6T)Yh69~4=JwTf>4!M?IrBBjI%>G$x7@)H~qwMQ(;(U#$(@H#{_w3+$ym7Lk|S|
zBEpVAGRFR1CeW_ES_HPJfTvpA1_9-(t26Q1Fonr=9EWn9XZY#}3?>&>WM@CKW$|i*
zeO;#gJE6Y&UBa#eVu3~2%Rd<8-gY2a(8Pbr^p#0RUhS)%bCWs-o?@eP<^fZsfi$>*
zP5Ip7kZBG2W&tRy-B-DYA~|ioOo?B@G|3G=$EE6;(euZ0NV56!K+jQ+;Q%fM46h}Q
z{(5_u1RnMHF8=6qYnLzh`e$KVExYADb|!V?0S}jmkKo5t-1zUFpuJ`8B;P&e4-%NU
zI}IqM7|~bhImV<eX0dhY&tv|QGSQ;v9C!^v|3}U9zbWuvMJLZBKk|Cm@yf0M0<(E#
z)fm7eQpo}6qLmjnn}Mqu02IzaMnIVk@jstsK4Uv`(ZWyrteEoBHTFwSl#G*SLHT5R
z4aS+h^d6+k_i3N#@>%_f)9bDIsfaQB69x4o4}}-rz~s49F!o~S%BN^LSMKZDbGyZB
zYpJpB95PF}{QG5swuRfk7d6WkChACt{qsS$df^rF8zV|YgEB_^B1dCX*O}rPRi-`9
zr=;1Y-|5q@NjWXrSSx(2Lu=`me2HN!g6*y7yMK?#3|{^<dFCPu&!-!{7E-{Je5sfL
z({hb|E953Ls7B7^tJ6`9mn#S8yr|v@f}<c4dglOAoq8AJ1H3j#7h<ndJ!2<bMdwmC
zS|?3lsXsWMqlky+<Z!<zznEP3y47TBv`1?yzdoV6)~muHX~U?cu%s0DCQ!x&wpmAz
zIXOh)(AqZXmjg|_?ZBxDOmDQn9LhmD2Td!n{uN#$uBn<K*Qf5^nJF4=jDQ?WjOu=`
z0K3?4RuQ~U?u*YBWc%6oD=kGE*!Oh0Du9gEVrm-?XhCNCG$)lVB|vi4GR&X#G@&=4
z@sW2YvA~KD^QYYsWqM0vzwJZGOIoO~m>f65AOxYfwnz+L(nhDcEx{U%-bZj&zJPH}
zwSBo>Ao@Z{oyC9E>yi7znqhG~QNGNYX1jlOI;c^wZiSEYozCpZDf|g^6SBaWzfs#1
zE9WX++L6J<K={#!TUG#<M$_mD5W}_G$qgqsHkjl&w3W6z(0dN)t0or13>0KRmYSH1
z(5MF(w`tte+Zy@#z4>om|4FT+2Y*xc^?%UxtcAPnm_hB3PdWdx4+H%d!1AM<rT0Z<
zTUcbQa$t<n>TPwAwVf%_;Bv6RzTABeF-}0j{h1p0l?uwLUET%4EL8u^Gfo+61qe2e
z0SU!FCWqp++l!JCqQ?P5r9sY3ZDrcG*KRpx-v^&kr1|QqSGxL@s&57kZUW{Iq0VBY
zVx@Lu-!De<6iB+~h?I<wHNtb`;A-?(6gi*0Xi=oHKRPi^=>ZM&e4hwEaaHP&&9(*3
zMc#jDuH^R=(cQ3d*%qx+o=D*`RA*p~Db(E}xD!3!9hvV${uG2I(YePs!Dru5F3+7n
z;crEV)!62HAd6Lc!a%-f0>_UGt$C__H<DveZbs^19gHwg6KhK3r$-XV;Ipso9ymR2
zDvpE(`?Ht&0oZcf22T~$Glax0vs6|PoHtTz`Z)HrLc~TNEE&;11|&ScoGzzLg6r-c
z_q=~Qbw-f{hDtV{>~Fwky*Bro4Vm!JweG}=zfyGnn5<#sj=$&ap5A8*CZ(mJ{U~z{
z!bBUth&hpEEfPwK4%w7O966Juy|MZ1E!R&>>t^F{l?dp!0Q?)3VyFJz4HpkL1c#d?
zADN4{5V+q+<f2!Ia$wBV8CvbZ&M(fn&4TEnKegMnJ9lW`57`>F!ruQm;iNXs;(&MN
z@Bz~=9bPrSlnm91{YqKK=O7#Rs=t0doTF8X4MJ8x6Cd%!5O~!YYUAckIXmdKNq>gM
zsJ5iEato(vu-k|syPuF=3AK(IK|DQC5&jvxUrBd#Uu;;r1$=bik*zvzA7~W2(6dvR
zxPeF4*&vu?&0u_Qa|6UseCfCA`2cVspgdrK?E4TI@m0119~FV(c*x3b3jLp?>$J?S
zNhUQeIDnhlyhloXkK=%5(qtnyU>)#=rH?Z;Xcy>=w6ghBJ>O`1IH%a{FAz^?G#W~Q
zh#uy<2wa}jGwV=AS}n;=mcQ@q;cLIp_(LvS)=+=Nm(ApzS!vZi!mT%+e%=*4HcWR~
zDOUFolNY-GIa~ucxq#4_aA&`k9*+c`?4Q6dlWR4+h$2dh$q_$@bU9oiz9?&6(=y|C
zrOFG&YlKHLNZaHdBy`-&y64+=I~IJnNj6ZF#e`sYjeO9eGNDI%`6(wqA@`aN_dO_G
z+W_G337t)`eWBu*0Q<jLz_QohLHqTLi~6&k4e7v;4~etAHb{#eeaT=7`q@cv^r9kQ
z+ZST9dH;Y{;*0z!1GI%MMfwGxpsP#{Z|yj+Rq7-sOZ>4>79mMg5rdwqKU;=4JKj(B
zqeAz>^4X5}fR3$p+w3|#aI+-dhZQ;z(<bD|fzFS7+fd)`NVTdq{0~CJv~zy%xw6WM
z&SlB8=@nE8X)Zqo@?V$rr+ct2y_mY*->o}-^YNN=<Phv31jmFj(Me;`&gPtamvCq9
z2VqQiGb7zSSDDp+=hw|-Vc4#=A0@ED!I$n}=mw^RG_@7m`PPsna0W)d9fx0tfN`=X
z2ncXKnc8>bR(2{7+K{c`FOyH+sG0P0;EeFt>G_X%n5qU*elq71-SpmV@%D4ftDTUM
z+7dTA%7?!FI1u1M%-#7pD^980D)SnZjXILsG}wfnl&@Yv#kd#<(svSW?z{dmD9nF}
zUDcoV3>#_SYT9v@dyaMn8)U=(+WE$SIS;nb87H$a1<H4sk804(BP;qPX_v&8M^<Dj
znlhQrNooneP0%+Ks;!R{cLHy*Kq#e})T{Gy&Dc?TNmkAT9M-h)O4FBMuPh<T`RwL^
zDrpd#X}i_v5e(7L{fS^D-F&QQxnt^j8$*|<rBrUR$L50D;D;R!@MD(dJV!F?)9gmM
zy31$_z7svRHW%M*B~d>!Xv<yE5T_dV4<1t`2OiLwqoWqqE4AAalpx)EiQ=dZU}JH<
z(?d_v8h&(RdhVCZ0>kdYq<OO8i=y2>{ySE{)l28fG#hCs=BrU0x9rRrey(5a_-X_`
z4rXd$q;K;Mwa>s)=mOTOA-2N4>>HaQ`X4Z1*efxiUT@8=$);2jA$uJ_bdz!ZN3q2|
z=w+x?@l>Yw&l*zQ2376F6#2Xp0ceP2OLed4kxz-TGUQ=r7l-|NvLQTEp&^EoslsP^
zz3m!%;JAE=tJmRnSyIXbxKE^7z$VMiW;G>zIdH&`Kcxo4BrBP1W%IS`+3q)g6*QyV
z+z!E{-(ig6J$;b@L(`bWr(Fv)w6Qbs-xlP;TW^<~Dq-iKNdARCopOUEaOc<0ngSa?
zV|j%|YZyTZl=E+1O5ew2If#M7XKrPbHl>@GY!4AbTSc<bNjf?`%EO0_p=^JK7a%|7
z{0=^3wo*t+U>IfUwy;(F1ss}Gf{bQ}gIu3-`t7_OxHNMN__9$8&_*G?#1xOWA}O=J
z3}ypxZ{I~K#f=Voyt9D}zTi7&lP*}$Mn<J_HaM1F2A%LkGN*oX!{uY&3B-xo@i_dg
zDnt^=pU~_OpBrfOAg}u!^O%6=6HJ8O<a>L!z0}A2?epskl%5_I;$9?^8K(VRT1+t#
ziX+<-+$<<F%XH0Hsi=Sb7tGc!Ceqv1MzR2%VB5`_e`4l(IAHM|&M|kPAfiMI(~nZi
z927b91^k7CgV|j0?EIG6;n_g*yuEe!hc+pem|D+6H-TzOLf0$IRH`h<YTsoX=wq<c
zGVnOHV^jy3;AK{j?tXQF6CQ&B22^=|i+CAgiQWWWq2Kpce(E*oyfp9Y{%}35ERMqq
z5)R#Ue7W?m_RspEZ~n+s>BzY6{71nkOkz4UI6q2G7MetET+>Tyh`bqv2lDdEOrq9(
z2aOgMHqjUI9li%&xleql?>l;Whz*vAHBK-3dMWhx>J1AD$!q?r6?12QV_o{D%3}gz
zWJvYbiSF^c<^{jaB3qABTSP!mLH0_>t&wjoGB1_(o_tiu`L(?DQ+DnuX&}ILST=N)
zGOt=~FdfmoKN|+T)Q58ANb^m5Q3zV}ZMI3tv;-Gdtg(ll&>P}zp7uh(*<A^`8Ne??
z<1Fug*r&-vDOkve`YB_GU}=MI?*nil4ju=lvNrQ5O}x<@lwGIEd4e>hJC~hza^5ao
zwV&el*acJhg6(0ud;Gpsgm@D9J4;0Ek6W=E>w+j!eBh6L23CqoavsZHP7jKsmYK-j
zP)l7Rf*fUql~ImicN=vBG5F_*!D(*Yv&4yi)MH?aKm*Siwi@D5;N1B{&5kI$qdd1l
zM2nM*unPeoX|Fy7xaqb<zn<A>+Zj@0JwoWkiT)P1^RIryr9@d1CIX~T##N%~;hh1a
zvZ^cM6Jufh0fI$7zp(e_zfmuhH4tMTHABKNgi3^E5`;E<xcC%hSCCfk*-or(*x6Yw
zxTW4vq})7$G>6b4zIGE@)j(>adl@blRb7C9tWo*CN2o+HiuFKy?<Hb!b=Ho185tJf
zV*<S+W9IYn11QB@ubHy#kFszbnPj)j67^}xItI_zu_6IiKyMXG2;lIDnoa;JT4WT(
zNag`cKmXCWV?QbeY&id`kqpo8Ske29eyIX%9G&fhPD}2fY~%tKlolXakI`jhyNgn{
z&MbsQ*U%~32E)qsue^fH9$XP{*DtrUE0*QyuCMS((YESen!Gg2!Bi#*x-#|5VoKo5
zROnNv6-{e9F{8A>h7hoS`db^&Fg-QMI9=ur=K07bX~q1Ck#u>=#TR}tMV&AGlA?1}
z`G&>EwBpYc(s8>*qkM>CT~?iE?xi|wcv^&z;MvM^-<qE@rRQ86*1WmJk)8xS(Q}Jp
z!gf~SvzV31>u0Qnpu^e+s~KR@#Z)-k_Mt45&KFL)VdzQ+VvVLlzB@~{2{O0DZdI$G
zVwt<Ok3L_dXdcWeI>#7n2b@U2Ae;W(WeAD!x@#r}FLBsINlQkVDERe%!lZB)<+Thv
z1ECAC2stJ9jkr1RXMvzMhWdTMGWBEcPhZORBO}ak0}02oG=ZA-`KYqtADQm%Turp?
zRKG|;3!6I67T2Y$<D^(Z$(o!t;`UQ-NdmlJiD_(xfrZVb8Gjbr7ssJv!pcvnm9TQ%
zX^+GI*gE;>Jp7cccS+$xyg5C({K#JT5sUX?=$)5l*7RGK7owak*D{PVkjMIQ@eem2
zOSV@xrU^AY!D@|^%m}5YO?yaaO!w~s|3+0=o_608aKrLcYw30Yi!zfO?&|DN2G3vS
z1#u}2xU3#7&}#s~-JdX1yZsET`kv~tKz_6Jc5*!V17s+e>##%{p1~3DrEf8lwkTVB
zFz|uSy&>(^l_<a)H{#rJRfaGUUuFG9^3~S2&&`n=Y}B3ctze#g_)YzT(bF#tAU{p}
zl&ZHxk8S*ww+k4X_J_+;J0_5u=IpZ{UVH6UK|ZpCYeN=QL|QV!W2O%vu!H&CV&k0_
z?^9507K_pqbNJ!QPU)CJCt@v=5Vy6|VeoYJ$=5fU3rBZUQ9h-A{Ri?8JUJ!<(X#d}
z&P+!AexD6Z)IwLIxqH=m_D9aD0O`2HbL0FY-#l6a;*>8_It=v-5n~t7PRS(6TQ{Cx
zGMo4@5RG;=+vz0Qo0;Vy>%Wx^Z+H)(-wl=fW1MPsKj_u0rt8XF-ii`y{I7cYol}|#
zGh{`C5hQV)bakxU)@)uukMwpI20<_|<~@+)w7K{z=T~iHQW|4|^_V{@iMs2**?eg8
zK=O)!mx;yNePWJ<SI0kI=-hO&rx#-rZ<0tER<<GvE2ijD7r)UC><s>{PWAF&)@69C
zy7pk8BcX4>TAfq|ley<qUC{X-efq&+Dxgj4QBa#>#h>+Bk9p{XU0=*_>&E>Rj<ztS
zjLmxS+Y#VGVNgVxAk$cKs$s;O!6dH4Bcrc%Mh;xL3{jp-*{U1BJ*=DVcPe{kbHwr)
zm?BwB<LY@h$Xi#r-b~;cXaR5fC9#;=tTXRpeRJimL;)hYlNKxO+}Z%|NlRYVt!oAJ
zuhh1iJhJ!RIwOpnxY~F^eS8u4DWCwAWf7N^VU>4hzX!VBQ_%9vq3p4f5C~4@_^zLQ
z458jKw}oJkEGk-x6e+3Ugcms533p0W`Fta)1$lDS4#59zWl+Q)DCGV2<q{TpGjK7A
zr#FB)j-3cBKrOLEi9d_EqTC4d*)=#-aj>Pkm~ogmFOb^C4qn7W-fJqGZ2L7^ENppX
zXwy?@mvZ*?b+D4jEmAUfZS*bWD?S8;q=rj|y>z4tE|6lDKJ@5900)TrDJniBXDGR>
zz(hisbud8iTT9dN#py$?BHpc7z+t;_|J!wa{JiBQW*PPWuRKI2xb5*`XURF)`;x8}
zE1f0Ib?@DrRDU)E88!j=d!r@Ke3u!NgsoWOtpLv4{}s2VZ&04DYd5P5P<L{=?gAxs
z1LsX5WnP=d4aKnN&wYd&(lwvgzI5+5W5d$__CZ>Gm)QstwGv_Mr1oUiL~>JaF*XLZ
zgx#M$5OJ(Y3TE)Y5!E$_#`BSSSK>-eu@B8kCK?vgQ_D896Nm;A2U_w^H+wS7l4?)O
zE%)kf2%)}QAyojffOcYBAer~)=e}PSyzWiWPf^<^;TG-6VL|~nz6JX~?$BVbXsgh$
z3L@h6;I*%x7}W~(V%UD9*$b66k$Uaxl>o<8nl=*)nDhi*`4p1$TS+`rL!Nb^u7y*Z
z@~h(;D!yx_F0grXm0GlNc$Yym90J_vjfF`W!cGSI7`%(_g93UP?o6t~W{g_o@u@Lp
zMJ9eLOuipwJrCmEmFyWiR|Ey-Z35S2?M97hHvk+De)mG<tZNp^vRJTSnaj173oW<4
z%s)1If*@P-(LgG?{&hR?{NxzR3DY#aeU<>;{%Lms68?ouvJs$*)^!^fg9ln{3e)W5
z$(CgZlJBiQmkYA|>`N=Vgbb`(FHG+MvZh2%o<)V#m!aX+L_{*NDLrd(9KmA`{4ogP
zjnhNgmzT|-4CMJfmmIY7N%`f2rd;aI5+o9;GQL&LG)bh$tms8e)n6C?xf%38`-M1>
zFa8-gtDI%iM4qB8e0YB{NY+$Qq2iIcPW+sB`G+!S?34h1!1S%&Fpc35hycsuMtrLp
zL3^I&JEE=u8GccT`MG<nAre~q=%=jUu~I5ndDgM)aI3n>=kM)fvp|l)`C#hS$$xMT
z+)#~45>mkL#B0~B!16daw#{db#UpV)^!c?dp|?)0oC^SR5Pai=Pufhs1X+77`IM4C
zR1osXtNjK~Q0GgIiULcNJewGI7VsRBecLVr1hJn;-q|XOAHVT2<L1%mYFzhgzg(c)
zbmvNp_)ytq`bpU)4BFF)=0(jv9gD7NTPX;OJ#|HJ0lwKY$35IKQ<nl)d%!)9rZGzu
z?&^Qct@QqxKPDw&ZvQpJ!~P)pH}RL&4t`K)jw@LZA6j1Ht_P)kvrn0PdNZIcTW9Ch
zmWej7%c@tjfi**MT}5g<;fl!mt7z`V8k!@*c~e`)j^g+H&h-F47{EPu0eZ`YDHUi}
zOvyq}8`tLValYSs;h8JPcYayAQC<X^{6Rg<gYl}xv;pJj4U#&4+8C%&UA*r24tUq%
zYSa{+sW^Rav9JjG?-^1%>HlT{({S^Z^baBLlNWbK<PJz$*g$CrixG-h<Zvp4BcoSR
zy!lBJ%%MNYvsl)|K~HlG2>}xOb*A{f^2Rhz$Z2AnwJmsg6W{(EzOIe9#7L$rqLMQD
zDwPJqn#a<N-;jlAem6)&p`rswuZ)3*-i|r7S2&<;8O4BaG~YYa2>X^LB~EH-Et_(T
zUs2^Bi+Nxj<?IT`3vJ(kJ@=98(ij1e)({ruJzeMF8g6!6yUtpE>9=OPa-yF@ukLlC
z`b9mQd5L*mf#Z1|{#xb9t5{jKiGzJcyg8HM3evm#nFI17rS$hkUAz3q>T~eUv`2jY
zzb$up+!(XJrA|rM7;^)!UXY{Tuvfuty(Z76b~fhQK2fT&_A4a_5g74Mc1$FKs%@>L
zM4oi4B*|XWU>3bP153^Tf8g7E(a$I>LQn+1f-uQu1}ZR5dGMDu^qM~ax%^(2){7ah
zv7pwkXbrubEq*y&+C=<XshDQp>pL$k<?+)wXm&rGp?@UhSU{-VOf_t;T7~RVcIA_r
zfWqmX)~(FQCzAd?jlmw7=PKZJ7}@1qmS{J6khtz#!k9-%mD(@!z;St@kt+Lpxp1zy
znP8rPhi-oqynU{2xJBoh@8+|cfBvJJ4PCfdCMbHLVR4Cn<-m2jH^ZepMBfwvDIAi`
z8*$Tg>s}has~%CAZa0|#LcfyOZqDLq+r8ILaGHtR=9sf@uOhI#Sbww+Fv+PhvRenm
z>=)v0{9Kp~+aUZpJLfSdM>+UNeviy)-pfanzp;jIjkF*Q8xQ<)nmV`X=T`zzMN)OE
zzOKLteBonOb!-2qHd<on>md!e)mDL+VxN2R9GYe<4Y_6O7>d+xr>ojqa~i9<W$aX}
zbScFRcYRxX6&ucO?zcxG8ck(7_ZJvJgG{R@Zml@M6~$`TLq}w=+H%5=iBi`s;!C)%
zAKkSlu=ss%4mc3ycLJ@%BQ~FAI{iqa6!<2M)?nyCJt1_-Kg6Q;!I*s#B!bb#&Hvir
zJDEnvyu8@`v%t9E2aGm?@#OK{wDUzw@off;?om6dY_p;_2EiBfndF9dAW-m5hjCHy
z{`W&aHZxV117OH&qW_lcGvOJaU*h**JErr$@1@<GE=^2XocVvGhrBrjo3lML8KJP4
z9l9&0Em6o1?73<uSa%+`fQV*<&$60eY{j$T9}clxA_411KpgmIp8F5zs}gV|pkJR9
zGgU@8s^0}qCOS9%^>cImN#M%zz5R4%R--Jp7;%nNfAC4o#QfWj+|++|S>CbC`^v_X
zevygq(a(<N{p`6oJ(>cAx}@=fahuoYUiX(&e^(SkTo%3krX1tFFJ&u$sQH2m|Kb$f
zjI+ydm;6d9Ayj1bQ>?Yc+3lYj$h}JHP@HGaZmhMV1N=qH5~&`X=DJ!hB;wLi|K0I?
z16AE$w)t1^FvPFhzn=LrwJMlS^ZR3UV&S`tDm?v@iH>Ncp1a1)<aOcC%>^f&*h6i>
z!JH^rKHEK*fCvNC9^7)Kd*VEvwjzGD4?S7nv`kw-AG*9>z3adAvZmcA!*Qd+JM<~F
zg|`v<_5O>Ei}{b-3|)huXJgwnZ)SYHi?HijyVjRt9>7!=1hy$YLoeN=vs~0fdLgVb
z*ME*Zz{+W^J+6Jf#OY%UAb6zba^n)i4dB%fzPID2Mt#A)+sBYnB;gZ~X{axbtIhu5
zbH?ELhN|u`rdl23z4rKf3hKe;Qy%zZ;`25!({62iCU=E;q_<l@g*+La6r<s{c6$Nb
z;26blkt>b?BgaD+P^_8ubu%=l#X(NF9NaRHJx(*4kyC(`ta7VU(@5<T##}o-Baii;
z=OUcqn>gG83AX>hb&+a#>WhknzvwDGk6{S^HR<s`jZMBej`TU&-s=NrGR*!t*2zgz
zg=vme8}QZVhDzQCs}kJ;>7wa1HZp4grH)eVxpT}<-J(ZrX#_FyPW{fEX9eF7Z_}mx
zb9nv3OGh?r3&)bD<yY^3{7$4)XP&&CW`>Q*&DXZ?w!GAz58@O@Px5m`ROwSR)}~}w
zAVfy7CR}Lp{<FZ_fI_Y{%3vvDZ4}dVo;3Mj?Y=`<<K2TwYa1Lz-L_c3G#8wz!Y+;o
zOpB!~?DRgn$qmLkJk;DnJ^qBJyL5q)w`MRud(bN?`1>qN643w0;%YsP%;R0USESM-
zqF0>Zs`8Akr6~AS(gWXj5Xi+b%Huh$^C_0#*HVkQ>|NkGN;2o8)8*i4e$X-)sudit
ze`h-}#SNjGxeo_InfCRJe#;W2gV<BR<i1hs2Rtonw&p;hR=j!HEA;k@d;L!<)e?e`
zXY9<r`{+D%>PW0;p^WF4{WthyBV*4n@ZpWOW)||Rxd->@v|18<Ov4n*<Uss9_2S8f
zuwk-XzKcz!Pp7o+QAmo?+!q(r)9Fj}DHrfqug^sqFCGKN|Ik?Gb|hRK^nHcG0&#EZ
zs`-mZ(RlGEUE`cn&UYnVwb;jdct-tv)M7s)h^@MvUkOrHK6zx2h3_7(V&batXtwX7
zzsZvdYsEUn$oEHQ-7!D#@RlwrMC$a9@Nb6d#^&<x8C2N+QRAJqtf3Hyqw<#hspXAt
zcRQfw_Ju4x{N`iF@pZnY5_=st8c>ecRhA0-q((Jk3{M{140#H_b3xiu)xna|pMV4u
z2_IzCh}w#Wy7^YS*tylzw>23Ylm%+3q;-^EXU2WSicY{k?3@<|!TfId)L1RO8|NoD
zFfmxGV`0-6x+MK@O6M`ey1ORdW1>e1V?V3E<bb^9tRs&B?x!!>T#V}A5R;<89!RG8
z(q%$J?cTc$d%?#sOghrx;-_J}wJyI*cloU(UgUmO)?J?cZcL+6%K4DUtjc<)p<tDX
z_~Zs2Unyw=BtY_>>B_CuB`Zz^MewJ0163low+xDliC3O&d2IZwzRo=7Z#(VU%Heyo
zy^$OCj((?F8JD$DP*)JkOV1r>L;^jktM<s7Au1eyk;*$!G5ZOOS`1W*%B=rsV;)we
z%x9IW;s^O??F@D-pVFXg)|rt!d$DlJ!$6Hxe2MG2scJu$&f*yTj=a$0goiX}TD~iG
z1;51eLh|bXL~ez0yI+9E*-Y)d&8>&lAJ!(^UVCpEcqMM-SgGBVo$?ACwCTNpcK#=o
z;a`Vb(~|qJLr#TmiTbF{{n9~@XrD=!8)KPGjU_%&OD$}q-f&I!M{;-pO{&t@&qeXr
zV5o_Rd&(GuO@(2Ewshy$)PQ8ff5|Kms#FbKC`?Dh<6}L`LCZP2x|HKfzo{jT)!gYl
zXap9cLBh%MUwkF@(@eI|<&jhM6xElI<<r!T*j@MwxbK#>0E_8-&J8Uz5WatBbB2({
z@fpEdmU58um__%;lKhJgo1^{zK_pcrxs-mxn&p7Li*ozw?6#{vYyM_<WO6?MWw;RB
zCW)VfB-@|dI23mw823$)Cn!E))$*n~>_8UGRfdq@`L>#KpI*wn5g*SF>%Wb-*JaeP
zcr;wIntCpq_3-_j8O3Y)@fRxCbwCr3t6_VG*e~2BzXv%>o39%eO?%T+4I(^hr!N}6
z>uX}^k^rc+jh#j`4UL^Bx4Pz*b#-zvtAe}R=4%L)r>x5^b~>9Ve$ofcEFPhiX`t;@
zxB2PrpPYvH+st!g2LL?hlz8-Yk;((}&-9$VAFZ_l;JJhQ>E04A4o0Q1;IXsIRPG1W
zH+EDwqz7ZgHYrd>iN7&!f6k2zG(|I6MYSkYy=KDCk4TESSg}_4_WhDixnQz<+3#P~
zk$+5j$748a?eX}>2A<-Wne>{8=g$M}6o5L9TW|Q5-6ArI*lz@_i7%a(NUcj2V6Scf
z!n5E5O<Yx6yYaGe=K;@IlYYYQHiu_Ew`%_umKPi9XR^HhfP4>^cF`y})@b{(?R#?H
zTHz?`Z|@|)oi;yNN$#ixm{IwHHvB6YcC9>KCcd>~W7)kl<^7z&No%`)0&O9QCvHvf
zR@{(ZM@mHC?fVX4+LEQDi#rTJDOcBB#-jZp`t`;C{$8%La-+O9-k3AyaSQ6bf7wip
zf@E^$7bhvx#$=1)^1R43@W`-jA;|%$V1=P|{;v-cFW@t3%J4X^ggXtMw8aaX?6B_7
z{Zt~mxvk;HJE~!e!ExZh70P2{zdaY<;Q!7wQ*ADJR0`+|L@-d@!9s>(@=oUt3!qoE
zjL03bF(RHeI=lqHQ9P3J9+zg*RvxxRPYJx>jem;RrLu^B+yRP2P{e<SL#y#a8MGNa
zcMK5zut`r4@qv4MiLb=SIP~C5ZQ%ABqcW8^bA9@Q2>!MEe&;Z(&}%7xT4Vn49^hny
z4}QJ|ShU5z3yDh(KFEqwC;g&lLpQfHqIR|Ed$e2Ib{S?bp$Z*6oUmoze-F^J9F+?q
z{}k193yQ7$D>r)*7~`QfLhaE1kKjA=c5@Zm3Y*@k{bYo(q_xVQPny<#0?&FSFOYTM
zX%qjHZ%3pSb=gy+xc)ELf}rg(Y$|5};kedQ=%D+XC*~kGYS-oj5I2UFEHO^IjDMj4
zSnWsbEE!qYr_{)CxI=3Wk);vXKHq5#1p82IlHfucqFusqU8~(9KuZ*?8EA!Ho_hD!
z?nmnmoALRu%_autI<iu~5?x$Iv|im2PSFFUBpz(&mmhdKbNp*X>~ucC!9~|E#miT6
zdnmv=C{11;V*mTosFrfRiRq%(?2AmEP5-MU<lMBkkxGjJZQTuzS@t4hpRmpG_izEl
zGu#x?d+LE^zJnGhM&oLs8~-3yhO?EsM^S;)lQi|yeh29LIp^L<xz$ef3%;GR2t$}0
z$jUh)O<gxy_Q6o;<DOmNX54rz)=M%PSbZMst;hzCa-E)6PyFn#<fo;}ohUeNB710F
z(GVNY!DpQ1koEnI{^hmjZEfIXecbwUEJ#@Fm_D<IeiWbWdY*6FoCdMfpM!;=1CBaV
z+`WeD0$v9g$E%N<KR;lH#Twdr2kIf#EZ*Rdh?tCQ^trV|Ni8JB7<<OfF*4v_&6a>r
zF?yGcP^DR^`$gc)+!9(F`RrwAx#HQND(<hUi-h8PtO4)T=iViNpETAEda5pOUh#sZ
zAa^%fgL9R71x>?i56t1pa=HKxkR}%(eVp?08&})6ehCMPO~I!qnY}OO8#dSVA8xKE
zaz5NqH9=`!rIIcJ{b(8F#~>5=M6>jJts!ta(V|=zMfW~G)axFe#%CcXji}Tql!e;*
z{R2c-uqE~fXK?!Iu`gW>hyCEP7}<XJ>W)6~d*Z51BHZl}<;C2kz=J$c&v?GQ?PDxH
z>Buhrhk(^}Q<|U|1=sELwbYOs`dkC9^${@9Fu454Ct#Zzv;WXkdNhZ`1v}`>0%~0c
zP^CF9(V8J`<O_dVm^HHkmex4IyDyuE>C$AI+G?gp{%;m=H{$hzA?U{84xYt~R^263
zyVrJh!j8bidj_D7L#Hn0BVxx*?x`m8M`7qw_OkIBh6IJa#AE%EM=~>;Y+BNt*5|y9
zIn)ws?X$Dpj&yo6d{NA%QxyX~EPs!saz0PzNzxv&1muJw7Ds&_W128a=-hT>puM{_
zsZ0ks{*|A&Vp1p2s(8mKvhOg)*J2Kfywoqz*Pj}LX9V0&3^1AX(%@6DhaL0d+Pfxk
zrPkHj40vHf&;C^{xi{|P{YwtnmArvDgQ|fhe(J}=v|18w%B87^gh)Y0k8T9q!OCnv
zEI+5y`}7N~J&v?8e}y_PS(d3fmzv;m%@(g@T|^Gfvk=F<MgR|p<oLETPb5|>onGtG
zSfH@)jFZm_i>qf=4vnF@cR%nW&lUTA<bDA94u59rf?MFe>B9vzL;zo96x@Dy7;rfc
zbBYx(c0A#xC=v_2RMly~k_m<B8ex2(WtVh~UoWpXWoL=Y-CM!`=)eG^N}zr9K*4AY
zxvEJj_NqIxO8Ipe!rg6Xk@^;Ep3~zb_A2SFvhVc)V|n|~Po+kyDUCbdtN%PjN~#HQ
zIixy{sH?voPECm7EXR8rzpH{!?{HKa9ly<nuHF2Xl9byVt1Mp_Jbl+0Q?utHAA3tV
zLHI7375P?7w@%`L>=_hwMSOZ$&qjOWQQKXL)Eh0m+Z%X4Idm%@%CDls;iU8zOZ0s3
zco|NoI*tK-d21tH?KI^3O)=C}qFTc>`!dcoRcz~02F%_FeU;CN9h-?GrU5l)l+RC^
zQ|lhp{g|x%bbOv;;En@6_ks3qHLr(*33T>4_G%=BpNB9w(EIAy!%*p|_lo0V!)>8x
z-{NOVi*Py3oeS#}Ss-iyD%L(Zy{~mc$0-7*erqIc!^}}q5FZJ?tG{bBYrc;>9+u>B
z`)RSsAQ3hoSLsF@Hkd5FR@ZK4vY_qczZqZibaQt@OE2w`uWW2(UzEc2<i@N6l{Rbo
zv+nB`(j~(0FAhA{C7n^eUjn~zXyx;4*#4F<+qz+)Bv9e|Wrg(z8D$K+*0J9Pxc@JS
z8;zs5US51V^RHoNajyW8Skw2qw@9vBrAjau#r<teWi`THV~n*6)AKQk=9$dM>hh-G
zA;{&5NaeES2R$4jj{U|JYo15l(;fqBFU{4e(}C-)^vQ;ije-E@`hD1D6QSC`t?oV9
zCYE1V*NS)rb`nugz6A_Z0Do4<zSq#U>`1s!ddiS&`$BtI-}s8!4ed<)@EaHXihXtk
z{39Z7+~(qA(|+2<0ByL^>^o-5OZq@kJQr!{wyEk{sd9AbC*V2Fc;M@nvBA$|JTtpL
zsw%UR@Ig7`POCgq*?Na5!}5{Yegx^*mf0f+TQoDMaG1L}aKWVXKSy_|Vu@KfyCWw7
z*I~?AY7nw7yW2XEk{Z7yYJ|1yLL>ZS3jQIEIQ*XK72=H7T)REay(@&Se4)Bw!DVU-
zS6F@T<RgPvU%+^{3)Jpz($23Xt<H)PmyhqU6K8BqAH1?>*Q;<a7rv9Y8cg5d+`wU6
zv^w<xXe2AW>bVby+co^SSuUFR3d&6Q$u^RavPw{TMq}q+%>QKHsL4F?!-Mnqr5K;i
z=d+9L{uaV}H2+i6x_YvEb{!XB6bfgV)dKom2^SFIvUl=XW<`60+CB}sT{NfnNYr1v
zv8KcVG@x&*vKQ(s+wkdK{|M9uH-A)VMdj3dha8-|*$b1VKASvaYvwB-keF>+AzCm9
z1GX?N&Pf3yAfpF`z9!Te7xrh`W;>ObwlLQ91gOfB>eTS~&t}il*=yp}cbwje2)GHQ
zy9V5_;TQ~BF1Ph<T7>tQ4}2}?Pg$m08~4o1oGETRZdLn&pd#ohR!%M2i!1@p!Ns>C
zPj2;#;OAI4gACxyXiX1)2-wr~eaQRv&yRqFx?hvlKtJ@BK4sM1SyHmwY?>MHnK_H}
zS-F%{0RDvj*F3lO-xmx1P!Syk`W1PzyBN(qGhM0>yBU@hJxVUQ!kGNSSJa*>5F|I2
zVWdxeqBZo(JoNM2YOtog_3J8IdotP9!?)6&#rZ8yk|EF%nUrxKQu%rIvT$X`0Au2=
zLbQ;0dssn0i%6yI4Hq`9lkJ9`Ty2{F8DYbI#&LpUzXM=>vQC7$^rC;8*<@QNXm%2E
zJqJ3t8T5vcIfEG$QBtat_qdA%^dQAA^6go~_?34}92YK(f95#>w-I0yAb%2(Y%JO*
zQeH@Nx$CoOk?+zbv}_E1#nxtfjktg053(#8rzLBUx!kr}oKpTyc0X)x$8lO{aWf=d
z+X+Z*mOec?jdxMS5V=92_fy=JEV*WuRc+L~E(csdai>!-6-7TZuif;|M*j3GGZr*o
zq(I>^R>o>~)P9|o`KrB9WKzj4pldx8Wxmcvr?Ln43y+M~T@<Z#{Ax4Ze};Hh)G}xA
z-N!GB;m)<><zUBaw$Jx0;K<mSL~Um6&d3m__9!HU;n;=-(uSNKC$1G7YavlfJmll7
z<5jvyo!(2Tb`h}0tkKl@s`mey3?ExJhR?Cj60{z!-P;ydjMTVewiDHU@J}pWp&|0;
z5L)>TA!>%?qOWCmRA@bGlh;PCe8iemv`RBxYri+DC4KWESHKsVxV_;v3@Cr9J-8x$
zcEti9sW#lAsD42vnDLyOcHBW?Zr1}Y(cA4g4IUb3Vd+H|Ss^%L+v`S>9-$LU3pqiA
zk2_IOK68hA-Qwhu)QbH2G;_C8k<P73n9OY1E14cg*ooadA|L#X+KIt^PmcEc-<ruG
zsKl)g9rq~wU6<*%V@fV&eiZ#<N*5)vt3fV&P}9w(e4xDYt*;y#&)<gH%AfCl8@ej~
zz!1fA9dd`0G+5Zks}`qqwv_+SWg!%FGr!FtG=jfJx^hsCPD<@(??{w*!dC1vUC?9K
z@?>9nEQ-#kpQ4zlmR--B1_p+`0*X}50QUv0q?&vXOIh<kh2#HJaI3mnfS~XZ$7$E|
zDTCg+<ly$zGNH<n%X)P@CeIBXWc!tL(C>V{9aSWYe3uLu66uav&B{S{8T#*{Jg?_z
z-5PlVoR-E<hGe_alMVrM_*4-0ylQ5t`3eINxK|tm^j<II0WzKzxY<PiQADpwy3rfc
zKOleY=J}_rx~w;ZUg%athTqePzb9aL^=!Pr-2@#K_h;We3KV`U3>PR2-%G0mAFlb6
zG@sKPw%#<1cn)|TAM_udqL6^HH>>Ix?2qs$uCK2z_IF-Yvm%Wf<cimNvpfK^po*R>
z)%FrU9fy4U_GnMxi2l_uof7~4n(<L#%-7E$4M9(tuJj2gf>>*rr7C=lCwQ@Mz+Ms5
z)<ahnlFl^2{(~m2Q`j2>Y7#D4$US(;Eh9|%loHP@#2WiqaN^bQnR>OdVod&6;HZ8h
z>!{i@>maIj`i4vW&v5>qrxmTOg+)~LObLi<-xi`D6{OUm+}z2>S(n{(#q*p}F{%<-
zc75&h9S&@b-uTy5T8ldIV}2C7#!AIPlzF)1tdAr18;!kBQ7A?Bb-v47N$1+-k?F}^
z;*D|UI`A8xcEmd+iaEDple1zbZ1Y;}*59bT7E{?JoUm96eXPH1^(@S4bq6}iL^{M4
z*_y9v_ak!d!Xw)F$e8~mkOzKu=Pn=GGOh?4R(q=R*xs8$k8JSi)S*1zQ-eXY^D8XZ
zEX4EvUVrmcC-4)VL4=m}5&e7aefRf7+74|aZm2nhd?+61g}I*}K&@ah3$LujG$d`+
z%(Ph*MpC|4-;+yu^Lt`vFtS~y=C}xS8|RQo?;6>T6<aD~6XzY@PV%g<XKed^*?;5(
z!l*dRS0{C|IDd^P(PtPL0f<KXUYtG;lv$%gb5D-K)AdLfp~~JUrJt|XDJdwjco_~V
zDlxyp*?8%%_@ef%N-g2dap7bQY;p8>pTn)U&`-?e)&^}U0Y)*N!@))WygkzTw(L;a
zoc>?R2?V_?{$9NB_^0A_Gd&Wz1g>39=Ol0zYMXBL)P4p{Gfy9jp23U@IGIFVUrOb*
z_@Du!;7c<QmCb};&_V-kkIwrNno)x~0wYY#wI2uWzmcZ!?Gm!9%4!HgWd5_t-}U>S
zS?}$U+*H~YVGmuO1JU6Ux<`9egKY{dO+zzl9j`Mpo*M`$k-OTVD^~j%bIFQJ0=EmY
za(K-vM<vv0`wrBf4UIhb-NsTH%VuU`T&Fxgir#9^b^}ARJD)CKRh0Jma|m5e;d6UG
z(e<{-PKsZPyb@+rT9Ek1ry0SQeTaS4yZ4C!QU5nlsY&QC3E^xKp>beFY?!05XDI2X
zEV<E_pvWN*qC6;hSmP-w8h7TyYecm<-E;A}jb_Xv)C0dyltbE5Cqk0TzUo&epZGDD
z^fqI&k4;>cJtf6u7na#qg{9q`U~)zcl$^k4LKhz-p?4!))~}(WSB@>S@Y?=64N3@i
z^}EQwS=LAW9N8ET-Qwzv6j3p%=WJYM)oXa2_u~L{0rE0$(WyE=$D-;}iy0mheBb_U
zIoq(vCOQ_BO1<x8F_Y@=6Kaq?>iPTwcSl=w24>ij@m!K%ii~lEcu5l`+sueYsGaL`
zn2o?JlO%PMbwpJ*zMWVO++u^S75=oed}?|qMrMd>t@fV4B|%%JcA8~f0?Cqyfhk2t
zy_4l$F-`)0&<z8j3MyZ6KeznLvF9%N*qoZs=hIBfo0c)NdN~`;1cKCjiH<#1weQP^
zhA4J&2C_V9{Ospi=t#ilL)j^b0j$`bm)wipxBtT;elB0e<i$PCuA9C}By}wOx!UgP
zY;}a3YFIj0bT9hxpcyqAp<5B2bWjerlgiuLEZ_k!&2rYTM~xz)S;k)5;H4(D`NqW9
zRw)0Qt`?T}M`^Gx9S7it3kYZ<2)e&EB%k_Xv#yVMB8G)-><<%>SDX4Dq;I`TNv&7#
z6C!UML(eOQ)-*A%wk5gjrH=%b3(|h24EaEa+LgfaC_0J|!qQu<cY5d~XrjI%u|qqZ
zZh_$h+E4^KN9V;6UTJBqsASQ0&t$==`aA#k@*srmsH$Vp!F|)8!GAZ94a{25<2yr?
z>w5$wNkB^he{MB^b`AXe|55ecVM(`d+<)a=W?EFHX0FQAa+c;sxXZh&Os&k!9AuhS
z4%~u*ROZN;nJWjGnUw=a=0b6s6U%`U+_(`D+3@iF9mn$=$L~Kl_y<0GKG$`f=lOoW
z-ot`vmBt9M-JkmCeaRM4U#|?FIek*nbThC&m1c|)ALd*$CZPpv9L(MaO>vnZTMT|h
zVx|itt}4W}=5W5*svyUDACkc20PKXJTYl2haYA_K#G$DBg}@&%l?>F18Ro<B<I+Fu
zEbpeie^db=h1xg;k8-G6UC?GSwEnm~niqkMM;Go0%&+6aam=He;amBi6v|Khbmu+d
zH$iGdq4OCyRw=2-w#L;3p#7-!Wq)~<!v&uYgn&Y+^g;snrbTEJC4xg7cO`6!2Rnby
zhzf}=cNC7bas`u3q4!Exz87YS*=meDS9tFd4BoqE`v2t!0NIJx7vKFpEAgk=;iu_m
zfVrLOzJUvjjr6r^Um~pd`AVnRPL|ZyI)LGwUU+d%akqa@-p<>q-M}wv&+x{8b1Sdc
zBHZVO2Qf1V4`+kJ(=2elcR<G%rFJ!P4uQdEWc)O`&i4EKW%L$6biUQ4@v?<5_qLzO
zAJpiSq`(?>MT^<;Zx{V9QPxk9VXV8UD}e(G!<CV7a?jOWr>%+Ga(?w<YOnUHTz)wB
z_pau=$5NQwLHqNz9nY@nANDwLQY?O=?t{_B{kFba_bMAeu-50wZCTK{pyvyhzuh^Z
z^w|7qtC8n`y!Wp^y+<b(vBvCq^w!sNqHX(Zp1dp{xWdDrIB4cphyB@K8BNUn4=X<y
zYA@V2edBsAVr3R1lCP65D;Dp~NaqJmdzR5JGYs`U2%s2I9QVdo(c!LyT)XpgHbAP5
zli!M+5xLdUIfA}Ma*z1tO-w|-(LLDv`QhJ~4?bGzU2{0jw36TQUA5XAKVj<WXYn_J
zot2?-cItx`RSZll3A}m-vDIF1bP|BtapO`*f+hZn4fR~_G-C>2_R5~9tM0MYPz9a(
z-c^rZ=ujf73exPIRMUE)0$OOA(Y@=aS()lz_tO6h`}1$L^GV2<!3d%vgIP7|V0ys;
zyfb3qAQO`45ErY~gm0mAdWB3*E)oP;d{TTcT@Ph^Pm#Ob))e6#@*k43g4m>0Y1c}4
z2I2&B_PCX0dkW@^25LDHu#cyIByz6G_rH@5HHEQt5?ddaqwGXMKAC`$=TBZ4SUk}D
zynf}htE)(X(N7@(;eoc4%bB`(Ly!KC-EMF@s9>JjMIBT|B$}={b(bN})nx&C7e`Kj
zc3y33SuS_A7W-nQ{Pk`kYbFD#ejYdnLGE1Q#*r@?G<q{X%gl^8dK;82%V-f_rLn==
z^e*7n&Wg<;^erECA%1_7*`b3<n{=m~+vc|<N1XNhBRZQ_NhskKu1n)ua-b7}i}Jjt
zAs+tY4@`u!|L>;onTh0_MEWQ)`aVb%>YkSLr)1?0dGSct4Hghd8#a5Dy;&>w)bwY^
z%aN~BJJg1UMW3OIHt0)Q$3{0-?amV2JN9+tY7To@&@{UMpz}Efx}Pt6%7D#0*i|dt
z5tf_}l5T>w*mX%aRUW^TI7za9bwedSYnGFnbhEy+%7B!yQm`Er!*nS*z`G*%Mx_j}
z5>|>1o?SG`ARG$&ty#tCCcRZZF1@n<>hr+-zvfj>UadFI=+V{Qzx!n~#c@~`EUpfd
z`c9nsG1ksN^{t)x;xm%=;M2s#cmQBjeY&J+jmUA<K~)WtO8(`UELaxOp6~^#b;+}`
zUZrpK(K(7GD|j2T-3>|@&}=;pJWiV<m&T}I{hxav1P{F1OuRe|XN<6-P23SD(${2%
zSv7vUq|FT067y=eO?FBK$E8C9Q71**J8mpMA8cR*@j;1dQe>76&CEICOlb+kuaT^g
zywGX7Ghst*u60n4*@9#Q%D$*}DiU}u_Cmt@y3`u7?xN{2Eq#7#x#-vY<P)d1pLlp@
zPmce#jElPs8S9r2GW+fjg?4ng#J`!}qZzinxAnLC`yRV{Oj#5{+K64*uJv!dJnE)(
zam}Ji{8ReZ#2O>^3i;Bdm@K%w`?CjIF-`2?oNgXM6%*w<!_K}M?YwbYon212M3Xv)
zI-O5A50$cN7mJBYxh2fwI1%x<ghMcUP6}$vczk8oQxwc7#Qcjp!tE9CbvE(*)%JVD
ze^BG`qZr2eN6fF)TbsqSOv4u=Ipb9oY;_It#I|{j)A-<d!5n-fExnGg3}e(aeKT5l
zU2eB!O?|g};$zJ+bWk9}j9Ir&EiSFRHCkA%b}f<2xi|!Pmn@OE=NKl5FDCZvCxK_`
zmk2u-p>n06b}sSy3-#Ry_>SJ!{AL7KHRu(zbE5CtrPJoZv7?;m_}-3A#T^W~L5cl?
zA9v6v?nXn+E#^`Dh9_b{Hz#8D>0ofStl9bBTvF&j6w?^m6ggRy$G_}d#p)bm={qX>
za#7?MaHlZ>6T=aCCfk=FL{G}W{e#Ez9Qb@ZYHrp7*Bx>H&GaSz4#Z9aDU!dgpwHi5
zQoZAMLoJ+rGb8@JJ3H8zIEc!lWc}XB-O9l6w5)NlYyTQ^{%XL@6UblQ<7Cx_US+HB
zxW-k=Qgc`g&?DNuX|51P;D;~mdVzNRu{5Twf6Itce{h2jPU}%lyhEJlgHInl7Ivi1
zogu@9^V;xF(-`p>v!3e95BtGPa|r5$r(fO##gNFlc|JO;MOToD|Gr7{F`PVT+UQa2
zjTV_8dj_IoaCdT}BnniO3qQxm{<U=ITIItZYTvPAND5RK$(_Z>pj{RFxwpHL0l}yb
zhQ{%d4)1dI<OdG_x(#O~);t!tSqH&qjy36chS7&~=y?qTdgYuWm=1*u<Uzc)GX%um
zpuqp_pOkY*Gm0#~(c!G(_Xj;fh;+XQ+ji^a-Hws?msbR0>~H_I`_b$1vm3`WtCUGt
zIUZrr^DZ*|!>k;Mr5L1eXmzCc+HH6rC!WN8+u+Z(&@OU1kSp?NkI!`nkdZFXs-SQG
zRD#5ZH{a7<L>d$v{{O!a321~D_l=|r_w7r1FNulwY8bua_zy8B>(q0Ez=01n6}r2>
zj@*#a`ppUL>X%@5#YJhwM~FQyTh0(=q&#!FJ+SZDe{-@2gsWO}|7jf2Se-Xv0Lrk*
z?taKLR-2ZSf>uG#u=^x`wYcerCcw)N`leXi_*g0>-(tl+dXHe}uWi%eI|CN+iYsX0
z?2`@YZPO_ylD^%k0BV=$0eBC`=0^TuJZmUm+6I|5^`2uszWd#lf5OneTE$NiJ?}3u
z_s@|!rM$UckIWHmr=BFV$HNNha(Z@E71=IZ%{7fuVYCB=)8!FerpX-uSj!JYTmf8s
zjZ4NcrHCQF@3O2!o$o6}%rwaZ&p#@W5WCy7n+TnIZCUnXV)4gJJ7!z8OGYuwXsUwM
zi8yJ|I2zt|*d<f&fh)Z7+P>_u+*8tS74E$KrzrY{2nnUSITNRd4XfHTLpK@P^^_f7
zd_ghf%)MS0X?hCii+A|zo(ksYYvR-`LenceXiEjLE{Wa-(*_rC#45t#wfzvY1Y@^O
ziQ95no1`D(Ppa(ir1msIU`LbvkRR-ARz;+2xq65@-@tk)*jHKx;dS8g3{sDVv;g%R
zwe@O3CxYsgjESfejhL^X+*f>jy`)^+octT9EP<4*nLsFKIVm!?m20;P3^}kbgPBpY
zf+!uc1f|t08fo>^n$8z11Z}o3iG;PsxqSLJ(mLZOX*|}bwHV4hsXYwBZC;;hMV3KC
zZ`sr&@$(5MdLmlX;@FFJ#T`SZ0B03&KwCd~7sCR?g`mf|tjdvg_|9kj;nuCAc;y?}
zog2=_?QDI;zRTgQWpp;lS`W@?dIxD^CfwVm{DkoWbHc-u<3MjBj=PBR-?^#O{&dRX
z_;lv`#tR|KB8!gcgP~VTS#a*rApTRrg7Yur;#XKpAUaq0AQeL2;PWm?vV$kWlZ_5)
z$9RstLbHj=X9NdJj7*|0Cndr~tjSl$gFw9IIvHx@Nrp<I=0sW^m|HlMIB8j?4q67;
z;69yF?B<=&VAzYQw~Hy-FdadUQH-}mu8dHuWb$@&U66UHbjX;8<y6Q>6l^|e(#_r7
zh=E~XXe7aGGLxso7sm<AqL>)e%I%hK4t%o^q}fe%CC)<8JMek@ItZ54O;>|bYS;9h
zXhX-Nkl#bEx>MbL4w!>wzY%W7V-)%u<iRkDFK!lQqGj{_KHC?l(u`LF`>jGKw%eh&
zLu#)6jZZuk+N(R0vdn~0SynE)#}iCcS$n>8L&A9V%X7uIy3Uabc3$2Q9ZZ+Q<;dFB
zvA-tIf+Mz+H^C}}+Hz>_2{O_%H`$UImVsc1g8#F$F9<qp8txu-OL|4>YNqV*!KJ{$
zlnxrb71G$Ddf~{L5^slG%Z_%;YK=Vp-Th97c*;G)ci_A1!ruq*kmMJQ>62qGhUOYs
z!hrPo#9hIF&oSjY<kP&Ydmb%umKl#5J<S3?P(}+Gy$uu&R#<9M#8>AkN0u;t&h00f
z5Rozqg#UyWw$p;eKi?RUbzjK&C($t2QAS5Uf{AsfUTsn;s(S{8AAc~szz)b!TmIS6
z*#UPkG^4B8E-I%upJ(+#_^(5$KnzlwrDq(P*|m5sv+(?OhUTM-039dFc-?Fy8Ill-
zsaxO~A3=7Xp1#vR-FPfQ%z4o+Wa-I^P3SHl{OUj^hp14czLIrmD5K8e{7NryZ4-V~
z5O>(+jqEsDf4CNd-@QB5`^~G?Ye&$2?evpz7Z*V)3sek|N#8hCRGU;Cnj2)Iy|lJD
zx8@tY8?)o;IflJ~-y3N6Z4PS^@bU9GQ^NH_>^1z;?-y8lB+|6@+5E<yLd~1~E{Sx4
z=FM&#(S7T=vhtWOZD)etHJ?21+Z3|N;zlwj!TebwCSv3(-?;Z?SKJkKwmKx)Q2!}^
z!Vq_uXX3H*X#z%<&hF`0e9$Db`e@{>`oP_Hj9#YJ4(IubKpNRiLuc3Ncl36q(J@^O
zY3NHI=L(yvP3At_2^6k;id}b#_Y1%uh6~+gMk@ZA2CSzU&C_P{rK8WAc;wq?r125g
zLKpHWM<x?Yhjk?YHJ{+sboIwmc_~PBUc<~sdm%2TXG6R<|L9r>d8ha^=f2U#cSDhH
z?_!YR$n^B2fa7?DFciR1Hn<GbidQhCasBo97MPWLISpVAd@3xIU3^g4yv<0PgL+Ii
z0dAJp6cjc9`}~c;k!zNU>xW$S1j1|abn)~1`r+TljL}ogohd~*DSV}~yF({!<xjQ4
z&BAuC*}wntnXv?~^3($uZ<NG;J_kHEjOzUxK4ymvVQm5;*5~K*FCMZ1uI+<}<eKAX
zJf*e-^q(rDZ5y{Irxpu9uo>H1xFa~qs~95#>!yX8Uawyrj-+xkkuTfb9NbHx6R~ov
z6;9jwO29?CwSJ3;!(0$s%$|4(u70Iu$>Ac&h&PNE{8bI7U2^OvaCVpxgLMsosa<Ag
z*Wp(zBIhLiWV-B#<Sq^f>Uv7)#xR2wi6~#98kg&)3ralrpq3fU9HlNx)M4M=zx=xG
zuaneVCEoAE?NqZy52vWqTGVBiM2_iHvX&*fX0gbxt~~G${-!QG)$Yl)4fWmAt1^!7
z<#rZt2jHE|BVBo(g*wO8e_s^@mVd{=Vn++6&@optYoYvT5mNXeeg_T8+}~pZDAumu
zOrJvaCPG%%zQQWW2MiD}r#C9%GX73$cSM%=Zd0++0F*OEiaH4s9@RQ3iqN7E8$}T|
z=D-R2h^Ut_$cA&lF2BB;<vD|L3p)Y>ybk8LW$WF%Iw}<k-c1yVH2=T4fPkHwl_-U-
zDgw_dM`X5M+Fw|#i@xgXyzrcI&nQp0Ilo!|T$j#Gb*Y{k-cT^&yx^|R=07Y9G#^EW
zNIxIRD%%ONjlNu2JDnoc`^;L!G7xpj;gG4ACCLeG+QW-vB;^>8vl(uV{z5{X%%fdO
zUkm<DWa{P4vo2feUy<La=aA4GjW%9^{C9{XWB%=$^sef_c}1OdW5S<yzHN8b`zYBe
z>^aSXx&yaMzb=J57!Q80eLi6CyXyV~pVR(V<~&l9^ID5P5VA`i8p#(3Psbo+m_2Xt
z{s5uf^_2J?ld7W*-{j(T9{t=yS=ujAxj_)H&|@@(nE4(r=t9&W<mEEJ*IPiRpxT0k
zDGg@3rV?OIhtBugi{&D_EpZy!=Gzt%%ji?hw&==JJBKyRV(ZfZYCEWVQJ7A)G3cZT
zbGj?Wbd-GfmnX<g>$gP+4<~C%DOY%6%EQL{Ez%9Iket%ZRwkJf1*G<<!t5zWT!7?l
zw87j`EB->eqxT`P0;5~=n8^Z&<Plor2Vd{+=!F^O<TiYrOE4;TLA#M1hKqeiGV#K6
z0Kz(D{`myC=~EuDd*x*Fl>~n!CGQovJ#muX<OVFzL8r{_jlVaX&%^fg9OR@vaF%7K
z#grrq)*#GgV;N@umvV8`&OCZ%(9QZymMh+{=}KAMZ$(x>;i+-<Z|z6d`^|BgDJ}uK
ztc<I;Woq{2!if625yCD0LwxU7xyBD}TdGRxea!=y@Zhs0HuE4Hw>}%jA1pli>7of0
znFhFLu@Oi-n4&Ocq%!J<^3w=pCCqJK5YK&xMb#J~PeCTvU6BW0AV0#Ei{RQ!50}Ve
zGme-k(~7tV@38NI_8uc^HIs+fG`Y|05dP#5vr}MhH~zoCKcodPeM+2)<|}Qq3O=kp
z$cC=(ejUpP1d;Dav2|Bv640DEbE8=D`(!6La<lPoWg*OSH}Mur5NX&B>d1DR-P+E;
z9%ZBMxu-tc8&y}{a<-b&I9I3>SH`>y-FH53J+6Y_Yr6CcA3?PoW4tTaa?G=TN~n0y
z*~Ro*-H1_&SK|JBh%saS`)$4GaV~5*Ds(zfX_MQBd{K|x*^h6t&@mCUP^t$@Yi9!J
z8TpP=VPv!Nl{I3lRp_UqC`sI#p&8lbYipPoBf}M&3dNwEw|qYmY3#WuZ)XBara{{C
zDaNw(vKOic#Mr5^mGR;$htB*=DgPu1;GOoH2ttM*y^|LJEVWTCI<sEzXU2r~&RZ_Z
zXTD-Uj_8pdC^BXc_ikUgLe9YtMhLwE;!N1^v6opNa_{24YAB^LsF_nSm_I^A@cJO7
zf`X9YC{c+$m+FcX{dD(B&ekDLbEbmPVm=cX4sNZHIhE10&pl)o%xBpkcHETksONiq
zC!xGsr+YJ$pSXFZJL%vqiUnrZ#jER?Up?)rhdR>LFe{Eu7AlEnbaPtegz(%h@QBop
zzI!OY24PFy71c!I3m+^s5f6OM+uRyblJ8O_@0a6~?$-UjoOzT05JD2<0?E8#ACFE3
zbiO|x1y3r5)+tnM&^mJm=MFDQ-;=L;<LFbL!bl+%Z3^}&l52Owb^Of^j(q@V^}okt
z)loE)p4V)1=3}&5rLYe9VEsa-4|^rDN14Qw1|eA0u|AG2k}Cq#JLd@bTbX0SHHQ+Z
zEo-8#EfB%#Dm;SHmNc7#%44Yr1neQf438Y~B_NL!&1$w{9W1!D%oxx0YCHCOHk-r&
zg^V+f3UE*O-Coiwd^Q6$qlXUPW4ehv%_rkgok^2ED#6;vy7~fgPifhmsQO~KmJmdJ
zGCJ;S@JJ^y>jh;sEsLdje=WlSL#~)R@SrFcC015Dn?B_`Y{qBe{75p2?G4ua(?Pin
zt}8~u)XFKr;Yl9{IC`2h=(eTYg#W10aA_3H-ys>L85;IdswTIQ4}Kl3U%Y0LLcIfe
zUr+j>fjM0r-y~HQ*pyoG9yPjt@F_=KqcoEP>=dm<?TQxG{iv8Fr}eSNLUGAZ1P82p
z02|WVza2up4*zHS+ctglrlD@I;tfFMj}SjRHjnc(N+mwu3e#A#&ErR#f-W5LBQ@6y
z+xTlYEgi@ST4I&i6+#XH1;+S$lG_w{iZ*lfDCIv~){5e{F3X8W3jVj4gZ8*tYc?1f
z)HZapn+PUPY4~@N+1@1xkDZb6-zldonm#M60e2en%SNg<4~PJLuSNzhq^|_tSL%6F
z`{b<8^^1BhB#s)0NnF1B=H?yZGk1TE9IQ+eQa}kF3*VYY^K%UD49g5+lx@D}Hq=Zb
z3a0oCV6IG(DbGCC2kIgTL?(^|Hh`*dvm+}u-D|3>yG1!-sKd0X^3J_yHN(^-8r`~U
zh2Q`d<ouXmT5Tqr>%AJXE5l!eqT2RS%w!?l7gWMI;!aqEb>DiPT9i$-3H9B(2p)a3
zg9g(&9a-i~3|a866`XNta1U7#@R?wL-bUzL6&nXC{Ip(9U%G=bcw4dp6()0+AC7ZK
zqilaHeSUjU8H)~J@X(=izFC4Z;f=Bu>l|qi@KlK7ecDoAbi`Xe2h2aVX=ASQE#(7A
zCt|x7;%d_b5iEOxX|PI-JfhAj2hq@9hp$55=E>EoAktnN)FB4k1I4djdtAf@2}rop
zbE0Ln?r#N$lBc=72O)x`nlnY^;vHx_2ZZnCAL;-rqU52b+ptZvPVWbn9AEg={dhj1
zb3``Z^{8duH)xsRV9%lP&aZb<D^8spMOlYEJlE!o-87=jX^dTtyY&hzpkr9$Yk~Lb
zftHNY&e%2UpR}V}U-`h<Q90aHGTF`AR7N12-PuA-zU*PI;9V(U&ByqH`>!Wk;ephT
z_P*(p%15kR{{HUU2;Zm_dD4(d_-TQf@#ZEAz==yC7y0-ImKT<h05GRG&+I1X=e_nU
zrT?5FezrM&$5Z7yt<q|Py1u=lsmIHUZb^83?r2EMbaGSD4kdPeJe&PA%zb%}+o3}h
z1K;=E7g~rkdH#NGp3*Sj$T`gyDpF#WxsJM(zxsxiU#t^5ivReph6JRyCco*ZQ`SiT
zlXFWtQ}&v9|KM0i#h02EKcvg!A3zV&_y*t|W0h0M7r*S^qS;jqI#n=Q(=@nIPs_M(
z*J$XHt>7oQXB?e$Mx6tCx%K8@c3j~>DnqmtvAZu$(&Cp;?fZ{%nCt#6`JN*8sZz}s
zcOKq&7$lzfCMvYP+wKMywjW;p8NTIYqu)!7G_8CxyS0)(d`=T_$Z-+$WP<Kj;Ef&-
zy)-9ZduaL|IK`L#F?5z<PBpqoQXnlC>U4Hn;3TP5_mSp1>*6|Xqo!Ed@TU2LSjNJT
zKbM1VZxU5}Tk674&FPf8hGGt(Ps&Fe3mndeb{SwMKES`v0nH4vjVnvRY5we+6e=VY
zxrI%BTxCy52;KV3S)K>KBsBU%<im#F4jLvdug)8-mWM7-5n9j2XjTo6wOqU_-r{J{
zbO%Ii<%V_m%wv}m3ccC;F%$g6F<P@ScT#uT!L3?t-Um8u)vNrmK=MHx=fCKGYBJz(
z?$ZX}vr*{sw@O%2-eA8vowo>$h&NoPhG6N!Gg=?OS=iy>pSL#UT=m9rnre4G$}P@$
z)sZ(%sm#4fFI%X~ZGhj<fMwS|u3dQvgw1-xB;f3Q?An-Z`NjaW!=D1~C5TL=QzIG2
zM1`YZEVy>X{vLETM$({h`TB$$u@X$g$IJ6%n+-REkGj~D2`ttcDJBQ2Jo^K1-!6lz
zMMgsYG<hiR1Oq<;?#&Y->oZNLJAuOJ8&fxdd2(k(QO>LBUC=>}5?_%^#R;<S?wNKP
zTcl&?ywg#w6#7zbF^BuwvSLJTcT4n?MIag{JfM+!;)T-R>&PeQ;!=K+gL338#7dBS
zt&#>=f7t)d=#ZwJc1y334?Ffea#&J!o8F%;@gnj1^RDd-t9$LXUM5hYTIpHqMopKW
zM=j(tlZ>AV*fmX&xeSD82x{_-Q93!%jOcG<5WZ1XyOD}cA7A_(NjyN8e10li*rL&3
z;Yqx`(8pYb3s0w(M;d1AOq*myw_NSHH<ejywe{O=MQ+;Q^RXIvz85=L*X!+lEAuI`
z<LCa0nZEVLXd)%=`tOMMZA~MK2(yJcP7q&h0CMB5cf*<sOabB+qrd^>Fk1rs_kf?p
z<NR^v)PqW6^~%La;!iz;nKt!~v-C@eQNp|##pAdBzvj>(Jd)ipf2J$vO(g5$3!w4p
zm%03^CkgLQ-Z}X@*>vvTl8@70hFQ$!0_$egDSV7#pzaZ4_Bn6vN8wB--1>Es^EcnH
zgQ${$wX^Fw?_fh3x@Y5$cpaBME=`VXUqKukxsW%o|0z-u(D<%kCoqnk24CjUFDOgp
zuHO$AL|i=bj(a^&%VvzU6TLyLoVZkXIJsM)(rx=6#Z=17r3+178<_~X<ZhWYnS*it
zVn1PSE6g@PA8B&OGm1FSgbAlb7|k&m^QRR>b;xl3mnu-ng*xx97)3c;kjSRR{`@%q
zC*JNt;$gz0gO9MaiCVjERHMc@F^b7a4Qi)&!4|JN(TjEZg_|O#VY{X054IByAXzYs
zcg}lP3@I9MnYJ`==nrTm+J7o#P!RQ12-V_|KwXOLBQCWcTW2l6g8d;=w13yzV=l#2
zQI1h&MdqjT<u{ve0d)Tga`)rWWulXOP$}4zJrz9EPlr%vx7(6IONP;7hvjJO+k&F&
zv!nqIh4(dgn_<EGu^5R!O>G|zpV<J4Hf3X0teDMgt3t1{Ja7buQX$u-4xOxMQu+{c
zAW369a&0duMRZd+HGY7GA+0HlC6eL&tbQOKishBnRtM#Q<H&HjZA@%Ih{IJJzlzY}
zi<#6mT(R8KKx^c6IBvcyg_ro2)7Siu;?aVR7?UpfN^tttm59y0>+OF)XZtO4<jhHL
z{^WNPZ&EbAh@3T%TqK8Sm)u!vTs^eX@{a#uNfd+-Gaym5jAk+={kOtxTB0%I`zbT<
zM*#DX$=MNv*f$xG3RpZfDhyXrBB;SdD(sr<Y4GDE&sH>;5>}-qDbbFb?91U_Khy2O
z^bFNI8`ipcjYQAs9`wQRe;jfCO6y&LEqim47sQepiA8V0!E`k;?jcvlMbfu>ZK_e&
z(JvdisZHX{CYy%Xfz1|Ds10D|u_jjIPP3(<jlE;=)9)N<p6nmB(#+jya|rUMTh9JK
z^4xF%pcndR?a@x{5WY==3183>ReH<VR$ZD^%ZoPj7kGE_B08_xFJOFflR;Z~Z5sZf
za+v4I(M`=Uu-wnDzUb(=vk`))IbA;yM<3P*ku&H#vpun})Y!auDl+;%v|Pp88hyt5
z#+mh5Ht5c!q1G^sT=O`i7K?)Gy~i$M9y!EHe98Eg*dZ=6v;4P?bE~NP|78k#0Yim>
zbbH6(xHiAb!oq=>q`VaX4n?T0iOUBLHm%njg?&y`J5O2i`~~LY1+~c15&JfmhQ>Uy
z`n?IDnMK549<)=vH~pR%cQq8(=Fd$Kn_xv>%Uv=*FXSxu?)L3sgGW2_uu1$~KtwEI
z+eBbzN_ksgV=M_ZW}f%1oX_^h%QSs}@54+!3B<x0$xI`&<hjKM2A69!ZQ?_>txdQu
zd#ZaUnJ%o=8tk;-%clVcokeo&yd~frq>80FwxFV8O_kMN+(RB<CA2^)`GFO-yH7=t
ze|8?b*slK+<QruHq;!@<%7p-e6f|KIKGO^P+oN&eo_5&3!J10iO^BFjYO7CZYe@Kd
z@&?0X5cTxO%5Q(o;os6a4`T}e=ZP5H|E8!3xw~Kq3*?OEdPwuJv3CSf!wf#V^%7UU
zC}NegWTM#ZR#1r#ojx|zuWqc!9bE;1^Eght#S_m;rSn)n_4U0oYUD#M6N9!Is38%c
z!H+0z9zG1H*VbL_)r({e1~$|*Da7P%?M0yx-Nm6DR8JYm$wB`3eNI;@oH<}O?Lw}0
z!9ViSQgqB-oDi?W8%ze<$cM~{`u(XkoGGy^Yj5eweeDCA=E#9gewdHuuJ2BHg3S95
zTzJ3w?!(Z$4e*s&C{b~Zc4fU3T`wwJ3<52hig4MS8_XAq0x)wNzqq<x#@lUg-B06Q
z9R7Sw-mvnPEc4@2P9fHp<iBQLkrua0_h{IN68?-6NhTZe-kfya){kjMOHGr&Jamxv
z!<LA==vKr(1_6|(6(y_=9tPk%?w4JD(P2CAe4K?Vjf{PNN1F9kEW1v#M-4xmE;tu^
zH2?um62h}<-hgVfVN5HP)v5afGT4MiRhvd;Rq!4X!wcZVP_YFk#qvJFdz2f_ZGY2R
zX)i?IzB^DcN7!iG`l&iY1~MNk^*AgA90W=Io^EH@<5$Pp>nt>ObqT$dk~U$T9(Tqi
zLt8zRmh*4%O#Bob9P*Vmw6+ol9ydR{;W+K<F$g|r{;$=~r~xUHAwZ^{Zf5jnW{!-Q
z<v<(p>-+t$hG0WJ?r&sv?^h0L(LF8F%8VrTm{u8`oo}4eFbv<XZNd<FXvRUEYPJGA
z-0?g}spaTJRIxQ6f&)7j6I6AIOKQ)85S=#%YjV@@3Eg%*%X!U8e5OTT=B2|$d0W1y
za$0hiQkM*F`yi-WJXeX<4{ZFiS6COcz>9KUs)6BBu*`ed6~w<Vz5~Ua?{lM*-;d%S
zVW6mI5L{cvRe<-m?aD*oFL@Dv|77ZWd0a@!-u@Ar9A~rKGIic3A8Jeb906=%zbKx2
zNIWqrqE>Hi7)AFKrIUFBi!nqmXwzZ#ZjyKX_uWnN-8MEJDV+@Xmzw6;A(cM&9*`TY
zhN-Naa*ANbL*~kaG|M6o2hP1J0B3o<svbog(l%pU?#l%e^j9&_elo-xVWSgXZ|j%$
z<}|%R%}Nnw9R*Y*p)t5df!dP@IfA6&r5p<3KfW8aI%!t7x^z9Yl%Bnp<P6Avug1+#
zWTVu5$=7yka2eY@zglSM7#aw+k0J2>FyD7lwq?KBI!(_8c#6$gJoRx-VqeQ?%~;rJ
z*DJY^x1=R#`esP?Q^$)s<JAj#OqL5j6HEWo`O&9e@=)UOM(fvW*+xDS2d_uN6|ekq
zh~C?{y_}K1l%=n5)=9Qz%3C=HF`Uou)iUNqVxUOnM}WGZzO`3HJLVF<2xZXb;+ilO
z3+=-J|M}Q*-&L-l1!3}}`NY!t_Q;{Fk+xAY_-)ie0>f2Ispp#JtgvZ3a0j(%1^D)b
za{YurMF-)+FTUyD(aQ-)^2`mA5bjg@x^>UYB80{4%n$>$*N{lPDOilJm2+5;IcK3*
z4j}F>Id{LqynXW8QS$G?HL^Igygrw__CMteJ1s84wJ^qi{w;s~bb~?0$vtM+?iW#o
zmRl)$)@3=_L3(UGH0q_{xu)1{{vfC4S`qpm-uJs9QL4)ap<#<TQkDaC9|9CIVjzY_
zK;Qz7ZI|cE?V^d)1jyfu6}6r>_J+CN`1v{G^Ev?#bD%59<IibVv5%ARw)~+>EG3{S
zJ^r(iYRCArrF<%9HS_+zg{KeYalhF4jgM2h;w*>ywSt*^n}|3YBFA`&)12`soALK%
z&^$R)$e|30Qm4zb%KbKIJ0I@hfAK`fuWJiXj~DeRR=*^L`j2?&fi8WSytguD4C7cU
zf)R<i$?!9UUS7th2$R+cG*Rd6KZ)OHHfBe3mJ%hROWIK#mXJ4k*1#SVPlbfq#_p5~
zn0rr<#UT;@)IZm0bT77Yd8G&2aP#2veN~4~Ms3v!yRdHUAtp*r*TS>=4Fkfnk$nqF
zyo4_5WhcZEXX`Z?s4>O6KJTf7I2ejxyKpyg{LHoBc^67@z3RP^qYpP*ug59<`gic=
zMybK%$)e!_;Sw4b_Ivxc8>t7UQbOYrfq2|?GCawc-8T8#u;cR3o&?pld=BL;5;icP
zFg93ciz>4M#NU7iE(gQ<rL$*6!K|!ry<3Ct7^3&&Km2+yYEY2qQ>9yJWgYC&_f1)E
zO>reprs@UQIeB@i=K9LSBg04vt2J`ai-H$$a74yaVCU{cuqXnJxoKand#DoD>SHkd
zt%y#F=<UysNHhB8<NKxTLyW{~jJ0DogpwWhPR^Gd#o$5MhwuVGJ+tV~#p}2OAT*&g
ztX9#ZF+vf>ELODeqC-%(A(i6cvY}(_G;5{#wlWN@v+VcUueqs_%um=k6`k#a=q5pY
zk`P;4zZh3#)A2*2<X!gvT7h%D5R`-=5iYa2K+cI_v4wS~AZHT7#gb=^yG)k-X8du=
z(mx=BX<ByJ_XaeJiQt4Uhgpp#8o>6RS!r>5{YGW}o9i@aPZ@*!ylu$#Yplgi-+xCA
zoIZd)Z|zw&o8o%Hf9yxQQh$HR98}eMMbh|8yN7qC?7VH*zvULk-5sk14}hUL>`ikG
z!t%-#PZqe{549hd=B%^Bgq<(@*1nhNv#Y`cb`b!ofBs1IBcnV(;`L~YXGL)#dTwnO
zJ$E&+<afMr>qSWh5rE3PqVy7^c^+zF+^d>mR>kW|Mn#J-!X#bzpUDkNWE@M&cQ$y#
z94mT^Y$^MTxFcm0jm}Q#${%$*R`AUGXSVD@kpR6JS7qJOQ%J}ybKb;K0-1d>YXt4J
z*)elt^gWbb<Xoog$2+QeZI?uGhbgn>=NiG!|9A7FW_~#OcC9GY?X#cSxrApdS|~*}
zO;wnH=P4EQUh3qd^goEFf&l=k-7ChRFJa%IW2d7NmK<sI^TVM^f9W7n9snRqbaO$j
zZLmND%sXo%u0p24<vw@K120=&k5_rlJ=_ravN1nFM%Mvc0l+7MnyZBUGrJ5FU-Bcv
z4Eun4c`=49E+f%7hgK_F4G>_1kQ->;$&_okVm)fV3x&7D)Fm(XkkYn4lrb4RYSbia
z?;uiAK~0!7rJ`NCbYM9HQV&XL(?i!E0Ks-lFI{erj5<VDTTt;gzq&lw?IUbC>-g_d
zE!b^Orp3b(816fMw@y;4Lo9Ge9qdQKW37|-<cr()8Wy~9W)ek6(bF}g^ojdH0E#7q
zbHJCqP_!jN47Ysrc%Uz9uwr{>#NP9E!OOo1Ghdmd5@J$<nfU@Z*w3rwA`sX&AACyo
zx5U<?%tzl9vwKCS5|Ed&=1f~&{=Pe>>MXh$HX;8!R6aQdlJV^8x1~1Sj?MQ&R>X@m
zm;a(3Paa5C{Da*E64e)<&*f93hdd?x^zcK6p>or%GrC(j#rXen>$rz*M(_g7OwXTN
zR1{8BfOqRuJ{FhXt@W02!~-`(;v+8JpMQ$=Rf~DmF~gtncu9pk_;2jzg%-`5d6+`L
zb@uK(%s0^c<)RSJ*;hkLG^~?qyv3Bqu;E=}i6eE1vO}J~Q+!@^it6VSzbBnOw()|i
z3*kKXnv3oQCj=5v@&*X1__mz!dWsBEWT9gXEK`JrUG}YGD?dz@5qSjdSc!$(%s^3`
z7!I1wXFQoMk^w*#baMfMkTG8kCtga`mVD=JD&m3>^2np8&rk<+ujmsBlF$O{d}L!s
zh+FR5ZGw)EkSo-6PFF`fy<nO_&z(4Bo{DSQxVJgfZaDqSe5xmSA|hMsBFZ=Hs9n-`
zQG{tzm>0y-?4LWg&7AFl`Al0_!9tJtK>I5WcE1MZA>vb#QGFJ|2$~M*jB(Z|DIZ3U
zS)f?w2QCsA$3cS#PF{mKX*U)0pJADe(e}~xnl3qKAyl3RPP+SC;)O=iMVU=NbsJGE
zxNR$rX45qbCCL?+*2hh0d}gh4mZtrdx+yKU8>OFVb=^HwIvG=oPgZh6;}SVsRmFzl
zvU=TQ8AU?}dAdFJd;7{z5pD2~S5|BKfd#E2|D8mf_*<hE-i=}>tmOEAG#pVMXq;Pc
z5K@Vw?%0y=r-{cne}%6vOV=)X$j#Ts<6DG70JGJpOGx*2rTfBSd#Hkx2OJoC+c9qv
zws_fYK{L<NXm!le1zt*vNz$J_|JQ2VHW?`cg10S>2}*?-GkTXrJC3ck)bb&9%UEi!
z!Hh^-%7=Js%?W+C0OS~n`BW$AD1XbvUkbvDVYb{cgkt!ED`T#cT9=@^>r*vTgXXI|
z7?%{lV!_(HYUtQX4Quc>kmT{hO|~xwB^|i`N|ycfmi28~H#b`SRC6X`Lu#5n`?NaE
ze(CVrn)%Lne1|TQmXZ5#oBwE`qIUF5P1T=vI&t2B<+sO;Donxf%Vph4#kk9(>OXJ`
zAdGKrq0s|k5?}mTImQpAlPBBF!RO_dF2TnlpdI=qsx{9+sstC>g)u>Y!^{K4RH0f=
zj$|+YEa_B@a3`o&^{rjjl;0XP+-@NpFMD!#XV%G(X=AqJhhU1RJw62yJm2&QeyXW;
zeb#0_{cm?(xwqEnr*aLKgQivI9G6XIKkujcgGiPGpxN`@+ka&^8BlfjjiA6=h6Tw>
zmynXllVmVsJh8%Xu768T+eB2THdNS|$(hzzj9N33^He~cAcpR^p6nj|1S$(M8|z%c
zz%G0}Op89QjEDj3h&{wU-fJ*pr9c<MnP_L4ijq+?upC(Xm4}|CML!&`rE5CH*3fv=
z2Tj)KpFOv*pc`u^{D1zs78BB;t@PHn^`MF)wEmbccG-KqeXV+1@bueBq0LHotSE^u
z2Jc+K&X+bUR{TVbWQbp=ar!be<u3E<8Qc_O?z>cvOEPq#$6rRe-Uu878PjT&{hRZk
zpJhJ9Xb>OMzogl_FB>>M_w`=5M!0%5j-m*BDK5W38c$X(*(na_0IUq7($XF@r;&4`
zc_AcO@k+?47~E3GQB3d7zhNeLNfbwD|M?JNrA0AtE)(o^LiMML+rCW|^;8}=miZ;{
zyN3V2x&RB-Q~1+EVkmMJZ(TCE^)8n0M9K1UTlsvA)vv+0U{9?3;<sscud=SodUC#v
zVk*t{s8<|Zjep#IQa|_eN+z?|fLOl0{{&AA+L(7)E!0w@`K>C-K$p(s(kGjGkaVw9
z%+~e%)G%OKN4=L2vPTW3=0!5vgdEnLg$KpKw*Er#LsB5jx_0@eWWI5|IEPSi9J(Ra
zNt-GB@g9@725l5!OT~3owTS2SE_RQ0@Ww*iQC&j8!rR%~&b_)ea)`y_DXx-)H7kzs
zI?s<MR{CrA0!@lH1PrjwCZD-wzZ<H^1|99`U$k?5@YQuktkd;q`iq=W=F8>I<o3F3
zhT?~dsVmCBP;j`jQ=lS#8Yn6p-+d$iB6cKm;IoTaGUc4LU-M)}(V6k@5oZ@~U=uUU
z1aKIADSPl;kC;%!1);u5TQ7WGpJLlL$1HI!TBV=_rjPC;UjmNq&X}K`4t)pu5A}e;
zvrtT6;MR^N{ER*sDV<~<6GuMNAOD`2-~Lh-<kqk6r%ch8$9DOqi9%KjyfXAzS&jf5
z&^CXbl?R-oR!hf`4y!+9Ho8uh`dz{p|C((p8hL?R_>0Y>?-X4LtmFL!%nmj(n$^mh
zj>_Z&X#OHS(G!d$^POJA*YsTe6`QS`_C4_@#&oOHaQvWQAeypHA>=Yx!Bb>W>|$b5
z_z8+|9(BPQw{_^c<znIl*{k$g!)|rJUHsxXH<v9$BWTA`<3(eR-|l{X$C>f*oBP+y
z+<c~5Y4ZlzSa~lH>n0Zqo<`bTI<atqZv&xSsC}Np3p7bi6o+G8u*(&bF20t*oTxnd
zqjF|ArTo58b=v#!>LWu%$un_!#2CF~GkN^O`3r;9uH*Iy1)`y8E+JHjw<S9$0-@V-
zh0~L{99L;{%oE>XYLg!kp{Um7X6YijdQzfbm#4v;Vf5(Pv}j`$QLn{S-ojqQVBX2X
zGAlh4Yp8q6BcwtuB)3=@!p`h$-HSLA=-EHF7VI_!ACIXJ!+4H(s{iM8e?Stkl<*w*
z)d)5)1TnXLdHeU`;KxF&6>w+zbb<e^YuFhP3x$IpfMpZM%d%yvRje<c3p4QhVJxg?
zx0V@{$dxMdOaBwmbekvc9rsjljUBx-(Q1Hvb0%0Qta%ik=)eG+YmrPE$lAF!K!okA
z9ii9%&tGr|-q)=|_@95~bYx{L6}I^3+sLMjvFEN$l+OW=(#Q8J?B;LX@bT5D{dwxY
zPfk6+osAvYZq4usgMWAKxKK}@t!ys&J#Y0uvka~2y*B~<rT?7ffM@^5y<XML$66lV
z9DbZSARIwm*rQ?aeP_-N<8<kq#3FAb{U1X;@2$^t{{!G4VIqX#3~{ooO&@!sj{Ul7
zD{Hc>gNLp?MvmC}2b*IU|Hz!E(XqECL0wTc;J;r_cV)~_W=@?kr_oLH7fu7&(3<Ui
zlqw~``6Qq_xTIawME-T?(I0oaQc_$6l5zIVFjY_}`EYHDVL*^FuSyB0h{mqmTBm=_
zy_5)m4P!d?T;2C(8^vrg-TK`adXaGNO`{|zxPN5YhL6Tl4^c?nHvU5Er~P3IC3eVE
zAg8*Pvb*L_kMf)iBc5wO2Q~@c`n9(}+j=xKuVt?l80GqHt~-n&$%NS?FP%=aDZqph
zApkek1v7MpgF@!|w^#IvIEWseK4r$-+<eT9py1EYvY%~Ab`~!kR|AE~ZenM3mjxzz
z^Lxf-f2Jnw!o3o?XPoX0?OSg7Flzp*6jJ?tt<snHz>ZwyInZp4ecVLv5l8SpHt^f0
zifX^sKmw2L!fDo6S)+s-Lt^w&v`-f01&GOcy=x4Xcj|~yLpRQcA#QPU4BvnCLI>_y
z<iD`|w#$5B^Yy0@Yh2G$H)HWNHZ7<{^lepLr$-!s)VKEe2d!0?`oQ>?VpCIg7mXK+
zI1x&FH6(?l!bO#spsns~zdu=&Ha*tt0MDTU7GUwflbTPqXVr60EgD5+7OL0asD~%b
zg&qlNOM`FcMqeP+p@^x|Z$Mgpn%PNv^W;XY`2A*;*NV)D#UUjcEDruU;LqERjp@&d
z%|CGeQBT-YdwB$S=OZKbJDxu{c?iF)UnC07K!>05#jRciHqSE)fPi)3fT7%bW$v<l
zu!p7pK~SErAHy4YIXz;b3JACWsN_Dv2jry93tn`u&#Dc3(ddY0C{ai+WPuZ@xaWrA
zV~!iJhEl#E%^$op7k==8<{d%V-J}!g!!|<uLR|}?Z|on#<I;q?`}Nyd4|-!N5O@{W
zlv9=2vJc<yX%{|vn|H|&9t70m;~_C1l=A}L#l6|@akl%2zS^s`OyJTWk7}%#%AjQq
zo9Al4ZxdVGw&Q`S!4X7`Rl^rI-QMH_IfhV0V*R9?pA5<3#9Ek(+IeCmqLCEP!GcLa
zeZP6FQY5#({t$&BsliR7N`)o0t-3#2^R^<I@KL;*#U;QV-*j$Y?8VG1Y3(x-9tLsQ
zveA#UuyciS|KdW}+tY^gdWKG~yx>)HkDAa^$mv4ZyRHojYf~}y*&YcZLSL^5^Rde-
zKh7iCj#a)GTSH0I@iUWJdjT4&-KeBd7j1|M@it&tIcV(_H&ln0UbG*Gusz!VjT)Vo
zV@%D$Nd5Nt`oKOu7B;|rk4m$VQ|t^828&IzJm;=#wmIsUB?p=)0JhjOdD)mZd`kH-
z(Cz1E*iy`En=#O-zy|V=AoyXDO{h!8!#t%acN;Q`x3%9T5c!eJ@-iZu!uiNpuTW}M
z(PM=?@}fm3MTvPE^v;sjprAyqPT28K{mtu>V58n7nR53`wZaiuU4MlkwXfnqu;T{P
zTPl3ir|)fe6y57p@2ZW9U3llDM|7YK=s>dnVSS7}t^Ue^f*2vYT!mkk>})QWbbf&P
ztFGHHGNx;rcql_vW&#&PwrHfdIdu_M9k>6T#it|4_^d=8^E8X^Sk_qt%W)3e6!kMC
z%;X74n0Z2j@=zUMk-^%2D3r%dd;uIIWPC~jE&DLf5(IjPjpsaY3xSeR$IsY4FkSD2
zVtu!fCCswD65iWvA)IRntTJrb2h0M`LZK(?{G&75O0%`05&Z_WakRROK=@AH<aYJ5
z>Y#QNf#C*o!U@Hl6;*v26Dzm9MBHDb2uP$9qw7^Dw9jO-803ePcNy*UsMm>xFxRr_
zI6&GL5r)-0Ra^w~W3ibmn-&`vxM)=)cD@?spvWWHoBB4W1Ra6BA)E{KPsD)8B3O91
z0jPIvT9gUmymBMH<@V}2;1Evwd0m{r=gWpJ@abTz|JHf3@VqB@CAV2CJ|T1y+dY$I
zI6Rfl@v;YU*%n^19{rhbFE^d+GWu3=^BwEERmB0{^iG)&y`>y|Nv+S@AEV6LW`f_W
zzswrcy**W87@>$k;<^L73|SM#E6$>DO}&m-*z_zMNI~kwS1I7bB~m)n*_f8V#Y>_a
z@uDmijhO5b=LO&7x7*3gXaGZ<LYBG*BOlP`Uzh8YFWEk5YYUx@jSU~0B(Ac{LtBNB
zZ08xMcU|0DT!aQLIFCQ<B)HjR5TtAqwir%Jnw-x@H}!9*ZB6O$<Rj8ef=Fgt%|3*g
z5aK&r9$HPYmVRmqK^-5928{Gc%=p?o*-8XLL^~%p?Xqi6m9`#XFY`k1&LQnZWw?I;
zTRDjN{hmybEFBte%OIj@>OJ63qcSq;)`$*B;IKA#KMzd7&IxlcIf?}TehRs6yO*2u
z#n`86rSs&eTW_N?pS6)O$&w`ap0b(nl|}+2u8Rp@bVS!39*VX=Z0JkY=Q|>LeiYAS
ziZD7dU}k<w3>F<|PwGJO|K|W+^vp>JW;WePD$@A~-0qg6YL%h4n*z~h@7B}L*thPX
zp{~xjE7ok{L6EuN!ZH<iQNw~kDH~@WePKhZ&5xr(o^^F8dL!5iB_6KKR)1N|l6k|J
z<Fj_Ep9`jf__EBC6gVQvZM3aLs}|J?F>BVU9o2t=SwKZKKeLlfv~fhzFWV$>n$~nu
zB@0&>J%=ID+1fyH2&dhOIc%rY5)3R7Vgh`ra<Glsj_W#I<<haro}SV}XQBbQu-l5J
zW=C&_4N|y$y9!IwzBH?8LAM6xwO*3(K1lsW*i>t{0*GW<))iwD2FN1|&|m)8xJkaw
zHYOmXECOAguILg93oeX1_SLk6;f1Dg`9zCNY)WA5Q9|GmMqm?U$*hT?<bN?;%jE-I
zgZ+)<E@t#Kz}sJeQ^ovfXc>4p`~2(dmOkBc&5u32Pp0e<>0F#q1@BW8EtRf$8w0XP
zoNgw%v}l^UkBQni$MFXmpC}569|>m_b?++r*SGz$;|WEmY9fw%z%|W;E7Ztht?z+;
zsh~H*9K*oCaOU3Wz)i(Z3rfH<T2A268&j%MvW>@aLcD|8KX<62VGBgZ+<UkZ)$()M
zFZ?XOP5hqOy&vzGsAl=&u%B0}^aRk4d9MGG9l}plg&r(SM{*mR?$GEwQ+dMw=EIzf
zyEb+Wv$KT5puNl?=MF7yOQOsq)}cQu;N_PWgEv1tSNW6LQvUSD4FiKIWAkd2FUau%
zNOT~1pyiQQ*{dQ<^;gKt8yo&3=gG41y{g?@W3x+|nP8=Q*00qb4Rb>)bCUSLLiYSB
z_g{8jHKBFgp~}p+4ma8;6hPdOnZC*ri?lf~Fl&|U3G}flsavu=N;;@R{_{_JSL^>K
z)3Q@aHspw`F4#OP#`%)U9Brw8Q8c^y6D0JlrP5ywLj5&}u%6l^z|fs_m^NN@rp!YR
z;H%!|B-w;;*mE?df}NU=1cmOd$KjsbI5|LnVY%v5|E^vO1~#$<l*6qpF%L(2K4<*8
z2zym|<IAyK4G&=Q#hOmw$mguIz_=RbY{1I<4%nz(UXtAd7qQZG^xU*nh`y@OOm&<(
zl0IA)bSBtw>($xRezKQuzy5=+z)=S|6Y@%{i}5)+AwdbN`=%WH^6|>W3lAB<xqq%F
z%t-#nyJd@^6qQm>EW5s1nmyC_L?{qR4pqOi_Gq9WP?Y&dOehSQ(|-x*t`PpgO83zY
z*zXS(Xm``LQ>vadE)+xm6VsU5`0?!SX?>M1iZ^^#!e@l+g%(@*Z4f8RrYn^R0(x~O
zJUR1mE~+V7_({ivjiZPSvS&5ZK=*wY_00Dk?ucfxAv5!L)Jf97KS57s4{as<I1r^m
zenikU)LRy;z*V8`W~l(N2M>S!qui!EZs=|+(WtbV{cTlanC|!~sD(c3(LEOhGr+@(
z&EQgfndx(H8kL66evO!+E0eo|m)l#c!dUnv(6CjQ*-oZu_=8bE>g)O|75hkC!Fi~^
zw=~#rP+|cG@yOh7@+ms9g0BG)25Rw7O|e!uu-Io!Id>;qr6TZTrFN8nrL(@j53MH}
zFQYj_a{J@;e|rHv!`$yF=IvzS39Y$=N<A5~LjsSo+h-(}Qv$5N8kkq4t?ELlnT{!4
z<5lQ7g9mewF4Rgh`kmbE;t_Xy2yb6A0UVD0KTN%KRFv=c1xiRscb7<ahXY87bV_$O
z3<FAslypgV2}pN?)X<F}QbU(?_kH<%@9(br7i+Q5HSs>rIcM*E_GZ5?d-M-_I52+h
z0o1u#V!scYRzS`w<?&j6#fOa-T-Tx}^bZ#R^ZEH_f@s4hVjr@JK!7eCT|Lejw>Nq;
zwyQ`UDt)`Q8n94PMVCkB?EWmSst-z5uP*l=TD>%MdCc*?(}<i24Lj9)L>rx*vZq{J
z`6iV3mBO1ydxv8NO>l!*Ts-Nrn>1<UhsdS#d3mKrma4bqT>0M7>Reg!ZL8Gh(i_G~
z$jALvByA3~4IE8KDw!Z14v1)q4lU>7UHBOhV+Ww=1>Nu2ugS5Vl2I;Lb3^CV_fpi!
zVqbh03=6O-)y1Y<JNp9T=eXuzQW@^^Ug<f<=QpmfBg&Mv9HQ80tf$t`p3roAGj_3u
zR54JrvcdA`vbn~FJvUsYxHU(1KfiIi32gzP=kRG#D>>lhKqbTi`b?q`Uuse6!rNOb
z6M4Jvyyr0;!P>3I{v|m_<T_;Z)1K@Rupj2^CDXI6RK*gU&fUCv?y;Xf*;~3dGyOE>
z;d}B=?>qO`W{pJA3v=^G&h$@O27&V)_NFpoAMwMS5C3s7-yLwVLbd-$i4%>d3sbgs
zo!9@?-q>L>N`%y!-?FMKR36MI8+a|-&rrCHRR_<Poh2I0;KXc`d8eoRW7ZZ2t@9O(
zcSFw;TtEKJY~m^$e}r+|-$Z^eACXqAu}@aFdb10q@=N?C)};P`wUk18kr=KAb$wvS
zzMvo)V1MQ*p8FDeV1sSc-cg5giBvrB%A;>Dcv_B+$n;}YSf~E%l;%|y8x`1FVyxmH
zwNG{GRo+=)bC&RzGHUdt-k1W<{Q;4>nO<~$(tS&Lf#IW;#CZO!(l~0g5jf92dOIqF
zi2`I^VYhI0Bm3^rgkP|tzJ=hlq+pJ2THh0qVTRI!49~?4VDSXNj@BJk>aU%zxj2jS
z`&4IG5rf@h6j#X+vL41rqUaZP6TpFPR(wBITQ}aHNm**78cgV{)4E1|W^|a!E2n<z
z3}M^y=nffX{_e{YHzO(RbRv<ztr{~AK%*Zwr}HTQmmoj&_{d3Su@Vd1<`TT(wsh6s
znDb#_!d|<>Xc;1E6iT!@TTAWq6$(SE!WD#t9X$tEQ4>~9(eMppt($9tA2r#+LuoKb
zW5ZT8O=ff?#c^h(Nth6CIOt>5cTfkGXvs*g?5)L#zHev?p+znhBk&))X2TK#?_7S0
z3+MZ6-N5EBi^(_VsmZJ+(nIFrYJ<QCYZ;`%=x=9JWrBkHqcV{sU1fLP5bR}@?MHjZ
zs{8X3ipz$Uxwz-XBjNwfNR!+IkBUG5eLFe2Wg=51mxY<Z@q`s_q##n=XYbdl!f)9N
z+ktyOlXufydX4uZpr`oJ4ikDwnI{{?_&XXrCkQOn13kgO&Wi?l$H<lN0;iYck0L*)
zQqTWpBgbVs<c>kWXVEe2kftMzomiUP`6Q6e+WrM%Nnq<r=b&spC^(~$kk^@?_Z+%h
zt?<0XY+48Cw`gpIE~s7@c2$;QvwY;qaI|1w-MrDrb4~$vw!a*+T`h40uvlM4du<tE
zI77GL?j39J9JUq)m`7{;t2sZYwpl}PE}#-$SBCTLD|$k*j=ZB?QJk|jl|rW}7U-2Y
z{WfFf5wzurm%|IeTFqJb(XaS<SToo4qn#(Nfq=Y=OV%jH;6HOnt{rud_mYJ+b$D?e
zRYf6ZGyE(uXd(U<6JZQvOUNozd1(}QU#34*OMwVt<X3VS$TSTh$cU4o#hjB1)E~WQ
zXc4^)XuvLs%5k(j7+o-pKnmnx&s=u$*o*w2Zq(s#4w4d-3$B12g_9nNTlGO)lGwk*
ze!9x)esF#6nA@OwviMhhR`QfMKJpadulm#aIiNdts8$(Lmwyj84gN@Vc<+~V_(6++
zB?8`cTtK4yuHb`JdDK)?$(wpKaGjmMdhGRau$YGVm_!X68EuQ0EJiY~E3;FEW508q
z+1kz<vFuzYAE2+f0}&ps)TF<I>h#&xhWX*3I&BFR;$V};LKaw_3R>vjA$lra0034X
zMn8{OF@9tq;mE8>GTQ`kJDsFH8Sx*)rH6y(y$nSks~@r<K3v+{m1duIJz#D?8j9lS
z?l5DJU0A30tf1D&V-WUheS-kqc2X$(Pa6~AuLm^w4?QqSHRUva>v#C>)%Hq>{<SFD
zLVMmjxM4ahG9VUVtWzAj=?ef}JkV#HBEm{IK=Tzg0#<4)^5^m>#BZck4?Z2O{&y&k
zE*^hAM7(eprGpY~5yt}_f4+6sF&M`hNn5(+3#kj$nssL`+-b1Qy5@ssN+kUCpfKjt
z_B~nW9ckPAETU?=3CD}*#uXPIj8OxQ{RKehB$00>$ERpI=#i<wkRtgf-f}%tLdQpr
zvMyxkTu#oAQMutdL-7KQC-4k^y3(>>ytj(_g4wI+mu>{s(x-BrC0icVbCv;2F|yl;
zTyq)YHTQd)N)%-n5=t9bJf_jxLF-c+NinBrh8O4TZ40#n_w_$rkgNr`{+Pg;ZS#Fv
zX2|Upu}@sdBybbS7GN(Kek!UdcK;VGOL3X>9^V4BArVMVY&>IAk(>AI*J<5a6GWXA
zv>yR~RbVWIaFjgfD+mlpH_v5z4{k6kp9I?)TI4YKFAM13Ji{01h~Hm2S5LfK4Z82T
zAbhFT7se3Z1Mk&=%O+ohD&LW(o2dzZTEX&$JG-YHI8W)KjS#(Pa~5HIYfhy~r1LK$
zy;b%=$S~{m@z<G<Ha7AUd@ZVA9Zq-OtocWjo&&kojrk>46y^I9dZFz{YqR;s)$kbw
z?DyCH=NuHeL<1^jg`HvFd|g)-2fVQssDW*7vGWj=Q&_LDC0Ft{?E$aOR$qDH`TT?`
znAe}nmpzKIigvuK6?a*2EuETrVPT@<fzPrO6Gn$SvZl<+Srgf!LC0~56|3@-Rm<$t
zf*lMu%rTA~z>4qL(1t8^XU&1iZi|x0QExkYXQoV-4@;~yfq(v(Eo6*!(3cN~3XI3n
z6s&-d_xX3O8iakoaXl|bezskdI)$!b&3@uH<4^Xrr`@4(F~Cy^+v3dxc{}3S$tSsu
zJj3AS52uq~K3sk5N7>=sk1ST65=V!Am!k&0w@c;$`*o1Li@OjHmdw-3*;bvm@A+Oe
z)@$$;<9G7K@Na7ugrh9Jae_Lan&b<G?f4&|CJV%>9Y$FdO7(Nz(8MnY7x7{B1Fz;d
z3ZvVd?e4nU9j31CbEU1n4i3T}Dz#$qa{W`j@FQEENOxe{%`6Yw`=|K-t!%!S+Kbx7
zoJ=qd4>W;eJRLZ4-gNpTN<UXKDmEG|{?_4!zR{{}5<V(aXg^T^9ind?h4JcHvVT43
zP&kEdj2=DqcEum;+IiP+iX&w*>j>quaiT>gl1+!DYg$l)=12L#GDKR<cnUt<X*rI|
z=wEfcUR!D93U;hZNLYZoO8Y!`9IQsiO8N4kI*r8bNPB7r#x907Dj8y9hd(ivG+Rib
zW?A{)B5r2J<aci%q8<$z#JvB6?KT$gn6++WID7}w2zMN>$$Y7`JZcJ`VyJy^N=Wef
zInB$v+!A00L{nzs?|R?2xPCtuM&U{V?k%6f>@MQj9NkoY2+@7fM<@}~MxM{xwc^IY
z@wJQ^C%p7j74ykwW5&4(CbI>>oA>eEI-qDE@g#<X<L9u!K%cbdz>{WeE(P_HD~CB^
z@!xwThWziwp1_oe5|};BYW24EJ-8Ube3{M|Uy!%@Ej*rHC|rwLFhRf}OV0SUmZ-xS
z36R;UdxIaCu$((KT7pRLdoWTiJ}cE^J0lCiV(TYI?*=j5(rzS%%d5p0yHJ12&`i60
zAqP~WiM<L$&?wIub*Iw^|42>=@IE8|)XmHI)-fhDWvsJpC4v><W9fb49@Z+R2u|?-
zLXr7pfqJPA?PDrb`-Gs0*vZOuVjbRU8C<t%Jx96!{2+Afd)!UodyD=nrSppE>fM=;
zL&M^V2e9#AI^c`dgJ$iA`m#Y{gEZ%Jmgq7(6=rH-(bppJ3|EH{Z#r&^Xp+1KPXfmq
z1RoMLu%~+^J4U_4a)qqSzbTkj@+V=i;HoQSR(6i^`KDMra>S__scGqw6v$6r9V)(v
zY5EsITz<`V#)fr`i8j)A`&Y#f(b;FYj1=AD*^~H|69@P7;G5omXM8|?DCH*hcJgLF
z!}<D_0&?Q_^i0+Jn6QjVNOkw#E6NtTYutv5=Ade#v(9>S++$?QgDAz<Kodj$Xy9{^
zF}4rUgy@WCg~^NFbAVtnB)dhW3v|a%cQc!0TkG@wrB=LYj*N?z{T6i{m5EG(GSx*_
zTx+JXH2TK`Ozva&YwY)I8of7i{mdW_YUSXT(DK<y#_Ly!)$cb5z7nGEQveSH?{tE^
zl}fOCH@y4husZ8+213?=%-s;edfbj`yrQtz>PV=|n}jr2jzJqBX_D%1#6B$5{kQe0
zlrhj=V+5z<h7gz);mXfjZO?@->yDbPwprzT$zSQtGf>A<1u$E`m?p2MM@J7H!al4<
z1u2#ANJ+XBxEj1$ZZ`%t{XKTk>(fPVeyN!Ya%E_9jo^?b)Wt<lEXNW?-UItZfoW=~
z)&%m5Xl;KJYFfnnxipD1a^B4r$2Af<-Xi6^*2I$A{G_kG17q+-Wfljv2R{npRvH9|
z<#adoX*e+B3BHvMeLUNpr<^WJ;Jk5_fXg~lA9|xun^;X!PpV%^Qd(nc(l2@OVi@M~
zOTRQ(tU+B=ASJesM1n+pCvU=k4M_}6L1n0U<5oH<ghl(To0Q#7eJBCqRXdh0Pb9{z
z<kyeCG_>J$rnkA~CM0%R$SKrJ*eWpaEulWoamB&tq^wl#<C>$u2k^e8Ya42j3e{T6
zBu2iw+X;UXkosX3p%tl6w7#d$A*l|u98r2rP98Uyc>I;F?Le3BZ$10xZMq7n`D0Py
ztNAs)1q0#X+e}_tQaN{$Z9E?qppAW5^cvq8Pm@WkPo&4lsd`^b5h5Bb)BaAazSjDr
z^!-*GQ&)B3tRuh#21)lP*ckN0i2y-ebMM$VsXP&dO`N@wz6t8qoD?4Rmkq(Z4pTM+
zPAAcY<^8KvyJ|dc&~|n^lA>$HO9#?Wp)H!L0qU8sR%DxX$j+{>Q9-dRvKUSSz2>_w
znle+rEb$XseG{6CRg?OOzn>4i6(cNhzXXA<(SlOc>?@t~84MSz%0$42__x9Syw3N6
zj_BUqgxYt%2&$?NLev`tPbY~{W7?v_Ar@eS#qRqLW4KFvoCsfh_2UNYYr{H;eV{XQ
zeFH!?q4TmW%4jzC%=v8DEo2)O*RdK!&M88!qJOxqNB)0Ufcd2l$dQuHO-n4AONi2D
zYM8-x{olTysq^NA`h%5sau^n&_!(24^LpO1ztGcbj0U|I&BS`WIo5!f^OEfY7Gdn^
zmGo~vn2|Gp#J0Vn7TM|mDgI@;;>$29JpZ7Dbd2vlef|;i@!*Q;W?CllB)p8{S8-Jr
z0jJTkaCS(d{Gj;~Ij*zhV9l3Z74{Srck=U_T)B$xIXPFm)a_$+H5VJ_yMo-A@4Oji
z8d?xWcQ;Jh5M56$&eJ~{U(!sr^(+TH;@f@NQ`>$*FQ3Fm`PE?IDF%fY$;LDlbRG$&
zWzJMQ@RZXPC$!Bz{!ujF{^x^P>Z0FmsFbyWVzbq$%6<=vYiq%4dNEpL?^4|$L^h_{
zW$l%ycFD^Wo@>!J7}BE2Fk%Q%kyoYWz{WM}bG|n%l6xsd^RZhuz%7CAdO`sq`;rE<
zx0+G)Sj@`D1_un`Pj<w&gx(Hmg0k~o=J$oE{M2e4CX#pCWbE(iG|yfg2RLrA?FDgS
zEAHT6LD6O7Ov%i;dsRw2U)zq2TRPMj@1k3j<yX1-W~)=!)d@KyJ)nC}f9c)Y@D2vg
z9=)yoGL5aSJ;D7kdk*7)0%`SS3m>oL-$JM2fV2zGe57_PyK>;LRU7$25%$HT`9;~{
zkY}M~$RiYXL~tc16)lnf3QgZD!WOz?iYG=-_p3axjjAP!y;0Zt?z8q_Db}wl$KOKT
z_uYB%xT6_@+W2{Jw(1BBrlk;GmQSr8;0XOqKu38U`DNFK!N^}~rW)-z#Za1zeDg+X
ziz3M$_1+gK+3Pk6g7^5b@*YC)w<2i60cX8!fd7Q%s+w~E{ZL+x;wH!CWBw_V%1Nm-
z7b*H1alqf%<rTp+Yiz6oo#_y2U~ovZ=0!Rs)m+nPQISn9Rk)*R?9y!UTPvt^h>n$g
z4{nU*%2LZwe+<5)IUHK|Mv3Te^@-(|Apn@Ex7jdC&nE@VI;4PxxkG-cV<@7Z5Qu4k
z?zou+e*Qt1`$Kyi$ZIhOGh(E=+X{qfjVnYbgD%du$GZmyt4r=nX`dxbGSA0+lH`x!
z$9z0IggPef;WX7|jSb%x_P>YM-ui66=?c$^D40hksXh<%!GL#`_=PmDhE0iCVqEjW
zY~EF1+8Mp=`r&A?BUxpquC>_86tEj@o+13!in;SIUL8wHCGpxfPX|KoVZfZ6K%j1X
ziS0I(zHPy#QphUnU;XzBn3dK|e9tKC`P&!;SE4pAhfy;e%JCzE&r_rQ=_%l^EK{8I
zO(O<Gl9GKYwgfyKH$8{*rm<N@1M?TC7y)VBaH*vK_hX5NuZ~;T?rI1|fjJD$W1nD^
zq_xH*nI-~pn;69G3k-MJjq7fr%VdQ;t-^`ltkAjaBoUvj%@lcTR%U=7Z>>!tqXqw&
zTU^S;jJZ1&8NZQtqe6jRasFGIr`x`-%rjnILCg`gXV5Y*CDk%$ef7=r`<*uw)(7jL
z^NyPG@6K!?*|s+J0+T@F>rEJ5{R!Cnf@FBQJCDiYXWbRQW~&36pSU<}&%&ihBXuMN
z?p8swNNy6wrt3a<%?JDxEHRGeW#Pw37VuxzcBiV7-T5f1&^J^jR=a?+{d5K?13KZ~
zQJmA?e7v(QnpV)7AE&iLpR-07&^rF&xduGZc7Waa-op^^h*<v1N%lCks}-u}7DDI4
zvY|7TNR!H7T}Y*|s~|<f?c%k@BXUvrEG20nBsNcr?NqvI^K60Lv4@lAw#}{yY^4yv
zz$hUY+Tq0QU-)7Xo!G~*zX#j4FT31+R2N4iL0tL?y7-hi0XgJ4*8O#_>1e*E_|&O^
zX|l+)`?ZZ)le{erh@l#MnvPn}qYfFu=kG|%PmSVww1;Vqyym@r^Amls0BAJBsD|3F
z+E?Bj6J833_9B_=2D^I;wmZVCs8kN$-nHl7AIb%=IP-cgCa{}UUAY>6sOn=8nmMWa
zGwZtb-NvW~$0hQ!Z26-1HgYWaqpFL5ZtE7ZNSz|4)zFy_P~-3=Z4}NCcz>ccIQ7JR
zMPwK4m=$z=z1A&jc?`NEEOGw9Ly)6*c1uTH&3`(HjW;v1{l*#Sp~^{lx$L(Uv8V{J
zwE9uR)9oEqYhxz}rA&Xz35i|L8qxbZ|MZrbeh^vEGP0E^Z#^64sF=gKme>)xYg8zH
z$}3y+UejBw^>@izN4F%7830br5%t~s%4+fMs&l|=te@=wfG`;GTQYoeY(c~L538h)
z{N3;a9>8w_8v%Jv9|mW#(M;|vLm!zx8H0U3GKB){dcQ<=%5u#(&m%bR?+?;R#7wJ9
zn2RrXt(C)|(6=iZgt81je}w&X!An;Ay!Uqh?Pv%lQR&OjEKuMgB-1v!*OyN(_Zcra
z(Dg@I-+x!rg&a@dToCMFh1JgYO$-;%bip&Ti7Dqn*)Q51UVSNdp>juD!)2Td>v<$?
z7t9n+JTCT8`EAb>-Ez2Ne(KhlV^C=y4&ZdW9^-)V_F<|Co!ycF+~2K??bUF5<>@g0
zXV6(x>@cmICx7Gfx%9m>1QiYF0x0mdh(c$Dzlg;ye&(>`SOroF2#lHhO|!zps;e~;
zvDl9GKZ}I8!<Oy|?`^WznZBOIhV=GId7S-Z-H@5^#saL?@c{#e1GCe087lvBzm5LG
z-{Zj|kGOo~%30@Hek=y!LYsfNd~j8Q@oxWIOb51!u}~Y}ym{0mE^@+-Jm`=o1KOPC
zd48kVEUiA#j^RVyF8EWz6b@*jwk{egZdhn&vrEHG{LU(ZaO1Ghi;}rJm-<lbh=B8k
z={q+4d|g(|TKOu8kHBiirBUj`EpvG1(;Y!Rv=kz4b~Ed_%NRkHC>E*0H?H$|8Cg^-
z>ft=7y?}4vSt++aPnl9By&OzC2I~LKA=g>Zvi)DDqrzZEwRHnLu;%6>9ZW`NtY8kQ
zybZrp9P1@{e=u}*<eOKP-jLg188cmcdU}?8(h`Sc6`A$>;~hdnuU<Btl@}j(e7oi0
zJ15T@_efCWjYY=8hPIq3af;jebl4!3V_pol>BnWD2!!YzxE{UU$;Np3CK7ZXd;}od
zd;*>iU<^GeyyWpEY`;6S8SbnHueGTv``MU6x2t(o;m}$`$M9I*1^%kpuHijs-b_#E
zy+=t@o%ruG(YwcclRF31D8?I@nlLQKx1MV6+$~8#doxKX-<=?|o|Nuyk4Q>o-1o8*
zv}~6LZu%|~Dar$&PhyERr`smURP*quw&Edb)BqY&HSOB@*izs<VB(NQgwSpN(uKsa
zI7IjI(|Qdp+!Gu86}ZHgMK)z#kE@Q_)_g-8v$#lVM=i9&6k@qDJ;TY1h+g!?f!lFE
zQr*8HEh4nGWBJ#j)}`}yz&hcT6$iE4O^|+C8G9aCAizyRG5l}><P=CzgegU8Ec}2E
zKQTPrTG;PoD_n2h^$8aA;VAH-Syik*MVYCxQQCk6;9(CaPrq7+A$~X=t+DrB?&>3y
zdXsdrDzR_=qO2#rB+C-C#%d#v;&0a)Y3C;jbB2lpkChX%2xS|tT$rk%FR>j|)$9ee
zsWB$eEdphFkS0<4(d9Cp=^N0syJNIQ6QVOD2I&in+0q*W&ALskV&N$cj!)b!b2|dT
ze1;Lc<q?Y(Th=9ys!nU&NPLf^f6(?Wf|En_Tgp;0ODC;ML3AV8UqCr563iS5>jcXD
z>Gh|&{I2mPtGz{ItHj7dy$7D0vTIL2SP*<JHB?4K^PzQP9|4FW>Kjw{mq-fh3<d;0
zu`}g}JtkHml*o0GHYABnsyFGRtFrITPtf@k{JQTY4ikysc+cC{*U{X4K2p!e<8R?I
z(l!@?%pt9(LIT~trpn3Y*}!#V`Op`Cu6Hgnd>WWdKP`W>4i_=^y*7rk;>Y?G5Qx^C
zv=Q(1?|(B1@cyO5!R4}4VUWWzVf&{R(HRw@*yiWt!4_>Ozb<H9ncL2ZV5aQrH^ubk
zGzqb~9}~X}I>j^Soj~{U&U3${jJpNeES@TXL6_(8&yq*+DBEp18v3&*#bP<>j3|~8
zqHO(lY|kYCn4TohJZpl-;bs8FI-Q#4s%jMFFHEroEH~|WN~hoS%n?*K062^ft1y%E
zX0`yF1&1i81x<!p7CO|DAaVS}JLnrrVqm2C&0v8Phu=|+AOfM;%d6OAl#l$y(??(;
zqKIKz_ph3Cthb8vck%A(S<Q7XUCf>QuQ8!Ye{A@jqLvUo07DCdS&7M7oR*<FY1Ibl
z>lLT94+uLSmG`-;)^#D`u2jDQ0(|<nb0-OAe?=z|SA7826*i6f6U-d~)2pn7sQ@CY
zhrW`44nsU|*3KT*BL6BZsE_EP1yyWE8QjZ}VFAK&Izy-3+F}099II!Fk8szHvI^b!
zE68-K-9qaj=|$G8t0Yb`&Xm*)^!5j6Gi;!o>w|>eUuJ;U6b~}WQud3JEAn@V0yFtH
z0EGb@U~1;ap2+3f;HVJnqZ{dHVvAEv2-|FvkjLS$n9MUz)nd?yEck$8DFM@mWmE#L
zPx4nqbz-$!@7^{Tp+M#27t;B**<Jl!z7IXadon0fWrJ(%=nBxsrj@t@+EJqqV=Vx2
z2oP*dt`D%s+`EqiRrvp#^TW?{ocj}AO<<w;D>WMt0{3qP&#<xlFq8Pc=CD@-eV(>A
zsPrD_rLge`74o@XOYMU$l!Scm_(pSz!wmPC<BPcpjj0|H4o)SFX(kfh5ZvxxsKR`*
zWq*Ln`2@1W7z(u+<odJ$)L=T~zscAz@9PYA&=h1CgLJbB?ei&K6+Gk59yQ0IT#r6d
z8ZV|QAyvSy0qC*-zXpv!y#ZH1D(ginyLT`32uNC&^SmJGXk3ozMmZ2sr~MoZnTNiO
zr84K$5_aZ$lzINIe<c?}f?((#8cI8O)Fq*X@N;Tt@AeM-Fbxa=6P4>=ADQUA<Ih+D
z%4`(e6Y>r=hG-kEzUO?mjgNOF;R;m^*qS*&WZg09wqwC=icoBcqVX2&N4qJbd)KKj
zPnSRSEZJB6bZqOm&m`Ds0uA)zzHBl#u|2IF=#?0r6v)o&l@tFc;$^WYQS`Q2azJuA
zn+h)ff&Xth|30fAw;)_59j3^3QE_{-Z^}-et;c^+kF!?~e-{C{o3(9frCyBD6k=GJ
zD=X`Hx40!}Zt)7xTU<3eX1mYWr{=s~=n@<!S5JBhKgdj2j~ZKSkKF2X91jHl<rj12
z5D$ZtJEjSX%Rb8x?#!{q`UPG-<uST4O>&mLF~-OCT`jTweiqK+Or`SrC>aeByAe6)
z86MEqKAyM&n3q6|l}qB2&QUn&zT~{#>27h!e6#$g*V$xnX*gqm?pl&QQn2GEj$P}z
zJL6T^_tp;JJ8zYxOkNm<NI%(W=xP@H9~SV%qF?>wBtw4I-9p&-gvT`wG|NB!7Afoi
z-KZhxogTPnMKo4u19<Y)sSXnvrkK(lrsogCCsM^m?-@m&87mDqR%BkH2egaKr~^7H
za*Kq3;-L{Pa!qh61c}iA?Y)E8okQXuTq`@j!|s;!8i_NhE)G&;#ZAARN$czEOh?m;
zh<Me^KLVIFF^O={m!Ne0g_jEcZqsN-Ol@g%l~OyU_W1_XZ<$3Y^=~aC9b;ysA1#A^
z6SmtQBpY%k2a6c3X09T0Km%2gkz#kPsG27;#c>sCzdYrSQmY>nR7A%x*lg;|OxuQm
zNzs8kC3Hv!<P6Zdq@1myv98@aN$c9e%R-?&oi^Q|(Ny8y$L^<EMuK?i$uvYcl{i*Q
z&<aBC4Q=8O|F!D_Pl{Nx>IUxIWzafID@JAi-XyL>`1=L`w_O-kMIfq*@u!g6VGy|B
zuzdpu1k1qk<w1~s8ew4Yh}4t&sH5H%=>?4<)#36N%MEm=)jI#L2}Bp3yD3V6Z<taP
zMQJ({`p9bjdIg__=A8xX^dtHx2I>2O?0>ZGF)pK&`SGUMpTAs2_=d9$ZX{L<<zURV
z4}*cvPLL2l!9j&M$C$p!D=GtblAT|)?uoAoRSb5XV0H>$(Sw?Va|PP!!{w-t_cYaM
zeKW>BQ(wuP&)kFlQ2(3w`uZz*5?je`#)J1Hzz}bP$M6IXP=3qiyY$4Zcr5+|=s@tO
z-gCDpde%lm3sypP8T%TlXI9)DMgnVP8vKF>!J?wUe1v3BnnXt0B=V?Qxb=J4mob|H
zXV|kFkhn;#@*}8HSe(A^kt`}jbKFkaG9Xwx4ki>n$d6hN8PeZ&hwx{2wCp@%vt16o
zsODo+kK4*ufg{(1a)F!jkkQ-?cULnWSJCNlf&NN;35Iq#QW=82-8+c@Qi(L-a;@76
z7?zXRv|bzyh_WxgI}e4Sj$r@}=`W`ATmrJD*M9U^L9IKF3cx^MD$9CDk0F+3W5qNe
z$onmW^aoke^eB!eFiUbE`(Oe;NZ=$H{zvJmo>`NBq#y|~aUt^XaiKFMO$kzFOH~XO
zU@#3ld!K<X;3X+iS4}K3kQa~i7qEyDatBV-wq6y_d>$sUiq{MWGQ*&L!_zvu4R7pf
zeg~4H)>?(4xWHFmh8653b*gg@Sh7ci%Klv;uiDND_f>DjTvu9<@Y`W_io)F#!`nyv
z)xC5D26`tlDHpSo6;(Q*0NZ@f#MM*D++%&R`u$YsWSqUr%UhKP_E5+SMhcKf71Ib<
z%oSn*FaDTd!5g`-Q}}S+qkYvapKg!)LO1c?EDeL@e3c3lXIs>0eL1*1-dzkf!^=67
zDu0*FL@<pSVmYfGS|4VXjSiO6Reu7&*4L8yr8!J=rN3DJ1|yh$jDCknu6Ce)<UAWr
zjOt`2@Vf0TMEj0`=z+Y}%d6D65Q}Uk(NIiqvsb7ezz~m-`Hwb>YtE4dCBCd{LYzVj
zeY%%gQqvxDjMibz1e~<Hqi=!^f{1q+{`Pc*i|27%px<k{R>*APBNN+!dRqNdGiR>&
zV?6-Xe7cmd5zq@Bsr#E%Jq#23w9ueTF;`J%n9?Cnq=SBSd>h`B1{b<m^uPIACn_T2
zzhkahXEoOMFwEID3vpOm2*yRvfg#EqEh(P@0j}bqSwl5D1tvlL^CN)s=_Z81^wgXu
zE^;Ow_>iU;M_(C;&9RYvr|GR$c_sQ?`}MytXRS{yZPjMrdzu$|mo#yP`(Hu4tXjXA
z(D*0VQ>=%gWXQ^f55~{^OpaRnoLTVpDCwm4j|;EWR3<3@`#v-vv4((nG%N9OHOrQ=
znT7>~HN3=V^b)d?W5%eaI#$EE_KKk{XRZ|>xM|c@Eht%y{%p|!eEh&^YkrnOlYw7)
znX2d8@LqE{YLIE;^LzAbMEj#*0aAV6)7=!+c=c=+?8h!d*B%i<oMxhQ;T=ONVoWD$
z;sx!;*W%-8t(kR(HD6$wH5vj~jODeb)kzU3a!OSPOG!m`An&1u7F}%hovFG?>M)2?
zsrAk8YNs4Pv6F)CI&QvQv3S2VRrT(oU~(Yo#TJcRjho4EaWBJ&R~N_%eO};?J$4r<
zuJ2YctoPLanBDXay!S)3e5}qVS;c(r&&b9MXI|gHhfa}f8;Ec-Q4G+zrNk+Od~X7-
zWK=~6>pF@t)!=em1uX?+e68s7j~pE9DEVhRY+vjWLCPcd7{PutBN?y4b!Ct`kLDZx
z#P|l(w%R0l6%b_n9ze&j5gLq#!C&X&t>JSVc2T--hcDf={TdRvFtuqK7N77+7t!@=
zub}|#s!mD%#Y^C7QiYx+Mf!mDKge*+!A~qB=dpI)*QXfbL|Hv{`y(s$U$?iEB{Q)9
z194!Zh+eN24<8S-rRWYni;G;mhfO)Zw`q7Ob&qsA!$26*0APw}bfrS^5XCFBcENfo
z0y&bQzP~Y7e)K-K))Wsmuk3!jF<lX{cDu&*9^d%$decOwFQH2>YJOK7?wwRMmsE0C
za8dN<Xbs@xVJw7IXcis=MG|^qV(5A+UvJVAN7Yhm>mOo6Eu&9z<y2i%Y-xo|RIgi8
zEh>QBg>Y-e{lm(d2+Hh%J{`mzl5E=DyCSd<$kId>=Df!GU6N!PeO{;6n8cvO1CTg|
zI_X5tAL4HT6P^<Q#g5eg-Mwb+TvaCH4Gs64HaES}l0{*#FHf_Xd@8ae@h45x<S;IG
zZX(<WsDuk3z%WyIlk-=JCl)(r$LiTy`%JA0$2Omxt@)D`trd@Y@Q1RR=x|yo61o6=
zS-$tr#q&NZ4kq}ngrT!7G2PX|wPx}9czDUP$de7??`jC1-n^H^a*9xJxwoK^za<1z
zx_&sj%pGPQ-k=YIgH(|0e9u7+uc)Ju=XJ?`reQ_}W$5<t@^Ce(;eE}}4JWtJ_|)&|
zgCiO{&@{edb$6*$s}kH~5B`dcm-cm@CA7sSCr8kkV+YxzpZT?=%10zXQ8jkAHRa5g
zPO70xwK|F?D_J-G=jQ^-P{SOq3W-m3$${90dv*-DsWsL(@0QXPfZzrJ*&PB~gz5B7
z0{w$6tOaRyzeY{qMm6zGA7tMO1~?YrK*j~&>J+hG#!U<+3y|_et+?G2OsmE^6K;<Y
zpHLsqbM{62s=<1RJL?(s<K=`MYD}Dz0p19}JjX%2nW^CEE6URD1bpdT-MM?eVH<n_
zHr3-F$(fK3#+8j#F_Iq^kSzg7)h9Ni_XqvjLNaD@jYnHGFI4AwCpm5X0&tOk?LfZj
z=)pM7)}J+EkM7IeuSoHJM5u8q$mY{IGIfX>;y^esHMM4a`m-Rtuqw>@cPt8%s8NFZ
zVARmC_MLT;L_SZ-27vu>V!ukP{T~PV^P>_=ni%dJ63T2ptHwzCUQ#$>sQ@jj3Beak
zrDV2%NzJ;i0&ma@!vye%z6;m4Bt)OahrREw0+^K`sp#Ksg9w=_ti&$7`%<cQ3iGVm
zIo)Vy;PhB@Qe&!;OuULLz=_cj$`Y&;gWnRMUpqGcnAlQ>Hy<e}#^WBYbq)Y?)FgK0
z$X3^{tv>9<%p`S&Jf~)UNbboA4#{j$G%LEgF~}hveq8(^7V_%9|1nzS&s&&QWBgfN
zt(ZQ28mhL_`<!c-{z>qA$q|=)(7M|PyE>2qDWqF<TxA<5A8=ci{p;*N2vUJ?bITkc
z1Aj-Ff%xg2>P9j|_w6*Q6m$cS)=+S2CmMP^hiHS4DA7G1hl(40Lg%*QZi6d_ixTVi
z=rC-h^v{qS9V563F&#q;G3awn|D9B{bY&=<{>+?l3Aro7HDJn8T{SRncgcHReY@`7
z<=4`wq!9y<nq*P{88IY1RtDVo&vGOOW!wts9wNgYZzjk{Z}5GNizDzJ?`z6pgH37N
z)MP?(6DKuqB2+hJT^@y)Agg{WX`eRDA;Tl}wsbn}Ht<&Cnd3`j;lWBdNq-Zp#_N)z
z2mpU3xw@z6x5*cYKrn(jF_<Ggu{Nae0d(~T)sW`X!pB5W;Ox781az7OQ9G(loSftB
zY)K&wFLcdpOCgYzK-#dq3`_`$7l`p_d{ken3Szco(09%+g?m@ci{|;IC4c9xSjz=F
zXZ`caVZJB;z$^)HM-xlc`dB(QWh61juljh?oDAhBF+Ane5Rq)kLK;(2q4}odVK8Jo
zMCI^%mrawe(xuYGq%GBYdZJs$xxmjybU*;W0e4RPqUW><9$@|l)C)l&V3^C8OZ+93
z&z|Zv%l&JVn=0?ao5H^p-IRt>=-4HF4XuFYkE)#ao&GY|i`l3^9MjZ#X2fGD>&du*
zLd&FGbf!Y|0l}Q5`(BzVgIRsfzt*D<bCdhXGe`wh_)7k{Pxl<DG+pwY{f^_-Q6%rz
z>$3I1dQ&!CE^1yY<&pLCe}{fPJ0q$)aRL)}pi*w{1z@_H4eJ<dGd{xy1}5*5U<xTK
z>e!6ugpuZ@VS69ykEwT`Zlg$ftKGUmisV#z{`$Q|<Pb0mY;e(GKSf(n^zYNF=(7y@
zO{TL`x8Z}&THG80tWV>*Q`vK%2L3LF?74ulHB8$3Y74%Kg;&DbwRpwhVMc??1?!K{
zbyt=}#vsU@0STwB3}#|2uy!j0rn99iJ;U>2EJyCS$L^8(5R_X|?><<Kdz$Wfk)gQB
z3ZjlZdqs^d>~STxk^C}cUYDfW8mcdydQ!Yy%kj9-C@;kutIf3M%lUEsobUPI^W)rq
ztg<r8$i%g5Z_yCYM*t5+ImOE=1-@Mlpv0D?<6jUNGFC{8qsukQscHrEW^2YSd;fz;
zoPNrfGwo2kRk26zT<vXwX++vmy9(ajCm`oP0M?>IODb0vuDPMXA@4LS`LMe><AcmJ
zk*rZCzQ-xef2p<}ABw$##Q-%HQ5Nev-D!19&{{;oc0sb%8`Isw@J6m?pbDk|!ObM-
zi_l6pGjJF1ut?;Ra{jDqkFZW|)}`bZ_*GtsZPXMyLCO*<*pp!r>1pn~(k@IwW~WwV
z5EM@|NumPbSPVkv7t8zCBLV6EF74xj&*<`8rfgrL)#Vl4vh-4pc;ds-j!~jzU(`Uw
z2;FblzMTdHBZ<=Gau~V)!`3_;6cDMi2v()V-$^Gf*re~#FWXxEXjpFoA9@Qv@8k9}
zy7Pk-qU?D|@<0PJ)g3~-XXuZ#SQm~+4@9$-C1D$I405$|U4Z^V*z995LXs4qjQl`4
zk>^Am)HYQ1eJsQ1lV=GqS2PFxzs|Nc@NE*58J2*qG#ubCWnVbV#PE}TIFSDc*OwKC
z-RD0fq*ItBXWkO7Y%BQCoij&PE`s6{m1EI8QG+X(>tPl-^gz7l`ZmO8mp_(Hmr(Zq
zumFfXW&@1Qlm{@+MN;i&pas|c2S|2s$t{YUH^wqo0Hd8xyQ9LB<Nj!26=dWAD%&5I
z%B)OlC8K|J8cYYfl!oNAc8rc;yq|gjJqvjcLU|>Ju$M-MAK~lXU^S<aK2XOKSdCL0
zER}Ha{&9Ujdxo6zdecp99MN&XqmX!P3XS!zE}|Zr3;Otv6mW|-;io>dF%QtgQ`N6i
zq5^&I8zksDpe{J~&AQBC8*k1IO#R@rcY?0WM|vlDRenL9lcAe!%+C9pA^^aY14tKh
z-G1e1p`Uw3w|G1uM4db?+>Bd)ScRvx1Ao1a*h?`$wgBXAQgk!bACD&>+b57__;xJt
zsk<tPl<bioy?02M*d&Zw571zy!PB>;<pJ8SkIq)9ESi9Q`liOr=r74Vc;UlYlp;Sn
z1rn58F$)K*0_uQo#mJu!h~ug!Um||d!-=bq`}3l^b#mJ$KlFU%2@}w+<u;iW;bM7X
ze8NJ;Fzo(~MJ~cz<Sm@E!NH(DzqgAix(RjAdV`5W5D(cvUDITXabosS5(qd5%LSeW
zF7{xt+_#Dw2Yp3|O`FyZ^raB4Ig9Y$X7jhIWg(srYjf^n{>^KZW{sW+ZVyUQZ$<B;
zss&QkbE<NkKa~q(C5ipJ`!+u%_}lwG^e}k;k9I_!LFBp!x^vJtn#Xn~Z%*5B=G9sJ
zXljy}6M5mOlRrV%6KCXkp<ttRsG>I<qIdK)Z1trLtj7W*GlIVcNUu&kmsg>CISYZC
zVPETp{!<Hc2Mo{V@^CXN0E3!3&R=;?>7+Ck9I5(PAh2tmH%#DCKwz{Wz}>D?AXj1K
zlC%BdVn(OtWQZ*%=``=J4oH-e<KgS|*E<G{1@Rl3O*i4}sXKvzVPelVC+ZygY?*cf
z^SP)romv}QAgd6`B`{H?_HuEq$pE^q-;~la_k)~6d<$pT_z!@rDWN(=kbhP;z6Ww}
zRn2jJ0$#=co$7Dm-LYT*fPQ{QBZNvs-BcZZpIQ6!AMsOKI7%(CT3TkaIR6VXQ7hS#
zfQx{JPOe*uvu_8wVq`BpY3KL8Qe-o1$EmX#hmp(%?%*`?ku-du4RV{Ui#<5FLgp|I
zC(;0fQX-7OWARdoyA4Zqqx{)h^zXaK3~RqZHVyc}p@Vne&u`fb!N&^LMAyKm3@9WD
z3B{;ofs2`O7BqYZTxfxL2x>abi0wBZyd6Iasr%@-3kQP#^@(_{GLIhTKJ>mR2KKr~
z)a}NbBZ<HoXLZzZ;2n0H`-;|sa*2IVt(XUA3BU4_V`oa?ZDes~Vz)-N?wvr3QBIxJ
zt|8!Q*^=-gCWfB+C-nX8PyLUJCDhM%9)6u6T?MVJ80C)z)<!OIhdCU!FD3(_#32ti
z3FnXcH(wghQC+%DoYx&in2w&&2GPKT(?0ww|Gnn9Z|Z&cc`jWyLVqqKk4SzqQH5f3
z)M?A9*|qkxXe(>{rkfauyF5s`kKlz=J@#}NXD0X=B+6&MSVxM_+G`I`#rhD{u*E=?
z<3C)febko`hsz!(WbSGr)!6l{ZS-JVgXKM!Sq}AtOx{BnbGGt$pXrIUIm!J2!rDW~
z8|ucU+l&giA(ep4aTbt}p|yNgVInrxi23xwdr48NE_2?FB)`3}nI-!mZVLPx&HU|8
zfKR3MX1xaW$)v)8E}+;>&E)o~KKMQuHJWkfK9ZP&S4w@|MqFh>hQY!UR8#2D?JZGZ
z4m_K=YGI9M(o0jBkV(Z?(uR?8ub&05j~kCs_M|LgKQqpr&dZ5^5*cgBECagY#PA6A
zshi+O)a#ETgDn%Y;>}P0{$=Wd1UZc0d_%#aU$j;SJOAE#KEJl!#xl4UyJhq~*_1~o
zFDFdyNp4mc>gti|dYH7^05~>k3cGP8->Xmh`R@3kQ2?)=cNH#{5$57G8t*VozcTI)
zm{L$_OcR@zoB<RInSP5uzBM0}I2pRW;~Qi2ed4ECEGQNDUXogdEbLk(Q;Dci*kq2Z
z9U^=+@LM603#=H#y#DI=8-=?}4)_ppe!e+hp8BfNvya)loYI}DSYgF3PzsjCChBfq
zM+P*_-n`EG5#&#bh<gZt3B@sruz~x?26B!fAMa=eFF7ll?!PWcQYtFsPn{eZ(R$()
z&YLe%Yc}b|qzwf^1IO@YE{lAF^BA2T80bRUx2q%`f-65>7aCx9@%1c8TD+lHZ@&e2
zI8nkQ=%+G6Ud%UYRIBoYeU#V@YhOXECPLF<>@L6AWKEf<4zUOf1+u7H&IV)@1V$0Y
z#VMJiFHvAxlm`Smkm<v=ZD@GqCHec@{(Zv94JSK@sz^3H`X{W@_<bi{7{bNFBkh0J
z>i-4RiJ6n;l_0H@rqJ)i@w`IC!iQJDWr2+#TBIGY?wLra;A}w2#722X>Z82PP}OJn
zD;ksNIuCu83BsGmg7zM0p*d+)&p7ug-ig}zb$j>IQe^;CYxnd&9i&*px(jx0VDPNm
z3%U*)rk&ys;VK+XOPEJ6<>do(yizXybugs--|P1v;~Ws9?U59nSB@YYGB2Huq{YXq
zG<Z@$-c(Y!AYEE^0!Ln{CeQ=JSG{}J=RSDebMPyb)VchSdMLXhfae8c9N4d#N!_B3
zGvbdauAPIdvRZVfGb{&N$_jL$2Rco$>-(6gmXD?n+S?9@Tq757FY=*)1f5cL-z<gs
zu7HfB;4%45fGY%ErAP4NhzIWe6_xO{8kzoFmG%+qC~C(Q`m?|NX1XR+5SV4LNcca8
zU#X$7H@kgjaI%8yH$huK?l<WGU%~g6FR9StQLlN=EVb0#rn#YQpXt^1Uvn&1@bG>{
zw@vvwjg;e~*tNuR_Cg8<rLR+ry8{6hx!2Z);=NT0a08!1wPbcNW&P4R!t00=qS^22
zj$+FST$3k9`(URFuUkQrcDKMI^3tP0hxr6vXRskx#3l(ZS}I3OWs-50@0y%(Ra+sw
z<@@yqK~NTv6c}UW5uHAu2lg|uXoT&#u$&<sQxf*p_NoerIfGXK#P*8yRb`Vw7@4yY
zZPm_Ea+opjRBWGzOkgfK7+~GW>rE!lkyj!%DQE6S`0~9>uMjI!(qp-Ou?W%v{q1>p
zOk~2U_C3N+{G&!LA0kuaU{uqrF`<J9ymY3x%_Q#lYg?Um^BZ#WY>s7r|I?Z;1wCXY
zoUs_WG|+drx@dIasK>5G-L*58iB+MYS1uz)P4qgmObJ!GcEWsVb8S@HV;<o(FWyJD
z5qkQ+RW^}x{0&Q1ZHVtaEIkU<AM5h3%*2zy;lM84!7`GV8PvHQ4L8z>?$y7W3(MYT
znEFJ6h${lQNp_gz=dX9~?d9aU15WO(s><>i_*D+xrW(k5TX8pq44sJWSCnoY7at!+
zMe!Lrzw8>&lOc!erT!<y4bQ!k|Nj3Gl&%$J>%p&f)((EEEj54wQLJJ}bBVuKN#_M;
z6*{5+CwYlhco7ii*ileX^_1)K*0`+sJo~p=)s3ZS3Ph1?{n=Hy>X1Eq`P-;1Q1?g)
zog)ZK+3TvDRHxo1uc}|MGHC9@BVPlU8!|{E9{O7w;3OO9H%_PEXUpEkGii1o2xWI1
zt)g6W7;%%v%P3_3c;CZgYjB_w1MCZNZZcicQ&F$#fPjPt>W~4Yr)4npt9Lg|j<Yh7
zM}dETO-`zM`EsO&6`>Q~HI<G<9XB|>W^%NdX<BfjB7Q;0{nYG#f~B8<I#)Rf*D=9q
z*bIkGG`f>M`rh8=+W=tf*7-_OfFvqJA+C9@0e@cbU1G%;|EntE*Z$ER!1iWh5KQPV
z9QHQ?YI9eYMB|%8t%nSNs@w|G`{JUov4b&<H9SCgr8d}LD%i<auPoEGROLk7|GRBA
z_OlGj-OLAK@O+t)sic>c0Jt_nbc07uJgLMWVX*A#IWfHay)QjVKb>-HYKOq|)PScF
zAR7n-{YZ<ptve0%Q;!p70Rw^X!_Wbu`*Vzy7ns{6^;n|LZCS{l>SE{0dLk7qd(dN8
zRlsk5GpnL;#n8vcN1GYkoGn;xQP3Hl@yrwH9FXP@sO;T?_B!50Yd>{oR3mLP47ssw
zS)a%lpjY%(XNLwZ;xCCCM8tIc$#2O&9xRP|a&RTB*Cc=*0tX1qJ)8K_!@)(c8u>b_
z_j|sT`uNMYGOM6j;@1N>F>wr}p4whZGXDQ|VJkhfl`)8lfcTVo(fzp1sRa7DGJ~;F
ziB6unUV*KH<ggso0>aQ&^O=R@pn08!&H^=IdS>S{z*f2};)Cu@q*9Dwd{S|Q$n!)t
zKV{_2t;10M?GtGT^~5v|)RVT+{t7mNI3pZ<e%^y?K_Z3WEvX#)dCo7!%`goTUWned
z!i!fN>W8G_`P!&S+w%sACwd29=o{#VS^sH&FIf5lfCv?NB^-<*`P&RZP)6X|KgOOB
zV_E+)07%+aU9d%JwJ~k;G<0)f`0aRn$I~+PKC6Q1l<3P}5OsjDMwlo==6wy_n5q)o
zG^o8PH3mLjOyn7ZNS*Go5?scd!sD1Gw*-eeyYtpYQ4_umnTCNalW$hx_><WLRGx5K
zaRC|CYWr7WH&M29sp4N6pP3siBZ*I;e?X&Yyy!DliUaj)rYj(ayx;N==cILe%)WPd
z&_%h`P2+jq=qm8;OUH-EALja^2Z8nh2d)^e+ky>&_|rN?db%pVF2!GxOqmJ;mUc<k
zluq(X7xp7K-$l*U_vvE3BHN?cA-4~zt>3HS`y+{NIhlS$D{k<RK=g9H>2>vK@C6A#
zVoTIak==%RtGpGnOSQ6R<=xX5F>@PI1+4|B;W*Y?EaIzxL}uQ+2J$sT$qGwW_s!Hb
z@)V)G`N7M<#%gPV4Y0*&Z<js5=92!(Frr@v9I;fF0K}{gK+MjhU08P*WdI26XwrJ`
zzug!&jiWpuTv0ZZ%NGi`4Tq1<qm<A`Rs%7YqgyqAX*8cdwe1M0m%q}n`SOX@m_MkJ
zAmSaNjg`sT5?*?A?4GY5Rx;S}!f_Z0ef#eI0i$!`K>tcgDyo~fgmemN6xY!-si|VT
zVx9V`abUWY@t(#Low?FXe)MO%)6O^Fu}#)AR6$;v5l+5?KHH%StJ)VT(^}Jl_xDg`
za@syi3UpLxe`vlS831xRonM*2lDF_nUDB9PfgKJkgM9;=iA6gPReqk*bH&GF6b<hD
zJ2Q+3*-R?#)i1hTKzA&N)8LbL3@<7<1Pn!mp?>A?KrT%nU^_-0ZH4?O6>4Rc3^1BE
zU08qeotpXk4tj7$H!shZbnB|)<|jso*rDo%;uG0Hdp`aGkCg$P%Wry&eVLR%kJG~e
zqg~9Utk(aB1q^#;bn9`|jjoJpboGc4r6}c#PtZH?`ZSf;C$&JVPybrtCZCa6!B<&s
zkEX%<`)5~9tVvbV!m%UjA*GYHu2~`9ru|Q%D<tINC^aZ-#5>|9O=FMFI82Jj)NlSD
zr^>Yt=OSd1h{<WB#2+TWU@1X{K~oN~fzXp1(q`%GV)mc^478^lzRIL??8ZkxQwqa@
z>y;M9#)R8G)$4NwodN`i6S4DD6_Tp;_fi=bdrv=eryv2ag@_9|TNB%a%`1rfo17QH
zj#F)4Ew}Uo%*p{1^Y+#sdE&X1xZ32&!0$<C6tdLg_S`q|j66teS@;v%$?Biw{=bj=
zgAx5WKA!o=JGZ(ua3wLU9vL5qXzH%V7iOldjrvKKyPQ(0`r;mbC-3qm{ioO>Dc_Fa
z#v<xwKXa2z_r<hGj2ei>IvYVkb`GNg;7elE!shPi*MuXN)#ERS&9Fg?I765KH5)l)
zoL-?x05Bo@Rg#Z2h@q0lQ^9dt@TEX^O#|i=!?YrS3(|Pt;rV2GMsK4)he&L}QA5Zr
zVe&c%7>@Ugb$qz3Pf@AF{{?Nt%eEv0WULFyFR$?Kg!sJMQjZ~WrU5pMC?Qs3(6657
z)izTIz|cxElFZiqS|P=3p*GmAN@sl}nO(-kbb+HY>Jd4dbryhFUJD;NJtY5r_=-){
z@*`6P_e*#cgt5}yps~JM+jAEsij3ScWN@VMOaNTrxFE(w<ryA9dfP$Sik2JOGV8xL
z-T%}L;WkEWRm~VfG2;E95@bZ@(;rYp(eald)a#I25|>ji;^>2(#-hEpC+l9@w(inW
z7gUOxgcn`;f=YTq*<pRUNsry8!s-Cj6S*V<)M7o3-=4wt?NI{>SNdHgzQ#wuqUG*@
zlz?(SCeSFjGw-0S;0i-yyo{~0+gPvsgztZ^7hM*wY;bPh`lDSia%hiw{0YLw)84d)
zAW<nO+??n>?+gG*R@^BA=}x(r=YM7z0#@2KL`8sc`MS3jSi?E@3aE+@;Bl}PvY`Se
zv4%s7g|ArHSNJlzu`?hZ_^$BtPN$MU1JLtYfyf-G;t;OyS`ApYl~}K}jPzV8;!fH4
z$^NpNC1Ol_z?o4<Txl-)5R!F^=dVQY5)gk7C8AyUFa*fHo{s}W#)mghS9tf^rJ3)*
zn8TTlTSJGNB7*L{%beH7U%3GhD8X%dc^@F0=_1>|JUZp|t@2qAdVFJKvMhc<KYJgX
z6UN7}4_xK<vN0V5{{2N8=Y;l8-S`}mJ@ll=$C%nMA@$5zPLGL_8uc?j2UaJ}rE4hx
zDrepgE&i2&an92;=f)0{K9bmM>fttZ;yQJ~r)uiHZpGWnw`;$D^&!P@?@{gXtM=3l
z)#Izz_a@DNOT;08$~+A~4WLtO-=B}#()lUXxvWsIt&wr)x5KfzDrv9xRwp&jv09dF
zd@g!PgJ1v*!|w@Op0$6rS8;rWGCoG6`TjqQy>(oZ@Bc6UR#XI3KvGgdP<qle5K&M{
z1*N-`4(XUk=RmpzM3Iz`hA9H08%9rRpuol$Fvb`=H}B8q`}>{q*E#>NJ$MlJ?)!Sh
zGhWx#lM`YS3@RsSDeb2{x4jE&nX$f-ne07qqLToC7r+45p6=hd16bp(PJ!>i`{fau
zC%=8Bq;=+&#i5~HOmfJ+65kI!&kCkc@;Pfl^MEBk%^rk=54Jzdg?mVA41ck+OtGDj
z2LT3>?LXUnXPll&LHaOlm`xNLboF257}#DR?>E~o>UO`n*DFdQzvZ<pSqpxSa#Zo`
zF<%%RZ4dv+AhGRBsmml9*+Jo+NxaiGvKg1xT6c#<uwk+=Qe-mqTf*p{?ye#`($quG
zuXgti_(d2{y|+aI@_u)epnwWe>Ip?#HbGH;NOw<!Gd_)!vgf@<-*b<<)gITw`k_;H
zB-<;5N#*1vXeU(3(-I1wTUd*PjI0@DtJw)LC%s#9s4DVXXY-iT6=cSw6;+1+rjM>=
zl^?BWR9F1=UtgeS^HG?dNhhN{CMp`KnryqnsG;zrG7MOJ2#!yqcj6IFVfwXdfAbvn
z<|Q*jTTV&^qaRh@7hgEv)PnK(`R*1-<s7)Qt}6EWsiT#SrxZWw^^KAwKq|EJyhH!Y
z{;Q2E#fI@WCAYm!y7`IYA2C8|!&+C7*M7SGHlwd%EOdRQ9jjfX?X;Nu$MxyAf~s?Z
z?Ro8;oR)9KKZc)n2^i7<0-s}B3+?c&D|%(~cAtDM_Eq;@r8an6()CI9o6I>Lzh*W0
z(e{J%wU4YPC>dSI{8IR9;HY}phXa%vGuJia!*cC??at}Ef39`jgE;voo<s4-b0|J3
z{Bg*<C(eH2;M}tuIY}2R#b)LRmTFAwYJC1r<MpMv>sNjZ-BmkwU{*RG%T<-nVlu=0
zatL49HOV_SSYMRCWMTLk{N#P^dB<#m<IjmUcFIj`oa`d?<j6?!-t9_$vi|Ib9U-O<
z@UNGYP1GpfV2%IkYu9r>=OOzVjf9nyBrW^7XDT<?;ELq*JA#UhNAU#-Nmf-5b#2Pz
zl^-HF3P3Twc7^di7bUgjr>aFuHtadMt`7bV96GsV7Ym-sw56=EiI)}mV0dl_u~c&w
zyyRXf?AEk66s)vTXlu^ho@8uMFQQ91<uXhi1W<(JK546hV)8MEH2F7`speJwYhaL+
z!MPn`6NvIF{lm?cb=a)hr6;cu;(0>@M>3h8xPdl`@A2MvnWX^}Az<)_$&j-2tjrSk
z-F+WmoQZBx3R>IZ^~B_WSpc+lyX;BG&lW#awy7J7A$R?H;f38jS30v4V4DGPy-TU}
zs%tm@J0*LY$Mma|w`#S8u~X^%C!2q*z-o=PZyNX=o=qA&$mNla9h<pezQM#92%qAc
zwyOKL2}~TPSQMbBVn$?Xsrk&@lzhRSYFH&RfE4P;_uN!WYUJ1HzwxH^H(J9|<HWBU
zyQ4$8uYCXQJJ99G*BNy3@7aAAP}eAW?u`Kn10n0QbHxGYBsH_UE)vO274QA8q?;}x
zA^CIw?%>2OPc`_%Kli86zQ5}z{pQinH6yHj>T9Kc2R?5%KQh&%w$=pPH3N4NI%Bu%
zs~i3wPXgpu&h33=BXFB9Q0JgaNbYx)fmWf(SLUWgv3zy5mHp&EG~hOx90Fi>q_l4O
zct(T3?Rv9WEBegX*HomZ;vrTg#n+Jn;ldK!byRh<!AjV){eHTme$`T;^L+?d-ZRB>
zah3O92*N%MyeCNW9T<!F8KjYvT)L&vHKFJzm|?S@K$kbHrgtaa-^5+;;5Vg!`_29V
zUqkP@6_u;iz&<u3eB$Hs4Dt?nAD=%9ep~D^STbO*IX?!BSzULcZ?_Da$k;7u;Y}wg
zdiP{GJt=v*_8g6Fakz(>GW7Xdcu+pr?pDZZXlMT{6d*}EB<@F@^Q*s~rPzF;da0G$
zo1W$0aC2hd!+g1L1hp5lOx%5d0J?I&M7HB;Hy~TJR2bDBGYV4ph~547<9MYJT3|!x
zCTIL_Mx@3rCOfv`@yKD7qz4T-wE2XYG|v?z)O;p>aU=HB#1;q-@|9=odBT>v-2%G8
z&<itcX{T=;98J$$>iA8w>nY+D+wvny*+-0a9yl@+GX1wCwZ+rAxPqnL3-t~V&jUI9
zp{0J*noXI&Yp$G;^^*JQXD;c&gkR{s?@SY6qDfGnbS?P3t!AFGv|V#=g+Q2CvY15|
zvVY1zKVyTuhSr%f(?}}W?dv2H4;-CqMTcM4zdeSf#9pGl{ouVzvf}~5;FaCF$xHS6
zrpeJ`_TyS(oZiPEqebMb*D$0kB*;iURCZl{g}r{$e^WVDDIQ&Nrc$TAF&eyvuUGCZ
z>}?x0O_qEvt8(Rs5_>aTyfgkMY_EE<Psh#-x3+~(t98RUuT#F*f%{^JUBA}agW6Yv
z6$<26`N%H@X$`O%XRfEB=+Wtyg2#&liWM=hLT9wxCRya5y7#Q9#fzN8P;w;1<%%p4
zK!RZgvmEYdwnH{~J$aWVuPdz^Mqdaq?<M9~g8F(RN9sFBDij_0weGmwtj8IPQnNV5
zPSJ^;pKmuV{t3u4w5#eQOgM1{7>jk@$O*o(WWTcztS<Abz{MCd6JT$?pm@f{xm($B
zTtx=?m6k%CVNc95Ov^&)AbXYmyEa%@-@Sb4D+i)>!s4@d{{@xU&Zt^T9DPWEZJy=`
zJO}d<kl*(LYlbU_kehEmR+BP@{C{xbC3}K6h_HeDO+?r1;bXTToZf9jK@C%l<|-Fn
z5=Cl&tRGs3T^5`yl_;8C+`E61)Sf?Rys`9KfBY{L0{s%QSL45+r!g`zQs=T-(T=0W
z=|%+(k3K?<&0<*bTq59l&q}KT*xstMEm6AIC!Vv$h9r=k7*(M;tP<uXfAr?;TAbBq
zGx%L*0m}aD!M0|lyCZ4D0Y0h$*Qwp+8yN$%jstuk7RljI9X|6GtADb~Z*Lf3lQB=I
zr?2i}``%@d#!uN<_aS1>wxqQMgE&;9p`JnQyEMKTpT$fUPik5uyT54|+{3a>47vZY
zN$}kgIulv;IRe#TR*`G2Dh%O`phMZ-8}39=MnXvlv?=6)v&|)@e;jVVXEI^n`}WU}
z>LuX@fyY)CP%Rtvw$E*zyE~bZ+x!u(c9LIFFZf?Fe-0k=D@F$Oo(va00QLHp4XK2Y
z<YjsFKoGZrts(K$l^52tS^-gtz@b_zl&)!V;ly|vM2q&}QM0L~QC16?zI3dw$<vhl
zoa?!dBDh%2`6ymB{-EpO88k9Bqw|~h%4=y?+Nms(S9{XlZK1yS3wMSIjan#?A!jk#
z)lw^78-65jXYP^fBGLa+(8qRxgyvzs0j}Ec`Po9$Ktjydq=rFG5Dm6o3|gi%rFu!S
zF~*wn$J$HxhdL!hodYEG>GhN5m6G<g<=ARh>{$YFA1HFc;-8&@Z{44HYL>L06m&Dd
zcS*x!b2xYn0eo;}`d^fTfqB<mxWL<5?b}jMLyK&x5l8gmbt=3!6~U`Aqp-4K3v~iZ
zXv#!rzd|Dh+bDY?p4WTaDC<VjIKDGG(!dSJcrGkJXw2;!V7=RpG}Zb9MEg#=*xm1f
za1oAr7w(kIA8#9F$(K$7;b7olQVay3Y^?v%vpmr5Ncf=d-D0d^LX^J#KAYjftMx1J
zhMa}tbllwl1G{bH=Em3QC9R5=i>hzJ1bTzUr^CgHb3p=&`;AC7&|^iZic3#FUZ}M8
ze~0}9VTTMqdIZ{e{+DM-9rT#{EffBoqV(FA=4{gkS*?FqC<OI2PB~?*<ixwJ`m<?f
z@U|U}A|Yt+ucXKxV?jl>QX_5;-ur0z17agF&RVI9^PxW)-nzluL@JPTJb=afEjf<)
zfqG@hq8}|$^BU{UbS_g$-4LEv{2+rP=jtE57r#BV=!&NjrIP(0F2KN<)tFx{EA>%e
zqE@<~d6B5iC9Ze3Vyq%(($*Y3@D2VHy&0SS9&FcNm?db&9>hw2GD|F-KH;=r>W-<b
zdLw%64;`lYbYK)26ALQ#p>cpzx%sn^*i8g|^HGIAXcFPzVGYIzdGhBLf?)D4HoZwu
z(MqPNhorY*E<*e!kqLeh^H27h=sV#4?M}&9>Qk`vwArh6k$4D7y#*tj=QR1<xI)O5
z({xzlZQJU18RV##URCuglPV2=yr)a7=m^Bz388fcERrR-!r*`6izrhO^s;(dRzC-k
zB$@GLCMB~}nDc>Sf+s~y*I>Q8r-ouV*dcCdRo{kE&ThP_>aX=IaP}>~lp{{oDq|>8
z_qHUSOx12y_fibK8MMsXmV+ej0)Y#;zLf6DI98KZioByzBUZ>K?v@HTdJtVl#zW!i
z+ZocBb}f_w+65NWihgcav130s$_2#uI;vUHK0gE&v^O3?Uou8~8@yqOIz@FN#*uk0
zC$;kd{adSNs@+kPe8LJhDsQ|m$?t#D_12s_mdl$&<ZwsTO5{iP1YK@ddC1e5>&pwa
z!{<-BE^h*VTI|H_t`xBl<zk%<8*TYs>2{#ZW}0W8|KgVSuxl+oxUyVpNqPAQLU};T
z*c-yN!RdG7Y^+t+b3tU^vT1KA?eIenro*zBK&$U0&C+ULtM~&OI|=_i^fmRUw~Bn5
zg*dFBAMC9%*l3AO3Zn5kdb#B7A9~GUsT|l(dS%mQE3{*usQh)+%>&clbta~yl;quR
z8NQxLBThq$SceW<y5#q?jfhr`9xB!EjGh5kQnKafT8U?4DMX02k4$`GXAz4c{^NIg
zBt)|D*sW|`b%h9?%yDi5;fqw`($*{Byc6iT_@`|9Bx@pz^x>Oo*4@bn3Bik%eb<xT
zNK1k<f1V0q+Iz+3PC>8KtH8l;z9+Sd1Zz9S<3Cm;g&g@WxED1U9+~7KjFSv%`b;>H
zK5T>f+w<<ZJt@5z!Uf#?>A4`ocHjI??9V1Q&+=M(Xj6wLJMxGDG^#M=d`5L3odm?5
zTV{wt=W1O2Ob|3g(;MREu_z5!TU>=C`7N`hV~~x;i-_5}4Of*on}pi2m#}(&M8K7h
zMo=fArLSVd83lfcXZ0Ik)qABZ9Bek{mNcNwmz5s<lfiZHP15v8LNv24N0k1lIpvUp
z)y!p}gkt#E?cv5K0XI_3{z%aE?Mf{-PfV-JFipoiI+YzZ*rsc3Sc$GSKhkK&bsj6c
z5~UA*K7v4~&hr**NWpSp$M;0zWt|q8F23qyXlX|jS>V)zV~^c|&cb5ZPS(Jj8kAd+
zFp%QQjKT->;qN}u6$i4Nqs^FKWfOeijLJ@HXeX_&>)Jg-3BkcPN_8K$zj*L8eoES;
z##+v~_3X|zeg`fR84eB;&Ww3(QuWN&GO#Kz#c$cOvd`op*8@x{Naj$$tzs)f98|_p
zBx*RDLPOnWaO=(*kJ!t*KecuE28={54PH)bR~NMq6w8ia6#=EZ(=AUb9+gK)llkL7
zN8x{&-HFawUxr%KA;Ux*W~-^H#V4K+dEMf!wXt^st5`i5gopXwTEolTAq3vuzm^1{
zgc>2B{}v%22gT2>i8c&Rgl=aL&1#Q?gFe$Ac4$(_8txTtE$qjnb|*ZN+N#D~g5EYv
z=zgZ2<?>7rTdkj!Ux)N=$AQB*%xt-V7H0DKM0xewo{e!*mFeSxMav`8>`UZNOvj4H
z6HZI}btBs|9l-6<ed`)8>*zAK-^dNGnWnwJ>Xm1RNh04bona|{(7C?SDx7DLE38P8
zblX<xEB%UOM4AD2ThM0eg3%m}Pi{2+h<Q1rQ_kV_pZZZgA+goOt$F4V&f0_L-V4d7
zGp)}t$pYk%5n76UatD+CDY!-<9<n|odZq=k9qb}0lQP8`?ji93>ZHY@?MEDI^h_*R
z@TUe|Iguu(yHqZ0m&Edam6r1{^+vq#{6oFL`lLk`Bv4Izdr9gj1wMv2$bjv_YvVtJ
zmABlTe^6k(PAKS8(@&D74aqfpd6~7+wqxCuoOpX-Pt5U6bw6(uzUtTFIL~gcM&OQn
zZK=;1)2P<9*r7CrfMy2-g&_wrj`pmPCD8Ea&FrEIIWy`EtLtNvtbPIA^R&aq$eXAq
z@6&ZacQACJVG^a2a_Ld6EN>C8ZxUZdpPU6V26l_DG-sTg);4~}1eoE`%Hlrr5P>+*
zOgM^j)*&FnTe;$tjvQ%}(w)2=C1tIB9OJk6p4!W(+~TIB^6J2t*)wGL@~xiimq2@H
z&h;?wUUtF2<-&2RG|Gst>#yigeIc~MVziX${!E0hV78^niI6HX#~k|OG2%F}knEG)
z0+}@N?{^<c@{Y4OR(<TYDISVwh_PNwuOh!0VcFkttgcyYk`qI%MoS1Ly_)R#n;>iv
z;j>>dt<?KfZaA*+>YbVP-I|Z1N~m3IBe%xURz8~>uU~T=26r&lJl6IoS3Yn?o|2?T
z^Z9A@)A|(8tgqrp>157DY0>2{ko{I+p1D$Zg~>V^+X%ZHlBka<$1oTP|LhS_M(8LR
zdW@+|=i_ACcN0UoJvUHR4(~dkKsJ?3shUdK!n6V_YScPIAaYfEcIsl+;=WYvF_-3k
z-fFCNkS+ZTCj@S8+fg0gL6EMaVXNE`?mUDI^y7SAcdu8439xsb<ux8R9ZC9si>)02
zYKpKX4H#xg$CF2XvDI0PI6G;z!otGaK9`=f8un)>q8zDcFV`P!D63{6IQUWr*Du25
z5{3kK&$igNwe!@1hsJ|`f$mpm^alSb3}OjCV=U$H`D*AJ_=Qt%)h_^XZ%Ee|FTWh1
zLeX;D&2bI`{6p&lt#?D%Eih79H%9gY@ySv=EL^rx8^2&+c$Q_}l%}z=K?Y@tjx>I*
z>uEX@B+wQp{w0VP^#)2Jk4ZZU)ub<;==<B9?>bE}Yr*ScbE7ZtImBCRq@ea46@To0
zf9^MexBs|8Ct-4{p2wT36(0a47HE*U^b`->c!{t#$awN+<$dusF^(!bApc7o=ULR?
zvlqXMuyFa>hE)9qPuCFq#{3jf+(7-jWKK?Rrh&q6e{Da5uMG`?JuWh{*DL@SgsomB
zBnPP~@9+)yIYXmIM)k%8|8xa^NKKJs!8oO>q|Ak0!FND?j^q>vI(H%LU*hp=C!O$8
z%lnqH6RowyRq0BrOovkg0<W+Xqi*7RLu>r8>oAG{hIN@af&q+>t?AQfQIoL^RB=O1
zD&%FN2s%AS5_#h8VUu}wyh5-@^~nwQFpHS@C0ek-FPRy96(_~TXghKUltCz;<7T_o
zsVy2$0-dq46lz(r6n2~#Bm!%wD^N5aPrWJ7?2fNc7{&nykrZqg^atjv;6i7>F%33#
z6eB<Xmhd}TfA&-hQu*0N+p)D1Uw21V25YPmMwDjVt_pk(BbcT{d%c9LHX5JYsQlt`
z3Vt~Mg@gvG7hA}~w^_J2NbFBUb>#~ZicTX<3PL$ygWfy=7Hy5KU17370#!}RMRqL=
zW%?~4E?=Qz_Z)UE<f{Jt(u(utsDBsgW8T6bP~sI4tV@+f$;!ayg52<pIKqWfgO0}|
zFFCA<<b40e%<i@jTUXWjpOmcS0k$2?0ALl!hHmO*VhGnQMCea7t}tJ=sIp$(s<Dh8
zFC?W6B!q6rW$H_qfqehk>d~_5FLsTqB|KAJ%h^+^ewI`XgD-?$aTqk?M`)!-5`59#
z=N*N5j4>~ePH!sF@$nV`VU!wmnyjI2#qfgsSJ>tOh?f~XT0+0MH~9Jd+7**U%l@8d
z`_Q83F{|c?j;EixVmKF1kUd|8F%Jg8QeKx$uh013yrbhoUD{R6x3tQdT|^fiY^;@*
z79;pvNGybfuk2oL1btJ0`W)YKbT!Ay%eYh8i0CvCPgEn1B(2TkB(Zxobz0O<=!=q>
z1Ag?dt`%ujQ`x8_ANdtKo3<7n>czv1GxtpsT+Gb~zbHU)kPs-OCk^RCz4oH49|q?W
zf|2OOf#-Cgh5Av%irxB+S3WiJ*P}Zv=hy5lPo0;KY*|g<KtjV5k46oJzQt@SD)CC8
zG=4O7osn2{=}R!hF^2w|yCvj_H-F%=SVE?$RxnW|EOT%4N~fIjt}Os<X?ylU7ig!Y
z{lo_|myWCAmtE9K6;+Cxtp}<2mMgB9t@e0uNgNNqjcJ?60&e*k6{AkperLjeq1O#`
z?5oL3hV(O$TC;b=S00s1Cy3nS80zPxl@N@-M_*9>=>BJ6mVPs?O>DVAMVY0^$5`x>
zx8gLef846pb22*&tBMy+822SAS1AjoEq`ajM{f2*D4nW>AD6W}<Ixtr%FxyDUgH0J
z^FcB*EIK!mRYczVXW;#lO5^)1kF?9ER<vhr3p_=J67=k>g?Q<B!V+FDP55pD*r-EL
zv1VOOA2n663?CLBKf@OV8MPMr3}z4|lXio6d$+<z3JYCe@TCe;?}E~PC^H$z7fC$N
z^(`BcyU0E6G;=p4ljk$jZA{&qXEm>831_92wxpR<&3e~;nl>shamV&)5=~v+kS3dV
zmrmsmsvi!dE~#pVxgTk~`7ZF2z5b(wJN6!*K$=iBp??dy{fGVWvcK5Cio3e#sh0>r
zajdHMyhc2(l^_j1tZ<RrWNMo9bhI&7KlDC_2bbrl0KhMN!`j9?4%Yp|#vw)27n|6D
zR!LOfyRKb+d&p<L(BVdifL~^<h1W@vrq*ZC7WVeYWj*8g1<%5T?aCy`5NFGjPj$~L
zTdha4Cpf#d=(WYB-&^x-hK1XbTe?fg+2HQwC&cr<G1^B<ixje4pr-pvWNACj>Ye2C
z41(CQ5Br}iC$UE_?5$7Af_FMb(NI$Dzu?Kv4;KU@0kqB8sZq#2BX08<c^d@a_z1<B
z7XgUF9n-&NbqK*@TA6k564KA*jA{si^|q!^ibNxV)y=e*Ij?@>><S(tjU`}d1T(2=
z@X;4?JxGnRHiOM5_P3}l_t3<=@$a95S$PhW^7ZA3?MVTSpNM9cmj&kynn;DJeg#Ai
z!(j$NbO`h2(>YWZNx{|%*>pOgP@pMPr;B~vB!2@zF#xTDdv3TuK9CDVNr@2d3WDI6
zvIyE0=nDzr9ml=p!72?&9Vn*F^vzG?LX(G`%GJ-e{Ki3OaHfFDXb#R1eE0_K7;pef
z#DjIagHiQdj+gPrJ$|5Ld;o#~K2f&+^UJxAgxEs-?xNX|gL7{%ZBDjY>;<%c+u8Jh
zRC8@-!#5~9A{gf(gPn;%f-JU`wE1|)AW!RhAU*9GEB)<!sM8r~DWUk;f?*;3m#;9*
z%^2$yI+XBYdhbc_*7yJ60@{_AeM^k8^1_uTnh2w+P25DFA*qp|il?O*!ZC(EO$pGN
z)Df&1_&#qj--CEZuHSOAB?G_1mupu8Z~}kt<%N6-LO?h$ean`As>xS8pSW40vB2Y{
z1Q<eR@!4GRwS%D1SwCpg(w3s6!e}!b=d&KXi`);a(Q)p~ES2dN4;8Yql*=~^#wvc^
zHiF$bLe>?&37WFqhD0Iqg;gN2wLp$|vTmPkF&LPb^J^kB9ua+kUM{;mt6;cxeW<6%
z_x&&|tW!~F`qPbIp`<@l%K?emIW!sP3Gwx>ByUXYs29R0BKOM=X?G&%z^%M@7oav}
z{Hi0bd){}xLsQdUt8eV|y`#ZI!y==);pertHT_`hDa4;3I}}W+zDlNX4ija7hUgB^
zAwBgzzE!czA?<_tee`zs8rHNJDVF4sD+c3P?n`Qa8U_JEk(x)l(yLwR6-QS?%PHOG
z0Q6k%b@4U>R`&<x)qiEk{6cbk@uRn_bQ<mk;oz(h5vf2ubfvy`D=YP~TP{y~LqwGb
zMUy?VdqYUCV~h8dSk^#m+U^c;7~1+z=#2YdNlX=44uG}~xoTT4oR_#Gi?=@Gch;X*
zxOr?Cokm#QlGC<NOZYSJXnt>Y<xS>Z6w5RDE|b0rCE$y*n6>DObd3Zh0FJ5aNoR&>
z2^ei?;2cX>*T5fJYV<y;Sia&$UMvixd5ewmFe~_-^gY>E64^=PL#okFU~#fUdzcx2
zSsPt7hqKZLAeJeG0<kfpMQU*|#*Fah&m20yVA98^c<t9d>!3MqzA)V@y!0E=Qv#6R
z^v5^$uC69uO+LO#7yA#lmwQl5DkC;4`dEBT2+aQ|LhXh6-T(KO?kox3g4OwMSa`jn
zs1L3JyS~5YhmKwGp+EXg*FdRclaGPj<Z&)AY;PKu+qHd9U_X#-b~b9iwKkesqm)TR
zSa9Lua6(?Nbr1@P;`HM#?N@>MGQb!ck)uh(_V8#LKgc%%p)dQ@VNHPg-Or>;ehl=o
z$C<n?<ZDjL8i$Gliq+$gaYp(H1C0ELERK+A0oq{kyKdhRx!_9$Nn9l(W(<3w!P}PJ
zf7A-^bZ(2VK35UkYL8h^D&C>TJbb!Y|C{vqQfqQ4_vdx^SW8CfNS@&HFPC9&vlJ!x
zAI9C*zII-zfV$-88SpIc9_Aqz-RH+*P^sd)giihPaw5|gD*Xgh<O={6T^EB^Q>b-}
z9Afqo*iZce;Q0}0<Fhpc-0aJ=L#OKjmza4XOQ+fPuLi48YvD{*rTI_YQ-f2=HJV2+
z6nJ(E+$=mtRu2+9ru%H8ow?T|<W1<aFSlL_%!3+xmbJkbI-^-I=?WU8g=5px`&0E6
zFEB`!6LSHWXUY-L`@@DYI`7fzU-(f(`);8+zV5iPml<RNi!~)rDt&f*#-OVtV|HzU
zaUevM$tEf;I`%z43$Azy6~>L1{{=c*JmY}vk_I}Vzl?(i8O~TvZ{lwimtC@iGP)D=
z@F^poz^;7dRu+!0qMHfYe<t}Xce$yB^}C{dJ1Yh4>-nmPlMx(wWdnJe$Sy-3EK>u|
z5<cUv`k_NsXfT!Er_6e`pO9rjQTq8|CHDn`WbA2;yugE!e{|1!F@5(5d!477<EA?b
zy{J*Xj=7-^_$+T{0z2t%?zPUIgXM4TYv5mVF?v)6DrvdxyOOUMqqFyQe>2*O9o`;l
z^<(6^dJz0T^<=p50UnNg?I(?6dSTnsZ;1tXG{5Uw$dtphdn!J78)AJya8I6_u-u$t
z=QamwvVZd!uEZC0j6(MC5jYeqZIiNRPj4M0CSr$cYE9Rzqtn9kBm_l$<arviO`FC9
z)+$YZhdvJJO>6S<T`Q2XnZX^rLu}UFafddM@>yL1D}f%WvzJE2sLDIR_vz;jmw04N
ztn04INZY9GTOF-KPYgt5g~vvW7$qT2*dw~op@QTh4MUFP9t_Pt?7hbQt_4n^wC2xx
zGgeP&XsO^VUp6Gc)?Tr(<axYLPs{Xm!S`~G&17H~f`4>7cG`fTklk9`ejz)wC`V+m
z&PUT$p{`pbnS_j%P6uNBhD%W<?Pq~qQC{R{MGHaP6tdG%dSs}`@Db(Ny-sr7Q+Bj+
z8-z%UqtW9a=B}yyz>P$KgOo5)%}3&SZLM!upzl@Gl1>zp5cjvuy{RWcvB)(Ri@|Z^
zDfJRf_U_h*V(RAhoX^ko$+H*k3o!cLQj5Z62yRp2c+t{F2qTR)8;qn?0H~7mkkjv4
zgzA=2(8+ld63YU1={-jv_;K#&jCgKmJJq@6_axIig^FNrrxOuZMA!3d1V_o2)Spis
zLVm>dWe+C%<?8jIngPwit;jNb8~_@jY+ls({OzADFD)F!I(+yHQ#@xx_Y&&e0=hZt
znR2R~l=j`%p!-SApY#e!<!1rog}IC@=)5N;F@G4I37`*_`MU#f1&^ItkieoeRawL+
zZ{Rb=Tn0myR+6lV+0Oa??`B3Y?Z_Kfa&1S5&Y|Fwp;esT(k~xU6|y!XsmZP7*{^fv
zQT$+Tu>$<X9RC`!;z#O0EEtVO;9s7h-fo;3&s|~&*^RblKV5MAdl%FEI0rOb-uay-
zq(D_IdnZ|~QWxC4<dI<6T(#Vdua&8vnp=D0h=|RzRfj$97bHJNSC4ETXZz(lCM#F%
z3%cc&Vn$l+2RkSiAZ=N)J&oR(zq|BtYd=B)$is<en--Jqu;Y)^8)e9-Klj@7;q8$c
zGgNQ7vi4k-eOL^}!h49+-yCLRPAu|r47dXfRIHyTVY~~q9(E{m-O{gE)3Ut|y6CQb
zm49K)6)OKUwb96gs05zZB91-+{jD5mqvLa^71)W7v3908NQSL3U)$`7%ALOv1?nE)
zWh%as!y3!O8gCH8_S%L&%1Yz~k5k$!=QPgdev)>SGN`BH^4E@X)4Z3{+}Bl{y+AIR
zYLTytI2=7)|4Ksy0h}jC-8Tg!N~ZaD5|U@suBurZP46XEirVW{nJBun*#(Sm1*p#&
z@P=swz&SNSqa>#`qX$4orvC5_2Jt-N{X<y`U;hQfR)@)Pn)1dHUQtFa2woG=4dB4{
zi>yA(=uUbX<VmhZGend6k;r}wLrYv?%b3}h@zzoTP1%s6My&OtpAZwzKOAB&Is5NI
zcfv2$4II(g{+5^%gQo7%&*_+}6#IAUm;F`&@xFigjSAzTq3-W<$}ii@$4up<SNnli
z#_WY=c=t!>k!>q0=&I8U@ltDa4=GU;>JR6HpE6rrwQPp1WL5{vrK_lq9gzFH%;sPN
zVoYu%@%?6PpD(AvXvZ*jFJ4~a<96<z7^4$aCePtJM@bzd8f3ljwumRxA3^Z?n9&}o
zFR}Zjc+_qs*chR36M%&4%~_}PlmT#QhqK5R`l0jj8r^oVQ4%7No{8Ps3@(1wSQve#
zRaP5{(_76ve(-ZI)3m7t7W!?Eqkq;bFIAwh;@du77h}-H8pD;+p|;?sxg^Z*<u0Qp
z!X{`x@8`6?3eOo$?Nf{QclclRYx$=*UFVB``;H+q^${-@fCZT{9sX5Iv%;>vdaaZ2
z<DvuwR*AOaMOCrhzly+v2-YSEnIjDDqv^Akv9+-M;$^Im&00vhpGAq98gEwxuiA^d
zy!?^>x0eUK$v1nhKI)EmH^#l6q)5w06g%{7!87wJWI8XNSZ?G~0{cg~<*r7C{I&xS
zA}#~7U+sO31RiEaDNB+0Pb9}?Yg$}0L|J|vF>jp`;Ekvm(GM{A%OuAZ%;SflI5j1n
z$7RPYn%`e80ePmNOX1PcV0*Y3kHgUWuJ&K02MC~Si>Qq}Ml`%N-_8(i+BL7+^~r4u
z(!_D5y%Ijk6WP_ce&7r--f8^<{f-=UF^~{8*^-TJS?hbb?C#`If@IlmvbEXMQhn8V
zw}W5F-f!R>al0|nND^6dAs2BGQX7MzH}YJ%q%tl@C&p&oG|u|=c4I%r&!cza{bf4`
zun6{v1wQ|Y!EgSrsJd1ApU~+Lhk}9YL>crIzgM4eHn)J}nkZ(wa~#?9-472)Gw>~4
zW(_vWOog5gWB>)QRCcHU{gr?PEUNQ@DNR)iG6s-NkN&kE{56B`jIgdzT3q&jDoE}g
z=6K2du*b`sP@4y6NbDf3%@;&n=}c)o2AWC3XMPmc1-&6PwjC(Gx(Y%E@(8tQgXSd~
zEUg~?GEUO6-OeyQ+prAuSuPFz80gtBCazh;O2o3X^B%otj05!s(elA{c5cEBRaQA%
z(~+mQ)}!{(?KP$W8+b0lYnVSAP(0<c4{UuT{}wUf_2Y&)C?<95F}y(>+qxmaVmVnw
z6TjFz)nR@8W*g*S3-ZaEISt&GalcgiU_G<Z3+TQUsJG}O>680vy_@b*3VwT1MlELV
zuQDqsm^HUB`lZj;bEyRrbC`HmheK_y(k|5)hQf_L5rfYLznxyum_i?O2hb6#IC?_`
zzL2A5PKUt#J)QL!gBn7DX%Mc7*RQS|asv-9QIWy9Ou>$KzVN9en@o$M5noQ0Hd(kn
zCv=#-EgG@^y^QZ7-Ns&9fu0UlYMjm^0}{<)gqTD5kU!@aAar8<7C8bN?m^Hp7tp+!
zNQAerqA7+5op@BQ7Fgmbj1?%67<G61O5`cm{yzaIK8zeg$u{s2k~)R$s-2hA^gn<9
z!1VJ#L~tVzY-%Uo3CIb&&P>tbRe<EWp%&pszV$W}FrLr{$tKl@08~L4cp9KSxJnd_
zIo<%^ICvK4(4o>zON>K&RZuZ+p>vjEH3j%ey>6w!XBePd`4!iAejVMd9gQr}X<r=}
z%@L=p?#{OLF!P2XkSKM!w&TLJd`B10!kI*9vuy#rin;CSITzdJfHNF(<izEuL?4>8
zjqJ8p!Q{l(PHufv-M|nQIzOuLTN}e?PpQq@5-QO{-r=us>dPUjeiG}QmCbX5TgoP8
zKW4pTFs<-!BaPk5sLt59d*_@DoB6O$Zp}EC#?<w6)c0M<;)V|4%HtVYOmjC7us3YZ
zx&~pF7npP#_w)OD@K>~bLLOv21^A`-_zTv6#HpGU7&#ceo|Ou^<i(3`kwVZ&lP^uU
zPM`N~Rd@Rjjk8|YuGoJENehR)lH^ZQb&86(sX3hd>>@o&?%kR&`4<oGahx{38DyG>
zy_stQa3W}H`d_mb?G1+$6#4)N(vpEvysLBAV+0pg{vM@taj>5?H;|#}<=Zv-WYvuy
z{Zo@>lee?K-cv~^Vzb)W^SGp?eKxxx=W$;;lIwAy_t3&xhc;v5|8N1W<V%1S7dCKe
zHl$DM6OY3QH~k!;?UhJeOhU29ynUiVlQcNQGZg7gg0`p-k_c%T0k*{4!dUvBbA$<-
zuK$1={1`aC?2QY7%dirc9;C_l_et4;kGi<l-S*f=%ROywd?dat(Z@D-d2i=P2q?w-
z<##2&I?N?!Bwu%0gf?^IHnGKR0Tc5zZ{EUU|6Xx7EQaOk+M6^6-yhxk0rLUe8bE~$
zl5TVfSiob2A!8wnutenM_sk<m_Qdv+b!i_Pv(N1;EvJT07~`(K8ZH0Qk9LI52rpyx
zteVH@V54&sp1ZV|4bgUDu;<X&gyRamJ@oi?Yi6Xk#+cvDT@P~U3w6y@GI(==ScZGK
z*d+{EDM7aOKrT46N2qAD>GsG%1RozD)GfUVV^--4HB5wT{>10xv0RwqFG@B5+ur5p
z-0XhZv{qWD70Ec#`oa_BA_-85iq(J>!u9nIAMKItH<Hq)yWU?Zt#gQrUiH_-6$=`o
z`S@q*V9{+(eSBN|pT0GiJj~fmnGb4VwdH>8dp%8+!l)`;3Sr0ei;EMLbmL7Dbjl5o
z^phkSU0U`Z(L71r!LppL<W*D3KyGx@TTzu?-g=YZj*amFOKp?1hf*I^?}J}RMoZj@
zOkiRD{Hb0py{oWLtvZNmJH!8j;--=@rWD^ig~T<Ht})tHQVc8B4%cmj{X8;e%sEWX
zGQr&y(>Vrm`(>snyZ%tCVX5LXvxAY@OZ7+Nrvd}EF_L#C^;>>RvL%SpHe>9EMm@YJ
zYL(aNzp2JH*}R0d=-D+juY%@AAG!*;`HQqSn1okO@fxzm8HUq886E1mdYDhCO+BpC
z9rNone(OXB9Vr`Os`d`@P-&29lLiaI6hUG$aYn5&Lb!QoO7_n$JYVu1rt|yEV1P)o
z$%e}<gy#KJl;!t|j%{a+B`PVqlmY77!p8Bd!y8_kMyS^GP0E@ElU%*Fe+1gRQzS`@
zj$(&AW*OppN}h*+Dev6lw?A)GY5FXCMqs5m_0^F%I+ZS978Z+Xf9$5nmlF=e9Y+S|
zRKVhS*n%Ctntb+_EBI^7rm@Op`C`nedKILT_mmDbnMbSa{$>PdWi6A<C-+Es0${Gh
ztl%<BZ}PJ#vcfR~tBcLf<f-<j%PQ|WZmaz*Fo*5ZC^#Iz1{6oXi!31mpB#!W`H>_e
zqu;gcT<&T|v1YRr?Cw9vqHIwSYJOdq%8wFo-(M>`p#`8@d5V0lf8G%LS(5XPa%`CH
z&5b@Sr@WCswl5El?hW0L^#_bkeUZnF|DfLoskZblbV5&6efnT=zcz6rM-+K<mUd`C
zAMvx;ceVC|3(Lpnp=G&7+X2Xa_C)gU4`dSo_0hlEP+>Shy!>Xs=bLMG5JX3K=S+Y~
z_rG%I$o;9dk%be8$Ai#fHXX#`XioE>;a*)oz>K&(E~LsP82F)%+hLCW%Mb()EMOIA
zilZg=#asTPxshb96i#mYh@YoeYLaxnQ4Jw`3t>}<ICZ=&9?*GX8A_C`fr3`*_Y|z}
zB8BtvI!+s9_pNjOtGCHo+Fq`8z&Urn@ZM*!4*5S7H&TL6jwO#dr|bf7a;}(&nAui(
z?vH0CRV_3Y1vW=bua5gHpX*g|1Tv}Y?f8a&$u}2R)eG)cMDq{P$_1X-j+20l)(H^b
zxXrP)we<DHbo@m@1ThP@0><YUnwv$edJeX8@33Y&9HTwnXLV~6=um@7nhqlbpmf%h
zjPip=r#rWmPr!ad6Qi}8@uL<Y<wvfe*2og_@vZV@lD}IN(T^18TrfKND4|X^+WvHM
zQIF*ibxP}DBJoG=Fj6AbC7D%3dKUsTtG3GmG}86{3$lygcuNV}LD?2dzMM_x*KhG9
z{w5rb9!O>tr7HHO#h}KJ44t!T*jlxRLcfd3h~$S%A-vjI$cQwq)qa*L3%0lKKKQ=1
z#(LcyVI!*|a~3Jwea*+R#}$y2$MbswflEiK1ps>6J+Hv*7A3XeUj{{MN_{ar;A;OE
z^2K^!k$7qlZ>De0`*JP3azCSbOB=6eyT}5lZ3b?S>SH{IxU(Pn7aM2Yj!f~b1q#vb
z0&6k#IWhy7Cws~d#O(MffgtU>rHA$q#G5pY*VQaEnQD#VG0ZmIc8G`???~37zo|m;
z)y-<s%kKdB#pIoK3sP`wlZz+?>wPxQ+Z4rhHSqS$z}t`2)gbB7O1$sc)YQ1>!^9%E
zpTaly)R2Q?nEP1Cln-p%yV$FR%FPs=QmRmY;1;d{2c#`kM6iEx|3fePjC~>24E^OR
zxGbeamdy2ZJNOSXyw6VDrnyP&qA|n91=(4#6=TmQdiz(MVnEj2u3XQLV(>-68vac1
ztC63s)_i<VR`u813VSE1k;w>}yA$~-=9y-^(yDqAcD_5lc3+Pp`Ck_7t>w03JnSpC
z^D>HXCp0RZEDRfOT44l}RKBmn0#|agdYiRF1R%JWzOyg5>L5zoP&fogE^=P4{-WXT
zB+D1QvN=)RoEe-x8<=Kq3BXbW;M73czVwg*=+yuiRzXl1Q01gxcQ1w*Hl7&<Y>IBd
zD)%jo9yO~VGd3-q%!!KVRDUYS$l0o!ljU&J-6;I`@3Qc!i3$tsNxT@K2k9LYe|_qw
z+wJNGoXsPc7+j-pc`2Y0p!)!lP0D_NC>0mke|dfAj(}~<&#o!E90^ewQ4R+0m5F)r
zrQdezb}5uusXbG-zM=q}FyI@&{~&-<xc=4irhjSl+iD4t64ie%O;c3dv^D8@y;Rok
zwzMCkh<dWJVq||!scq@^8%M|3V+L+)k|LEff}U^6tc>n6Qv{W@$%Cwa-vBOMPA)Mn
zn{Vqw8*y+(Kem%fo^n)ijH<=jrw?uGHF6Ox$2{6{9bGrW&$29m_><4{7~vg;TxtE%
zLzG0vvX;;)1b5yy1#`=fFxw6)qnAIx5HFMd!<m{d`}{|Z``DzmOuM}aIDcx=@*>}i
z=ESGWJUemL@ha4EhBd6zuEZmAdgyyIL;-ErW5F4CM67{dcsBY0KP2^N|3v6i)>}TI
zNfW9F<5t6~lHa?sglhtTW_Cwv3P^-##p63skRacdu&%xXahj_A8>x~k3$DQ|b@?v~
z0U0jDE_$ek*1BNy-hi2FD`9E~uXN(riFIVl1RjDMl51mo>#W)@wI14_ch#Ro)3GDY
z{5y`@Tf>(;(Xm~(;|<Rfg$8oriBm~vQcX+MGSP7?zZF(Xi0Mc@0ve?w<p7n^phMjR
zQRf=`bb;FG&_st?*38q}Lla*P&D*zc0Q%d(mF$2By^l!KUcj?yXGkbmky`*5tRTS|
zTIZJPH@3s18u%jq7TQQ_gU~R*JrK7Ncyz01Ry-y-UdaVAO%A_k+X=nDf7C=u%_6S~
zLi^wxiMh}%y=(pfkBwsAB!xZk(iPVrb=%WRY=;fYYEr<CjVizqE!_|QHIs1MufJ0B
zfJX)&oSo_~3)zMYg&@>*h|=FQ*gu1JfnE<c>)6vWh>B&vcQ89*COe1qhkI(E>EUP9
zT2E(IxNhbmADGE2f~f{GY)_i9&rqR@JI|LrG3tm$e@L(Ci%xDQB$s%bVL|F%Te0VP
zq3c6>Ha$NR=6`x1iCi3&a&Xwl?+wVfH?TP6O4QP<dTD_TMoo62SPE|i5uvzhoYF~X
zCRmAP4(W3o#z=fajtLbNQ<4HK_5nqH7=>UB<&8{Ij>g#?!-eqCKeo#t^eD+3dFTeX
zkrkFbhmm1QngInJ;0+cKGul**9L5;;yk(UhpYOE4i=(j~`HJZF9I$RnmrQ2fflrs8
z0aa3z@v*}UNQQg~HS%U){h$7u?)&|_A*DGFUMH5xBfCb00<#-oQ^HlRxH}u}pz{~a
z|D`pX#{9tZxhhceQuh^*-}(ex@Sdjw!3{U=r#VVHQ|=?VTpes*b$jULB5->W!Fk&<
zlsFfw8OndT(awz8GvM2g3x90^R5&6g5?6-`O0RK9sKL)Se1;V2hXE$El}7u>en|Yn
z(Hm?*Z-L`}>%)yrNl*@%IXRQZQp=*K8%3(jLPS$CU!5$<I+CN8_wJWtMqNO+@ze=m
zDUTa&y$}k8e#sBSJi`23ecYSjEibG0v)Z+B3tT8VYHL6BH?VZNb#!U4D{5c*o7>!`
z)+6|?A)1;JMANd$NCvu3Dsxf4#nUIJ)I#g-$<G`6YEG1<edVK$)epL5JrRw~iQ}#b
zl1(<XYhtT*3PXhbx?dq9<1qN3uH6h36PfEnM|nMv+^7sZ9y1q;|H!fC`^%6uZX5h5
zGV<1oYAaplX4j~_iJLb5+1+E{5?LpgfFFEjRw-NURD3qm;`3)$0N-EPxxU*d-kc~0
zH7o@bxSwcnIGVRLQpsuhdNoJ9$~{j>z?-0bTVL_)n{s#G<tz6i1s=0LtOS@zA$_he
z`<%~ZJj|n1+@AeE)%&3qcV#$C1k%YJW(l>lZ>Ir?l$75$+GbWj^5A(rEWW&#da6c6
z^QQG0;S6ybm3a_N<_tP%TD-@Sk)$!)>=>{qokXDjX-oiE)&CSK$?@+ZHncQCInlfq
zyR;Kn0ycFtt71IHzgi5%)YSndCD{_*?bm<3Bj=APxxz44pg)q--yQR*@?UIUbyJz;
zJ`n~h=)O>|QwQ<7d6uetg7PFv9qFUBPHx?W7Qz0sL-|FHjRER((QMMc4_AS?XOxEj
zBTY-5?$dsjLu3!yn(!6EjUhcL0V#Y54zR|q#54m;jZ#w(8e12{RBO4<x)$HmG5+d0
z)>S2Hz%OWj6Vbl!|NP~e9r%Ds_Vo=J2-n=25E%r$+5_yQ6du#u&*wsZ(Y^T`*I5q1
zIgUg6|3AfT1r~FXvyX4tw&*Hs%LM4Bj#`@|(tsj2iT>2fqZ)>RmNm!Vc}h1)k1hr7
zQZkXK#ORR|0Th`tp?@U&tTdw-A7rs+y`mG~cNB93G`56$_;kQH7-YtED`H>g!1)1_
z4{Skc>ZpsQSxKShxxRU`(vK{<t60mAtYH#S?Ys<bEfM0$RJLkVrnfhXS*zI?E*?ls
zrn2T9!xuTbJwEjTqJSb=0u|3SF;;T;&2<lhZD7dN3|`G>>cFPJ*1FoTH?x0ssUwg1
zzRfW(ann0oOk;bxQUKfCw0;$5_9*B{k>Q@&P5l=eur6_)$9+CxBAM@mA_nl^&hqTO
zj<Ou3=M5q{8vb<b0m-_xv1d~Xz=Ev1T1xo{XF7AkB6JCz<lBVkaHdm3$>jmyu)p&2
z5eL7Nn|`GI+cEbPgf#l_ypdA<T+l>F=HRbo)!3n%jcI@E{)Y>2eq-@aq0g29aoQB&
zlVQ?PGc$8HssqF$Q80{p7(9@>26z)0=7kZiXZ)d9`#@mW#yy9`?nd6OR9oJ1VW5AU
zpk43NE}F`n{@+|Lou>}vw_=LcITD5I;~ER8Cq>BWn#MT5_ua&?3tSt`#IO8ovg1ju
zln6X0OPsZ0-2eck$ga1=i~X)og+6oJR}wBbvg839X6=f5;8}5a|M{=(JBXjHckmK~
z51TY*HRk*M2+!DV{?#@>e!SsVT{>#DRJXBQzgz#UW9m!mkA~C+g$}u-hMgXj13g)Z
zO-o$EwR4lYA8&L4xbYu`qm9s4_%XcXxn#uhiSp1Awcc7&l#)ro6z>?n(BP)6Yq*`^
zj;)sbUA}DPCoa>sPMB{ZMt>l*>tX?r_!HH8ev_M$Z=U`*xIf5+zm<<XLj)X}?6Uwm
z%E|GFR^uWF_HxDAdZx2O<0>x4*3RNsLX<lqK<tav^kzxrVQ%vwt<tCmfJ&ly=pn0O
zco{iUxbz6t6yoU?wX1MWkRipqZtKE!&Y`H(0g<C_YOtobBV`e4ey?31w!;hy?3A*(
z4gM1q4|8t3{{+kJ<h}A^Qesa8wxZ&H^D*%T24EMb$==R!?lAmLqaIFc*LH;b4_-Qn
zlw--~*Bi=A1Tb0XdOc_cS6{Ls9tV(fn3YI{Klp+alwr)MXFcgs0bc%4FF&VuNAeGf
zJaUteY0i>lFmWn>ty8RQvuHob6K*0FoD3ZM73aC4Qs)ME@-d+eK>ES!w(s4015k@^
z*262jq&jqanJt>C$fkL%fCv|OEHayZoMp&Cr5}vtFH3};a{94%NXCH%0meF%CZy(k
zY>H&RUWTsE9liG|RIX`gd$)UP;DbiTFJUL+CTzUp`0UiPlmcO2t}lA|p5>5ezeUBA
zaL<+<`+4|zVdc*i_3B^z4A?|>#Y^xpLxe3Y756Y@D`AKy48OP<krGE4$rKXPB&xOY
zWNG#c$@LiRIcJE&jVpI=mb5}o@^EaHUc!)dj%cpNOh(vHBPtRRBt)!(pZiLNHaAy8
z3{JTmS$;{T?I`C#L50yv2Ba_k4(1!r-^W6`Dwj`n(B0#(QO=&y;X{kf@7Z@?1RXns
zFtMAIQ%btv#{%~`6~id-9U0f!FFyb}E@bJy3NpgwY*NBK%2ijfbsjzg+nYL-)82e-
z5yQ7@^K9YZC0aR=AS+jz2|k7$-#0(I{@O|`fphujv5x03MY!XT?>WYse8x4G@F7yI
zf+~};FD-HZoy6gFG_gFGg<6_6p!)~K!@EX3Y??MP^xv}RG#lXyT>1vdboFO%baF?4
zn<ZG1M(T+%uA~YY%n**Q5|uGR7Q1Ftg{-WAYgfj;b$~9}rcghp&`Ic~OL!!teq9Q5
z^PvRuS32pZ719G}M{$?fSS^Rvx+e0yPcuSiGH`{%hkONx0xZ9XAO3$qPKBZVk(djo
zofEJ;cohDzb~rni<p!avK^K1)O;NnOcD3H+nJ^#pYVOlL0QZDJPkH`c@?s}s-{=Ik
zGhpyvG0Q9qxh1Z6uJDqJhr7P)RN5|i6*82UZ_oY~69U_u&)n&%F5{HCNPzZZLwCJ(
z7tr-WD5Q_{zkS~;ziK<g5&oW>=KEDbAkAX!#m1Az0oM+7G>D4+mmED-sQBD)F?AXM
zlb7r6xeZ%&6MCfW!+0v|_4WyUs`(4exT}#;n%5MLgjHnTaPo1YY`SlkRV<<kRq@~a
zReJHUWHr0WP7m@k)mD_f;hC!H88sNTMOH|MkC4MFh~HIs>)e4dmk?7bZa{B6d)u$R
z4q$~aT2jdx5kzTnS8ySN>U`#nB4^WvBq-{LM<d`;&_f0A>TOIjlZ9MYTH(<uJ!lTG
z2&rOy-g(uQ*z~&4-dP1o6tB)8?dkXh*KT@awVJlgyDTY!vD6t5X#Dfexahx3%K?0k
zzfoPQru6WwIk~r$uf5QJ20Zb?Us?E)-)=_jdIk)V{L^N<#^o&{fRDrLwSS7yFRdbj
zECJ@P%~B=Opo=s=uBm@ha~{BgEz+H*7v;yg{jb<EkQu*N4iy{M>s(voT<I|j_}2h?
zeJJ!d5QiYf@HlVfttpLI8#ChfSmYY@L`VAtTm2>g;MVXIdq3}v$k_viCsjZ5wt_pV
zy0T}HJ#A>v0r9B05aqa<c^aS*fU2$b(IQrva(RL{5Eq9>9f@0*fZeJPO&a_h6!#1c
zx%j8?@44V1n$|FoDWlY}-=ZZ9E0%aBV#8`GA!*xKtn|AU3mbWKCtjEp66F#kYiaH8
zD6%7)oWoOe>Bav>#cMEHU!PQ)Qmwe<w1e;(TsSjTb@yG=0Jx{Faia}?5cL`>t&Zn&
zR)pDXcVFw4CCgRV@rUt2g61OuSO3icc~PTpID2xO;Ljx4X)`YDjS-+J{*W1QH96bY
zXjQfaBf719nB!<HhKutvv%P}4ZWVBYGye}-(muCoDMr3yMl@*Ak(E^AZTQu^IjRQ$
zvKdVzpGtjE0x&A%yyFe9BMO5y03lPk6mZyIQDSHc%sW-=mQE||*G<X0EpUQPC@rXz
z9Py+hg$l4hoVoXozH&nju=1r}HJYZ)0E16j8)`JkEq@WGoLhj}1z2(%?GX1{lWGax
zTP{iF$%iw94Wqv-81DHKON3FA+$j0!aI5{WBIbpPRX(*CmL+<v?Y5fOzJD*K!1mOy
zrAcna`RtlkeZZIMwf2S6;^w{Q5NvFsD1w9b(CFU(BJ0h=p?=@@|4JoG30cY(LXj<G
zH<3_8Qc*<qosbyYyb6(BvM-Y;DUp3Q+4n8`&KSl%W-No*zW4Nczki?4@A&*vM@KSw
z&fNEPU)On_kGl=ESmFIa`nMfKUpT2VMi3;Xc#ZcW2^k~yy_QwuV#>u71(6SG1x9L<
zVbyT&nm!UJ#rC^T?`9m9VN%^m#u+xtoN)PZ?~T&mLvB1+QlWykaR8S=4Cz?BxuR3!
zYJjLRIFnFBcA03~c4Q$OFo)+wRj%x-YH$iml)G@<SRlFC%@4%4t@U5cv;<ERco*?i
zaF6!q{OATp_>o2HT)EeBI{7Dwvp=@Dz!=Mc**gX%FmZgh?g#!b_dv8yBRP15r#A7<
z;0~mPOQiYjs0sLV9@im~s<@%Sq5L&vS#T6hTyqCEMGW@$)f0i)ki(+g#5eQHU3p%#
zl`rPjGS|A?!0*K1b&A5#2rt!f$<^9~nus4UbMsJkg>iYB{y5ss;7kRYtANQl>}~Z6
z>xWJOXrA_nf{|p4OMKnciT$5zqp8m(diE;_v5igqjk~$G8t1iw3S;dN;$d78oqU%u
zXuz}&`5dj;Q+jp}^lAf`JKbtkf%}f;`^bX5S!=!<Uc6V@d%5R2NNNG;3F;e2i=7Jj
zKf(lgzQLN-z^I}K|LN`-s?d#RJaVxnf-bQ=&Ny?dB~X-1jkqD&^OK4e#COBC9o&OL
zUHUw1eMGX-1quv6@Lk7gG_>~f0yCxx9jCQ1yeEcvJPSp?$n?%135cHcX#Ge6e{TP!
zeAG8xc^Lkb?lvJ77v*JXo^W_EsAV+)N*n*@k&XRDxRb<)<jAv|<Swyff@-_6!4dr{
z%6|9C+`C?fQ<hG)95jMP?HigmmX6<8Qi0xTx}q1S$u6w-ddV}KwZ#m1TWw67dcd1O
zledP53E#F?X|AeUelF#IqMTr=7*=~v=h6LDwcf^Cf9zWz>&qhD-#N<D;gM?UI_XE!
zJNws@M(JaZl(!U~*!<*=ePIkNbgYY9DmwiU$_j^@iHp21HFBR_SrnfATGmY?GBoMp
z9wY6-c)>tQm{-z^<*uERXnAB%S$h>YWWwKAMFnQxfSud<=!2^uBZ&dst{scCwkc^A
z<G+`L+jZJ(_aXi37TMm2fh416g%rA|Gktw|TXcdE+I4UHio?@@My=4<(|7hmYBgL(
znL)-yg~_`%YsH!F&i+sfe^29Ab)OzqmABI|w1TH&cr7KaN&f@thjbRo?>u5ZtSrKv
zeAkBN65+iU-vW;hr%-j_*CX=XjR@UIPw1;UZ-!~9ZZ=HO=e#p8ZAiYn<>K4}cdx`z
zGF2a`JHEJ%OGKOCEP&J|1nWiUt?pgXFR}z$Td>*Tmc$)Yg5c)M6Wh|tg&q-edp^@V
zj9pLE{6z{6-<nd-lZDa(7u34{n`?-*f-q-?v+$tylArS1s?5ovE$mubNKlfPv(sWx
zohz|P8{r*EIne_Km@(u(BGOIvPmi=N#QH-12w(=#;?HTAc9B+5<OBBP(L<W#kAb-t
z??@TBa)jiIb7%>_SM-9)C)3_f@q|&QlJs<TAHIC2vFs9z4^5Sg53NQDhhy$sxTe`%
z^;_UH=dtUJDfd3z-%lC%r+n>X+SwO+XHJd|!ntc*l0DC^=6&Xr-u!)r$0SAAxX^yP
z<DPDP;1*}3U{vjgWNwy3BYo6D+H)osGB-5?_lV)Y;kW0lAkPZy6;~SX$$Uleq!}o9
zW#~DUSX|ayy$jsQx@wmKr-JUzz~wczWN>#RDQQ!$vkLt2yukHT(=XnlI`@Xu`_r^S
zMQU6vQX{|eIV)5ChV%jmQ$2m4em`j|xJz%beNZ|3TImsZouUW4x3jJ#sw6U~<us0$
zEZm)<Ju+`2{<fn|>2>jc-DzHh8$NmlsIJ~mzNebPb45JwCtXsJ7SC>2jMLuO89(5A
z=}H83-+qz9V&4GaXtzjI`E90krI`H*qoUX0P4uRB+GBTt`u9e^f}E>{-GkKrG|OA*
z?1~G>D?Hg!HXg{+vcFxhZAKe_nrp+neEu=(KHnv1WvMK@=0s{@QE0h4Ay5B8Uz&CO
zgjUZ}zb)vuG2$bXT*Kr3n~_so_NhoXx`C}^nJ5B9pG{$N+pa*c21;6!mWwP^^$U#;
zTdRM{HnOC9p*R#1b?o#H2^mb~lk|;xkTrQ|8*|)>=csW<p=)U_Nkw0Ae`HUBDD}a*
znAvV}3d8sA$l?@&HTbJF39LZlIQER<zExuA)Dyha<dlUyAMmsS8Q<(j?or~F8bWA+
z|AmBqu#{wwPTy_VqnCqf@^?}n^L;teBdhA4_v)BvS+to2RLvM#<2w8!zLN#sOjlh(
z{k-bB!GapA`Z>1WRM5d&W3e;G;>kSSR5G`0AQ-k=oum@<E7Em&MGT@Mf=}4La-9hp
zRDOS6mh_yGI~x)WyItNsWqx2CL*T_Ig%;XQkRjDX#;Gkt_`TiCmmBUog+rV}Y9MGf
zw_3+XeV2*^{V%TR##Y0BewkyElbi;8iFX|P(xc8noPokN^1Sf%elnK|1~#d^))Iwv
zY=(owAQ;7b(j*Iwh2|v6T3Bya*MSCvbYr5DJXVDe&Ob_|_E@Kn$~o6%DJO9^(Dk*B
z0&koDI}3oVk_Wak*^@SrOgu;zswQ`hs>wYj|DGbBjM$WRhN0vv1exVP{%!u`*6R`b
z$BaXPYOZg0y{DOLF@aI(iX$%aR7Wt~G+qJUZ8U{!YD=2#-B@Y~-b%42^-Y{fA2%6Q
ztsuX#$8)J{KDyiTuO+!BEGdm_;zI&&QQxh(DZn`KTAA7D^4#iDZVTK}oUN8<3`Es6
zdlcK=$UDeWXzUT<YYIrE?d(xR0Gn#2=j@j)5P;j0Zm2rQfMy+RSkEjw7mRgz*urAG
z9&U~KZ`En3Ow+A*&8fhP8s{=Lq7X<G-`P1!%1!bqefor$jf4?XNDG~n-Jg&?wO}6}
zC&LL2+sNXZ_V4;R<PL}2{)T}>s(-}p5ik9$auxs$E*KK_ySYGH>d`UxQRf=M8jg$h
zc*pES?RGCI)1-4u&evE4@J{^slUyoipz;QWwXGvg)qRRK`OIE~E7?{^G-!1&^acW?
zn(=6YwnJ>#41GByYq>9+pYOR&)dQ1so95dIs;{@>VUn1XK-2oasgv1!4~v#?^#|4B
zy#j5nFdN1#%~C1#s5f#0d#bsb57eWWa}@8*$MS61OPr=m`ChH<*;{Zt-kfz_&<0U<
z=Q?np5!1Gx&O$$EDAt(o_*hl+gpOV|vPOXJ1@6BU{D*kywqxX^lV(O+Yxs&EF-}o)
z^A<gD3vQ5)JGJ;9*cwqMm+4p0LpP|-M!BONZ%H;_1ydOlUG-zGtbVi~P6z2&%6fL>
zgzV3L1u=g{5b|Odu5bNRbfITE4Fu1ZbRd(RoW+HFhAK$X$~k89)>N9~>B0Qh1TL_!
zoT=)@-i=5>Uiq)o_J>6*cKoFfhv4~sAJ7ohG<bIlZl#pA%oW6zrxgKDNXmQ_wR<Wu
zd^~2+xTAW{Oqf8!%bYrf{cBj%CkcEda$VJGL57JU)4*XGwK4o0$LDnu`SS8_$?U7z
zqZ3r_!|lqQ$)M0#22We~n&vMboBbRDH{Ms%VOM*4naq%PCZN>p0`?p*xb0dz5hopf
zRi=DcN6!l#NdF!HLSDTgBRuDj-Q$PLV;G8Awsn9U9;k29AQ4*lg^k1dUi&%ApfG<C
z>maaGMD$861zu`x8opFKoUw7oghN76DESwA{xZw*!=IKmgR&2DR5&%BG)JoZ{iTWF
z#*6RO1)EYc-3i)y%$9FkB$(=&2x_mEJ_U2Ov0ojvJ09(h^?rTBoY?Ysrm<v?$*ixs
zaVSO-jFSXsJ!lQRGB~qCa~LMDQ+K2iI9YFhW(#?r;CRYX!*lt@c87|z#us+|lS8h&
zzD{iyj_&V1E!C8WIMec_nZfV!6A^CWw*%o?;g$|rBdfS{7S=iBC@jk2YF~!azCX^L
zMzVNTdq+G%dh$~<TCDW@kaR_v8+SDZnMUxpG)=^}DDhwNw^8k|j&Qyr(-IzCukd5D
zlmcd22A?!~Zqfft2@UB=lNlH@iz<7!U5uh%wwYLb=;!2Z=2)KAzERn06-hNKkk3u;
zPg38a`kgo&s_l<cDB8vm;-pu@oS6E|vL_W}7@4fLY*xmI0l5N!CXX@4i`9Y6Qg8o}
zSLcCFdD3XKmF1;};W{o;JY?_UgwRf9lRn4BH}Ta-6FBP83km4?<-?56J=4=6<j@zm
z{0ZLvm)Nt9MdyXpdTB|NqcOzp7=rQ~M&9Ef;VHzsu!BXuJqrXSn7reI7@`o0=2juh
z)?F~NgloRF#o^X}=Cl4XWR=6f*@-_Oyi+fUr50Nx^^4KY1UM^b0OmB{&@v#}`OWFV
z=XNfc1j%Q6GY}!s;xGG5t1B9fgIpkyLt{RN@E2Q5V8@4vkP+Dkf-K)4p{^A`2{!ya
zVfcwfN~iz$3hccXhwkidPmlLpJEgh*J3)^`Sqwhl+vOo_dLTp+F+QF|*fum9+(TkI
z?X#M)&xhXqL}r0(R~W3|-$hMrS4bZCE4nQNsm3e1uLB#xEcAfl8@)EM9|S7`fEPc5
zlp{}LvA%{hk#ppD!fa$Ie)Xw5K9wa;N&5gs+`=EtU?|__z|&cQk?{rrfjd9Q`*_4E
zoN^=`SpM<1@!in+(J}qrq@p(VZbZ@O+&G>tjl%fKAQEro5>I&+=6*6Q)}$Enimr2i
zIn>-0Zf@Z;jznA#+f@Q5@w)|*UDqo5SP5-cDcw5OUW|7{D2{b_EIZ0&xHtBcRR4_^
zQ<7?|`)KGGEDEq1nTi7UO>vX3g*Pv!#kWYY<mJ%W`t{QY6FCWD1;kgChr=jfdTCF0
zQ79;OiZ_{W_yP`kVbL5my`h`%Z<Ov&gUtN~f*B)1>lm~vBR<k2-*YuAh~c?Y0SFwb
zr%bf_egu=oK{VewC~}TAowuiN=_yXZLzbTEcRASwNdzBK^IA~90Kfy@DKWF7h*Z@^
z2d2e#*i9seFK+Se^qCGQT3344Tjfw;L76h6lCvI#-XE$MD+l&=f*o6(IU*@{W&=;}
zI+i4IY=GXqo|QB!GwL416sVm8TX4vTEiX*oQE~&3PD&bq<QFxEPP9h|SzKFtR;hxF
zIV|%vu<plf*9b15g~zz7Il-vfjIdU&)<x=p!eY?UmR4`1pdPA&PHDOD(5G6T;gtlp
zZx0fbXb*-%K1R4_=>%ETcsAldabs{DH{90`NUCiU7)^TC@YIyOxRs2teEe;sT=$1J
zyf*KPzDb&~{f6a8!HCD-A%tGy&_V>O{L4zmn_q7nFyXGtpmMA}_k9Ehj)pe9pSB4W
z9!t3DhW6S%Ya*_agS=@%(fSE2)2T+?)7#t+-&CX2Q<f)&T6wo466md)fDSKx#p!!6
z`|v}DLOup2ti?2%g72pcNg{}MU_=aMl#jfvO<Fa8{jmrl{UBpw5$hHdB8U60fZNRs
zTSp)N@Y0JIZT{OTe3iG|lfH*v%q_PV`b6g?@H-*^PB43vYM=bqW!M`nZc1(2rs~0=
z2)GW>H@CWS{`m=;2SlzBqh8zIDL_r>`A3s|*;@a+QP6;UHoTP@69Iu{>kXR3Ly-s2
zix2Tb=ZtCf$jMb+Xr=RC*Eyp~-p*alVawrc1Jsz~f=xeBr`Y~dOt93mL#6fg1^W*}
z4Wq;l{`oL<4oj6aOjY{|Z&LVocM{uzW=(SCUaX416>$=13O|Y?&*U|o7tw0@K>N5w
z4m^v=FK1ryzo!oHZvWgDl!KijN#+D?^UTFk2zg|3ETy~19V|!$YD}3dG!CBFcNlR8
zPA|REE&8VQ5UCxNn)i6$nfoB&sMbmhG$6dV{8(#dO5z!*{$<_62sm_**fxE4u2^~O
zk9UD-#dHO}%Qy@DBzCeJ>2ALA7!}mnd>9H|-2h2UE8IaLtUg<6{_;zLLG2p)OFhS^
zVzY(zzS1xgT>P+HRp5fvl^{^!@6v$%jKUZ}(r&5ayB`n<s%!WQe7U46vVtr)E&UkX
zgg#3_ls9}mat@+vh>pQ2+rxdPJ)*YJ$wF!%AAycfiZD6)Jd1LLL`^%jimr<vwFqs9
zXU7doKN;nQ+jvF1ypf0nR$P`y*Y{Q_H1?j!VEkgiA2`>!6Xhng=h)CTP+9H&ZT%nl
zs-Gk6Y1}_er)T3XkR^pb_QZJ^MtyPu`4s;aWw*wTx=`olN^<)&8xZ)uje;Bw?BdRy
zGx`3EDlWDEQ)3Nse6+$8F=`?Ouit7U9h+$@bDEnAjIq|zDtszm&Q-UmjcpQ6{h-k%
zNMx~U;fBEpUQu6W=XgwU*L|YzI2FZ$u{6s}H`42pPirM-mwykZ<DhFY@AmkCPt_xj
zG@?~V&v2j|RwG|3`Ww78{}7B%Ods%is|^||YBX?M%e|Y{4q9%z3(X@){?m%=_Z@%+
zRzbQxvGv9G=d6*VRmz=gOQi&s*6_PDG-*Be94K-r$j<{mF0A<i7nZh}dP*{@)J<=I
zWUCD$atC8@s)v^EqRO{*)2{rQ>X=%R?S{lFHXN$H>IUjM@D*+}W}bcj<luD2uV$>L
z7DC72f?a)Qca|9W6wEAWCE0@Vd5(gOJzC_WXd}o=l1GprPE^vz95In#sm|MZBNMOX
zFM^Fz1Fu!MaYbgcSWF)J(dS`1kW29;^j~L^3_M)bLQYD{$i#;p#woWUgSkvA0)l$K
zrAS}b3rhq{k|ONQtjo*Z+*-@Jub&m*fL_(#qM~vt5OPe?uCN+D9B@_4M+!L2&)h&O
z70wYib!gx;9pwDmDcibP*IZ|X=}TSma9cpqBfqe>CL7n4$F^qqyo>K7bE7sbfQ{;E
z155j9hrXU(l=|iVY@;7B{SVPn_z8v|vmUeFmnsikeTqJ;865#DaRup#P}Oe_cj^KJ
zNl4=S!i}x>d})L7p72ff${9s1LNp=c%+~wF<g_seADwl5+dyZ-@~=*P;lo~;9busD
zo%1~A2K&np<2_1#0UlS;k$c0rqap~oGH7Z2Gv9P0OTYYzcl?BVu|>q<PQCd4@1|U>
zNkgwDR{v_G(JTsaP-{mS>3NrT(Uf4HwW<>Tep(kvLk^aS@?gbVXxPrsPWOLZR0>MA
z_})+Lb58apVp+rq0ET7}r<_Xx;d3nH@=gLarPOj#0xO6(nCJ*hgvAp2GRMe6RsMq3
z&&L`-MUnq7@1LX6UWNv(S&Zd&_qZQP3=9MdmYQfY2N4~C?0|+<blCr!f$y~S9O%58
zJGAe&;?%;McEf&ONe-AZcZpSyd$QNliJhIA4exEmK9Sr2^p=xxiw9FGnN@x2m<+3)
z?_(eqSr1~72HLMz)x4e;I`sxRpV7XnjQv%I7dIfxTVN|7!7fgZ7d5l|F@98SL8MqB
zIl+M7L}vWZn?(A|KkOK!^l*xhwq96O`426ZScv0HlULkO&8ZU)B6Kc1*^QYKFmFc<
z7Pylz=;BovsN>L;(ujU9Z>Bv(G^d3X4}v`=Sx))u0gF+<>Y*xdjb%fUqk&Sou$GF<
z0(SN--HudaXsfjJpyJgZ^6+WC3q>CGOSC;-`>g%tERf*CXslCdI$iX5QUvDZQ%rK4
z_14;`ZBFv`sR~SLFa?<&e3lE`_PhKPq;Kcz_;Q&bqE1bWpwrJ#htug%0t(-&*rCX3
zzOaPqgZpiMp!VNiQMT80Nw&&L$n5^zHocJP!-P1vslLZh?n|Hd;$de3ZHf#BBTbWL
zuKj0~EPOx0_LWjAyZ+BNv^8=2{bsy&Z&);s6?_@_UYo%;y?x?<RtZ5N@$IckBG%xb
zP+sgistach{<LgPO`LncsDi`iGi?_Codu8>r$_a(bRQcehNiv)rEeARj2d3%zyX5Q
zqm^Ipd8?&OgH2wmC{>@<`zU{39Zov{-WX-6%D70>QGSUOd{O^aN}~NK%ck4Vw*MQn
zJA3u)VX&&(RCzHNZ6R1&RUIZ{4OwAlOV5WTi6W|W)!IR0=NY8A!}aZf=5-JHJ1w_)
znc4E1!kdbCX7}5|y#uD;jSO;a2U8i6m%mowsEuHJf8x{1!%MB41a;dWVXctvUhjY9
zyp796sSJ0xcik5=qcrsnN5w(1&aM%%9+S5fC?OCN$!V>+B8oVa@m*Nwr<9Ljf+(~k
z+<H;nN<gFLas2TTGV`mbFFOSYVT<&#Py$!bs$(A$!*`oyg4l`*(s;rEDNTZu$c{vY
z7w}0hpkh-FXb19QOpbtoS`u82jSrmlZpbabp9;y9%<kZ1e&1`L4uW2M>pC0TXZHUo
zgII-OCQ7$Le;Pn}Dw}ZHEf;*?gd#3M(VI=<Sac5MvlAe&j9^=Nlhyn|-tLXXv!j?j
ziAGZvf+NgJn!9p2raWLlu7Vq_|Eia{I>@LTj0@rxcb?f0sM(diW|KXp3e*l)E6a6D
zuD4x`uA~HAdIR=OCkew#&MM0fTknRZHvO-poo@rv56_>U-Txb~YfCx*+vzLYB#TLl
zR9ncg(OV%QDgx!;#3|J>5BaoXRrpySh10L$tpX>aOA(E9%SQwGMJ%mV`_8OImwURS
zo}B;s<h8WajlKK+F1U1yZ2YCIq(}kb;SkB~drxr*Xbrx&{P6uLJ35!PBw%*pxs8xS
zvwubcccL;4>7rf1(Dco2L5X*Z&psU<+AWaDJ)=h%cD)U!D#@V)x7_x+MYZ>h4Q)Za
z78;!+C_nifp`ROn-sKs4HAK(=BV>f(irkBPFu;^_LB@LFe<}RU)xv1q{Mk4JAHE%;
zdusXd%jlJhSd}8i52<fle7P5QoK;#83Fw%2YG4_PhimaXfg-FfXki~@YuL_hJE-xS
zu_r}Uy2ZarR$kV8y7zgj13Fi?9g}zI+g%oEp%N*})h^ps+7F@(Uhj1^lsfd3LAY+q
zV#9V89EM8^4&I5d{aQr4N09f5j!1mO;0#0u<*j13(U7n1%i_q%Vk!~^Fd!O6DKobI
zNnlf@0xkmb+DuFK<REM_DQ{U(JEt@41EYFmVRsv(%JemR4}op2?RwiE;@K1-uY5JI
z`gVf1GFSY0K*0^$xPh62#sG^A<XvH#2g5guu7{MH7}_rsIZZG62T^^A?_!$tl$Tq4
zu!a8TccRR{`u<oXgAI*|pTo$f1<j1V+jl3fr%Xea`}}fGrdK4TBVeos#q=wkizG=C
zo#;%tv+N3EiU>4oVaPn7=>>uFtte+oliUQCB-iYIe>TQ2N{LCiki%xyn7}7cbkTOr
zTdO)^?x;xNZjWMrjqPNAYt1RO^_Q3IzEpU;MXlmal=iRH4*u6#rrU^JFM^F=sK@=#
zqVzxeT&71{#Mx0GQK2vMEd&^DsXnSlj*8=yj|Hs@MIt=Y2!h6Gl!s9ns<0_m=rW7-
zzfpY-Lf>EH<<NhSmlXhcsSsPWrt-KSGrEkv40(X#DZxzbbz$%yadY#1<qyz+-mK96
z<8Z0zHR;nf;{;+M9+qEz07Nn$29oaL-=z2jQdISpIdK%09@)>vZf@~!)NYn0?og|6
z;w80X-<44wg>)(R0U~jK%qwQ?H&O{15sv}1nw%kP`!$UrB-Kem?5%CL^iR7ZuZukZ
zC*{Kjq+Q7zs==CF?W@-qM%|c)0P^H>8tz3K<u{8;x%18A%at0|WdQ)ylpG^A$7w(F
z5R(u&SCKfr#1xVQY~pfm>*XZP-PO`)4!|Ngc~oz|;RW|v93qPrDmd5U$HQdtgo4FF
zMRp`R1+WogK3QL%4Z}Xhwzs4ZK%5h<4tI_E%SDCW^X;9^!^L{!MPY45N}EdEY86FU
zqhCDXJ#A1Xo~QUkStctqRXx;{8u9q;a@x+~C8!8$CC0DQY~7HfR72<3uf7@-JHD{{
z$@F?hAWp`2?Ak`e$c$<?Iou~pTINB<*|>-#`ZLbd!4))m>Y#$J#gB1ZyUpl&d??*c
z(y=qFOP57(Zr~xa_!uxO;mk&v?KY?An=%vu2b$~BS1-_>1!RTc<Q?gueqg8vD9m52
z>%qdY-?pF}<&n`aa;`<t;hkhYj%ouPCc~4`XRn#}wCdPcHrW{eYYKGSteEzm)vvan
zNun+k*5}<w(nZq>aK8KPidoM4%%sssx2E_Ozgs$4<I!Ej$}OkE;WotU?k|Y_54L$4
zpSj`{vzLzGaqJrYsrDBQT?ppbZe2=Nn%s-urS5!^vgNm^4WLgU#X_|hvHsKiTLk^6
zGnH{1kLGX2UiEJY9~IX}gjPJAbO(l(9ho*qzL+K2q>0kq@KB2Z!P#cSBk!4JT)3Bj
zV&M`sn!WJMijR3YJ3I~~;GmkEi|J<RL^&qMCGfscPL}XT2ezoDz+*l<@%|zv5xWJx
zX{#&uNd&_DXa^1(fl>M?;2>~>XnenhS$R`m?fth7Kc7O@U!wlt?eVcyk+`tAM6ZlU
zW>T{G<&R3b<TP07*SUxt7HBj}7?Ex6h{^M?=;PH3%mskJ1rEb=zc*x2k{Pq(|3CWW
zHt^E~9Ghuwf(j-DIk|C_w39dtnECHxo%`f_4bh?$wW7LKi03*x<xWbm?Lt7&J-BX0
z7&AGeayU|<jf&0;)N#D?(!_1%0n51T88fALBi&1D*}AP?#2&p!_~_4SjXa{$@re#x
zlHO<@CZmfZ<KByM+||^zv5Z*o9}q`4mBHx8(%SLRitKYM-UaZwO$4(I*Z07YNwb8<
zjQ#+{qLe#xpwo}E00sinC~;=~_;N8*3ag4)<zgdSdnGa$u^Br1^p~dHis-rIw?ZZ~
zyRvQ1d5iaN8)JK6!hh+PQva8J>0R9@IWD1)x{A=N8-ROV-#fH+EhTY3#c#=EL|VP#
z6MO{fo#I$o7ij3i+3qshx;i$2dd>dmLGYI~A?YE(LdM=xd#Wp$h8a)yfCq9(x+V3)
zYQEX_#j{$_TPgS4PFcoG<9{J>FCV-&j_2#h8&nma89VBa-#o{j^$gW@HrrQ@Gk&+n
zEb74=^mpz+&+RA^1-(nY;mniKOw;t`79Q!9Bvwv0mRZ^pZ7np<M4#QCS!yXD)|z!G
z5O*lek(HAf)!Sze#8&1$#X`Z`+djyJ<Pr{c<F7~zgy)5|h0cmk_6(Nxy(N!zA}GzU
zbqwVo>`b%nIl>Dy6fnTV2XA0I6V(C2)#twMSmi9?E-A$JaXK}Gly~_~irPJTSJo-J
zKYjuXL(42@N?(0IkB!%y64@z+UtY%PDU7|1Pkrq`9cE)%RL-9bFux41FC9d0sI^fA
z3uln96K3%p>I*%vIQr5rJ%<c3SV#lD6U9&S-+8BHGTFjvkrn%_3Zafo8Pt;);;n@0
z@}|dJ@!}-q+*VrBTC=lysp)hDTu6E|p8!7m@Hdcy-`wl6l^_$TB2641-stwJ>R+{=
z4m8X2t-r~jy=ZO%U6nWo|FyWyjq{myeYLb^L3NeF-*9IbJ5S7k<F6&^Nnn;D`Itxx
zS0^cVODNJL73DdYyUIs7fRGlLC_g~ecXt(l7v17`{pFDMM2-j8EN|jY8n|{*u234i
zw1Oy0ABkhqf&hTYSZ&Y_Z-cg#Zn3V^rV|ptoExQYya(&(|MLe;1%8Oy%q-)vP0mJv
zVs7BuNP*Z8ckGrL-glNz1|RP9AQq%!=%8W9eH_9Om{tlIw6B91$h_CB`Yl^XSZ&f$
zQ?pxv#fe&j5qC1r?o7<#--)ASU098pfg0X|PixthPvLlE^w=uZxk-Fe8F&k^TG~6w
zw+}w1^!X2D(wFGWk%_~HM$*qd)`MW5Ki~SM=UlW;(-Us^_Bjx{p1X|^@y0v*uT_k?
z75pCxCgXe5T#GijzOFNiNluO^{VzH46G)bVOidvO<-NC>Ypst7SVuH=?x|&T#-}=r
zoA5+2^a^27W$wstVwC4G2~^i{9`+NbS0S*01#wrO?yGHqEbl?TZ2f$Nh2offdZ5T!
z6F+=bWz|ML62ACov7sK_<-8TkHRhjWB(&~L?tyNbVG=Tu^ptRurAJrgtL0UW{%V2y
zS&g;l%D<`L%iXZ2E}AxUk}jdL^Zd4gA}dMa9T%T?|D~q<_UmfH$mC|qT-iFDBFi3W
zeN#d6pf7gn-mQquUIsMOtj82Kv`a6m#r%)DYjbD`|BB^vxEsI0aZBuwa{e-9Uo822
zaOgFz*v~3w?3_B%VLz_MKG>0ZyrKZ0!}<X(#B8FZRPxQAX;Spo&D}~x2qKPybl8so
zmo3zVt4AvGDXmukL7^t>3*lL%OSP+gXT|Fsqj;;HX&k614KEk3U)4+31!16kq&-eZ
zpT(&5@O8`{=4De!pR(a?7~U~R*e=p+<=73mQFrn=;Ik%~Q6xk@k;XXhnGTN%BJb#D
zX-aU0T4|oV$=}!%(*51=VMynpj%CD+JSu1hbE~qjM$I~RO-P_l`Uh)PYpwo++K|(w
zyoMFwrx0Z;%-KF3WA!d;u>rdvRE4u0epHE!_3+q|Zm8z0aK=R%)~#vmiN>DE>p%S8
zILr*$^XGX%4sgC_Q0R`{>-!2`0Urc}Yjfi+Fw;B6)0#y|^VXo!F7MMg!hkLQ3*jk5
z0ES%8hfr|q@dIJf<gY=DP7PXWo(F!DKnMOn5JUA~>YA!9IN>nZ@OfHZ4N*1Zomr^C
zCr)M~$ocQ#QW;Shu8;BmIx%^cc*b->9|ujvS~~E6&s9U@EX@tVU|@qiPzIx7|H04^
z_AM0dL`iepscTX$Dt4AdXi*YJ{=nT079(fjjk*Ur9e+S)OhsfWPW~@MW@!ms;ubL+
z`A%FU%D3oVz<hGpI`<tP;7tP;Y`pnQXEd8^cwJ8wDG;8oQI<vkMob9+;<jXsJW1<S
z(m~VHX>~6o&nccteY=s|4y_X%5nW4Wcd!Zob3_f(8dI_AWn0YSA1f7Vp(>0&4&K=B
zariD5mulkv0|_4sp`(9xc|OVdLtSn#=d!aI=y|&Q%=z`4ZQr7LP7U2%skhHJD_nOY
z5#99(|D6TATxOxQ6b5iibFV19J13j+?aJI7YrVU@h$Z<xz0XT$`{{b|hdv8Jqk;QX
zki{|#JCFvmt1%Tbi)yBXXhEMK?2%Y$E8pRyO20COlSOV%o#7hMBAgl5U;<MTZDGtE
zh<K{=tw8bVhc}8(bIX27^;$P|W?k2NSjysHb;0j!%CAd{^qa-w*2Ie?fRp)%5gsMv
zeypdnWC06YYKIdaL<NI*?a<k<ot^lIUCYFNNiEABvp4ZyHdX{H-5N29k!(|@I;D<D
z;+U$oXo!C$Ra&E*!!`IX@JuS-dXR9%O;L*qfKFgd8xPQ+Xh?1*AfPp^@(=R=ao?_8
z8<$iJ)UsjFGp*~M?&+bRsj34R#{n7`oYJ`_m2{&U_G9;(N|sW{uFJ16fBQGA?M3&_
zQK~hSI`79*nHUxQ2UlOL!#FTC(JoRWW)Zn*x;yx6$bKmsgA8TwpFzHXHqf#}Z@Bew
zK>^8X)_w%<HYn^sc$;ATc3Nt|;4o8}cl-9Vt0&^gN<Zps5`K|so5*o%tNBi~`;ItS
z2Z4XJ5H^ZK)Z2ICp`^&)LO~13Jr=$rGCpwT`q+4Pl9fdc;!rLk(4uU7Pk7ebLL2^+
z5zf%zf76XBHSM$!U;KK*;4`D*fpj_FD{orz(q5tXmnVBn5|js)!n*S8)>6)fhZ&H(
zQ1T_jB}v!_g}mB7Hye$B@<skDod6_}sT$=AhebznY^=>IFx@TjU#d={%sq=eh-G{U
z5sQ6L$7(yh8-?+J<it1wmjY%{2(=-P!%Z0YA5y`X>ShEmoP_d{%*%(DE_MV}4*CQx
z9QOb%3NB*jnwh*WT=KgA_Kh?QL6B1NV-YDjM?U&ey#5hU?Xeq6oyVR_Ctw1nmj&9I
z*00^K@ofpz9wWY;*jtnH$nYF@Yo!JQwd0dE+6Sp{j+qsMb6S{o>geKbPr|Qj!nF4)
zViTqa&T`TTMn9H>$PXXxb$de)D&<EnzdZkH9l$>0x&fx)ZoAm1J{chAVsc8UQ9QzQ
zVp32cN!Vi|ptay~&zkEg%dDo_zJD6NxNM&C-<dlx>VMBIVx~Cf(b$Urs=}gL`)#%L
zHPx-FAbGdy_^D4V4~g>8vtyjDFx=ofRNmDFCK-F*nQGilDyJa+saA}?7v9?#Q{uI0
zgb1>$nM-TF(T7!W(7S$KnC>qfGgRSqmXpM``-`MYxP>h}Lt$!-z9b{Zah;lx9C*ir
zo@IqE6&9b7H+TbtbFYEgpS+JTH!J&_-YKM(e+V_6UA(6Y^mnDAvO)z*rRjCEEvE_h
z@BP_QgZ9l+L3}dhNj;Jyz}pE7+vd&F&m<Dz-+}FP7DILKuj>E|y9AoUJe$~?kxT4N
z)d&TGnpd2t5ntJ-WR0!vBk4y4gqswLpou*^f;6L_-VpnTq?D$$W&h`_d{uAhJltCh
zP+m@B1DVS9!?U~VSf5X6)NVMFhDtX7%i_oUrUKF6Si|3=knKla`A%TUF%$<nzaBcP
zE=jx3Hgd_R>piK23FRi`E&ETL))v&ebGo|Y1)dp3zjtc8n|jL_3szEk5TQdRcdm;k
zMmNUG<TG2;J9iI`mpoDeX5WuO_&;b98DI4uad<F)0fsq-hVWLzcGq*?Oy>ntikeT1
zP*b2e$Lq^uj(`}Z^UO&bfcX<y4YAC41)l9v(I%|JdynMB=ZClNHN0>+7^MX2(@@<k
zAYraKy)=1XAM`nM#v%X5rC|dh&qUHCZNk*PET)C7wqH|j8-d+RMD&$(&xOFF3msQ$
zMqx1lOH91ewfndf;|$|?f>5k9nA=oYU%l_K;~bFgya-9q=DlKE?dG)W&pSbwsryNZ
ze4Tw>5Ui9Kf60h3VS#ary+L&l10_d(4WEx&S4vxRC4r`E0t9)a(Npe*%gKmCp#$E8
z18@u;L@a0ea0?O-ZQjRT<;4c&h6*I9eGBt#|7nPNhP?Ep)2>C5XZajsXPm$pqY+b<
z5GdE?t&~cV)x6D`8;|rEE2pRgTCJ}x$=WO*<+J<mdwV00veprUbq_?N=n#!dgWk8k
zja8F*vOIz*5}2xlxEq%URQ$BHvEk?sITW)=$c3aQ&K-i=bl0x;I=>%_+eX~S-TBVD
zphoN4#!L;=QC%(4O^*d*c?tvLSeG5{*s!m#tazx|wPtUDVURW!Svrun7`xpqIt#yj
zeJ>~|d)5}m#o>ss7Vq~&U)SJjK-Vn0Qc_oD+2J!)Vh>esPaC)C7~sD7IySv;e-~+)
zt}&y{Z}-hN<?3Hjc^)pG^XGT!x3>S(pXrTao<ytP>Io{F;{IXduA>E@CghW+i<A0F
z-6lMzf|6YDp6QaKe_ForblWpZH$AgF)>#m8BuAIdrqsfAQT*4Up-_@|`xR*C1@`5q
zDmT4B#m5_de^?w0g7!ZZ9K|F$@#pC;d~FoCwmB;PM}mTMmCs8)>V?d8=ph7@`!c1L
zRhKo<?%O}yZyc}>`8PL2D}&reEwMR8<v2qE88mU0eP-vE+1v?H0vxG|cY9=ok)Q=`
z`jgnri}|!KZ?Ivz<g)m7@912>LuGN`k<CgEj|b8Ep0H`@qz2aYYuEpCN?cQ&Lvg0=
zIL9Ax#=fC`fxAan5spd`({Ml$j^Um{*#pUi)&R)7+kjTP>OW0MyBQd>@DFCOF06{S
zH>IvH7CL*evFGpnNTlRV!07<U7Kr3Fw5j-}dA_+6C}FL;vu235p7YSRjJS>^fY&c{
zC(YfrQgX)B{tsW7Pv!ci%n|>MXWRsOpV<@`eCUn8)zX(`Xo^}JpGQ{1<2socdv$?t
zwJ$}<Z3?vW`^kZF5WdyMdI@iU(dd2!d1B<YU50;)7}2zNEjsi;CHV%ZxHtr9lMg3Z
zPwXu}8>$i?FsQV%N{N^A+B_5?T)-e+cKLB-^`F_Bf~9yp8T$*a?70nBm6)UR*o5(+
zV@ms(4xj#+_E~U+yyd{PS1lW_WOcY``^@_IHpCcFhVvbJY7&A#dfGI(12J6l^5ci)
zexRF;`qjImT}hSIUg8{TzER=~#`{>wSKXD{s#^rUMeuAT>jI+#!NN7o@r}M7lzH>&
z4m)uUIs9}f-Dt?(Q5pW;$^B*lsVar7#|g~}j;hs+(Ds927b=7X5vn%k0A@arvlHcn
zzP<TrzlLQ;M6-<B_8dq83*0wW%;`V+JBZVALQeq74ea!&trzQ%8kq6A^G~>BqDSm=
zs8D;$+$6$gn>*<x0{^J4GQ`ewYyF%L<5a)ddJ9e2>mW4gwbVGb*DSTqU0;!j?1y+W
zjd@oDwLeputy$7IOI48S2kgCyj<{dX<d8z=_VDJhma2lY_O0@WrcIe$FbdQ<*DJfY
zhu#>KC=#&0j1X1|efpe{b@E*;|L6qbrD^?pj5V9Z8aK$M>^fVzD0a<^DDptO+ypnH
zr@JF612wIl9I{sS{_(M=#yx{Kjdfzv_X{b~8E!AODye}v-=YJm`9RA_Mh<;D#YfTf
z*<refQfgrBEcn+N2;m&y*$d?J606&l-J2ek_l67o>%?i}Kx;mQX=Z&+{HcK0rvL8u
zR__`I-L89YR2TE)qHp-O$2Z>D$a2P`aA!<Dojmg^X<1IH#YS3#_6d6thM5AXC6g-=
zLxy3RQJg2`z)dq$MQu^}iZlA*2(8@N&ZjBv=q*d^DK1mHm^arTIqx^F0)zTEe~*!Z
z_!I9m1l{wSgv1Z)Y{^XaV_Z_Y%NjIs`QW0Oyg|A%GV6zOuV#?hV2eIa6PhZ$%xvhV
z0}kPDdBa0^!<pj;01P0)n+g<AHq0;@3W}OsaJ8@&_T+SQO^$FUwa!@W%Ey`z1c9$O
z6!0H4r@?PlSg{Mt#wr3`g-ziaC)f=AG!N#!f_vq^r?iEGjH8Tic3X08ct=Aksfb3q
zPh>Tb0umgdR*w*91xL@>i=507GGmdTNL+DZh5e%}*!1JZ<g<`5!ZdT~dC2;ohuUeo
zDd1*~t6Ge2)AoY?ayq1`9Ix2Lil#J5w1wXuWvCl+>^$GK=gNlwR#_shNY+?lx+qIP
zG_)=bQWCoRPgva2*4%&Z3yEMZ-hBi7o4Of1{)D;q+WzG6@FX<`cS1h6@}p6)RHDWs
zRy#xs)&lCBSlt7sE(3pTc*=%z0})Zw1<UZs#N<%kI<0og`(aznA(0l}gOaz=a7puO
zQ?NxOtJGm)B;DX&NTcEmMOC57khfnI3TQHBe(cbTR929IE?Hj+(3btysQQz}NK(jw
zWQ!=2E-B9BzZVw#Ij(P}&;H&QTv_nQ?3rNU@6X)QKSR?tq%C)3qyegX#pu~jyziZp
z7p*w0HI6x71}qzC$F{}k!G-Of7*Zm~UW_p_7Y0nuFR^V%TzGTl_#Qg|b1^;NyH;3D
z0q-faqcHb;u#mmP*tEZ{u|%%R%T42!NOB)dDm}TI4qR4n#Q=zBx1{dq1|;}oTCd=3
zE2QvL+aT?cOqWUJf02|9K|vE}vf6+l3A(C)pV83`_z#iNKYr~8HOg#YnJKVtKRXoA
zMStxb<w0uX9Y&e^PozhuuM4l^AME~W2^kd!2edvA!tIjO%GKO@T)@8se4Ee?v0$m?
zXkWcId3H|U7IHNq&2OHtif_=Dlk8t?UH0q^%zYgURvb32U1>y}OR=UutejYzaVEei
z{v(vecwI|6%KgJ*cRyLm^>?GBh@FPOh25;n36&PCA?^>(;TT!5Hj1$2{Aqw_c6(`W
zd-UipU;c&``XYy$oik=Djj~h(Q{AIXEX^jZIc?4vRQOX>3u;il(t+A?aaA@f=OKq3
zP6VZIu0<Zm4=~(bzcrj;k1gEM>iJXs%PVe`=_<G?LJw54`WUKNuMoHQGGh~5Icba@
zKeg-J`rIW<2Fj&-o4kI~x#CUd&sZ+Kn4zJ4l(|$uSZxb6^>y6m+PNNnXNz9AhQzX4
zz|q7Rbv^mdOLBPC7_uta`nx>>_HuT51?D|wLXJ#B#2{%=W8MLdBSl1iGsgCEzO=o<
zYGHyqZD5$yFnPkG{?^`+r90&|N=`7KQ&(-cwh^lF&e!Ui6u#JPm1I)+Tc%%0<4wVI
zg)CIv#cM>vnKRYi<KEJS-(8am?jZzemofwdGg3OS`3+X8cP=u(hPG(#3Qn7tYdlvD
zBX>(#)s2Nxq?Q;B1o|^rpNnAcYz4+1`cL<lElxsq@-hAjfI&&Qgs*kjEW+(r^RM4j
zH2gg9-&p{R78fj(MTh@MZY7y}Mq2nfxVXb`-J!2AN%o!O_x6m_MXjfzh~3vACTu?J
z7$q%OpUi6nXhvc_!=>@72UBJNeI?s9cUK^B8q%W1<3SyZ?2?2@jK6rTu?If1uktlk
z_YKu?B~r6zf;d#Ypl_Ge4Ei&`WY)HZ00!)T;5JWA4hiaaIN1dN+a)z$2I!Pat61-n
z*!DVs0}~Oy9_68}H9!%?4@_MoF}OQp_Q6-h4rX4D0RRQ4+6Ht-P5c9&?2D;_3bz1Y
zeSM!|e{l`Ween9=YB(@%pMZKRge_{v$XR5SEx2#tji&xTu`Eh_Yp4bbCW|u2*m!9&
zAnd3GtF3d+5fxF7m*hM$r=X@3*DaPr3o_`mPOUfZN%z-3mii&KGyQ2qC4MM;=9k|&
z@B1?wwy(q^88}V*mY?G}N1rB-PX$a^ALiAf)v^{d$5veMZVg)g+=k%#$#Uc*tlC9^
zE~XTsdet=RHIfA@qK4$b3wS<%^+LpmoR;?^X*YQ-@Gta*PYW}lF*RM}9g?c;V7e0k
z|3_*F;>8u0YOrS)(_h{<PizuflehFc_x=g_^nC~ZqMFv*M2<+vY@?9z-iMXIDy9&}
zpC|v`5@){xoFd6&BHF^GEr+|x=EK#ey-Qb<X&d#N-Q!(1|E8V~Ui^h7_5a>9PlHFO
zah?*1gR8EnRGRUOGtbR~`x#nqeO*2}zkHucAVYHlY8MDh0f)vd+aQVM{IHtVk@<I{
z;<7Ogr<$Vvk+BUC5tdhXG1yvC%({5H;qe$e-cxMrWQJbg7%#Jg^w|5q7D^AM&C;rj
z;wAqKxO7Q-VJp)OFD76HslN`k_fc`vJ~~_fZt9-;Tv7mK`Fun0vu}v>1!i2hRGWPD
zlS6(U@aSX!hH^t}tC0vr6<BR7O@;P&|1_nZV@_8>lcuM8a>d8&0Oh-B?k=Te45)|*
zm|Y}>_{p+I_3I9EJIAo@hR0TK+itRD+p+<F(W)r<jznN}lz@Pta>hT2u;onr$#-IB
zvHmJ`9LPzE5<2Q>o*|BGT{yQd*^@oU3-S*lpZo=^;2<7X?odLI%n%?$_GfAIlS)>2
z)yn_*bXD|>XoQvKsbS;B44TsyEWA#fq7isY$9(4$^T|_J?y+lr`1Dpl^sagjQn&A_
z&bbdVW)eOPUf*k!dUv;awl>U(L6imq)ja(#BCq;;W>zzKXx<@-{F9JsTjqX-s#J@^
zW?r)zO*kN7q(~GToJ`~HlX2sA_&Qeiy>Q}%8~f|h>f7g*&|&HKH2F`{oL9?kJjU36
zk%2LWw&~o-l3!z|-Uf%cyggy~qD=_SfRcT{N2?TZ*dd|B+w-|VhfQ=%r#GI5%h!SL
z7VNTIC71ZTy6lP6-~qOrC*wbF9sg<A{;l&?*@;tSqa@+1*H#<`gr-~i-S&=;qAtCu
zFN;H6EtuzLdbb>L^HY@k*lCZ6D-q|vmMI1#oV~?wjryAQG<LjoNR3lY#@fEXPE#(s
zH#}W#=WhLMFkRr6wyXpz8rj=8UOFzRn|=4nYgEVfYAgp7n!T2Wh0G1U6KmX^>J?x2
z6?d)U@&dWf@a`$)Hi(qm{feA!)T)zKhkp4z?>8y^JPXQJa$#yXL*3={YZtHJ))z~@
zowNe4TIzl?9vGsBZ8^>ueVw25vAI6j%=6`<-1hm&f*cQ7I{J?ij$RXOVw=p*rk`<N
zwO@JG3!jcRjM-Jz2;;|3Yg%5d?tC${{L3x~{Ln6+^1rpJXb4#*eCeBM>1+DNyQWlq
ze1VobY<|)>)V9v+;?;a3@%6-;m)f%pwjC#7rq-S)<rDKvdMC8kV&>H|D`&^Y))c(9
z054Y2M{-9?v-i%!7}mq<SDdeP2L3D)MlALzx7wWBeS8P4d(Qg`#OM;XZ^BmfyNuiB
zvrhC0xp$ge!g`KgSuCldmY1gv6eCMkKl-_@PR@H0o20_+rxgZ88sA=uogaJqQZx(N
z{7JG?`H65z;^I|AWL{v#H}8>kZ)}-yN4qGiJ>2WOD=V$lqW6t|hENC|71|EEgX%8q
zhgjC~KEHYtX@z0`fwy#?f@BW1Ajj;zyMnF`6Tc<H^Tq3W(r%i8M2W2ZiQlIJK8>ym
zC*S|GT;pJ4a52f=>@%+Xbr!!)vMTgNhTvg)v*HQ7@;de&cKwBDmInikqIy<lN@W`c
z>4?!94G;CJZ%{Z|+q;|YAzMb0Exy_xFLnp59xCDBHL-Rh5y3l^Um2+fp9>m$&K+v3
zLh(v>*ZQ=_V|MF^W-93Uk9aO}v4?rBxep5p1$Bbz%fi~gkH-{iru)+zW<G^DmJ!}`
zMu~4G<9L)V#bJE0`WxB@Tjuk5RO{koze%)d8`FHyY~*2eA7^Xw(PfD#jq^JOulK5Q
z<G{~$YjNjw20j&A!20dk2VTk7{Ft0Wg+<NGV843sx797Yd=i&pndq}(eL3F`snGN(
zUFR&%H@dd|MK%6h4e1cUuw-M>69x@d6#VRQ%YAn6(dBXn8I)m&ap4%Y@BXaE>qYHN
z-55c=*)Z<<1wQ4m??R&7-?GHM@|Udyva8&0L>Y*`6oqL<4|~a6!pd#soNZK%DSd5I
zXPurGsJFr)*FIpazbM4VCK5T;Fid)`vKeexx|oWpX@;EbGwaRi5gDsVS6Tbh`oK>%
z7sIqETk?KTp3eR}mvuw{ONFDC^$pWh$o2lJ1w-c(7BH(>zutkW$3X}SX>Ztel#%$|
zSh>)lgp}Kf$|=UyA+Q5EM%I2d4~ksaxAf^EIInL=edN&k;VK4IQ)5!J+kYH=-i5oE
zGdZO9F2lv!y0V9P-7=DZz|G_Ahb^nD3Sh~Uvg~54?xUl{dtDs{rVF#+w)=yvA8LN}
z%GpooIxhJf$rLh0vL){?RBPiN9h#*;6wx<#>Y(G?m&4}&$+(ElQ+0XCJi#iLFa2_}
z{@$`L8$N%aM}7Eegf8M8UyOZbzM-6uVY2-@>vPR)Lm$VRyKZu$&q|U%HACN4PQRk<
zWma;iJh4ji1=nqv5;ZintxS79B@jGHmGQ!?x|ky)rJd!OerO}p4zJAe)tCa~ff6^I
z2lA2i7g#}ul}iJo_G_00{p<^t*B*`AoCC`s^YN?u_akNApWO>c`cai3`;mMpZ(_0S
zy~7A!5?F=<dGkERS~kIJeW#Yy(7v67!TFmz`G)fJ-Z{sHqXlx04d->ARqBb7yCuCM
zCA0R4Q~9Q+PNuEqk09KH=Gmu379JMAYKK$rC)=9~3=|~4&QT0G{>6>`W+}bMgH^k)
zbAe$`ZPVW)+Lclz3%q1V>@T8{_gDEXhM)fU4&kQtB!<&6MH}3DaUeF!hJGE&24#~k
zeK+GGCC^YhF`cb-!-#1s#4sFn`hh%sF>3gD3ft>rr+@dnxFuxdp*6ZV7(pBR4l#eS
zLoNAR@fF3w-B7{Ji+b>Nilxt-7aVahyL_dWz6_DW5O4(x>3kAULLUmLPKA=kp`)26
z0oN1;cFOGzxl%WufGNmvS!6A=<qNFN!C_Q)HY`o-OTRfP{i3V^*PHZ<YgoJIb+j@^
z_fo~Pyb00}L))*=ZCZH>>Iqvix%zk3>Yn9Wf0iAcS*`7XfXRK-tDG&q9=RkN4YxL3
z+V<ru=WEtdPjQqfHggv7TB}Frdi=hv06x^!w_cvVi6Y)=dMBJGbV=%bb4SCrQREYk
zTluq39R}0&Hja6ImVZ5<zT2k%k=ZHy-1(Yr<y+iJU;71R{C=4`430rfqL}BU&y_VO
zwXJE1asOOt6!hk&uYJ||$V^(0Uh<umRy4uk_RH8sJ)Vo0@nuIo*3Shryzfw-?llRA
zHfjCOFUa2754zdE<TmHkbL25cRgNsD_h);#%b!Rt@$^JJ`~f*(f7R;;@wABL58@RU
z6nFQPCqsG5s=}p-imFEXLSR{!zW**hNDR5=dX9IM^+Qq-L}uv{!$80NwjlKKd52Sd
zAMG<2;tX4>hNG;TKOO#p`=69@FuOE?qJz+-tA`mz+U07E{EmrUQ61!}Mg8ME*v<QF
z7dg6W9Hq(J^zkMrX)pW>z=n4G%mMw`tI}mFwoKxFp6(krvc9v`#EGVtooA^S7)kh5
z&F)~kBy2$79Mt|k!UaC!2XToCO#1`Yj7n=}H7DOy@U_if_%4Hdns<xu$G~GBlPnMF
z|GX1=H@U1j_03OV@tDR8h~qXbm+RGV)oYrKjMd*)wzyy}mS0vL&u$h-UK!wcw#y7Q
z0K<vzS%*emv8a=n-8s=w9SVs>`N7W|P`_>(mJ6jtzl<vj{I?YDuzW3pPAV5?{`%z`
zliopByY~FN@kH?|4sGqezY*Xdw<ZE-ROI@*JC?qehPovPqiFJT^unB*h4k>Jl)mSD
z%L>qVi0@~?^AEG_o!Y~qSl|r9?(qi-(<=jq8NGC&yo5seI*wuDbCsZ+BDDJ}v4(W~
zz^<{%=KHj;wJYc-6GQ|kWku(+<h`=IS;}X5UpZtAssAj_8UyE@<Zp?Ii>sIBHCt!Q
zUm~8^N?uXCCOE!x!bqijK_N#t+CKXoqAlM~7s2}4Rey-$oUrjb(`RNg)-ZH<&ey@~
z@QP#dY|=KC*(G4t@ZAz~o;j4k>>9$l`$O$T(*CYN%)IDhU`m#%E?juJ5OCdhrp1cr
zSyyJjP(7*zUT=S97Ujo2QnkvLMcp0=&qkKyenTJC^&PfdzzZz;*M(mYDfGG#9`?M{
znCH1klbaivt}sfbf%j@d(>M8)b-AJ~zLv)p`<ks|(8>1qHA%uh#`c+(=goC|)!t~(
zN}k=cg<u8?z&%8U+{C!&T?%oxUj{smJZi>8{Xfe7JDTnA{o}{A6s^^vwUf5gsFtd|
zsg~AOMX9~_9zjr5dxUChR*c$e6t(vVDq;t<gV-ciV*Xy<@6Y>pzTZE;|HL`Y$sxJ#
z`*mH{<N3U<`_3n}H1sV_IMsfNho%T$YYOJwG`n<!!9yLF%65cKRld`*P_bXutFo?e
z-7X|2n)~4RGJwTLFQhJ|tZnL8Bu_4hMSZLC9Z%30-bu3Jz)=+2dqwn5hyGsi^j&#m
zja(wtEIxSVwa*2t*Pl@Yka(nP`g6WxGs6Qa$cDuZN+)n;3?hZD_qrj=`>ZT#XC(?3
z^{SE3eiNA`vn}SkDSmoDE%il~G5()%x{5IyhvPu+jnU7(=a4OjX1unQ1=;nqbYb;q
z(VgjmI48<&1-0Ag!$gJ<rL#A+h}@v@cn_><<EfnENj{=(kM*HP*JGoNuU4KhF{?WK
zRjUnk-CtZ^7*<rpI~(gbD(W5%{%((7)qdCYFtA=~@5Vb}xCWl-L9s9%2$L>S$=c?^
zPrqRkQdvlibo3(R<o#q^Et7Lt>Hie4hqj9_>s@_yp#A$Y{k*?#I3N(v8``+g1+Jp5
z2a~s0kark9C=qwY4-F-oKi18>%bj>-AYyhR;jcGZ+9#*xqh#!2JoksG|9_7_u_jx0
z|4Cmp^&1;f9qnwd>)Pp+Dl$nuX3>IIly(ORpY^fK3STgnr`9o1S<;MbJ8QO!vh=rw
zM+m#*pF;7FiOg6JvY&p~bhZz@7y(-D*N00~ciM7fWO&GNRVdCEY3*0~-#*Yvqt(0q
zhIdY_h%1zv<ks7WtCYEv(a<7SNl1LT88>iN+Cq9ARYm(or=KkLcSjaIx`NewFz5fI
z))8tkJnZ7E5ro3NB{ul3#Kslz2mlvUC+pOoIxWNu{TcK9XM(jR&n$AeH~qxXy2Dks
zpev!RBtwHr+`lFyTwf<?bc_7lL()`{js77dS<8enV!XDOf!v)~0Hb2-IyHSr?|!(7
z;f~v9pbwB@yQaRzzgT}CJGN{>>3tTox!tgHC`z^N@>*31z5k2Ak&F)qjvgqT;v$-w
zT8@x){8sVR>WH$ckl>-cfV$TJqF+1?_HxvAp1}D?T!6URQzwGYU$G|V?G{Dm&RZ*<
zkoAA&eny;r*yr0-+pF{{V7RycW41BA^N+MxP;w1H=2v0u`hJY8#rWbz<CY7)zj#o!
zj4sEcvPUpY+S0Ctvr0xVhqljCtL{sG65j)g_o7xpr7uaz`0ktK1gqT$jqObH!7L88
znL7eETg$hH^@@2yZhm8Ws6iE7e%FiKLt%<EzfGJh-Z!#}5yB`<c4!swR-eMH27OAC
zariQ%=&dzHTgUsE8yxi1?Ag_el46>jOmZ|*{X>SNUOAKsqb!5vu{~!T)B^%zzlh<>
zAcUdP3SDR6sa1xq&1S#gM1__M5ow!<U|hFdmlrh5xjnJ0aY7j6O*xw1C7~W^10_z7
zP!9kT<`<+%=|a|(=_1k5g9r73#<Q$czbbhD8zzPfLjM!sJXj@R9;W&XVXPG7A|0;N
z^wgLZTan^M?tv`xbRbGGJ@6Dl1S{sfNzM+q!6rrBTS$Xoy2d?4qO@E7f`x{Cst>yN
zn64BglfNolIhsld!W#sWp?GUexs8{;;htt3UR@4d=QN?TWi?UTyU7V=3$~Vdc3U(|
zrBxyM_N&Z|=~vtP*Oiw0m~t|8c<Wq0@$(P5^y3i46m0G<3Q)z-`Av6nZX~UbK_vX%
z4}SRAu(L?R|6I6bt1C|JD-+pmk;kvt&3Gw;KgTK$F@OGZ&qYfuNnS@Ki1f{bl<ocD
z9$n&_iQ`(w+fP-KhgSmizD}-zQw4*OXrT{1cEamGX@cUkpIbjjgngRI_k-dqa&Ekx
zATaLgZs&9#d8l%Im?*4`rP{}aRqPsTNeW;Spq?>xdcHs~v=A^<sMg|ed<salnptKr
zn(ajiiYS$fec!kdSP@U8TUGu8r_$t$djihy14?`I+uaB{3co)x<dmyGx^|KK#yno7
zb##lri!(F>%|va;j)J8%tTbS@h{qWjVL{KZWAnaG<|k0>C?(UT3-YBG5bq*iF0ib7
z%!C-2UxGO*Ap4#Z37yiAgErMzFfMNLfVj+P`<0#RuHR(M;$MLqC#<`YJIxeSyCnOZ
zA4|7FL#MtR6M9b)V0d#Adb$Cbn~h(qTsn>g`6~Ks9?+&8UUR2jViKkFPuH6<c1QmB
z(nz<aZEOc7MW2suh}+CuSPPx2YQZn_%q3f>TErfkTZdbhvLAGiQoCLp$~tp1?!A$L
z^wi^qaiJJljP)J=Ci_5UF5<psHHWm(tnh>IO&-DJl92+gfm8#kE!Xr^CDuDpgn9J>
zPW5F}ZCgP~1>*-o17wOKYv9$)ED*|_mfi}h+sNn*?IwC8ok=w`bzlBEWA(#G&ufj)
z^mpv$f5bM94I*Sf6_<&MfJl-c&&m++M#>Z<k9%TW8lLX2ptJ2LE02}bfxVPkut(<8
z)3!5l1a@qR+Tt;LVR^ps-rtqnRX3yLa|&=Osv=bnkIU&MF>x@L-DmE|Vln(<Z`h?=
zMA)b3<65f-d&XfOR$4o+ql#}W#L~NohYt;w!82BF`x>QJ78ofEScmT!jQfeD708kg
z+;%MKY2Oqk1{;!&pUoI*O;`P%-S<_^>(ek+LUxGTZ1uQp6nLyO?)tdJX4mff;7hcX
z;`F=GTcb0xhYW@?k>mHD<SwJrr;`rFmFAe#M{ER0{+&lP<o%WRZ}a7%``NKI-!_#!
zvRs1H9eZHr;QBoymG{lw>vwN|<TuIvU<q~AuHv{FGG=fdv!Mt#cpBunt>Es6<O043
zby#zsF}C99n+p&ayF)Gm+fUDp=!Z1dlrJNY$D^$ZU>TI!{I~0144<CQhx-DjJFu#b
zWit0iQH_WXCRw6v%ZOgJI+()|G~W~F)NLrtF?I8QWtsv8m~alK8TcLRRu7r7xs&zE
zgXCA@$0f{5aJ!_Om(c-jfrn^?1&d=+NV`b7Nie-gH%pZw!)|8#J(0IOUe4n&qAIhB
ztt81zR(_NYD*!no!^WCJA4ou^xRm%iyGU+{vZCV;2us!p{PA;7h$Nre`k{t`52>w1
z9*I^)C}is2zhic<K4r~kDtz%yM7o<f3PI7|k4=!$Y<a~kY4Q`Xh>{4Nzl9MJN5%*6
z4fYGEif8D%R^H3*%E#AWC|q@fwCRqN1uK;)Ove{(aWb+VB#N<0tsV9+#vD-B?5QKW
z87_0+eAreLyL(0mV?$3G)xgEeIS*7LWaJZOP3?wYnn$Tunhu6@M@hy(p!B!KWl3pj
zO#*K!5KB$50FKb>g48clVtqC9@q87u&fVf#!!9Cf8NM`|ZmZcD|3cFA&0O3uUFP>>
z1kH|Zzz4mB_R#Z>))FuvwS=o}rWm_$Lh{T{d+W>}-5I=9k%Q|g#&;pbu0JkPn)iKM
zRv#SNP=$Jg?qA0|g8K`ZwAiUkFcDC#AWfT1YE!xbK`*&|PD_gTJ53d&Jy*Q)XiZ(#
zuLjGBR*-%oeWXlEmlN7*O&@<vIRspZ$Z_B2RuZwF7r0@-8|dlGs`Ke;E{o^;j$s5O
zLD;dfOP?Y2`VfNM8(=`;^KDVpe%#&H$zb*HuYq52i5~Bd5wN^P-LYy~XKPBm;L5H_
zz62U;aZq@Y@_^!rBd$b}b=|i?1`h0wCUaF?{<EkA)vh)LH=duTbxHvT^@%bMGT|5V
zN@)&T1w<}v*goo-dsR0C$Xo?qki<ewxd-lxpghT7QB1a$?0)=T-`F}|p|f+fZe`S}
z=IBms4}GvzktjMSB<P)<uhq(~*(A@Yt>h+@GI4-wS5F$E0L76%-(fCrn6QmhL_Xx(
zq9fmD8e93+2(~k0^|zg!zh&Furf|z9cpN3q0)ZH<eGy6e#kcQoJR_pmB)~APCR1ZO
z2;q5HNEMt1r~aLE)gVSos64U_z`CjzG3U1u%GgiaC?!(4#}k=`3E2W9%il$Ffoqba
zCNk|8A_EzNV%~M>8Hz+c`A=EcbTpf@rlzpM_sIJvGe6NVvpe3_bK%)=+}5HU_=fN^
zQmT2K*X_FacedIiY*uE<X-U`mKEAu*IL0C&v)3JA40KP$_S{S2FI@Qs<<mTQ56+Ly
zH(DLB1a1W|RF`3Xoc5QNQIm^x4ANFDD?ls$0blg7k^WJ=$;=ZE8i7fO(*?a@E>!xJ
zAwD6VWh4UJBTf=BQ6<m%1y#i1sExm7%)dx9=BTgTJXUMQu@e-1QHa>%Hs4ow4>>95
zx^m&8n7kG4MUd2LOC;&nJ>}VODW&-#8`vFHepJwm234U6MI34E^FBXn<?V^KYJ`_8
z#crRSMe1IiT<n9PiS`Swk(uB_T3W<T^O5mtEM<U_?)@^_bBdY);hZS`n^pr6$!JKR
zC_0`MsyOt~H`d3^s3U5l<6#TRI7T-0heL)?*%mnNBn4l8tITF7SuZg^z&qYW)vino
zRsc3Uk%>5hRP^w*3`Fi3!$wxRIwYit{%X$Wy(N9J0LSjgG^V;M`k}y~)HvuFg$WCX
z6kINgDjYkX<wlvoAJe21+d=nB=SGc5tH<KA`~ru1nLxb6r_V_2qs>J-xbV{9D1s|i
zk^RH!I?Ly<EQn-;Z|wLXaPDV!854#=(pZ?ml`<`LuVQt<Efo4f333N`v_O+tqNwfz
zwLklM<Ad3H?`((YI&^g0v~%p0>3KHkzhP#R0)qy7-bZ9Ez;twQ3iuL1#r^8BbpW@b
z9@(=L<7z*o=R+n!D*565mOD#*xj#)%We0>P!B1|$`G^c$vB%jl<k_Z=hC1>6v&<Gy
z#MNNJmzk21EjYoS4OC`iE>UE>%@6+)w}*jZrC<G^3^vt^%-P-d4<DgByl-mwN2aGQ
zTK89~n+t&7irn5I_09cK=;E$Foz+|WJjO)e_9IGd#pM)H(7yD6*UP3Qwb7`J^EG@w
z3#~`zMAk}7=hBh#JH_RU{B}csUmA@r@i;6^<P&66dI|!-1~FKB&!<64p(>czZb6s+
z0&(T{f5gGemKqPdg4(Wy)b3pQ;aKsK=j*V#kuPSc=uvO|@FN+kIIfvca-}ILZ%QET
zN(jyFGKkK+&Vr-Wm(D13bat~uC_1|WFN>Gx#m-}|zrdM{SN!^XKS?%~%Qb^_;dGx1
zXg~ad#M<wDu^j$CTaW%T9l0GU7sw&FN81_Se}umpzA^HEJv2WZXnkr_?T^<z=ML03
zi0g`Q)I2xL9M`!#R{>`CA)|;#p#<C2;&hI(ExI@|8g8Ru#`mA!9!Gy<axK&RyMuW?
zh$1h)<Ms8SjG~a>w>URd(*a~&NMC{_+uH5c#thHirNCx%k2p8qPk4R+RP0K#yg`43
zp2C{nhn?n=l?6~=)82NtqhWB4XK!uodNPw{zfv`_ljyf;`%G~4*`28f)>z0dp7DEd
zOL96v3p!Y$bzXC?m4F~4iD1Z;Xa8S*K<I6)6Wyy$wcWqvy>t5*tTdjWEFT+9yXcIH
z!|iRifRAQ<;L+!*?)9IKkY&VstM-Z2oHCKj7Z<rx#!IfJSI#ds1Gj&THHYxdmdvxK
zUL<@g-6}f0lMPJ_c)2A0E_+>!wl~;3{b6(T2J>5B>)}r}^<5~1?jDK_geEtF|6T5z
z4JE-4JGE=6G%MC-qG<tSSPScCRPq!s4MQePLRz}4)CpI0$*#{{Pw{D@8}Y^dY1z(t
zs-)0}gSqf!0H0K%UBKobwuAt-`wla_#47b7+=DcNhn)0TBfLWHX@<m2)>VaaF_uOd
zpddbQ8|(?Id$~HFd0E6QeC~VQV=7{8=E^29nc0!RmZq(=^D-;oDs}KEwG?$XXtTq4
zv^B(*>^Vgiui~%r55ZRrHi#k-HmpNuFS%)VXFrO++ATMK`M|Dio)ToH=VHmdsXJdF
zwU?);^Zl?GZ1z820QcJop5`@jS4F=6YIMm^q0y3<9~G&$#y*SO#_q-vE|m^BlSp5>
zSnSk&buJc?ka9#EO{=Zc-tA(jeIELH$oipbeP`a1PRSyI7g@K&S}ZUun+9lf$N$mj
zrlxJ<o9G!0H6(91%T4@hO#xEN2Qk8v%VO^)r^O_mvrp~gg%kY%w&72j#oiqnC8zX5
zJIUz2s-0W@8oRxToNC1jfbcNhj(w_{5(PlVa{re{$w$*nkJqnr{;Wkb`m8Y5<$R#7
zLy)tLBY!Q!Kjka~JPuAHbhkR$r+~wevOVK7jYNc^%Fs>Q;Lqd~bW=}acBO?rA{)$V
z&DU`QR+&GW%eANg(=>35p4rP!-+MtQELYn_2+k6Z0*@owh)<G1h$X09D%-XW(V0@q
zVie(FJh6jedB@n1m9TF0MT3E1_a4?nU7F_PeAU&l`pkJ^Ud05VXfk{C!&W)Vq0Fvk
zy6^Tine_F1+c$-hzbz8QKYxDeY3&iA4Ccb#cbvi(@V_lH!3g<JJ7#NqBDHP$EOz!b
z%J*jw=W1@Fh1tV2m>>fn+#%K$oozC6@_3qprDYku1wqq0%DqP=R|s=vH331R@kU3I
z<!%4YmuhCb!_h-^_&LxxbJTUZzxwwF)DkXfB-^_+KjW@|_U*Sxhd2JS$44^4J0V#P
zWgu1a>5s?IFB)O_aIaDm!3Mm6#4bV>gZG0bN{)+iyIkQ<mG_?HtJ{CxxcYR*TYs+u
zzAM4R-|`dbb*ney`4heL@yGqs^Sf?V8X!i8tFQ$zURPPBxHOk0B)TfKY)e{fYtzH(
zu<1*-pY-DwpZ+ECQ;%*;@tv@JHiD>!iq5$6qL^*E4@R*ak@W#rTtHiYg6@`K?{($2
z(CM#V)KcgNB?Zv6Z~4sR((L(pQryGPEdKuH^`qS4l;O`Qt*-xHf5X6l#T~nnDb5e0
z&=#j-sXnf)De8Lf1Obmy0ZzTqAAr1Y$5(NCIo8%F=X~Y*meXkC`Z=(>*Vy6L!~(y~
zA%(#oMMXd0>b<{$-xJfMwmQtpSh*GxVKIPU(VtW58{1yJ?RP3SQ17g<bjl*N<?(q1
zzPavJ_@Fn<78)40$99Nw9lIf~CA+>349k%=-fRcb$SvO{V|-mJ2(Gw}@pRjz1TUWU
zM^q}Zw{(xlT*Vi@iQS8mcxd=N@kZe*-c9)lRD?%r?CB@h8zueYz=F|^`r;(IEWaF?
z{R4_PrJ|jNZXapgfxf$YPOkn_sYCdDuK%|}IPZ*YWLxt|2M&smfJma?Q#?>RA%a<B
zRiZ01{d$!Yz7Nj2&L)V`lp3n%^us@obQM1T9RZFMO#ao!WtJu)3djz`UIc7fyR@cA
zQW%E*HjzKrhOWUyjT@IqC+m4oUR=`GZcsV)+`-69qZBO?i(ZMr6ZVtR(dCOO>g}8k
zohle{?lX(|CvDwPuZ(X0hZsr~%B^TdbDjWit_WjDOLYiR84Ba!w|ZGR)MrqV<uN*6
z6=?(PetQ*9d?=5$8&ceYt&V~;!GXzkCz@Z^a4H-N>eXh#e59!UqCLb)Ms-EpQXITx
z=dM&bruAb*RBd3)o{IZP_IIxvqjkeKd3u+>J9%!a;Fn(lDH`LKn8ZtkpOc|<7_Ivx
zvCUB?yw&WCNmQ!au$ZvaVG3=Ju4yG;#wYw+nT55={}YDmKYOK!?gYkQ%5@WfUBZ_h
zbOB{Otjxi+Y(Q_oCmmHbediw#x+=KlUGjfK%3feRPfta;OyS@&#tr92p4q1DFtL@|
zx#J#V7#oYvJ-&5LOdytC^F3wA<O_;tPO{PEI>d*qa<m}k@cHvexzTRDv!%*NnV&wa
z2|Z!Q5P;}Zw*b$`FGo3TPWQBhD=XY~pGEs|W#DZ#FEDVCrH>tf<MU2I_<!5AAs)}=
zVh{2{Y?pyt3`Qz!If{#HDB|0?`{!(AIRy=~?#_z!w~ez777`+mwL9MvOKU_3{BC|m
zw1jMjGGHjWygUg*Ep23kPaj5^($R+$6zJ<KS>7)LmtF8xFgj$v5?btS|EIKA3LWjY
zUoq~*^~3$6q$?K@y^-Xts?xW*gI>Cm7O;fAcV8#zzadFNYHIx~^9$`Ph6N>&&y)Yd
zD-N4^mkw0qv$m{fKBo}0jt+J|Ty)6U^vt0OI^VeSm%ttrAO*sehx0TFHX9*A{#V(j
zdv7ttr0lVFx<}OmwVLxoRDYxIo~bo1te0f8vH$TU{n>YG$7(HWAX743Ki%SzyB6r$
zJXrai{b}49oXJ36blnqIl~f?E+1-nzKJc?%a$0~E?=&h0(ODN#U1pyJhHvnJqg*9L
zI3nrSpf3*2<u-n7g))=5zP2)UE_+p6pOmC!wjw>*_ZjmCkYZvqYoaW1ysF~Xw@gS-
z4AB*_z*Q+t>UfGfpAyYNR(QxHMT8Q*+lES0o<xx<;|6}F6wjuJ-E6u(nI%?W0I_}c
zTG(sQEZ%-Svtv}teznL)O_GW8ZwM{#L)FjbiMX)2p4L@d)?+5#PvOr(zm8i1mgq&~
zW)>rVoT6c@f(KLUj5?hCEKVC2lg63-O%K=;927dYMR@2%{vR(cvtzY|$-xwoF0*RA
zzj|0$?6=5)+g7a=nc@V$R_L6X4j6C>bkn|=<XB7MOG!TxWBj0{joRt+bu~q${zqvo
z`1jhOOwU}4%fj-Fkr)$tmIPO5w)+}HNoEiX{B0FS1Q05R4Pq3K$y5pf(C1i>$Z~TK
zi4IrXDC=YeQ|=lCT@CZ91@<!S<)f|T^6Lt{*Hrs0aFXLUrS=q{Xa;Xp05m2)Jhkph
zv%8t?P@=y@Qectp>Wd=B(rX6R28kccG{`uQY^JFPl?s*tEUE!c>2;gPIZrMUs}2Lp
z{ZL8j;Z|M4d{oW-sMLMqjmq48z7J~9Qc}ni1E;-X<T(50J%thUBI9=kH!Em#zVr}9
zDB}y^TZ|X4D&P1*+o_;#@~|_{1X+$tRL}f|^zn1g*tzc!tA{n1{1rN>U6K_PysTaD
zUaT(v@Fl}@sXGvHEbm2^cYsb7qKeB3lUNE&{D^la78@E&_kQ`b8Xa{W#TPn9eR<39
zr_Pbb$>hJ;yy52`&voSf$tpoBe>F!lG;eS5DS<pnOtNLFd<<z4kXx2<y*79Fn>KGW
ze%$-gxG)3eK^!z}r@v-<gNc*6J9(Ydcgp5d*GP!6ss?l<*+Bhk{nRtVI;(WbJ5-Fd
zro?sJ$dYm~dgnlh4~|<h4G2Dc=bK^gEpBVclGcPUceHByve)?;gyAo6JG(b?AJl?F
z?*T4XaK_QT<XQiQ+hpI)H>nK{_iPY)WxB074=30RUhsPC-z9#16jl%tM*toG)jRVE
z06c0(H##^;T^u+p_(Gv3-pe}afv`!#6!=7-Cs#xJOhgc}0gaO=I@;kaThez~DRvj9
z^GlSxmwv5KK*K`w3s7UB&Px46lgo}vY!<Vk`AaF21W`@T@M3PUTo!C7@rxHJ%5{rV
z8<}V=rswK@Mgw9;r(a4B8+A;(FBrdlzffPkeQq-ETMyzc3qUD>e@5HF6BdZ4#M73k
zPlS<?<5Iq-u9i!}Kc#k46qAXMT!>yYynJUC81aD;)4=v<!K35Ey^O<8Zh@Svg3Ym7
zWl=6C4Rslk>%IVmc2RYc`R#!6hl;BBCgLJSHi_%45DbmSa;Oo^VY1<Diy&`U7ND<j
zzSRDoggAq#S^a6|$6?s~EsxNXHg@05r?zxV-;Zi@ixO~)^8)HiH<uOEy%IIT{3;4g
zfEa9Zr;e=vy#o|5>WN9Sij#n_%g6MMH=i$K#|SAQ1?yR@o*2xA$0)tj_}AfPL!nbG
zqmJ*5Ph3c+*MbMgUb=LI$&s9hHDEyZn4WXQ!wv>$cRk3^&`UobhIsP$LZ~jU*v)>`
zA%z^(IQh~^p$W*S8#Mhn-er_8jz)QnZ&it8VCn%qw7Z$NC9U!*BEe*liQRR%zuGqL
zKmgHOt*5V%40TS>BSl^Luw}R><@Q1VmIv?0(1Yn13|>!2MV83jjaP<=?j%2_*?(Kz
z_@GvC#niFi0_u(czLJWZmHS#|W_>`7adiyg_tOqbI>H&fpJMhd!uUWTx;f23^-ak$
zp@Tlk{=g#Tv-5KLZ#v~te~a`duKlh#Q*hTPTh`8vJcz#ZlyUmmd;U6&ph_AS7R>PK
z4iVSUEzSdAM&e&NGpYvq8~<z#uhR$3-m*7+@ap94RBx`zFkjPCr#ZO+f#;~Rr8w3O
zH^6%kX(jW`wt~S*i@bhD^0tUxlL8RtW!agjhw_3|g_MOX*mCS&3TF!fHV~jcMAay&
z<+_zzZ(GiQL%sR&Vp?G3J)42E>NF#~JBh)VMM=Tb?cJMs@yB9|Xp<n)apFFM+mtxA
zcN0Hh1rFhd+Do%mozN0y5-2b~b7<Sl{I@>SjGx{7ZscbN)AHGTlW#im^pApzd|63;
zYEH!ZC?@g$*sXWpyDLsXvB2qg=QGyO>l-Ha+hUIl@EQ%$ozd;ydio}RQ-Uc(Gs*n_
zL<mbEuIna>&-B^CL;y>|mY_UgQRfO|jS3EvZr(#?S=Aw)ggiH)x(X{1rPgy~;<`;N
z?d1#Q{-_xhZ)UNqpJZ!YZV(_y$})N#`6&%~$&bSr!giZps&jb?HVfD->}ZLm(TbMo
zE&F(Mz3vxMfAma<wo8@M^hFZ5Bz7uGER*@KYRG{{WqC^Ioa6I>sQt?Dl*PhZ!r%3~
z?3@TRr+RydW>?@F2escV8~<1Izc-KUs+c{Q4Lz8>P^SdfO#gNkt-Q@rZSQT-obt_0
z<hl|sAF-fz)jWEE$Sa%1{z?)vO_k}UHR^&%VK8J3u0G$~<9{JdE0N4!ySDNnGtGSX
zQL${$-7EC4W3A4lJQ-uZ7q~ZJ66Nqd*=Ke_Ii=Skan-g}{dG~!E-zwF=sB@_(HCX<
zE)TPny6~(bd%>S-PRE3Aou{~t#8k>$$~DJ5b>r)4<098Y1sNe?>VOfdU$B_nR2OUH
zhN;LAzN}8OW!5aM<r3z)|FrZHTR1K(lfDu0D)R^J@J5?cViYc<*3l~{(PnlOFytma
z9{4|})q`-n!;6he2B1oMWhK`#FqTwJcCgoM|H{0l;ph;D>y_&)q!T|iCtf%Dit^F2
zJ?SQor2@PN1s<!e?B4`(4uf?PFppfa&AM47e$#5vzf3eAm3zPpVf50BAO`{ZcJ^IL
z>J_<(;8t&`o8G1dl%SOq?qfMpW>%?~dsqGMs0NSYHIQx8yP6z^q91MP7bZG2ny={B
zbgTWjGQG8bp!Y5Ie=I<Jct`9msy0DOP|$mYz1$+lcsxtx`=>jdrrnI1PtKf#eA}MY
zT032=P7B(50nt0W3&hn+ZktykOT8md3X&B^JH&7p%hIzvf2<d)EQBq%^T*7$8_8Mp
z=jGm=ysElC0s(O(tZS}hdGjLa;0Q5#+`QRMg}9JU6jy_te@fK6r#6mDgX-RtFb|lI
z*zL#+xI)d%QFrNoi=5B07kR|&!NILr{}XBT;r(!i%I>Og{$Q&@|J7?<sQ}~9wSCF%
z#o09&KpQ1S^^T75Ifxt-Rwx!@wr+jpmrf0^#E_+Qnv!j{TbedQg*%w3@L?CvOU?I1
zktOU~Y~v_}+vNIiT-iz3Ad7`yAn^Qn^jvQ*1Elv{bD4rd-h4=agmR1(bH^B3`B`?H
zm`3pWc_jogr4qy4T<_~C`{zu-^`05;x<JO~U+|HLx3zI^ZQ`7jg~XipuyZJaZ4-%s
z0#lEj<=)5O*X$pbxy<%bU+}blT{><qecIAMRocAmhtfH^)htgeRtWkCgU-*q_xfgI
zv6c&tRgzuTf*e+6L}~;qDG++E%psID0-|0Ro#TV@F%%TwtS=IGEtF`opB~f|=a}8h
zpG3gb_Pg9jVl^U0lyi}S>Z{s^>cOx2ZcZyqRQL|dS@tSg-268Wkr2{&u~r5_9r4w%
zld_3_EHy)0v4lA+#QfD=#)=7B4*m>`?QNSBLl_vFp*0UqmqIi}Xt7R{R^QwHn(V)5
zTzpkb6RPs0xfWK&%&hTRVKY}F&MH4xIZ~qezTQ|DW5w(cWc*Exug<}6>C^*#69GW1
z*lK(1m)Imz1MCYminD2t50!SO@?MsSPfS0##@m)v#%T)F7ks`w2I{mbJK@5X++<)5
z#}Kh{NJ3knF<UIeEpMFpX-RQZk)Be3!Fn`HNjQJty2VWy91gb3*D1!N$IGDv2h`qA
zhH^REmW_?qyCRJUWh!np%{G<qO;#Rdco;+59qN>1nWKT3=^rckGJmn3$L#T$jurg^
z5{(c`=(D--cR&H%ub!4rKUn8ue)fEDOhmoyuQ<J%(=4cZ3$S(?X2ZqrX*9?0o}cW5
z&&CW24@~afjtH=Im+6Zph6VsC<~@3J`)K+d;8st9#7>so&Z3OXfb3aiw|Lk}{xM(I
zsbT(33k_0sat!n31#plka?Hw`^d|nDFVxyA`!zyBasM`{-rxD!tA))1%>mhG(!|DE
z))0pIDgYxi1EU5^)?eWN1ic+dzjeCGlVKtD*zFmtwof)$>6WhctuR%%pg2VivsYAh
zZUAGchZaml#(SwmNL{}M=Ag%I7=<7fk$V`7{6%=M*Z<D%zQTgDE3=Taj+wSeI*0&5
zibrI#?^L+Caj%m6mXov$aYD=E=U1;nhw1t0>MMpQFRvgxWp4Nl|8H5Em};!Rqdv~a
zW9prVH0c&M%|Gtbz}m*rRV(h+Ngc8qdxT*CE|`{GZ5PLMr!ngKET+~>1vDX>U#{oj
zhzB$}->0^LMI&AMu~;RKta0{Zi>MwBkqR6^r_eZvW1voWF=V7u@y8u2)SF_vn*s|!
zdZDNk`!n`!UOC{z2sZ4xU+S@P*bbjYWI9<6u#WNWb$RR*G&F_$<r<m-9FwKuxu}W)
zy(w%u11}$9Yh@evH%!n5%0MScT5a<w<srgcVf1b}_rD&)S6|V=5)|o=|2}{H3viwe
zX?f`C-@U7j46xmKIIENA5LifccARbG7crnFZDT045kqJ3RHq5}ur#5dpJ#)dx2Qny
z-NmQR&Kc3@9IH1n#$+%?wk}9JeF*KrgY~vr<yM7p`r+X7auggK^iZkfX_01)_z_=8
zp-B8^Bq>lesr3f=?U&(>1PAb9UMxXSwq|jn+mrf<Y~*AmBg=mCY!0}N{&2?kL&^Sr
z{^PD?004ZFbVmEIUSSgDBcqE=J9sS+0T>T%rIJw$63BqM7e*TJdWU4p;~N{xF)j1t
zAcIm4N}m!GV7t1<GOg(PD)3U});&f(@g$w#Ue^LylZ*6`Sbm)(X)tqz{*9x}IFwLU
z0=>#`w0`(eA3WSMZf0}!hhwNLV4|>4`Ph@hcV*pBL2clh1+@U`FQjsb^d`9=?_%V$
z<jJqo{SRq_t%L83ETxFvI25y%4t$1wtJ=Z~+uiHR?_r5m0vRC4d@I%O>eUGLBg)vt
z=y3F1D&Tua)dee~%7t3}&Xl_mR}*V0c27*J2TFQ)9j)&sS?7T=o+A5|*?x8O#2R~$
z2}j=L4)DA}SA2a;u}Q+@jM$~d&Abz2Dl^cs3m=`w&1XrFO$QuF55n<@=ZB(A_jqM+
z*WbDw5^;rPF~yjaYFQh?YVP-T!3?}5N-N22IG-y=*A}7C<~v|+{K_ybymI~DIk3Wy
zRtC6CUK3hLyO6==(8>vlN(uE=M^>o~)sNS%NIUq>IA^#CzKDIW05MjQ=#r>Sk$2N2
zAj6iJl2(b*-yh>g)P*YBL4m->YWDAYVvhWrA`2jgf+8G&^sAcdz?c{yqNmFVmv+CI
z6>Oqaa}8ex%JPr2U7;o-Z>Dlp!mwHzP57&ITcx(tJOCG}bIc%(y@3G!F(lB@!zf8Q
zLAoCE;}Fpr@*_bzdRESo;^zNLL=VHrb;>I})%Xeu7w=4$2V$(}yRf^049qH1KMjp7
z=ozhqQ=-roM%Z4@erAg$nWPe>OA!(Di9%0voNLS=Z{C)e*zph?3Vw8H>v}g`<fpqU
zGipe^??+L2RcoHHHfc8wb92)4`+-#=qf`4=Er1aI*&6{BV6EVvF4Z*F0=;CvA4``F
zJM&q!^lyLiku7SQ&);hF3%CK?`()@(nvAxP0G@={+cc*(GQ75iq!&!17M8TF`zVQ<
z@eEc*BzZx)nVxT=M>?%@KZY~jpn}A7-*tL5Zc7=*Q*kv{Wy<i+<d?(uZEYQfCCML1
zX{vtjWvs@|^fVT9ytCkgh%xt2`#PH??!|myToo)vmH`is7xw)YbVwGdt4?Chw%rK|
z?E@RHlSq=k@><6XGe&y>a7YwX<&M<iul2m{(|I=h$Z23TtR-#4BEzWj!~Hy%s#P)m
z%|zY`wYi|0_0%eG_*HHZESNmWigqIJ9WLE{tn@J2^*Gy1NH?hp;BX1~JG);*UJHfP
zHv!2=eSwA#o9hIsFKZv0K7O)$Qj0cwJ43JkmVvK&l)Zd!+yp~6EQRx&m2?3G9&TV*
z>V!lIvIAl)vJ$7S9c%s?6SkdC=Hua~tTq`eEeEBkTM%5(`H4I0S=yalsy-%cy56|I
zY1`FwpCMVdRgIuvC!bj=ipp`5b2kZh6R#S5B2SVbv)4Nnuit~8blH%-8&xi^z18AL
z3H5=emF`9q7falR-b9`Ka<Ap;&6-)ihB6P-8C{#M<Yt)Bq4>>X_0lw#I^jHn=!=oU
zeBYA8rBsJvjg=p61J`l^8>~r?{jm0A1+hbc`(#<qC<LQ%OzJ&(5<U@l6oA9z#I+UX
z!><`JFppv;Ds+4~90Lqb0`6do1Rk}VbePl;Y>#IB;c(eWZN6H<ZJ);)%4`=fbZ>B@
z`k!SlJex5W#oly=PNTkI7xBqH6}d7O?TSJ8Rea6EFMn73e!5A&n|R*?%$VD?h`TVV
z<NW3FoAA$<T?`%2-WxRkp7jNl+1WqmhNcpa#hr_n;8;h|Id`hS^I{CHNjmVOi&G1W
z=Z|hEQ57A1`oX!5Miy(~d<16gcd+)^^lHtzWV(xolG}I*<`;YR7y+*IC5!WPSRvp}
zQhM+>g34E&R&1Y(Fn-hwn>jqW73e#?a~d0f!p>KOcM+~7{o1~uD1(FX73IiM9HZ=N
z1mww+g0794DZn`k_g)bf+r%PFu}!qCx{?9l)DgFq3sUD=949wFW*zc(s{*FP=6_Y4
za0X^^(=+rHj*~ci83f(---WpigU@3=?9|@r!zzmN&C`yG7ycVDaijO%XG?$$!%qh!
zcREqx=X@u&(*6X${poM#i)8m<Rdnqt{4KY`*?fh(Cp>~=HBQ*v$<Eu(hJAY=YenA-
zQ8vsb==r;PCVv+^ue7!J<94J>{7-jpLXS>P7Pt_n<XAkp#tIt8&{!I`I9oIzC4(+*
zUh0%Ry{2@wLS{0jWrzWvAHse&D-xF@xxSq@Y&Rw8UFmz@bu?xkn<F-$)v5h1I>Zpb
zXg8Bs|6+Ml8wV^Q=d%1f9_r_Nb9pgnL!GiSX=9tEy|{E?@uTeMEZGIF5sUA}%rJe<
z^ZuPW24m`=^RGFNY|{PB?DT(OP8vM#Y;nuvwFI?3AgsjAAwU#(0VJZ>nBwn}{@azA
zAX#;(Wz@t;CfI^kh5`yJqmn%vb6Y<8(p5e**Ms%@LD%czOY`~ed8F9ndbURvLaUps
zJ8lj#f*cgCqyr~?*lFaVo!>j(IVb2%`_DDq(mlLoGK`POdvwM&u~BaG<4;Q$R`zB~
z=GVEVZ!j7FL<!n@$WU75t)_&=A6VZN*UdSH)b6CCWBsImr9c~dL{rH}$C|sv7T{kU
z)NhZk;bxvJ^B7}$e9I6c*%xJaozH=L8rHFJn;Ch=7AND_%WUuo{sv}a;OY%-s!Rop
zO`z)_m)(g~;!mS`O9-GQM9*7L*3Ep90b2838dV<r$BVySC|@AazGR`aJ^b@v?Wp@c
zKttHgJjNQxv#hvf-rbD0N^^#;(7<jnN!PAr;RH6dQ;gmn978UB{Pw9pnNsn6?H#Ot
zm0}t3`diE5?>CmW@;di&{^Q3#iSZee6z6u#)i~rUr5O5oKEW0WX(|yU-LD?UU#fig
z4UCAmUcYZ2_;7xc=+|W|bE7)g5Y^DP$7X5RrC-seZ+83A@M6xvtS4qPl)h01p#E*{
zg6c60z|Hc*-QtAQm*^0_%x4DkOkS4bUkebr(xpqRhKEZ56PKPAkk;NkLhV~2?h2%!
zv-N62*SdWn72x1aY3`gVI-MV5{ZtHNv|C`KK+_ftn10QdF$T!kAg`7dC|EmJF*LwS
zq*pr5_!44udPAqeJCjLl7I9Bjdg5YLwI9TnYcYKhbRQ=C2~st*P<}sve)OaL-rn~Y
zW-L)Bd(<J5Qq4=xH94`WW-%)Q`svWy@aGsH9Ho~+X0sp4W-ZB(-<jT~jZ@n`6w&Yp
zKYy0WwHL)5AMAXj{)oySpbDn9`Wu0sns-3__%z3lq05||@N)NnEgC^KH1DC;))bCU
z977hvs;Uv|fa~fr)xCYF(C)LSDNjvtzzi-^lJ0g`S9>1D@@*a8MI#$`eS55&_*Ztj
z0<ztQdI1WOJlGF*kXS|qA^c^I?V$MRGz)A%U<7;Ixo}{=XqC^jLr_TrE{`zJB}=jX
z#<KZ;EMR6ylP%T=(Q<|na;)ocCUCxTY5g0tb#T$9Bsxt7o}H(HVvZ;Xz5GG3I~C($
zfYJ@lIx|T!Cg)SIQYQYrc*QpMmaRN~ox9ms$pbF|pCl{NzGvFFA$;0lqS4jhVRQm|
zU%KHB%{dQ3&yc`R+x6TIs?m1b1$*zj9Urx9Y&YPZmTsx-oD`IK%qh@@JHKRw5K!d@
z>i(v&M}hQ`_`LAhm&nEt7@-bf{}gL{s<DLQZLWLr!Dzo#JL8ZYS5-OC#xhq)J8obT
z;P~g@kg#w|X|X&fFmh+JnQnY;$$`+5FWNSV{ZYn~laWL;f-LLkCG8!b)6ossEvT1P
z$Z)N3U99nM>jm(%&+SS09@WFU5fp}8;7P(?0!dlo$bi&`h4durD-TbfvGm`vPS!FD
z=@guJlcf1-jh|Y3*9qcWMcd2Pn5Bg}x>0?)aqgi|$3ORPBOFwu{s6sepi9$R+Sto+
za=o!`Z@^17#3j(hhjqWwWd8LmNe@q7km%7~n&f7jXj708)B`b7F_)z@UogiCYa-_1
z&;T(QpRfMO!dRbTYONeBQA8Hv%waFpyHzvS%aDAnk=DEQMCL$z^Ef1ASFpLa=>irM
zRTku9(?~qqAky3u9DAcxHyYXshj=U+Z8%53_Kqj(AWv9}5QJF@)2Gt+AnINo<1sFV
zZ~MP84D;^aIp4KuJi@S8NXt0?`4<2_jTem*PBIe9S8J)39zWgXst}y}e3Yis-z${`
z`ukzm?Wgco{hWOBfIoHy_Our4a?+Czy$I^Z{+J1ZaLcqTdqcR&DihE5MY;8!2PY?a
zUe|knOzu$?cYb;;W&$R96AigQWY)2{6119Y3{Vs@XRo04BTrrbI{CD6ax&@*3woGy
z3MDh~HQ*mZ@hWqzlH>nw&MhE$j2NcUW*`<XPY(W6qr;tzd4~GQGPst@;TL@fH0uDM
zFw|^to_&zre*;|v3>wB1Y;g(%!o~Q2KX7kN;H@;LN_J<gnt@<Q#m5w)S01$YN8=mi
z%9@!&+1iq)@W9~q{=P<+okpKEbhUN=uyFDF-k;ThP|Hz$%j}YhH4(}AIcSC!8$E`)
zeT$f0czk=t77vNrdcSgohSqfG6+_pap07x?t<5UK^XD?EnqPwS7#1N@Q5x+d8K)dv
z1~6v>@!q(Q)e4A=3wOTV!RdKvyXzH~!GL4l4+}pwoIXE=RNA@B_M9?-M<hf|&ISe`
zScGUh17yayk0s+(--Mit-<skG%WMs(xqQrL_l%UTL&JAO4c79DAazuKRJtMBy1hX2
zmvuj?xReJK3DUM}Nkpkl?bWC6BU*-$YNqh5dKTw)3L+x}=`R~aBYJVq`(nXNY%$rQ
z;tpI=re^uidygM9u0k%qt);5g3cyG|?lU`=2dD?9wv&QoTP|*ApCX0<o>jcB(L-HX
z!jev2LkjdG2+C<M8w7TV-`na{vq0TIxpCI2DhR8Kibji7>c1TO?mA;VCia?-<x!o?
z0)SW-;OToxk1m$J-^I;Ht-m{$*b!*z<r-W%1+yS}Yuz$ajMIwht<_3#!g2Z&NNcb-
zS${3lw3__uII3fg|C@UNFc5}<Wo?R2qydz)-Q-|8sn-)E-j2cZKzqz&l>!BYSx9#<
z?QM}!anIU>KFyx{B8u$m@#Vqc<1|e9ixKP?(qOp|`EavtL#tMamj?%a10(16<<&cE
zSUd!^u)BdGwZ6+mfn8RKJr7j{1V8Hk7(Rrxs(A@!Ow8{KLy+)8Ib{DticKbe93P{k
zg$pq6K&=m%8aS*7#fL^V-?l)#DZi4sKr)+?NW*=a<6-^VdF7y>_|ht10zW>J?%rRu
z^av`O5BB?&(7ES3!g&Ju3CurmYor8;$HmjX`1K~)u-@|VfD<0tRo{9u;wsQZR>oq+
z8UolDUs5~K`uHk&d20%qx&0}a>zbiuLyA4q2Kt}v1GU8MK0V9rs@|@jn_*H>bsoJd
z`rig$&o^m*MH+@d6^o@QN7E1f&s^2okschdT_+!&wKTq%{mk=N?aKICxbRso_O@C`
z%8L90gSJ?qclJZicx+TV=6bKdc+cb*(9MsZoDJAPo|*YO1CEoYQUBy3q#oPTV~6B7
z$er%79oJPv7-Uk^uCsj{Dkom&pB=`)qUZlUWL28)OMrkXbNASc?4`@F>5iNe1xN#c
zNQIQ6KeVc<N2&?3s}3-A=9Md^JKkmr&DAvfuaio5;rk*X@#5vvDLl-Gwpa$MPZK0L
zD=sPGRETKaQY#BN@60-XIpWpmn^!;o;9a`R4_s)OONdHo?U(VktxrKlpEO*KX)azS
z;_1f}C%*@6{ubNG4kE_FJou0ERRi2-yDr+5WcD6SyJC<FBOC?5GzQHdRAD6^7R7P=
zsjsR^Q7+8~KR1pMDcJcl`00~@QJ*GPkfUbc;uzYPZpL+li(|W?<yc+xJ3pW+o!*??
zCrs4<HRT@GKX8rp#ZbL)2KzTSn+L1N#1hM(%c@T<++(PV(8(ZzsADiR%)o-E%GG)s
z?Eh>@pTQFLw2X*{*w|pR(nJlM1aXodwk-9ve`{4Oj@t6(hg<n)Xb7LG+C|UmwQTJ*
zzjHZI)+W(WGiJl#$TW3wpRw^H`oMZ_>PpRQpybo)Zm}+t0HoLZG*PdhfizPibpH(0
z;`rHY>-(L`G<kTYX2uHF*Co)C`ksf7{Ty&48-#ROEC633Vpvpzv!3-inxOl)*~q10
zyM31JQG=t0g=!PuL-@f|HaPN6E1C?LsX({Q$cd%2xwfv0<|pCX9sXEkM{wiy!xZG7
zeGT`=8eX>r<xdLI;vM!@kVA+IJ|xZP!A0HE=2-3XQ&DacRChbQv4Hc=N~}9alj139
z(>21ex1@sT=j|mm67v1(mUM6O@w3gOilq+F)UKV{bF#x-thPo+xX9`4bMNDn=X76r
zAr=7vvo|GUM48xOysHONe@M_^6qd;DD~L%1T7^6}emOh%w1}_Kms~7AEjJDJ&Mg{=
z+gM~aVW-*<XmrO97pFCNsT+D_;5)fYtFfhTyU*4Mi8<;E*wD#&v~dury6j2g^Yb4r
z0SW{=t)|Br4mrP;Mwd;_e8=9`SB&u<25;L^OKhA*8)844zPHM?F&(p!?Wn6ib>?5=
zi;=~)2fYY-I3(UMhCgX2F!Ahd!By}F(gaBzT<lNM8<5xBxgan=AvtPpXR)F*l=Js#
z9MVM7ITp~dwJ4X0Uvswg#6SORcU)3yoIeK4Yn!w>5gR+3c3|n9Z@Z6NMO^9wO+)zS
zS!K{(R<^Mw{{r<`-Is=LeIZg^2fxqMfZ%YNF<`W}EV}yV^?aby>z8X;VowaY#);`B
z?r~)O0^p_uGYeBFGiexMRJ*GO>RX~4ejI?PZK2MkD4;1@dXR7m!unfFZIBgx|B1Mu
zyN;=uVQ_t-*&Slw(Bzzkt+j(wZQ|CHFdvmxp?rDSzPCLmwfxQ-rDX;Lm@#8OBaOUT
z*vLxbLjcQ2$1@E{_38;d1-(f@*@>**{j8v9h)>BpY|5DHjqd%~LiZovBD+1f&kZ{E
z+xE|Ya8vBZ^v<6{!YwFk%568pM0O0t;=A+G#`bLn0f$ZtO*FL?395E2^Ds9<6mXf#
znMg|t3?%F&<<$p!y3HoKuT-5G_@rpavJ@A{Y$TM6`&c4Ggn>aB;pSHSI`?B8zy0{^
z)II(F^RJRbsOM;E8#*o7MTSDp>-a3H@FdYeCQEcfM`RMgj;wHxb7Bot(<);^*-x7w
zMK_J6%eXT3_I=!Raeiz3b)|eOs7KiN{|?Id1$St#vbWo|L9D#F)+b4u;q^ZH+h4a_
z70*xPS&m=!RgzTOylA0XQMtDJ@_=XNQ#vNI{`VVqx}N~<a)@vGnr#f$IO!>1Gpl~?
z0@+TG`qn>Ql>jxnui;_=l;%@kB-H`!EZD$jbT6xpqM504a#7#MexJu(BGqI)B%#=J
z+7yi9U~_EFYxO=Ym%`KwtQZi1k}LcLU6j}7qAqo$MO#etPxFral_<?VvY=CoFMesa
zUieILE50$BSotk{O{#?R9gA>%ov-1sy!D{jsN8jG8mUe%H%71Otay3H8#b>flqNYI
zw!bYX?`3__eotb=i((JYTbg}uYnk8p7k-H2zmMsk7t$_4RO;tlW@5zEj@`cshhCB+
zY(W?KE#@^~*3KFmzvm0rVg65Kj(TC{aJHH@(A>-omH<bmCk>vbJlr!AlipZqqT+HL
zsQCEp?Oa(mBElkiXEO%y#*y;-oqJStak4BB*aIUJj;62g1R+w7rHw-6T?ji~^I4?|
ziMivYdj}6THYba6{ElM}j_Zx_pRkyde@>Am;A2u&9|B#)znYd{8`(2E*1P9xdB{J<
zadWM^h2<6@vvU9T)Bb%E?ceWS^ME(q7BTd3Vy)fqsTiqg4)gg%<b3j0_4Ix7^|Nm-
zPIR#sOxyoTSrss+sK+RI(9Q=3HSh<Zi=Q6$Wcdsm#sZW#bNq9Vv%!Y(cG%G@6BpQv
z5*zTbY(X3asZUBnq&b)@p6-VgtT<SkQki|$mkk1v$H$1dQxBGBkEh<!nf$JDaQ;&B
z3&-3#@gBQ0?)Cd>St5!7-J20onrL*`$>gWd(1Vf)xmf};NcUWlm%MS&lPvsMdvxgL
z4JrY!@{bhxh($=zp-T&-QEKh_UyNE=;58Xs*3m*G*n~nvU_tc0$a3|&7T?Bk<}yT0
z3;x=FJP+e}@Gj<lo<4c_`N@>G<TYW8=7aKQ(p$Y6?Pcm>*TeCgz3kv~*TyZHvM$;W
zP^J?cj@Wg8?utrRczIQpxa_jKaYrL8rB3z!?orTjTF~Pdmur3nAS!=+h3gYA71wUX
zZh&z<s!;l#$l17$+rKTJ`+G=ghSQC=j@6j$jIwPb7b8-Ntv}N0r@g^q%LNK<qvvx7
zYdDbuRI_QZ)IG^y9HS8EC*;?!!<JRYRi7{Ad+kE-2ZNCxQ$~IJoq&r#-+5yKk?yE9
zN%WKq^r!Rot)4(^0Bt99b}%`!RARpVDsi~;_)KbR6)+3Q61&RW`T?3HfHK7O5{C0-
z!$_NtoS;~Tw0UG%z$4IkdHBLGZy8>et<XUx1Zgg89p+GaK_@b~-cXAvZJ0i@l%a60
zA#xIkSN!LXlt3}0K9jUAfk@t&e2+|7FNh+}hS2{zuA%9J=g_P28RrwzcFyvZ4U>==
zf|SRw23`C4+&^;u6^|l{iV=QV){_S9T9%I~W;MTB!leHY!~U{=H@xi&#q7bmK~jjd
zlhb4H0Wh4lS1ha6vc{=7E@r1#C+0y5`t8GIX@}A_nJIx5=@hO9#@g>R#w9>Lc%Eg4
z0V*O#*XjKKSimWP-k8)YNU|BJR~7(6|APLi+mGT+AVz&l4+xyz^&7qeg5`p6t|j;q
zo4!qVU7WNrNqVtlr5M-n!QThOGo#~2VKgEqocPmq>wg*loP#asX6S+z9oEZer&uHd
zF@GT-6PB;VwZD9(wCz=<1ReKuAr;v_j?QicBGQ`ieC>Ou!PT=-U|g!iTE1*Me^4z~
za~FET3Ut6-=XSkptjw`N@S+Uep$*6X#Ipu&Rl?m{>T|yv{;t|!RUU_897x8)z+uQg
zGli$2(RwB4FE&xwv^l)j=~p=0X9e%M=EjV>=S@v?ouSY`?!C$ZL-s28oo9ElTLaZ8
zJd=5xuZH+e-3g9Rkzr;|#R1vqj{<RRWmzwz1Lt(VCQ6hY%q^Wf7I5jbjXi!j(tbYh
zG`7rlKSsj}%ICaSMHfA<Ri@O3MqF1OrQ<Vd-v|vWcnUJ_?j7B<ZljtfW+kc_)>+R4
zhW-Btd(WVz+pvpML_xYrlddA7(nN&NQL2bE=^X?q(m^DFK&aA*h)C}uNUzdD?=>JL
z^cH&Pp$0<s&-3oPv%51p`#B$g$#C8GeVucDM|eqTCExhRiFgm=<AA`5*VwxOY%Ei(
zFUuc%Gpux?eljXS!RHkl#`a3>u#>vu_1HR@^?yFn+t2QZcfvIVy<AF%BALPcT%UN!
zLRQxQ$>Jar6-u1qMVt@RFMsU|H^D`2oQMwg$LtfkK7;9*S}6HbKc{~E;IEjfpSb7q
zuZ~`<k_r7JCAn!qs)h+~CZ=Xud*;Ydp?S65;huPpDPOn0&!U3{Y5@j>uNo&ye`MAl
z2HQ~+-YpUKxjxr$uLd#sD6U1ia8v@6itLAamL9W3yr0sn(o`OZ2{p07I9~gS1g@T_
z<BN5FE{;T85o<(8DWBto_MY3CZZV3tHe3IA_4EUY#>d^L)GJq(pV35Fn2~?*Y+_i=
z<BmLkr3^1l;v!j$9OTi#Eyk~vU24+0FN-2mcl}B`>|WqnKV5&p6HK05V=T{e`<C}X
zu%C3`R1M%|FYI=mkc0E>-KzZFW^2XxWz&P-M7GKB>3b`6i==lsm4Lu^{fVU=wk*sJ
z1L$5VqxyFTR1>a0a|oa=``OST$Sbhad&-b2W%%(bSE71IYrok*{NedApeFIiEOx}J
z@UkwJu9vA~ia*+g7<bwq=f^y8PR%vROG(UprlPGZ8fjJN8(~<tyx%9)sh0`ePt0->
zcf>YGY4@(=2wZSnfaguh=0fHo7@PLaz>^WCq3VTLBG$%vV29|wgnTI7T<<qO<Esa=
zoR2k}y(2@Q=dayzLu^Ntv^7dNM|d`D4}iDa`aZ1K$k3YMXL8FfmFD1*(bC8Ar=C1H
z4;ba8O94Q=B3q-sM5$T~3@LT;0kf;)JV@A0o)2v}v)<=1MTn=BUZD3x2iJ52yalNz
z?YR-BuryLO+;Z|IWoEp2*H<|hPGw#7;~5u=&j&Wv%C(c4uQUs1NE4<K?+%r+j(CyI
zo%u=fh<EEvQO(Z4b#<Lqx}f-i7lF$W_}Xdk_jKppnEu8F&yr5C6n;TY1HG}lsa}&Q
z`Z;i~kEH}|BZFnq#|^`m5b<q1rsZ|>q0sfE2=CD<LM@R^ntLNgQdldi5v7W5O2U{G
z9j~6ru^-${kKfvW{i97^Kl&hZ;$kw}2To=Ejad%d?N9-yB2t_~eZQl6?ws%Zt5N&g
zjcI4>>URqm9U}oK0n51;^T1P0#mEViGvm5uvQUqpd;HNPKk9M)CyJHZ4954h-XK-}
zXoWuCYBp1sqJqhwd7=KGWM9{Xv<ct75_3yaMh?Q>IfP*m1UX1DNb#=Y#2dj@u;6Ln
zV8nt|5okVp^AJ8z8>s1U@*wF9V`qb-qL0enKV*4b$MAA>pnC4Bqvs?GeDO>s0N&>8
ze5p{_lFVIacQj0cU<ui2pfzp8QP6Fc;{mtvj`xnguaP=P?+|Z>!+zeeI%#tDC3d!U
zj?!xc3-c0AyJV41OQ0JOF8Y`<m!Uf{CoFgOSpuZy-bjRj{1{8G?|o;Kqyd60u(@Z*
zPBeQ3<xk(y_d^5zG!5Q-tj%2)OA&mluIC)bT7z;D(>y~1a~mVcN|(4BlBu9W>RF8U
z>2k<?NUr2Y*dPjml*mYSVeeK0rKqj2Yw~SsAH9@GJ$yxXNj@z8V(0I)Q^;lEhdMK4
z*8vdN4}~|Lr0U~gX&6w_mj%^G4tJ-z;hNnCN_$_sW|;=H#@tQT-hx0oywVSTCwnR#
z{GOej+hYcPtWx|U#Cy?Q&)@02FOHLAj}^b<cj@pu^niGbn8x6<rbAz{3GUYns%g)z
zY5#ai4{@W9A8U&UMe3aIL*9XmA2I_%TGO$Lf`@4b_B21fArvVl(E6b;R#0Hc%hUub
zl@3a%xrXdZ5dZYCWEC6vsUhiTs_GyA=m4~XhY(fbD^{uZ&x3Za(mh|@rRS&XKNxme
z=9cl?(Ktvv`d?9RvfdeMo}|w+%>=iVD%1lRsw#3bZ!0s`VD9_QbE!Tp!7qf{Wmb&z
zb-m}FJr}Zpi5-2OalsB0%Y6EywAZ<W+JCl#B!|OT*^fe%%saTHiR#3>n$@O1<m48v
z1DfCTpPJKuea7j^p2ug5OGDYwPgNW$CfD{o8ZS4J45LeU)K{V`@&7tv&Ud4)jzRcH
z?hs%HvpJpleEF!3WTwZ7Oj@Alcr(5zx|#7ci1kP`YkJLRMHuzA<E^^M9dD=Vo2LC;
z7wDfRBz?Si+jVbw&t=sU9X+qFT{DDcXbQO3EN_h|?eS(0T*r+aP+2?=z-j-4cUDf{
zt?GBGFCuH~9@x`#1I!I?0Fj~Y{?Qm$4;fDs+pNuI4k=-l_N8rs9Gz0fEz!+)v=vYC
zn87(LItFBF<G!G=RTrHjw4!WHrkD@LSg)mgEu}L6dXr8us35WmN(dCZo2HjB#1q-D
zyC&r*s9}1rWa!)(F*3VHvsx~K>3;FVOm2L;2b0H`XaVjV;QC~8wEvw(9#lT^;nqhM
z3J#SRx3`ksIqY%S@lus(KL-;2C*uqR&%2e~iZc~B3N%v1ku^@*mE{j*aEY#Cd7WBC
z26y8C_Zaw*Lk|CW4S4)d<`-4DQ*h-KjD>5n7SM|h#6QioxhlH(Y#AYASX;IaMX6W!
zjg5?{A~CC)O1@z>bo(a8$CGpe7Ueic!V_cf^!-+GRDy@;3E;<x0q{~7(Oi=hQ@9E&
z6;r0^stCra@uxXdEepMJitg0Z>>@Je9K#cf0jhTQQ(+*l70vu6tM$K!?afZppkj|l
z90H0f>%zLW!zWl$cJQ^68BYPHrgQ!oueH>gs9jYuXEwj;5wmIlFro&YX7iK-)V|jj
zYJ)3j=R0l07Y2OnT4i#LBxbTQsKh_#9*$JNImT*GbdP(<I>Kgl!$K`)((uzeole;s
zFOD-Q>Hc=d0`gWAkN?tIUU0cG^r96M+V}H?PT_ggMAlp+czi>S{={)_u;gVD9RoV1
zluIBWrPs`rq-=m*Ksw|@%B_xh%7<Cs02>Ist?sC@bcijh3V>-)c`V9JY@6y$L=#mc
z<Ec27Jm>IT^<f)8aoMTc7&p@CmFX#+1&JKZ2YC|L7nZnIpW}XCTJsJJC0oD*=KL5+
z`VygmJ7);7za76>Py?A23jlwb`yi^9l!3Qd7-h06UAMpzC0aiCQz7+G;)PYJZmPXb
zh?+=Bd$L;f9+l%)i~SCUwyzxLE<b+9Qax-{U@*C1bP(lD*Coh(L5&;Hm)s_ALHc^|
zYMjosu-xQWOFrmTfh_@M$Lr8N6MOoYg=84);NmboT2}e|z9a@g5&pzHc!k4gJVp>5
z?|aC(A67LV5|@7VIliEzUd^dn;G?a!i)!5gAZD8h?uiduKWS?IcuL}MF22t~AKa9b
z@%_n)-{@F7J<pxo^(ZVYVbA6r7xwf+G49!7_ly_z`{(k^!`M<CR!D+uhMKRC9DBTp
z57k^diyFpfPin}MtmmUOdComwTmkw89R~zSI9MI!nHl^>(r7;*yjNUZsM*QhBUzD8
z&1>wH?GvN$xOBR@+OH9g>^Em<x?^JvZg1m=b_C7eP?0{&Omo3(doI9X=cK1|zq;@{
za99UlN4lsHw5($<5ni-?%<ev*&Aq7#yv7EmEEnUwc=vRK(1+=H@rZ@9Z&157^-|yE
zp7ama;3e9hT@~s3l?i=po(tm=JBRumF6Pw*5)mL)_Oos!^ApGF=I<)}8-lO;mC6eC
zsg4=fJ1LiHmY7Y@ar6D_3E@J&hAFLMuoBWrGakEAJ3gcDRTihs@L90@{(f5_cy?>D
z3y=9)kqBvZfPJmpV@4r&#EuMTNq`_a>v83rbL4ID5fQpaWv%$@HfTY0k^U!4vdC{7
zHc7A75-DwXYs(*kT{~Aj_JE+bXPr&5SK&2ebNYnQsofKO4=;X^XVxSI55}zR&nc)s
z@Z8QPo}y*BOp?Nf)wP@-gBt%*%B-HoW{MAKt`gy*3n=(&wRI&^P}|HUkej`tbfjns
zzKjmW6?ROgim3m{5w~6J?IS7M8_osN5g=<(WudlS9;sQ!q&AZd)wfKC>7_!SkPQW>
z#wHaI@^h?SIa3K<NfN4@bJ(*KA#<a|YvWT6o?Ke*hgDLz6S;sNK>+FeyU1XA-b;D*
zHY#`f-*E)mH+l0>x2hdDFx_A}q)VWh_49y&{;3?Ph~aKqH!8yje<Xq*kxxs{n~j-2
zuC7tFGQBuZ_E1$FkP^b&iG@eA+W))w+mxQn^p0gwlt?J>2pD`+*9We6IrSRpE-!?N
zA8$r=o;|7R4n%U-d;*|6QfRnhWIS~zs@7pv5?eR?u7opg{(l_rr!ia>x??%wbjX^=
z0kwBAN*SeO8>C-X$zQ%&xPDiped5}i36d+aU5oEtMl4nAI1vp=StdIv+spFTU)Eh@
zKmOFfSbHpkTg2|MfFIG^xL(xE<g(r^F8}`M;}v;t>>~Ccl7+UMauW@t9X%~|{ZSEf
z8Ev*iT+b`lsl+3tHLlBPab(S1!`Y}_JR0lFa~-K6u9@C&|26Ll;D_b167!P;rnSA_
z3_e$A>#qoX_IkDxZd#^$g{$=QAGz^d?D$?g37u=(UYdW%Ysf#YR|jBI#`uQsrRwPz
z;ezkDiTuQi7QdvxM{8U@8P{wl{O>@vYKdY<<tj{D{7bW!v?sr_5Rcv^5}*8z<Yx$s
zyZSZZ^qGL4otV<~-ZQ6{1^}{bwetD_^L@HoPY0D=Sr$IR{!;n96rNZ-<2f%m<AZFd
zAzYp{2e1=RVahipAAgdqx&s(L_(#pyZ|6t5+%{{jwN>+UbvhZShg)>cJ}5=HTV)CF
zR1Qitf7^eq0Ia3Dc{8du0S1mI=k1(AV*lS9wl2SgMXzlKw&azPJz9A1?vAR7D7{|)
zy^dVHf~#b>L>}3-DS<a}vOoCC*6&?=b2NAj75qLZ5%?^P9|%|c?=D~>THTw9eu?;x
z^tOj75UP@~mfgK3j!PDV%6;9v^;axVgB+ieCMFy?FK?CF`m;(=HhMUe<2#Sicl+=B
zi^~y{bV6%~6VF)4jAU|SR9BvHM7WB#Y*<~9Pl*A#dEE`6?2WKW9<@71xE}5{S{T8m
z)<pVZ$8#YDiq@0&n5wxzb5Qt*D}3n*%e|Of<C$e#dHb2Aq=}!s74%4@{xKip{vy=f
z`>abwt$*dyY+hC>pU7m<@SnjCz?lF{uLG}C03-RbI`10dgw6g#ZI|TZ->p_69NeyF
zD;#UE_p1AZ+70WAWM^4>JR=_SessR{VvAd*_vj$sJnJHe1a_Wm24^g;EAR6l)b@0Z
z2p8#(@dt;M-(f!M(KEIPesM?|a!JR1d8uCGJSW-dHucUbd#<fZ=E9e??qu+X$=;yw
zygWBcs>2TIh8xu4fFyj`HszJx3|SS%%CSj}y`^OWTKafX{X-*`Z;V?cTF;3mn%3$r
zDgPEerSVSk+dpcB4+gaw<eTOh`+qS1B<n5NGOaiyvTs^rOXK!7;lEhpS`n^TzDv_l
z#{oq(*Yr=C&(i#aQEP#~CFe-0k5K$5Vt=fpxfePjjh#BpQ{oRkL2M5Itr9r&e6RRX
zSL^w>7Y_$TUk$S60dO~y>O3Ojq7UzCjeA1?%!7rn7Y<Eq)ty3Vbsy~1n>0YB$i?K9
zcoRs~+Zy8@5FUfBDO;C59IRdpgPLj<TM;qxy))RbQ|Ei=Z(lqXwVwv(Y5KJJ@H;<K
zf8U{O7&iYD$Nd!Ldom4ad!A-fp>|(sLAvNtreG;f;E$74o<2_fqAmS!k~A?xhT;sT
z*BDt4ieN7aN9Q%J(MIqF#5e4nRVtoOGuhNiEw%nOO>dq&jpbm{;NFzRZj3d~K&KsR
zVhLeUuB|0r`C9RRn+922S;w%oJMDGpwAMHHgkhaz9-Q%}&fI&7RZjAKrYl5Em$Mu*
zB|Cg2-t<3*(o6ciUcCLfaFqQ1?5SSP+reUdkE{=KVZzIcRYu}N<rR1Snoz^azTz6@
zIs;Zp{cT9W`=dn5ZO@Wmj;$Ih-_o{m@HumdoJWvMZSk-cQWW&GxMnj+7FpB&l3Sg3
zOVD6FUO??MP+E-s%dC0Q5TUyU<Yc#4pbPU)9>e1gD?9|>6g}4;t3J@&gHmfOa1btO
zuF~JQbWv4Umb8J_4YR=L343lRI)a4(?ZT&!8k!7X4tQRU5DXdVu=l9Ep>$nPP5}tV
zC&&L2Tyr_mU)K&;od_f^308V=Bl_>qmoKFWSRDYe3>iW9#vPujB|Xns+H*Z*SzpAg
z0q%e+ZoEk8TD&jZeT=KbhiVk@(llOXTUERGSH2eRfj2o`XsK|do6%+<?c0*R%cj?}
zM`#Z@4(xZ*f6e#KLeT8}LmQdMX03+4mOihIbjqq+kE`JJ#J7sknvYU$+tbfy(4Y2!
zsb0WIYPUS<^Y1@}N5yJe-(66A8^Ctr6#B(B%Kq$MX%nxD3fbeKTX_xHKRj|&YS^9s
zajDgaUxBbxX*iU0vVTZo*(GhIk)Nc2P2Gr66p?g%m+v9U?wp>d2fXo}-TuG)vA;1p
zx*%cMA8+}!f!X~fU_Z-b=LSa3`8QO;(%UOa0ay8x<OG>^Q4CXtjl0}fUd40on5;(q
zl4a&M4C0ekj4VNKnXGohOSXCoJ1wZ9Us56wB+ufr+!wxVw(=JnjN-YF2>G4ZE-sFs
zNV{c5V-e+I<+@+70C=tIJ!1Sh<(vmns^;YK++fb-l!Fii-zk^SowlkV4KA$5?1-l9
z>iBi}VA-2zPv+Vn-)*DBkF+w6f03TnYFyk-;S#&%Ssbdq(+yPu!WdH&qjNm%+<i5`
zx9W8Gr!+F$g}w-v#hlyg+;svJD4+vvQaay+Nxf-uduAedMOXwlqRZ&6nb-tp)ZD<(
zPGGyZtmBw__PFjus(m^p#cPVK$LC+9%Fe_x`C_+2WUkrT*Px;hGOfa$0L@p*{3ica
z_kb(|(|bnXgweBQRj0g3z5G}}!cSA)dCSjkKTP3q0;vpwTtcLpEa#TiTQy>q!^;Rx
z9w69Qu=U6x)@`=XqOLmGsqUu9KKYX_t=m*fH$E@Mt+2Q?=OZE3HpZ(m&MR@+gDd2X
ze^S5Dp?k{KA4Zt3#HBr;&ym94ly;i@_$>q$P*fVf|5;5(>FJR;Xy00A)y%`=LhSL+
zMXGF>4@Dm1U555r;u<gpjk517&Iq!6tp)=!Uc$u6UP2CsYJCgJLAxa|XuuKaHKkQb
zaGLKR`cdM$qh)@pKeDyPOQ<I5)yucBB}c2Mv)t`wIp=0yyMo<?IA_AOxs&~<y%iwK
z&B5v>s&>{lpXnpi2PGc;y1=xSN8O>h+-LRpdcw`|lGrtz$K5X#EqO9)p}_6-+1!O~
zN7?gcZMtJ$c?e=LPN1!XdeZZ)f%S&cgU!<CnDR_tQ5&0|mqhxH@2N0Nl-<nwBKfg{
zzLh#K(Vs1OF?`A+S4Q}FkBejHi;%ljMz+D;%1?vN5<a>v9X%6_FKoQ5_014^u>XGj
zq&d`S-)6cQy=h;<gE2Np9wE!UAagcb(}MCs$?d7zk2GPtGcLr=GYse>R{vz@dN%H~
z3#F~&z`*@rXDAEDdF$%w0xrD^a7vLO4*7OlLO@e=I5jS{wqz$;bqy_FN9D?ENT0!q
z`}LvE(cfjhOy=a&0SgYk=<wJVywCpfC+14Mt#=Ad=-BEf$-ZR$*hw+)aHqGRgw|s?
z_s)FdAPJZy-M+G^wYmuZheT%a$7VdG(}H_ceoY?sS#t$g&K`KF1-{F1L5#+)QmM_-
z@wB=Mopj!FeECbmu@Z1Cdzs@t#_~I;Opz`MrPqBx*B7ecu=8RSdEfTCE_Y5W%n5_l
zjb%vnit0$u*5dzki+E`Wq_3!2@Y$5Xn%R2qhX~%y^Nk?RB3$97@K)iHMB_5c1>R)f
z&Ms_$=wi{C;CG2w`EBG3S9ds|g6@r&wNIbwdoiVFqfYm@FJis(xodHCgj-JxxMLm*
zr)d$13cQRC9l<s=((sx{?D$+8=PfRJeHw%G=}70KD^WMLYy77fjV|2$H`lsWa^SEY
zYeYU8)slK5ajV1&H8muRPaJ3pHo0<)W9#S9|9Fbu-|EGghPZp)Xq7gS#OT)CBJ2|F
zyo&6zp-t~f&=h|96Rm*)n*a*LNitQBP_h42&}5c<rl0(L*|_P<j-kxD)f#%m;nhgb
z%SWk8$BPnO4lSpjE+K{5Ta2a2N?2}bk+>Ze&Ldw=6@XoZNZxBo`md?@EWhQM$?@T@
zvDW^ND|S2to$ZVof>K`CT#*{Tkd%^+CW_zpqAe%>x)6!&q&AlvW|6orIwW5g$#80+
zz!BQ&bn`I>H}hwCnrK?XLm*85+}bZ>i2TveCpryE@xq~?Hg|>OR;lSa@3c{6#B+Pd
zRZ+y9&Pk^JCmFW|dHw@OMY#rKvtFG$$KNV$P)bffu*LA?0Lra~Km-3LE<nOA)S*y!
z%zcNgi>th)|H%@7ay76K9mNXgY7AasoJ2HA9v#*7e2lFW19zv%_M)=EMKML`UAdkA
zs40<EAOP3te+aOU1CadXUY1u_;h5*Ti$_w<R;E@==2bB5$!8Sc(9F^RrPv4q3;I^h
zY{u%$TDM2Nw|~Fu06KR>$MhFTY1{>iqshHF^)ns}d2<&Bdt8CCA=1J?cALbcZA*ut
zby?P@97A*o1<wvte`uKf(iYt$O0s5RZ~+YphNbkSkA0EE-COTORaMVKo?$s&ohb`M
zoY}Dr^^&+wF<+_;k{^~)(w{Cu>|(h*EC7F&qFv-b9dNEy1b(%iT_{)fd(0iUmE*@?
zNk`@I!R0f{_VXJ8w{QOIe*AUgVWF<fEpO1Epy50?i7CoKF-}%BDyXPq_B9Jj>ML%&
zSD~hQE%5_M8VYa|^0Bf#0Llf^rq8tH9eAk09K|XO?u;TnB6+Jlpn3gcY<o>y(Exqy
zzhka+a*p~fOS&bu%MOB@w(3(K{d?pKvknSG@%ueHS8)_lEozB__2=a!Fqw(iw9_E{
zTiYM|WP=x#)%6>PuK8RKN;W;v@UxNpsKBcUZPHF}$~zefk$%}Gro=os^X<)xQZ-zd
zLmtW?!>H=Ti|R)H4LxHYDrd#d5to1YMi8@LOi?3EuRC#loSv68Z}8FNj9HhPE%Ri}
zW16QiT+FKbFK!7**IqizdR9+R_VHCzzT?LQp#bL*CHLOfjuRTu8|mjb5%9>lbU2b0
z*|6}CL&@LOGs&{x2^DcI^zNCZ&S(|{0ZmGHCwqW1E!?|d!u@jmqKeGLWkFdTj6m>%
zX23#@#7iHaZB}D3BVPAP=<!T7^gqqmV>9=ucuTZKb?nk#4T}Mu4y;`^j8y+l-!*|8
ze)PYb-D_SGcU8I-XwyH^y|QS7In~7cwdIl2gvagKo2|g>?1&j$GI>VXwNUfzEbl0P
zq!vGE_Z_n-S#ApEuJ^?{-<Ebg+tiBna<DeW&nTlT7Z2>0%7);mtV{ixFwkvn(v<#y
zGi(_!t1VUMCUAG>x8`?C(-(fp5U2>E7}gX*iHggL2MRq0!Curye#XX+9RDWV0@Aww
zWFMRBuNWYD29J8bUy5(e0MSWya?Irw9qs!Wq4ud$M$bu5mrV4U79+KuVLx}5igBE~
zj>Frjs$9E~DCzBu6_has32N=DMa84Qmk{NZ8ED`3j6t;WdrB25SI%!F15bi!3qLSb
zwcm}XfUhEb4xj1%l;7}B_GZBd{>we!QT*=u4|9+vjC!&m$em`q`F?N}J4TOqz=KcZ
zk!C`!RPp(UXSsievFn|k<({tYizC**!}@}3q#YI3&&g6t`*yKe;qLsWxy?D4^ZJ<{
zwe%mx7)};*xw*Z`C}d05!SCJqK~ah|<3sgzYrsD+dvo@YAzDYk=5r+kyF>Fa34a9A
zMRGsO#MnL?b`Sgz44U^U(0+?beCzFxSiKjiz-V$q!l{<&K%&lSBo`!n{1mZx64(ZB
zk8i?D6;{oC1rtcjn#;ITvu>MqE3lbHI6c`MUerdpWYP`YNr!MQJ%p<5x5lpWEqo4l
zm2&bzblL3ct1o+Z7&aWj8P6281)WBzir2C%!0_EK5C`>&75aZYM;w=X$*>pppVJ^=
z3kYvk0SMbs*e_t~t;*=(Xq(c{(cgkHBt!COthX+Tfo)j>)+nlWWuy4EHt00$u$2H_
zg8b-eg%j*$OA*HnB>Fg5+)6glF^btSe4mdVIsB7l4*LB^RE~K7-B6HtRYL%d>|Spf
zpyb2#faMPpGVPGm`Ja4JmSZgj6(QjTH3@~a`F?W@5B_%-03Z^RnT5a0#{jfg_!?xO
z=(fp4V?~c8ec~?vuHqq&F{C22@vk8sn6ASb63t6<2=u2q&1wA-Kol69G7V>nZkasa
z*uOUwi-G6>nlc6Y83Diw0^X;)Q9SQ}KY=Equ5PpJ|4M_z!Wq#i_9=N13D`<pRkP40
zKqH6yEZPKt49S;o_KhQb9K5mw6G#;8o+Nd4SMU!<(E6}`IM~QseWLlmqPGSz&PHwN
zsIz5mIv{v4<=@RDfUNTulZ|BORG2@+ti}M)C&B|K-@TTh0j?FvdkXH;7a4NUPk=44
zi+IJ;Yxvhq>?d8$k%we2%dava<#%M1fJBIB3erqGm~WL2=xO+NjwMg^(I3TB2<f8x
z+l!6EXj;7fnb^9#Gm1J-0Lo%48!bO?`fU4BjdY1{4%)puplEf~Pb>mXEVZ&EUg31(
zjDoqNeX>&)a@=CIS>XzxM{{uJ|GXg?^z>JX&Wi_%OA-4~9K;Di?nH1ezV{^(^o>?k
zYfsx(v>RK#oNs%6UbDNV$Z&0TjH~0d%$e91Al?CmyNwEV^)0`jOL$m+zT@rpPTsZh
zH1*{9Z<jM}N<-h;wBsM#avn1)Y!@zL61gAO9)EGrU=K%c6p3#*o8RHdn?5pmR<3M{
zYh45WV+?$34Hoy|A;(3Rikptr^VDPUKH_<hQ3a3oU;}~LJ$eD(2fmQ*#?xL!%=wAJ
z2J%L)DI<Or--B4(D?`HQb5nhy>-)8-p7@FS^*tgozX+MKuy%>PEgAGuxR}<2xO{}_
z0X|x|xQUkc*}i*=XfPy&ZeQeCO=U#T(2W&U3Qd{QU!4yfcx~u#Zzl3s2J81eFqa3<
z7q%Yq9)*T@OPbt#rg&ZQ2dMRh8k}2bQfr9O*?OpJL6fy^wf`Zz?maSGrD92`r-ctv
zhZ_wg7|5x@gY~dw&kNVfGQ__((1>5JC+uk~yZcG|pQYGHvf*MsryH)}PX|#VEr4Bx
zaT;sA?Q?>fTVF%O3A}dH?Auqod`|-twTe&Z2*}|X<P|jxN!%h4a)&1liPw^ji3_>^
zZC|2s)%K(*v8yOeW{Ol4I`T_wxwbCmry(Nb?(G9R;-+HpKL0)@$YgeApdMl{`rt=Z
z`sEMqv8}~iqRv}F?()NdA)4Qg<tI149~0@*#Lne$x83g%-{4d~8YuCOgMs2t(+RHP
zPIX7R%@Nm|{@}&h2tF7V4ff!sWw|Ff>IU2iIMvk&nvV&9nQqPp|Gr!I^zpl4fxD8&
zf_<V=1*dcg-Arq`^QkpBtX|BYA5H1L3|DR?UoB7+&w=6*#_aNL;rX1Wd7pqUNyu(3
ztuF$l20rAB@BPMvUOJ25Ec}(c6>Fjr2!-n(EcR<-re-P`_0#0q$Pr}FiM08)lfS1g
z=CI=+i=5ozTT-h!Mf__f7Xl7-1JR;>pcak3lLTOtun<)RC~%bL(G);JDQ26+=}|CC
zs>dPISGU8Mn=D8Fq=C&eefllhq?;h4TX}*{7oh!=)(_Sf_Q`mO$qCCTGH(qEK}*lr
z&*)3eb5st=o?9SKv%jIjP64c*H3Fz}DsTlDb^}swZ)60-;0qb5AD&-}8!*52buIEH
zNf)sN>2-q%%=MNQIg!`?Pk>hqfc9q2gA=oLK&=?rXsk7Lf05IB`~qTORFai688Y9J
zrlT14?lb%Mzg`d5<k`~A@Egyw9JRV{2(VbsFYLIJF68MFpcW4SE-&}dWblA|YTNmS
z3%37RQ!<ZY)-8aS-3FSxM)yL|DL?T)?n2-dc%}1`qBiYRWQ~DP`Y1*!VMy=Ome^B~
zS3-|=V@ioE(S_Ot)7iy1sV@!}Vu~dOciWbY1wF!0@o8g@ZI~<jsg5tOnnAzX%R@al
zlKQ6lf`08E%RYXl6)BsqB%(U_j`$sc7wB|)fN5==TfH*7yaS-@9HB#tvAMEV@HZqu
zPj}wyh2HmRWk5-fVrK_Lv%8&!EUXkeR_QEX@^lGv_=tGDGlWPxGpk-Z?cpHIASM;2
z1ItpqS9C;E+*h((2p6OpX_g}nlVwC(6P;1x`9`kyjdkxoziVUIP8`jZo2BR~0oFJX
zrcj>cZ}>*Sv7oop`n_{TbRIY+UXkQ$lDL7c8`9ph{9W8RJAwT8Q~&cF^B~|e19?>w
zp`qJX_^qCAaJxpk$d*<P)t30l_rMv~1+>Quj{>}h9ZyxecLZ%{i~_^Q&yG6A;zl1i
zEih{@%jugG?w-vgg!d`SMXJN1Mz&nToS_3eeW0XOnZ0YiZigi-Ks7<@8FmfrS+z?9
z8LUWaA)==uNT(0^^_A4s6=Ep9XD8^n;hE$TxxCuMx4Hf;I)@9wi&&K|AA5GLKMeX&
zbl>T#w22;41xA|+39#RqD4lt+|MfR3#%H}@!f~3fZ2HTOr>+!*`7#xq5BtV0x0WD`
zm$Wpz3p#DIovY{Vx3e5lM0)TuHh3oa9$^$-NlO5qr1Ug$%=!H8+oqa}*1Y*PIYzVV
z9AMNmo}{&e=A7u#bw=}a<+ZnEZjneA;GHmBSNC|j)(F9t;+@W2?mDDNUdQq31h<me
zK|%B$qOTc<52!vUwlt;x0Xi<)`_2OL^}}GYG5ZdMIj?QGEZpbd3Y2Z5B<Gg%!lwO@
z+q)en-G6SatQtA-bZR-gSuN-^sFHE+d{y^QQJPEzjE*%=SNH94ga46^^GuXUOA@9V
z`Po;3n8M_b2*>-%(7bp*D876B9_XP@>vGs-E+<pLal*%+{OI^>{^VsehZjv_(>B9I
z)C<buIyY$fRvm^Ah^Lm4<uV?JpbSsZ!y${IK3_VI&F1M?imFA%p?LefWo~J9fNv{N
z+_)+Z$3|nvS-Gb4s>_TV?#wHv=Ryr>2L|c6=L(zyQs^c})Hl~YyeLkn0~}Bej%J5F
zag`L1n+zTXiC9LYI?czTNF%32rChQrk*%?5YT816zW%3&=sN=?q)%MK#7z=gcDuD3
zec;KC;GCvIhPN^4t{%J(-)f}(Gc)A*m?47^dI$2I$Kmv}h!2xI3Z2{p?OFnEita3*
zUKWS&);$^bLSrO5C2(v?Te>h`5BJS}?BK~(1%D`u*~5a(Beif9%I~0-L%VvOlG>jj
zq21=3s<pz?OMWi-i*bqFKgir}zxWFz)@3I1d{K{dH_)Vdj@1lz$h|jL-9T30!fG<S
zCgPN$Bwg|lS@hg)+H4{M<6D~(uSR?*-iZB~Y(XRa<>d4j^tCl)CHES{saMv6Yn!c`
zP>&NZhPuZh7rHsNfNmIxyWH%)*N*W!x~He4bHPedOLsn2nH=Nqoa}#bEB>Q-Rm<^J
zPU<Z~s(uh!U_m6}W`GTU@k$E<b%5E|f~Ws0se0clx)}v^8!J2qV8K_VLSnL5b+;qY
zqpKFp7F+1$ICq=ZO%VuucT*T!cVR~pIq#%53&dVUHN4GAVxbo1C8RPmN$^e@{^X#w
z5Ix98mbeN<J>Mx>ANH!#N|c7W4ka4O>Ga%2{v}P;l&oPE{qg-RrRDy;)l}=rZh<#;
z9Hb~n9!eQ#($sOy@!3kTUtKLYan(1|Q|t%~%VoGXoLP__&SNdVn8m{Me>Q1i-2Wd<
zni{|u<o;x~c?66T(roK4p+1ig7;{Q(l2W32u?Gk;niG+EX!~ZKW6I8oHrx3w(Dcwr
zclO9(WVO@k?+X~99=2tV-)JoEK%i?OZp8`tjUVJ*&hLet=xd2e*^T##=~lIxMcqM!
zQ%GMVk#tlrpO{%HrY`&951To+0CNaZ9mb6s>+s5fQHzF{qeDAt9yzEPcHcA1>XGp+
z_8C+BQ(oF4Tq@7~CgFu#vHKF5?g;9z=^kz@XNd^tdpvA<OU3T2>g&JUTF<kQxsWL$
z-Svu*POlT}?>n%%=Ca(>L3?~tHk+sTT5sQHY3FfQgOrzK$t9Jq_y@Lk^z^FLV=>0y
z*@sO_(sb%vq?*}J`0?adt(x)-@3ZB7r_MDk-@H(}qHo!gmk^Ja096|mPQilJ!;n=m
zMZIZnzOQ-#0-+PfG(83yJ(1B~H#g8%9+SYtPj^5G_Pri38MtIqvA)BL(Q`4xTOc=p
z*EO7a=H#@yl!3}<%Zs9-D(s}b_3Klng0ls;C~8*9{fcVtXT<UEMCw^NsvS+bSIPY_
z`X0^g>n>KIoZ!*zUrw-5&iEykKLU3>CU?K3F97>RS04=otH=43N7AVtO`T|Rc~WG5
zjhXHhzW!&l#0E{bB;BP5JM4fXkzRGaY2-L01n&n0L6l%cwP9>5y<SfMOwRrDSMnaC
zcwem&7yQxaNT$aa-otm>17%t5L(}eb&KfFpEE5DDzRBLyTajikXN$nhdAnQ&GY&h^
z1zl?oCtRw-+NMzk^B>n5X#4;I9yv2<dXjB+s;*F0ix_wYJi>Q+f%^N~A&{?nUU(~*
z@Bonc)lC<}!1w~wug)+>+AYKYD&fwy8KIFCF#0%ivMbE}dSdg#d_FMod*0tt-&EET
zP@$3U<LmDfEMzX1Wgft5)Yh$3nlv(H>5jukntz_zm3&jXE8>@GzzE_c)U139A=JL^
zO!^272C(@YoAZmr_xh6prYsm5$!;XwEC$dPF=1rz(SgN?OUTpyRvT*^+Zl<>QDsGj
zOdu)yl{o~A)6)G+xIy{pNi=Xf6!EHpp2czlWCs{umOo&4iF{$|{<aGMpl4Sqv70f6
z*DZPRZuNtTJ#)4OyRL%+WsfQN8-qYlMlh34{OlS?pGJkh_LuuvOApEQCeh>egAw7O
z7F@ugN{PzUK#jHdRLXBf`}2W^NQdVl-<A6xs(H(AZdb!jDf(NT#^GL?qhfmtSwceh
zj&$@4!+a{6F3^<KJx<nfYSoDrEyOhDa1QnWV1hkZQL4dBVG8b9Y79RPRfLNLFkf2*
ziRR0F5wr*gKW!LVjvZG7N{0WWR{=vwugDWcC|o4t?g?s2^<{8EtmvZ5&JW^Wl{l(d
z4;7i7vzK7`ag0|Gi9zWmT%|Q${oZxKHXVpNd55cr^XGJf^UtX4ctdjJP;SJm^H93@
zSUT_L-krYmvm0rrrx(~vO&Wz+cd<(d0dZq&_%J(Ej$JZ0)7tnsovRA}*>lM_<k^Ct
z^Ck2G-|wDR_R*Ar;JZ3Gk%$@}JZB3{zuXkfSW$A_8-H!<2y1C710eIK_C}UyAjg>O
z)Ogdt=0l9a-s#HEjy_!&QDf<)*Xh`6?>3nYs=dFOG;5}(>Yt2NG`SCcU%m5<9m+yn
zpweE@i^t6AK9<rJ>T@BzIfs)G(24~04UT~SS1T*eD0jgj8IMpDl8{4}Ui!lRATn8H
zi^-z9@!)@V0jG7sEe&B1E@w`#t*N88Tb+SY)g#)hW!fL&@zl{BukX|y43M}dVtieH
z3z|uF1~40V(6(5<NON`fU%2nkedZTLrK+a#()|9{7@x&lhN30E_YD<8S)jxTqGdo;
z$_QMKN`1mPdYkS3=Xg&)(a(`^rJVH^TqaQBeUIDFObY$v|LSP9Tf8ImKKTczK~B(=
zGOC6-q?0+oo7M9Fzom6SJLf+PqaONq%YQrP=yAd9@lCG(md@W&q8vW$xNc2I&H-&Y
z{gKz-viuKo!)=ZS^He0Q#O?#W2ZBtxoLtC%It=~avQ~x?<+8Lym#CWwC}Q}6&g{b1
zS9GFR{Vor(nbBNkPi~nH)x0e4q4m8h5=foRFz_ZS-=B?T*c-6F_Yk4702AXn_gZ+&
zJ)ZwNHaSFYVDwsX-;;$qd2{z;|743Mz0-Y8`_v<wLDle02mRY*`ddREhpLdiQ+X$(
zhfO`CBc5L@!sTF7w@Dg1veSve&E1Cb@P5(a@%+j_p>3YAnDBnt?-n8Ft9I3yySKEO
z&wjJp-jes{i+0`5QZqn`W+b(Ag@l!Y-gQ`zA4P9&Whk2e7cCx<7Aq&=`J-SQQ6DHG
za>8hQKD11p*Uozw_OLOUb}ze2I{4XpM%@&dq;L%@M%wRQk`tuy+=UfgI<)}aR(v&*
zj=TP}{UPn84@1jGe-8Aj=?|0foK3#7c#t87mz=SpPuAK<vM;fhoC)GVqQ*VA=;pnx
z(lr`#lEPllvf18DoJynhzR~H6btF3V%Xsa3o<CzFx$T3ZAm2b!B4<cjK|WPXCVyi5
zoAiRYn9-!<iLxV9Hb7k_F3TP?GVQCSZ<K>eGBcVTIGZ}ZEWO3z{0XAG`*+&InbqYK
zY0O_21bPB)ll2Vdz~?C~<rFmdDGxW64@3{;2E8!T?I2r2!mfp|pQ-%ecLpEzv5l0d
zOV;?$ng9*1XszwGoOs`tm%D}Td*@A;Y)zs&@)wwYee|o?A6bmLnGD$0wc^(5g+ue3
zKlMM5@m_xGV9K2o%<}tmZEE!8gR@7=Gz03_G@4?u2jDY0C8GmjGqdg7#_EmFgPJ>s
z61~lcMvQ!IW#6`|f)D7AO0nPfh@kFYh>e8<xVHnH1wmr&8>_ZWO8|RgFHo7@F7zV`
zc|9fm*a%H-$D3T^E2r+vsuCZHNrLoHr0=>OY*!+Q76?y79gwgH^}nZ4P3(uM`V!k%
zIk?WrRD9FD2<-3Q7vUpfKTX^K?5%~s+>;m+-=U}Pie>E1a<$a8^7@iZ&&i`vfZN5$
z^!)9IO1V@0Q*I85M1g|MNAphAJ{PVTU4iTrv{2q|SoYkZ?(-EUV7CjHxrei)$+yJV
zVZG_4(=^ol^EX1M9q(&;-16buZZJjqIPP>BqK@r%S9WC2Hov>tBObG7AEY+3RIZs_
z2>kIa{$-Wo(j|4$72N225Y%1F)O7H%0G-*9o+feL8sXXwgrg@dC{cVcatd@tI$Kl&
zjr8?%4qv+Hi=%z;yZx|N9rAav6HDVCN?ryxbuh&b;2(u)XUh0<|CoWC%m$RF#onoV
zUG@8|86?MMVN%^YKV;+aP*X__IWC7BRO*c~n(y{qRV}frC7kSAqjKWS!eFLeiHyFY
z&JSf)lzD1QcQ-*TblxpZ`N`S^QqJ@V9oT%gO;qD%(fa%Vx4IU8?FD($>mMM$q&cf2
zp+`o^eY){!Fm6-Bzq3AOGw!<$zY^nb&2+e5#5wOSqka|(Gz_l04w(NnMI(!F?ove_
zu%SFptYh`!a#Px-+r?AZZ=S8XugVhvS61@{J09sU$*F8`#q-L&YP8B=*Vitt)wo0`
zbKWkSk(KOP6g*AQ*Cjn>8fXMC@<`Idg{&Fae2QEPe^#7~je0uBjhAXX&p8Wi+m4fg
zWLP8hh&$B*BX<w|`7hkaqE}IbYb5fV;)!^&VB=;_({qiA1c#ZuwzUG$z1yo$WeN_k
zvaPxx*RJ5ZGuP-Jq%v0VFQ}Jqr_k6}m^YYC**Tp8o;Ep^JV}d#VE-f=pBdn_Kq79j
z7IEMDKPz|2ow9tO5n4Pj^Qe-F9h7XGJ&L)qIRB58TV_`0iMMz~&;AdVtheP~^JwZT
z?ZVhujX&BH_oDD4t7XYR0~vi*>DdJF5X!KE+w5MRV?KQP%12ih)JqGL;TeW|C>qCh
zxjSslFJE>SEY;V3Ks@Y<lYX<zVa1VKB-JSj*@;^%xKiBQ!)Cs~W|x@U-ld_!YuF#R
zxm$y=(SJDagOt$E!yI3kPOBF~gc73mV_o1Xgu=|#`@`1&UaB%KM@13csATL~sQga&
zS&TyCum+PR=fPKWcw9UAui($vJc<4{cM{`%zaqe@KV0_7vt&L6eG5{xmKoS&PDvAV
z6Id}B^%$#Xh>vRht%XK1u8i6quJJt>nNgc{)lP%RkNp6rD%X6dYj+n5Ipp@VQdPpS
z<qjm?<2!zgiAzvpHa-F}TROYIvQ$@LDn;#YuX^io#zM*`OZJ<n#(E#}#*95w3<z;b
z%pb{b>1-(nthmQ30!}y$)AslC=o(&!xbiMMK*X45{g{;fdHnMzwN&M@ri(v96@+`l
zH+;pdg<1i@^mSx(=j_Q0t>TeFfG>|v2{CoYm-=1Kf(WMsA8)LxF;Xpk2C_jx;C?E7
zK33E#16$9TC|g{&RBvCMpDT;>?!%ZyaZ6c1Yy+2-&NE`DJYdP$qE@K$2-yxs>yS#%
zOj7#P1EHOp(2)a}E+pD}bs!xc)p($KvEfX3g$q7GCWoZ6<Lxi}ztC8n6bqwXjX&tX
zVGtY<@Ak^MYd5DbdmYXWfiSZ#H-D(dW*>X?ZF|0+qa0;P1K$3dZuMrp<b8S|Q#C2H
zgS5eUh5QE6%d3rltq2hXnkUE6h7J9)eNLeufWgtaLnFd;&FSa5Q-+d#f@RQxp#?!f
ziEtCA$pdxHxjy_*`d}cmpVsfzGa&xtfGGTu>To#bytoW7(K6EcZZ{8i;s3g(B6Lt;
zbN8)p_hsA>2;2%=&~)2W$PTkp%mjL4y<94KT;ry=#e6-Mluys?Y+f+_=&nykb@C%N
zekFsilA`;Cxl%V>gMhVnsgiRih@DD-&3%*r>8He$;C*>zZ_xN;DWv}xV(H)59rnZ)
zRWH&eL)p$0&*d0Q=s3<7yu-ycX*#bvAfdgnKBnGmpG5)9Hh##{<ImUjei!ojggIMm
z5fhW6@Z2qvvq@yo1&|+d)<I+(>rZ?G_zstsupBeNI!%|W(vYWBU9A#l`q#K05F$+X
zB$qRHh3Y~<bp0=1ZwFdj0^5*HpcJK|$aBx^_QWX~V<p=Eu=Cx1POU~E(%Jejar)1p
zun_LmgI+tu1~{>GdA94l#Ke|Rfz>2k-_DV|*Uns)c-89WD_o#Z;P5Bw8th<w>3pV4
z%WH&Y&4Ex_^p&?;YPi22eTb+#uAgUDJjUG&B!-LLr8s?SzihqrC;iLd*#t&O<~P^W
zGz!f2Q{O?*&sXubCi`Wi))duabztDWnHIp(#v|1q5W(<GLVhneT))*X^%M)&AC64v
zMTk^lKkd8q5q7GJ7W3=e1unS<7pY!v;C>9L=oOfHT4^EBp|e@gt<k0~435Pqa+lJQ
zZT54rEi&R*2Q1{2bx#A{fpM-08@DY$UCL+i@)Ymg;MKc0Q}Kb#BEi}3kLyw(b2s%*
z+|4?uK=YJ7*9&*-H+_=FKc5J;ouj-c*w6Mt>Xl%=`@ok-9B=9y=T2u|bM$w5KXvv5
zyWe7Y6>6BCKQ;U$mbU2HC;fZhn4?55F1_VdnVvu){(YoVFX2)kw-w$>BcGNgz<+_t
z8OlU8#HE=^!Fs>yLVN5^$mQXI`y5rv@|+#FYT7^0ylz*gyG7YIKuN+LO$+q4J!R!_
zvVM+F>M=IAXZ^ef=yJFlKN5))8iqv)YZf^9QTdqp0i9}_1<bp45RjD>dJK_C+VJ>Q
zp8P-6X%fpC&kH)UH=$O`#fsFQ&i-M5)q9j^Mr@xZoRo}(_J8r`My%rcDO5?MpTCu6
z4raDRX<LU*aqGSw=ja!^#R3kR2RJt&3!$6`B<=MQ+wyKlAE8n8SGeWQAl^Wry9yp{
z0F**{0r%*eKbnEJ!}@caM(pGGF25w0)vS8!0`u=WVM6H)IswxS?fL`mJj&Fy+Un=Y
z*h}Whr5KeE9XM!>6wJ^UO0zZ)WLf8oL;HuEi8k9#pqD57q7i>#_vV18YF_c-H!wR*
zs?$pdyhUmRqtTmp*-v35)~NWkxDJ4`3V(gn6$g|J&EG6GX!LLO`|4xmw0F@j*YT&E
zs*j4&I+=x+gs1B&XL?6gsgQzIQ#H?r_O~|c|96pfkr<crLvTA{aeqM*4FM&N6Y{M)
z9M~qy{4rW8FYgf3e3?UJduaFHO$0r(VJ7{Uo%K^TqWU{=-Kq+aBHAFNCZqZq@a}hh
z`cW14b!<3XRoZm)e%WA)N1H%;dtt}yty{*Ug7OPlg8(mwhR!<mP@PyOtFY^0nSz+x
z5RJ`!f9XfjU@-3wwNz(sgbIbb%DJt)0dqHFf7R2S{WH-nXCLkm62Nm}KiuqxbuUHO
z8M4NSxQVPSw3O$hj&3``rfkA-T0zN<7k>^&`irXPquGupXq>%v>rUI(8Uy$mD}?@D
z>=aM<Isa<fpT(G`2Nr<zj#zNhzIYWd5bw;eb9q3NbOCC*m^`4Wst02oV)?2&2*nN3
z^N2b2WT!JW#8Du}iA+hZ`p>5-^J|A=NXHEAlI$arnCjcilgyXj>)*HEk$2~q_Lv#G
zrquD?g6Aahce!BX7gH|neo7<9<Ff-TYScWKR%B@a;aO7uK;(S<_;d#Kx3gdzcfYX#
zWBTzD7#&ik*n{{|lH7sU6Q!H(x=T@^CqD&k_M!$ni>n{Z9r(jtn><@O3u{+Hr2WlO
z!R1}+=Y4-?4lDF!(@z&9FRFdRkgF_(?9Dq!f+(APQH8X~Wv?!<3aV~ld_uGL)qlMB
zRKW2x%xw;3OyEGQp;;_uqnZG&ujI9J?7+$HPNTrwehigMvxSVM@M&^F`chPFKV#>^
z4{RPliF*Un#g>iq04DEznX&0B9Ja$F%{{O^G4EzFb*mRtTMR|(pnBFIsR%g~*@^oI
zUv*m&KvSLY)m!gO{M6xb@RYiP%3M16u{N5(;k`?AUs=b8CS4*KTVBsA#?AHQ;WKMW
zb9o|#*S9rpE5tl9zyDO(Z7|$Q<5Bqiy!(%Dyi2$qT3+$Ly8t0&H)<7q{l87_I|W96
z>aD%3y{-2N_&LP+paiJVOJ`PUL|BRzr<O;l>~y*^aN2#G?s;bWwMAmlXGUl{+bTj;
zq_uxzL~0npXx46XJVPS^Te+6vwt5pG=t(y|4^~O>7|zkR9E*cAYz5Ts)FORqHOz9|
zf~-hFhCEuUP=;(A^A5BpBN?Dz(2RqTLp3ITuc{5+B_bK`^$x!Zhy9#fsYsvrM~F;1
zU;@2eUyB-7V)wq@#fA{DewX~U?Gy~_BduO=-HH&{U;Rf4X4^uXybe|0TUTAfpG@?i
z*ddDh!5e-JUwTUZfO#EyyIM_2Sy$n~AQU?V$HG8@=U!Qcj|RI>KG$XC6qJ7}JAI1D
z$oC5k>~dHb+j#<`JLiA|5GLEyp`W!Rk56NbA)De1E4Lr3LPpV5!R1nCTt1URtK}n`
zT~ADG2IK5GRy4jdto3j_7uss-TEp)Xi%6yKl&&?NE{I4hsf4fwZ+|%_pF{Ng6upde
zx4Ze}Y;+ua8l&V>{NUi0Ov6A|=_Yxf$~KCinVTBy>2nx+I-^J39#1Vz?tH#CK4Bd%
zu*5|8OkH~5*0<!IJ`*lsV3^CW#?;K>lG2V#{>DEnRk>Qd`iUomsSAdYgdUF6<G8<l
znOiewJsGHIp*qCbb(=&eFK7SeL)m<3TRV}yC9#{lk_A5?b6d=sBMcs4)tm5_K%9(?
z(103XX*y>ca;ITjoFT>Ofin*iX^dkn8*OP??caj_9QNH;mlo@q9q)Apb2sUue}&PO
zww9~Z!=)!7GS1({7EAe^Z?9p@rG(l5u}j?Wy-X0YX_s)C>)P#_Yk|U3w-|x&qJNhx
z4GA<`!iY(P_J&r@isVyqBc+EgZBjgBSMH^Vx_3UD@Lp4|Hw?U#nGBJs5|Tci6fmD}
zi|!bgfW_EPkjI;xTPB(uPp$}Q7>k>Zo2NB4N*AWhF2s!-Ur1X_n>6*icVmHE6%g`!
zV5ClA<aFU%Sa;#(hQ&Y_)7EGl2@vRZ9&M&NjNNCmI%5L4?=fmtzh2v>%h7Xr!zI7V
zYAXd}TqaHC-Ewq~zeHf|Am@g&+!S3rMo9Y0g)OqA%d#A~o5b@wM~Th-Oi~URJJ5$C
z1lR6|R2_&XgV*cj(C)%!L^a$!O%nWO$`QN2$c`@kN*AzF&g&AH(K&_AOPL(X4*TW&
zC<<xYW%QGd^?!~V2blY#C_G6=V*Qf9V2U`&CVsKE1vN~Q8&MY!_B6rZQwrJ4vYd=>
z>b60-WN}zXBkiVWFU|>a>JcTWJ!W^frm4NPJXJE&)NV50%`^VlC&-z${0-Nq8d2<T
zOWu4Pa1T3fQGT9vTUoc-h}~C~EldML_oc6`#D0|dX)4|z^{<<c)O^j}DPm-<-R{E^
zA@?O|ubLJ24K3gN7ftchApUSEGrhgJ>}Vz^+uQR@6!RG0X7}T#TL&9f>RxAW4f~&N
z@oI8@2;gP~tM&+tYj=4;$JkM_ta7wA3_CJP43=w>D`c=2n{U6Eexq-SMg+o6k8UT1
zr}8WZh?eJx+XxpEXXq-PIIkXj8g_1pQJ#p9e6-a+K%WPE5uG`)F0<O@+zo?7WU@&$
z`Q6-GQU3>H-x<_Y8+8k!pwbjnq^n5p(n1R=3L;GfL~1~q6ltLa0+B9Vq<4`nB@~g~
zdksAxodBVi&_W2w7vDSIow@(+FEY$9NzOU!XRWo@UfWoTuPy^zn%7=b>|9pFn54yU
znA%`T0P2@5i5eVdpv)}=*QYKbx812*;28*s10^Jct=XD%{V8xK@5ZS1gJekh_%yLr
z=TMK}06k7Y+uK7CUg2RSoeD4K0>Ge3dZD$tv~M=WANQkS`#nk>CCJa;BBu7%0Od!?
zj}Qmue;Xdb4l;l8jxX58ePyq6_+D-=!ha~F#p0;t5pbidz=>)Cn0Q&;vqDXA9w(fX
zF;#@~6%$^d(vp9mr=pH|^2v^cEIR+;!*3&cY+wB96e2l_E+TbwzH!;ykQE=&;GtM7
zzM@J)$83M+{v8>|!4Hwl5;rNID%^6IcdmyRi#n4iUb|YTFKvCw59s%TOg|RyBfJmN
zG*qzc{I(-*zLda|;K0yS=e@wMiYoOU*NRB048p}DW_a0CfEC=VFNswzV18SwN*CAm
z>WJia?_e{p1($XhV>%~_be8y`KZL*O?62;8(_yW@0s;5?vtv~2-WDk)X6k$iG9g3r
zrGi;z9vV1qa=T0&hMFI~WE#pK_@Yf}*LjsXXk`{6ZP3F*C%EG=KM<A;MUrFv<v$Z$
zb{gk<VomUG#-j=av6MML_IpIm&vVli0NfY&Qq#WiBFg+r3gwa}+=$7^Z@2zy{^A62
zW~e2E5Sa@!c_I2GFva|QEwLNv75Fj0F_nBIO65|TFtgZnrw4Y#X6(Fq=8T>{8@U3j
z^4p(RiqLP_y8G4ZVKS8g@Zpn%8)x{r0*v<K%{X9v;%}ZllFe|aG4pza@E^Y6P3H{!
zmy7d`tV;%BsR=J>GT=!9w@zc?({_$Vigq*WlCVZaahqtOtn8&)o#SdS(>jDsqN6j6
z@vsZAzXS`=zHt)d(E)dC<3}5R**~(*biA_(d&llG0`yu5E5NWad}$lRr>D8lDc7CE
zrWrWGkLHywZ(ucF<>nK~&$gBD%t`pAP=Z=(?WxMii8+G3ro+R?AtVuv(rMz_t`Nk<
z_Hg!KD^Sif@KW&{l?!4|{h>@t&m@v~#}j|%*sNL1`w6SLJx-_8N<<iOQVg7vM#6*)
z-)YALXQ6o6IjAr839_IVg#^_?#c*vvQ?EXM(_xu5a2|i5w0iNU&qunIZq~tnwoat0
z_P{I1dWJkKzEfy(=*j9rze8f}x>ZH0?*r55$vHr+7;ykXv6Ktn4^>0)zM<ZzC4iAI
z$mh8)X-=11ZgILH2#1rmLRAwC31}L`vz#|s6LLq%$_J_XWonvRXNq_+Kksqj!IL;V
z@qJ$<jnh{)&!vTA1@lJEuodpg;0?Sj2aYE`CO6Laf)vm3Q^LA;2a^ON%p$5ekS(Yo
zUVbjEBQ1tgM_2doECpMJe~Axun?LtKflQ|9=$MqK#Y-(@n<rV`y}QbKC<U8723!!_
zz^62K-Rs!aW-TUcg)y^_J`Y=M`bVINTru(SqX><REtyRJU&Otvg+Ca4DYA#U3=8zb
zM}Y2T@t`!1ESgWPU>c8{CKbLm_8OL`CKs^<*c2k;JDM@qB3UK6hY*M~s>}1i0c<L<
zL5VmCH)2*9g;8amX)ZKm^F1B*S1eV|0>;r#hof<6E{a(ccpZxrV(lTyc|yM>h}(MT
zC$B;aaPoY<xU6fmAS=qr#4QDeSXQCq^hSgb`ljp@rv@>!ui^J^{5rg6Ed4qqhC_k{
zr4mDtTL8ek2D1so)ZYA)Joeh1L8eLrwAMxJe0>@ax_FQce5+T6>{MQ)-l2erRRQ;2
z-ZjccRs%C*bDdVq)c>q%hi4yr70h8~dKQeiU8@rHfv+&Za^MiBsc_s8lL)8iR$TsZ
z;v(=!<*<l;eXsy{XU>l8Td^$}AT=cD>2rM-G6pKw2^t3#TK{>z2kM2)jkKKFDdS%o
zUFEe|a;T=|vL}y~*KXUCaGU>i;F)^s^+XW2yfR2#8hrmmARV_9s9Y{?VWBW&U;+pj
z`ZCA)udF@uYf>&=vtO|eS^fLP{o)Oz^Y)B+;v{43eRt#V;14m7)m^$1=&t(jRnEqw
zX{x4$)|e`th4KL&=C6U8eh+gAa_@WE9i@CEkfvn8P5rcOjAP@i)>6JsfGS-K>9BKp
zlN{Z?4KYq)qx2ZK=5S47q*d$qEnmWjF@^Nd(%=`4pRQ_=vcc5KTh)R3Bfp=}85g{5
zO?;E{Okn(}i)0bt_o0S%+$g2ADn$zY-3cj&iQM57?v|03J0tp?4U^tltwckVAMSgw
z;<rWo8XSNzLf1i$<dfPEM#Au60|TWeb3f!BJ`!iL%WgM*gUy*3eB$c}KOCXIMjL)b
zz4h2C4BYQ{U9sdBr|fWh(S6n7>IcK`;I5^&xEsJDstn#k-0!HB|L(Z*<%;5;IILuY
zZtVotyqAt<`^5m$9p08c9HBlJrU?pXB)wuPOnJ@!WSR7wNiEMSQ6Y*A`dJB`8nMsz
zL_s$edGFm}h|b;&fY<C5JD=3F1b3WWJUT`XbRVgx2T?_{N>DoaUfR3t_+Ko^+oXTF
zn`9)N@(4zo1hTd@_WD~f9pyBk4^vhQ?jx*aC`DCyF)G7M-?IKYHMAcTEcDIPJzVfD
zboP9${Br;Crtf1LrwAmlej#IQDV?HWzrlGjLBIXwq5=nw(SD5;6h6WV6U5ZgFFJ{)
zLp%NN5BTbu&TL`(gq6aNv}AAY`}W|@hZxV*RAN|yYnogX)7xYk7uyw+%Dy563Lmn8
zM}Q+7WlgvNeAEUI);gB2)$rh6^D@q<{R}~*1mX#v7PxqRM*(_V?xd;`7Klra*2G%p
z^z=OoPEZHjLf}o?PM~LzjM+*`wPTe7t69Bo0C;)V;rJNBfN0g7=ArEuPGq7@(;p>u
z8$i5SL`kP`4)Xa|ll6E0O8w;4S6ZALoR^qS(f*lyZ{g&R3~IK36CIOKk)x`<`SS>F
z(Y&;pBknV$p>VjWQ>Lv<jVrA=H;(yM{CdlQ#+T7<)&tl19uO*HECU^2t<nZswgr*?
z6m_`|WffV9+9;KoO-?POf^V~qJYQG`Dlu)BRLf}r-C!kpxZgk6j<LiImHjqPEv0+g
zjUS_gI6h-B3HqI$=O0FfX1ka)oh-TR|57X7izWq<q<eId6F!W%46xN+L0n$r<y_kq
zS#(Z{0n+}IS#9}4VlL}Ngo2D?5kK;SuTR`eY)9%ChGKn8*He?YhhN6Q=1KM6cy{Z1
zsVdA++ovE+%tDn3847g|B=%mmY-DwNpBh~5KenZQ%OSq}yGX}bE=!f}e5H&K_H1+D
ziBIgy@^Rijop)_ABCQ}2rqW#rZ^3;~+W2ztR@1P_jM#?txD|A7(W6Qe53}8r&1rLg
zdJ?dTd$WmP`SpzuZ&`r6KNBKQ54qd&;9%|ufwrCUnz1`q&<tlcK3XfTeJvw}(s{j&
z3CT-ou5)D!T~!K`8P=Aw1VOEfW1b>n*U*l>0dC0Mn(mYyDEoMU=CifGh%zhF%fY-%
zjBVm$FSD_A!i<yvq1m%6CZfefL7Ld=0|}J&Rbp5`bw?hil`^Hf-SJp(wEtBF&GQmC
z?4Q){;3gOo?<qx3OUxLzXBBF<nz-*3P5Xv^u6Ud!+TSAtQrvGmafi2E<K^&&?^eX=
z8e5l&9MxtA95Y|B(M`;f=)ORuzvAYJWbesX&k1Sln$7UO&CK!JFr)LtIDShH5+QnZ
zY=Ew808-qww#kyV&u0|jXI}GuOq4H1Vg3Qk6utfOmmqN|@MXp}VP*Stn9VpM2+i2L
z-o7V0{o5m;hq@ZkK2qbw941PmyXiX5!-0E(xuT1f=q{lDUoD`TLY20XUf#7zz`eIg
zr*BV(Qy?g{%xnIJnPm}jmsG!ziaZEOyPk2OD633KsKdoCRZ6`)V;L{z>h#X>4+prd
z;#14rctwM;={^n!rOMj3UY%(^Qx#<%!cyP*8Z`(UrqTY5L{m;~T~5C~PxabRWvGsN
zskjG3@@F20fd{kfbDdVh^MXteRaV4+@jyS)d-Bq}%}A!+Hm)bUhzV<(-X_dr4yYqj
z+Zvv+8_mE;+(&-Z04@7=VReyR|J4l4EED58SjMm7RluXHXxZl#TiEbj;1QGlD1Cw|
zDJjgy)K%{eO=pLbbMJEnhBa*$(mOB}Mv8MP<XZ@@1n9pN)B>t0>2kQto9k+*CJWfp
zG>u5OFyI{PF8IX}YJRlzod!Lqzi$>1J_p39rJgqKvnyOw<7*jm9-j?F+I$ge)ANa7
ze!h;j1f6!B%uLu%Iwm1s5$<8z1*@|Uc9KcDfRnc3!smX;zzsw8R7K3=!SCXFL<Rgk
z0XwJKckZB`AF?sAZJPzHlKPoE!&%k_r0!__4UVLb?JYALe!|E8PGhWj(PL_@JVIBG
zMUu%)FbAx1`Mr|A98>cu2ID9lx~p#kQhx-+9nWH+T#<@ZfRUUK{_+tU1qk`=m`_sj
z^{Y8vaaPLBvBV)1U6&@(G(5}L11O?!a=&@gHyx2DPxy9OPDq;ygeD+$z-FqvK*-n&
zhpO{X=aXQYr2>89ulwm9Y$7YH4lT79`C5FsPQ^J7t2rL)a`SV<A}%Lwg<k0#=$HrH
zjc9n<V^F4pR%Ji9d!|1ax<K5UQ^LFg4Kp6PJM`<Ej<b%=I-R^V_8CpV8h99ckMHN(
zi?mrOl#xR6giSde!nxd5?He8RpuSm(KWaIhV~%g+?~4<X7F(|4jt2}IT`bpCO~SR=
zg2XLUE;zQv-ISVF+3*Bj{dJ!anQ;12J`Io<q9jG4e4ojqUAx8ep`Xi|Cmw2yA7XUo
z+P>WBcR~p^?0xNGN~5(Tys<E5Ok#cQq1hEISX$0TH}9!!?0w2#n{x5<lE{Tvv#FVV
zEi&>z$-G_*IG9#ugY_f1A9!0<-CeJpDQ7)rL$G!(i%LoauR{hIWVR!Dp}tCmgg2J5
z3(4YwXsMDx)WtncLAgJIb=~`z`sPilB&_&0Wm$@Owch(dd&0p_l7D76(#h=Id$eZ$
zhXFl>Gix=cDW$TeDHZ_69@H&7H_n+()J*qmkF5<kH0*ik10xp&xm&?=48H?&p{d~T
zpWK(;aKF35XcWEx+PJMUuZPZzW`);Z_aUKup}Ni$H*LT0q%Ueg5625Mf;p&_aKi@J
zYn;?_o=F&5=TcQ9rU9G&2-KCrJTVwVDbeA!Fd-YiO*njMLz+I%aXJdgz!+mn;|`i>
zNk@-$2;=$Ok&USmte)_CLxthniaz=<#5Cq%dCF+wLvrhDi{BBl7^1`xTX#?9XxpHf
z$;uzjnX9*n9Zs-faV=Qo;e&<3`tz;*l?!xw2sOlFzaS|SEpvaNiIAq~IGOPN%TzWL
z2|IImV5G|2a}Y8^wQ#8g4Mo4ID+3%o{uJZ5f;z#eBf4yW&5-((>wgqDMh??^?H7)Y
zJ}A{L&lX7{xeT#3cqXXnb(n7e{coH6tCSj9(szA!uxijV)}G}gebeMA1m5OI#liJ8
zYDgaxq;z!t>in2k{r!*Jd)EXzBv>zp>{7cOoBPdy(|eyXATyj0gM`DJ#eWkjg~S`Y
zEtr<_A5;%1VVk94zRv{>EQIhEI2`F*Q`(aeg7u-0Qm*Wr6fy^O(2JPQAz^q9^1+s<
zGTFU~DVGOuelK+h-X(TMdQ3LIB`u5>6O#JzG3#e+v_{6tQ~7B(MmtX6J~2E7GTFS8
z%XJudq!k)%A~QGDOANBOmjq(G27;VhxnO}lI2S&xlgIMDu7VHn5^VC0Y{0(#8-Caf
ziNiE|kq{7qmoq90V@ROQ8b98Ab=e-Y()j$I{(83PHwm1}u{Y(wtuNaRYkk@<7Vt{v
z4Kd>B1lth9Bju{$ITGIs;cPoeVNQy_N~_>I*8gSDbWOO~^gu5F^1UggptgO1GfDF!
zluB#*34zbtw?qm`TBZBzQHz0%W8$%ON2tawIyg=11<%W-a<I{pG$;+_gP9;oiV?*E
z(Ki@0+bgzDFUqgWH_}bNnkJ{);R=6a@z$ddIFauBgfCY@K4(OhK5FL;c(rwJB9_7@
z#U3VL9Ml)L0Ei3t#C)@mJ#yZTFw8|?5f<wA_}jpU0GJ<OOeI}PF-&9EEz5U<bV5-|
z<<Q0l*(Rz`xHg@aD2b%K$ZS_RjQdC?QGfg`%~b{X@t`gHy%k&JOk|<R?`JNFaBP|$
zN^KtaeM9vl@VUG1RM>bgUF!n}7c;66!C{SjBy}L>j|Mo5wwD@oe)j&CeVEiesrKeC
z$($Ai3TA@aYV#mDwG7s~W9Tb^2<4ba)^Ep&%K?~Pod=P!vM<=RW=v#P3KPote10u<
zDubRCCak<jQDX;=@Z7nsY&T~+{q=8>YvWs9(+AU?CFoBj+|NQ%)hSmno28QaZV~4j
z#m5FrbC>s*U%^xhnLi>l?}VhM-I?;QvBWMiQcPEo->Q)O#KtD`TV`uI+p;<I@s4a#
zS(N%Sm)Ymtdio#kH8@rU4>-;`l9%47mXbOg;nlrGpEeTPP-*G3s<AX5dS^+8lSP(x
z!S{!~=;+yFBRGb{8|c}qot1Apk<nbb5OULJrILbL))`#Pzou;R?rV6d$0<Dz6h-sp
ztTPDANDTxbC}xB<8`cei=V0FyR$gx~%N>lIg?=$#={)q)zwa<d869Z`)TCTd@Tyxo
zBoWKNu9x|mfduUdJ3)BR%Y1E=-FZj7fc3TxFw4~p-QILD5~iK@<XUlQJ;Qqw+m{-d
z3Pq!$m@Vu81h?i!<0Fr;E1LG{sb<$H&{&U(O8CL5V9^t~cK#JF^qPt&Y^HV5@zyt|
z{Hl}WW>m9PlIcy<dA=Ep(5yP+FMaOv&^AV*WyxR1OM+xUDhbkiZ_E+Lqm>K4w@JO;
zD6hNK%S*Em-JfyFeJ*um+ngo%QEGuESwRgMw$k46l)dIL#<p4Pg_GfS`sRAqbOmk^
zYTINO;ldU4u+7ImM<uF#OkF6Xdg=qM`r+SEIk~k-C-zsOqwXCNX(#t`sV`_2dPj)7
zh8{)SVj*=_aT_0Rg-E(=y6>3|r$LJkte0xVZAEo8Dk|+cI~ntR1;D=j_OuJvbu%6D
zIvn1vSrH0hHHCb$fiaR>-C>R#rG06$5?BSpvVElEAFa(mndQd|$CJGF$W;!_)Obbd
z`*71JG)L`sAE8{`9d>{ojR0OAjJy}fEBtBJ;en6QQ{I<~YSf+!zM{u4)M}}Aar5O6
z94Q&+K^*+{Y$(%2{%Jm^2nU1$)t2m{$O-SVx2#B!Fthd(fwrZXAUh8Z@3k;f9Aka1
zA<GB9M<~nqhI`MY^~;6ybBSbUik@u#kplgBVvV_=<&c#B{Fim=s5tf&cf<Y9tEsk1
z^(x)Ec&a7Fa{!8YNnpL8{ul{XQ*W8Q3pUSC*T45yv8;r(t?rz+!BFA&aa-{xDEm?|
z88YFxX}O=<_Aukw!+jqs_jd#moX!4mTF*w(IF!<-G3p5voG)z4)Qh?lUnRRKh)Vg`
z`vbuGE9wfzCJ#iR?xr&QrZ2XCJ(4PFh~w-NI}nmp*Z*E~c(8qKYcBqXr10<M;az>{
zYfmeB(UCpBI>nj(fNiM{^~6OaDGm=<ue!$G-DfznW3Sz=6HxujPPMWu^Wr!nS?c(M
zeiP}Vn39$kr1N5z-V{$t!TFYN0nQ>#RN-bKVReN|A68P|<uFv<xchJ?F%%RtVh17N
z;LvCV4-T8#N@Ch@QQMX=HbVNsfGmB>_bLg|sc$<?YjZbDMdkj)%hYnH{?bPuyAsRM
z3T1guDXSv5VMAVYESElJHa9)q_mZ~a)PMzM=J}Oz&WZK^B$pnx%o24GP?)sF{U@)=
z?BqZX<y6I)LVO>;k$Nn5-u}(Mc8aYzdM+@!S8=P*=?D?6fb>Mn#}z!;k|h2A)6yz`
zR*zwiiWy7}nNRv~M_yQ(kyRrjk~!xB<Cb%Nw3e2yL9(DD+_HpiG<yV4J@=H3M!}on
zgW_No536W|h&1(nvNUrXuKq*ZX>j}aj}DK~I!5$+`b@BJ!tmTn4nsRq*v`bb@jLXG
zUa<OrE4L!TQQK=(trpiWxb$Nls6KO>Y7b{%da4Fj46nB>4F+O=jAXcL$X)*!17Iq#
z98APmKbF6J)o>y%6Zq(gswUsg<xDlbl@B8_v(M>qtP($%+Ko*3(rurCwD0sQwQ_$W
zJ(MPea!*fHa>On^DD^9IE5GV~H)I7W1P0Q~*`4>9C`;-|mNV;e7IH~ZN-I}(xQunG
zZLnIs5!`NAer5g@AW14~SDJ$8jUUFcuQj%*UU8p;uxka>kZ5XRqMfxO%1j~xN?DjB
zOD4gu%3+ZFa;6H`<`eeXWEj~w^qXqEjAc-RdR(%DM1-nyQpB^?&Ig5D9!shh^0HM)
z%1F@gIwfF=wGP@IW{p)TWT3W4TyBoaeKks^T+s=WWO(iqW}WZ$wb42(ElLd2syC{^
zWo9i#X3Y{N=6Ab~c4>~UGaXFVDl|?(`XwdBP3Er@!J^Z4go#>T^B;Dv-4xot$<bf-
zn!8^UZ3b|vX5xg2D$4fLALGu<g`CRlGIO_LpsKOesTt@8%ug<z4|`efZ{KWw6We22
zq-3msp`+FGS>KlY@<~jUZb!vBBewa+eW4jysxGt7jZV6pcqZYw1^p_fxxxD;s0sg%
zDrqm^B2eBzAyl+*Jq=Y%<F&0gJzP*i%2qX2VXo&dSD^6t_UpHBQX9(OY~1A-p{G8k
z>SWF!Arg>!hnmC3CbMqM!=)>kn@IC1w8qrgN(6m_@b0Pe?QX6~9N^`Fz}R<hYwaM5
zHu7MsS!#;5ub9h&D4tca-!8}z%f2huHMyt?-Jj~8KMifO2!F-(L3C(rnp2yj`+E7w
zmD0qXWTWTq(u@-Cj2@Uq?S&t%6k-zqzZ2=^PJYXd?E!Alw>*4g=W>lI?I8fbZH^3T
z*J>}j5u6cZ!gy0Y%##zhoWDvbO}F6t36*$$LgT(eX?;R&t+E+Cp3oc&vl%w#5yyEv
z-+XM2G#*oOs<`iyD3LjEH!0VOnqJT7=gEz<s}5GI{2<tP#jBPF#?|DPcuJ=>#w$03
zJFbyd(2|Vtlgoo2s6$+RpP;F)kr#?kd1T4DnmM7(z@=@wwr*oeRKGmPViXT03Emg;
z*xf}!RKp(ZzG$OZjN$rEUOtuEAtb5`X9Bz_<?$i4B1<R8IQ}0EQ^<nn`;e3{SlwIQ
z+r*wnMHZF)zgj?)727T4G~kZnQ}~<yaZ**4bTBX1l&J(tgXOe9F3eDuq8V)GPl@u5
zl`7|vO7*4QwZzV1Uai)f7CkGgYf0_52Za6Elae=qpbxInTIPcu5h4L$zP{M&PHq|1
z{gu=9MP23WV5s+D3cxFc+ZhwCZjt9=aREv^4G#FeVf>Z;#`a{g=PO7hpzHNV#Z=FG
z%6cHwMxu>h9V{voI1=%k#@6nUm|vbFb%IS-UHtFprHokMv99*%Ggo>`nuZ=5<BNA|
zu40$JX-9fW`Y#IO{Qi}^x7tU)zARpSpjdmJ12C`=iK%P~3pKr;a)$(pIkk={mR<7d
z!-`A?gXBcxPBvL$d5U-n3+~GfyO%SayqcEBjL`FLl{v}64xZSlH!LqBIRy{_(-3~X
zbk9(BjPLk72#IZTPGnj!ZelH)p3@HUXZCtFG;qq{lE;reV_>m-aMKbU-!q_^edqCx
zBKmKS>q0shHLfs;G&x&>ijFM;;77--Fkzyw{JAH>C=-4l>a}`fl~N35?zEy1x5sqq
z@nUFUu<kBjYBYRJcY87yS?DW_rUkC_QXpd!x8Hm9?cpLXss|`u$!Qw?zBQ9aEpIz^
zbj3~aZnQfGuGMeH?QjnQO$?FK{!8@i`8PmYsDtQS=JjO+DPZ}aW@+q)ajZ_K6q$0i
z41Wj*-9V6+@?|7Vg6iCZSmYbI(~#PF-&(I#_Is-p;-ad+OWWMzj?1@(l}rjNSL(of
zOpU>Pj67eo3r!2UY>tlaBY>NFE8ZgfvuR!t`;L9u9%9X`nfTiL!Np2#JMO0D6m;>c
zVn_NWm-9;2cBL-;I@62(Qy!6~6{dTb2Y9cael~QtS6-Q49OyFTc1K(1Y8ZlBYPa&h
zJc>~}V~olAsDRDtO4sHktBHvIH(s5zRJd61+nqTwn`rk;1BTkzak+PEipN?2nna1*
zF~x<@@1z_fh4I2b^(x8Jo;X$Y+2Q(*z<$Fr#zv*pkF`9Ic>TrU4!DnQv{rGL+^&Z~
zI6hqS5yDa(>W?NY39Q+nZ0|zY>s*s4hqy%E*e37-Mq{Ej>cakYNy7eyxc-A7T7{@r
z-osuBY*pwN)@9CyxaCdR_pFI4sgQoIhEA?zeQ@7XV<5FaU=%X7U%YAc@5Mi;sXn)M
z5O<h8Pv08a;{4P<-Khz&Jbl?a?y}<9915F*z{`$z<_f@_<KGYO`5j)gEGb96&GbL;
zSLHmbH6psRuD0wFR6i0T@IaNj$?^KvsSD+^rI$I0?hO}CRg1ABq8-7D!-g$(>RxQ7
zAh22(Cv5rd>r{-3gm%lS0K&6P3K>^aAh-AUwf4zP#4*lqITf@Jz)lCa$GLDswsU;K
zSdJ85Z2fb=?oYpiBV`;9cQu}${P6J%hvAC~4x2O1x@JA6saf|=_2Q9@C(Wu$U#nUo
zI0;)aUe<fY>r3^}htJ;)3-*+t9KNC429LGvKP^kLgZn(k9h$q6TB0-P<!^w9Q=ZO8
zS;S~2bW88^zvh!{*Ao=a`H8ch*hdT9s4?+8Jk`f>MY>iSdRcPSEKhz%>@H{B&v+d!
z>gC}J&Q5C|_8mW1(`CzDpZ;_ODd72F)pR&=Js$+Pg(Tw6jx|r#lC1mr5H#~|R^CbU
zPd?9z-%(!G=o%c1>ykMf(T~kG@$mJ8YuoKsuKxV+x!p^HQ;~&H^~9XP$!v&4g2gFC
z?wXHKHD7ZD=84zrZ~kOOYZ{)jDAz3892N6x3%!5s`?|{a$0C*=EX*02&jEy<H@Rw9
zN54!#Md|RM0`w9)-lgXh9Rg;m*ZKm3<{_-FpP6fWkO0dyZG-Sw6^|Mv%yb;!tg_gd
zZmrTDwu0dN+d}H(Q`$h!ZtnQ?icb@#bq>eVU}%E39}UUFSwpx6l0Rgfj@lPYcWvv!
z4rLM6W!rh*G$R+WtR!8iW*!owyXQj;j9FPdYKahK^QLL`!X5&4+tpnVzVvk_fv$k9
z>$T3HqdbyouD|SBDmy+N4;MeLd9YZuc{YjC?$DxQ3!%`)^N0|awZ+cr(3|boJ%Z!P
z<I0IAi#4b@AtK!Gj5oE&lGp>=YgI#=1}W0Z-&4(WF)h=6sg|+~s+kWSZ}z=$D!Xn8
z_Z(5PS*o;$_ka;r2$?~hQ=97)MV9oJTro;}7ssTw-a6c6h}X9x23(d|_1bTFQS^yV
zSEkG2xNdstN=1SnP7r+8;jrLS{ixE;wW)t<bb+DTZ^tI@$u6bGwv80}*98W@JUqIS
zqOztYQO*oz0Hm7T9~n=?P{L6!7Th@p8uru{%{8cnXfB;)&cDt1ZYd{(_Qz5*$OHZz
zsk)Vcp}D{ZEEzN4mL;w*GeIQROWuDj8LTzgFZ$~Ao)@oQ11z@`ekh3;aq#|B_=3nq
z2JwA)!}xGIsA(lO^pmw%e&{zwiSauu0Pe?*(hP+x3<*p;%RaF)a=#ka>|eJ$v*Fp9
z;_#!$v3oW6&Toj@T2I6T*3R|3#^e6$Av5dMmx@)LL*Iu>SfdqUQt*t()WMrtpVxbs
zPbmFvw^?^XC~D^Dl9_4#<&pe<|7cCjPSFFXe5sP_cmMJJm!Lp{1<mh^3FwO)b^~f+
z<f9eJ^}d|Ftlx_4=qBu=;l_=3>EOP*wOjS9&giBy2*JgoduapicSGkG?P5|@9)jcf
z?<f#g3Z->%_o1)TkA!yqqh4HG>gSqFTV!*CO=POW@;?WE`#-+`_;E_xuDqxOCciCM
zWZr)GGm#|M1OLmYeh>k-m|vhx((WH$*$yStyay$=^c!_M%?r=m9UmlBU`dH75&RH?
z3@gM^O$jXrlt8h?e`ME{<&?Y<No{WW!(K#{;;P64b5%nMG6oL-73&T8)@O36<zbB8
zZ3+451teVvFcPB~1~H~%AHC&wBeXSv?Y8PpYu?Zi$<ky3s?_(|prHNrdXqL_D0%3~
zV?goIh-b_?<R;Ny_CC2Zq#aFpE9%is3RX@00Vc6l4SCH|2`4wUSTU^33HYXn*AN^x
z<7o5GI7*$5lrs=IPfNLf{eYSGM%qsHKD#&1(QP66R<Sz{;$PXHhVO^e&^S<bRRexU
z-l5bwH~gLn_h0h<9Q(Kl8b^~TsQS=)((B!n$ZSO2R`7qk?5#eSBqWh-g2@H&MY4#c
zih}i}Ls@N9SV7!I$e<!UFw%&4=w$3MFItXz*7I?n5z(G*ll9UE*wM&@hS05rv1tNe
ze$<8og6|D8smb^1_n+YjSv76gg!;M#hUHJg@P_j<Q<PqDY0z6};NqvZ`@acV)mf9Q
z75TcrCFbUol9S<#i-7nq-$x~H0cAWnPL<Z!*!)hruxImUA8#+PeL$}jF9~m#1nVW4
z+!P&53oVAZP@nC1&0%|5uJlt&@z_wEL!09+N?Ph@6f|j4j&{Jc7yh9Kfgl1)XeQ)#
zv)7Ky;b0X);<-QNZrTc!`=A-yOBaM?4<3N<gv4-ot%~E%l{{BMWiIc5fCMA#DnS($
z?ZaUiPYyKH&%tongR@{9549C9g$RB<FqbuiV>@|4MvMibh0TxM(jdtQDm?`|5j>oZ
z13Tl-ld|*dA6HEZX1UB%k5t!@Q0w6zcVs>jU!UMm>-!azR7mS>hs2?;Dq9+i$~)pV
zlFp>348&|0a>cGAOUI6e!sY(Fr0$z~|CbNpnUdt3A1qm{4^{LFzM|2H9{Mb=n>I?=
z>zPhN`>O#kj2vl?i@jso1yr?RYh!(;SzVaUH?^cs&2LgUo5%eVCk^HPl^fGR4|C0t
z+T1@M@^jo;a9_NfJ}eHc-^l;wR)b$gcy*By?@Z|A7z%vR@7Ube&%O5P8V=TxZ#lR)
z`;ubh$ek9~B>;F<^wM#JNDoISduWYgHHF9AzL|oojaC<vF_NFjbjRJpvMG&#<>l)M
zL;JDXH=cD&$H~-dU7qFvVr7~=&{1%yMdEE}rc7a`k6+n^{~?CSZYb;A(C`S@lMz0W
z<T5OQFe`wwN9)N<-_NpY;_?dI8dPtIQEqXO{xfH<RDvC*$7%k#XE=AAEE7cGJP&tN
zSykHi(YN40Ts$jC_ec6#8tu5R-T<7ps~>b^5pNzmAQQsJ%<gxpWD%}REm*4W_-#}G
z)=Q|fy+KNsLJlWgmlZ4W(%m&JL@r#w(4Cd*T+U`U2bV3*!HsRzTa;-y;9YwluhCIA
z;5;CrwE)n|DMmwenw^e3W|Zi6Pu)=iVIxBMfa~oZnJboY$$E8eb)P8QR*q+H-)I}(
zs0vaj7~V)0tD;X;HTDM%90f+*l{+|K6-j>r`T4F2=zlWasoL@s`hFY?Ha1c5JoM*z
zB+uwtrq#aJh%OAebE=@Et!>D{yW_`Ji3T%xY*i`pnuEwVAg_B-r`zFSp#gGVT#XN6
zpE|zytG+0vbPJumPkA>L52b+qde##!wzkV2BPU0t_AWzGbnA|BJ@Kx%<0nYzf8eoS
zI0X^$cKUJsr*;+n%!7?hw)kB+X_xGeK@?zbXAl6RdxV#0S_$_ul$$naT3PH&czaG@
z`bM>C#J2r;C3~OQ4#EEtc>Cs=$wjxp)~fCIsLu-HR9@xuYC5U)?RE58<6^He;SVG1
zSNSin;uaMIZ+MqMk1zXnllNy6<Gv+%gsl#AgJPSI4O4q`mS0(xjrqDwyCq(1AI<A;
zQj)6AGIQePJdt?>2#J!YK|cJYQrCPmBC~X7VP~t`DHj^4l$>Z!l9lOc&nce2=k4<B
zSra75bCTvbl4F0SptxR{-AGmh+uoW8suu>eZ2bqg^bOVN{ppewxz`BPod!7!qM4I4
zz7LQndKo&?G;ggL+gB#^cU@W1FGl=Bn`H{`7GKxj)!|I`7Ar*YUr_DKy4vgVB4)eY
z@5DP?rXP*~JeDSS(p3Hm8rN5ro3(hHPx*THj*Hs}nk|r|7Fu51%QW_ut*e|gTfO}R
z(p6Vh*=6UBK^wa>qPOIoVSCGmkOD<O0gcsTUN%|nL&qd7WIR`Cv^fa-srrPZhMm#5
z?<|4qPhZ@BLelBfmq9OgAv41r7E$fIhwsa%Gs}H7)j%ah{mP5%cAwX<Ji`uo_FwH+
zt`*cCWW`L-Eq?aFZ%lOXg|74zu!mI9O*1yY@XFI>P3~eLPGyUoX)^L0ZVH*JX}{O7
zy>KD>(#C)u)l98gY{_Ob$F@Wx%6*%Urat8^gaKFBWmoN$DHH35n^mgcm#^dC{zerw
z<8(q{NQ|+#Ea2GM<~wToGaq?=XR?1}T>Rz1-oXzEkycU1OKMy#!KCKz)kWZrAmF>t
z*(AatSm$hp*#^8gwXRub1L?3?j2rF-d2ux`|6eVDE9{zq(3<wqwENQEIJ$PJ6k{Ju
zTkXyUe5DofIWW%}fthZKzMxzj^czLF55H63zqsAt7{ht=A#F8c&0;<FN$17;eIK9O
zp8eUi*ss17iv=~E-A+D=)>>%+4PN7)d*GZgEpr~c19^%As+oA`aJpd}cuP?>G)97W
z7Nc})QOW;#W2)CgSyp@K!nt)b|7YxiHZ0iQOGk7iC=1(4`5|7$l>k91)~27jn$C0)
z6XzvaCy}A^HFI~wK$-8`)Z3fBPN;R9)T+#8y41L}#c{GL(m4!1meVb(jz{&S2n-Yl
zF8z)GX2^KUB$H~47Te;eku6LLZGgvw6}WWeXfO9c>K%WTfsZ5d=oQ1MY~_i|s>R(b
zMmGIdOP)A7Xr{g8h}qf%+>HO;!0SBvW<4_D*JC;Ja8Zui$L2{QVd+J^xJq?le_pSS
zQ$`Sug#)^CsA2TQ(e9EoQX(K+R!?98EYC&Uw6OKqJ1c8rqLWSa+nn3Ny;EF8@GV(5
zON$UkX|erpc~NytUKWja;6<59ZXFxGv-|y0iow5`_&FH|xS7`I8xBqz_B)Jf@RGyz
zI~VL=!8bDbXL2i79h%Vkkica5iH|pgzrW&PN+Lyd(G-|Ei#PlIHSqFBBNJv?C;6@;
ziI{sOEt3T<mqRVXLc0f7oyh#`vH}&D0xOlx#3xsO?vJFVSp1OMhX9a+tR6=YMv*mh
zy6y{(<LhW7#*Jhkk4#nn4K(jHgLK|-M@1mCDHrZgsIK<<!ksBJK+<<CHMm7wqF<c=
zaxyGb>7>ueLxR$or%SrU9|Kbt0U8-{%yzMyJd_i%Pkcp3bk526vb1H(>7xa|v}dlg
zs<hJ`kWGgz_}=m)XXV{-Ri0UNca+A?k$EID2ZM9S(pmG!$^YUijEEi+J0w}Q4fWzZ
z=xZcBt>SI^d#?^N>R!k1YR(CDQLj4P`_IU0ij2G-m_pk-By|2T+u*sPd2(J|ik0U9
z)%xw42h#$RI+>m15=ZV=wLiV;EjZ1b=F)y%o^TZB-9$K8k<e=W*I+LmmS?ZB8NNTV
zI2bQ-Cb1oz#;sIE6Kj4TH?{kDE{VKKh`z|$nuR<{WHtKf*raUrT_0A&3Yj6LsF@&|
zw{-Oe@E=hqRRy>)^C`~*Uk!ufrxLp+vB}~V&QfrLKH8-82oMM?uBBiJDmkf~tSlEA
z_Dua{s1Sg>ZD4Fd{Jv^zZ)HLvLo)4!)#|^|?HVQiY0OW>KRh3PCjNn#4*Zd9<#$Wq
z#V0X|SeDmT$v~@{Zl#+h0uo?OiJXcA#8BiB3BNCp{GpSZFz1v!_aI+D1wDSW7i-t!
ziPh!x8aS4l=s`AF(v$9%ULBO%_xDZZn<9ZL3?6@u%B@0N?Z^IgTzWgu)j#xF|FvVW
zBLXM1y|S+&1IgLQX%i`<>OQS_Kh@#9=}0|HzHY@)$SrBtS$=EeN1{r(Un;YW87qz9
z5X{W6<YQz&&Kl}z<H4YHV{Mf||EThweHgU!-&6xBV(IqkxtjZ93TM)tHRtC@VV9-%
z-5-gc3x_5iN>3Ql{Kk>}yX^F}1qc4_Uw6bJ@MCI`a{oPu*QQX)S=oAT5y<9T4N~iM
zk$OT<T~^z9^D%`>d7o&|1juts;dr+&i<qkkw|d%E%`{H}1!|II5|e>4DDsF<znLzk
zu8T#C94SX9&0>)q7y?{asyoY8{Rb^`cF=^(hqS}AV!j3;U+!Z7WZiID5Yevia>WzY
zuFy;lnzoV}37$WgZ6Q!=121V7zhnkW=^N5H3-6M(h%UF5oiNT_;iUc7w%)z&wCkO-
zpl}7q@@<*6<&x2Hbx5Rqw|vv*(7&dUqn`QtU*$wohkMO`P|_b<M^m63wZS>Vb@z`<
zCuYa_wK3buqy63;zxx;uyY<WbEl#mCJlgkTS{6K#h-zx_b`R{=<!+<QET^J%nT4I7
zO+|j1xDUW;iuktMB?(KnRru^}WErMi;He3`bXlk<`8dYbQOU<w8S49gfI}O(hi{8v
zIZCT={nMLVtmajo%{T0DSvD#;D?yCBksZTE&^J8kkn?J<ouUHEm(%AP?Jl@urbX!D
zPKHz4>j5FUuHYutphttMy^A*NUK`Y_k$!AdfMLpx&9p5mm(_31BWIUaX(n*VX1i*P
z<!!(FqO$6}KP^y`dT_kXtfZFI5vWtK({<rqA0pG6MdocL8c5hoshf~I6ECS7!@6X!
z*ZQSqSBu_fQQ(;5$+#-E-}`r~v8YVjUGa2P2fI@6r(2jQD-Z;7r2}4$YCfUIX0bP-
zGB5BtI>qqcSG1HqIpMcMla`p6GW}zkoI2+A<@Jg8TZjWn*>aSADH^^kV*PmD2T)Qy
zyu{5PL~SomH+lBNAQYH;b}z3rUb=7BXN8dPwhi>WH?H;04&@p+;OATF<od(>2?d7+
zv>%of`TF$pR<0Vr3(0<XbkyQ6U)C~)JkQhq9O#nM(;KM{b5o3#-+un0QLL0<A<+;j
z9gSbF1A;t<CMzaY_PZBI*+hRXM^xOT=6s3D)89`rp*Y*K6fqB>h0A;-DjB{LvW<|t
zX2bSdbPA@4TcemSId3=bS&pX`B@ZO$thELzISsL`Npb#WMM6#gtWyuSCVB9|&nel!
z(#Z5KL2Z!j0w;aT@(YrZFDIGw8+;(u{d!C|G_w+`45rdZl-zojVr?sQlxuz^S7FyU
zwX&&G=aI_$-H(_Rl#-^eC1G%pKj)W+o#5%-dC(zB+-2ozg5{ec)n@aj+M5*Hw`ZCN
zuYR1C8k5MmX|En8?HcH(1tYz$=SDH#+IIBOgrFj71Hq9V?%?mZp0477RL`SeCbgYI
zzZ#~(B_c?JQu{aS#7Waa>DM+phuOz0gn}k6smpjx=gpJucl>G$)-rAp=es<3faTz4
zYIo1aUxLf~VwhC!h0+)?|7T`MGW{sNA!ANTMY$2lBK7M%ToHbH-@&%Y*hTIc#5hjz
zSk~1kIV9=5`bf0959?X^qiEffaJ+Gvn=xsbRDoElM6i~rI1{C(K5cw%QgBccQ@Smb
z-D<*^;arNSWV=W%p^n^nr*1a&Xx!XdssKkv#}v~jwJMc#Pj|eB89o~tp}JuHjKhfA
ziDW@P@XwEJ#|!ToAY!?3L)3nYQXHsr3gZYk#}cc;bH$qL8TOhCe~q~118NMRzee5r
z^qKz-DTz<|a6sg<O{oWPq_XY!7WoGgLL32LQy-49lKOf9ftv2uQ$)Y&$=5L38Ag=<
zQ$b?&g%EY`$$S1u)7J%Nj<8FLsv<h>{g5I7xu~5>Ona|ES6!IrTIbS+@<~kXo;V~w
z)<%1_{pEr9pi6DtuiXCBJiB>k$bfdC)lKC9&n#g`{#yf*!6w7&m+myRNX82m^RJmo
z77MqVB11H;`te9+m+P;j)++VdTJCRf;y8YC+Vg`Bg8k+2uJZ!uXy=SdUf&hAad5Ol
zeEQMz?;vMI1dkT&<;~&9yQVezkj`tBkw|(|l_Bn5f^5GERb)N>^&4omrvDFS?{JIO
z{YNh#hL>}ET4O6b0-2*_^bJ^6q$y*ALtWUM^CjHrM9Gu4iKF}Zd3|i4*9N#`TcQ~=
zrf$X^PKaOBgc0OLc~0U>)6qC1N2{v`A`1_|O;xK&&ERj34(pqS^`0#R=hi-73{yw8
zb1UKMLYq+T@OD*cXaqvXxRUoJwGK~o$Fr>2d)^l3(H9)8P6V8GYP;%(l6n?Vqwfae
z1xrKQC0&4}7$Tltd^1jo-{)ky^LvanMm^b@h57qQWtPx2klm>UTjde2xc?&Wwl<aN
zMe!m=vY*2*LmXncS@qS`ccu$eu@$~|yhz3I=$$f!stTEtp%3lCjuCr3hgK7IYpyJO
z@nU8O+mqpGQNbKxmKL?JOc>ivb<eHgI+C4&Y&3N0eh~!2ct{Q^t$c>73?5n}8YNm_
z6PJ-sz(v0G#kNM;e)zM@sDD&@TLuB4Z1HlXlMFQ^<;9IY?o$MVS|?+GVLp(f=c&K+
zQa!@f{uq2R(+(}U5v+b+4u1EINLX>oY-~pY@{%UW7_8Xrva~RL2F?m_{L+*zQyq=N
z?0Fe^Fm8zwn`!Nxe#>^dz{>z@pP)OJ``rvxHl%E7(A@&gM$v`Sziv6cKyA!j<l?uf
z!MR)(6SqL3jt^%L8q#q#+rt*1t}S;Z>#qZ2$=NTdic4!&RJcw|x9Kcw&Q~hk_goK4
z3SRHOV=UC*X0@CUKWV$%32yE{Uj;6XK9i~TgDf*oyUz-j53`7N{8Z>ML^o&64%_Fa
ziM6&BK&iD4=B(B38yx2}LpX3aob#be=yCx%BYeD82DD5o%3g!_RK)Ui4v9=Q;8$~;
z`@%xaLt`Amk%!_n=NB@adW(Q5rw1xiC<H<JxZveo(fKg+6cVqw^M^FWJDghVGBkep
zYf`_hIcvVTa$Q+#Jr#nITl++ku&u_{AFCk(Y(=t`<U}(dnB4`_GtpYtSMS(Mh1KM#
zkQojbBnzWTSvy^(?@TaZL}G)Qga|BB^WNel)h$wZX{RGAu1520P|lBT6n(kU_4Knh
zZ0K96`2)JR0{Zk@GqLes%DJd4Q=dSdbZhhNrF**NeV@M!Wpqzp!?%(4m6sZ4-O2bj
zo2v905r=O;y>b*o1+jmRCj&a6QXZXgCO4?|!Jdjx;i|y2A<HkS?EFZ|bVxvW?5COb
zZv@#zqgC+`c=lTLEMy~;;-o#N@u9UXd)u}LM=V@ohq`@;=IJk9$?Z<tzGLgkf3|BI
zU2BP`zOs~*Zh@rk!P>25WX}743T^N8)>hI$Pmyy9-}Q#|?{vmn#-9-ARIhiMPl}E-
zE{URrPVFTBfl&vZZSuI+YaU3lADrI0ysp4$^CJ2Smre9jC&;Q)eqJjEZ>?hed2Z0y
zNm?=;;HQwUl}aPgbu?4Y_?mZgADnQjEidOPk~d+Hrg!J^=pKmv-Tdm}piX8xX`Vs-
zI4zr0Ige&PZ(EcuWT%+=ghQ=OTo$(z%|FDdAL7l_!2r>9W~xGZ@%vxed(6n{SDs=h
z7@mxvzI6Ia2SLe#IG+F+u1ifZ#&44Z5YHHmVN+~edBnC?EYsTH3EOmA;;gJbedeuK
zpTr88?<EV;CWjVQq$6Zc_-4s%D247^O|wb}&K+LLc{T)~;x<ps8~tJZ+yA@R(AcLp
z5`UjEUti<8p+ssIP>MCb-8#*7?M~UcmGeGWhZE{t=+NDkJpXm;`F2v8-fr$);u1CE
z<*P_8rZ&1y!7I#^PNThambf;s$`hx~YwxJnK944jxQduWyguEjehn8rtp8b;JDj(j
zp=%GWPIL`zX1e}|fEn5GdBoZGG+n&}%ZjyHdgUTn<9zYre|-UbG2|p+Gy}r<uIfGZ
z+M@_{XpRg#^lqXtjhzgB{rwwix}9`pjP*pW;|8S+w4*rN<8r9xXB_be(ejlQMr2AU
zZ`%fGYCt4x{LsNA+)bm(>?|52kH+np*v(iO{qMJD9?DO=nqHneI6!GH!*Pr-GHFv{
z6dUbdo7OKHk`d>aIl)U?<?>6sCv5%GaV3ofQq6=FCm<qje_M9x4=Khd)hB?fl83fe
zKHKekd4X&t&y<j;k)!Q`u`$vYhS^rKyqkL2u|f_EQu+ECPZ0y8tWJWL3;BB}J0f?E
zj2w1kZo=Hg_q}rVJwC-`d2KPLyUa+vnY9{-68D<}h(%63kbfG)GWz7sD^BRQ-Z$1_
zFZ}Kog_u8EbG(-Ty^Ig@y3i%y$Cf<ysgDktRI^%rXNF2hcB%4-<k7k_>LVj8zf<xY
z=6HOB_$|&nLyhrj)DurqjO0aK9sBNIrqY3$AVxIxmo?R(n~6t7A#UGEjt(+;za3>S
zQb=56Wz0Hhb*%i_%1@%L`vyl=&-aL-{>yKr`#FtmC@r?V`ZK>E)2}5>2P+Y^XW5}H
z)28wk9W^CXYoR^%WH>KX3nF6w3$mnI<sNxDY;Dp_-1$|&&lJ*K@LK2AUk}lSe&Q;r
zoqM-RnMy{ReiI4WpTth9><6S0UTk$CO?&vGcG6cbL7taP7k-XDjW(AuZ&bPDD;3V>
zh+<_Y#I<WqygMyS3&*L|vNE64zCe)W`!+Ql#ip5rpV6o1HLy`l*+9I2JwXiFxHDF!
zpT6V2-9pNS-rlq!qY2I;7d!5`crz`Pl+2v9PyMj;uzjizRBw8-wwu)9kFGZw;9MRJ
zS(0J?5iBzZsGpZIA<;Cg)v>XgbsUp7fL@j?Cqjtd{5p8L-xx~)1E$8SaTT5!yczU~
z*0&n=VO(Rk2)n&i`W5sE5?TZ1<Q^c>5*lv=+&>iEO|!YwV#}vvut+i7F4Ug6Mp9Hc
zZwk1}mZe;f*A<7j4cdad2XdladBgC(&fhVjLK2X78j}hea2Xgi-W#OSC5OIybyJzL
z!`)$7bZ5|Z8R)!PL<-yQxteA6T}jwvrUNb^0G0(Y(qF2R*FBsIc2h9aK6sXM8vm|S
z+$IHV+NZsjak1yk%O>Y+7h&p>Uq4*5<qKzGCe3rQV3NmECI0haZP;Wc1d8geR_Jfh
zlc44N!>nb<!*P9|u9It=l24=+rIRDTu*_R3ro-DF=d13YoL0){eb`f4lrCz;EyUdW
zEfcNtymxNZlH8Qx#v}ps#yKtY9#Xx`_<Q0)`A0w0l;^+iZRa%LLYlE*)p9uWO2~?F
z&Rle3j^OnT8_ym&oTDX`^B+i?j3xGONd?}9oV$-`SigmWo~z{Ub>XjvbaH*ACQXPw
z`|zv3>SLX+nDK?lsnhD9NK1K*`8<#`R`X&PWZDyB$ijkwtgw&_m5B;ljRzW4{yWDj
zj{u3TQy=>FX6l#rdLpBb_rFriq^&$@0yPe1_oQM-it*W%YKb)k(g&Z<eh;@dU1+B>
z?$L;)qEE@FdV-u&_FZDI(uREM_hL#P-WeiDRx)`ooIV6wi1~1ELJxW^P}wp)le@bL
zP0hK!>R>EF-4N79Dt;4SD)`5W{9H~pbgV0^di`th$LSNmJAywTM-hZY8|!l;+RPxh
zD7W`(JjH&n!{P&#>(hkeeR<ueXIqhGCcm2E@=iv%+*wjS-~tK&hn|fdpJ7K>eHdOa
z)Atne>lZ<Z*pc-^#s^gQ_w@&d?qg{m$fZE~mKc>HxU4Q{`;FD6Zw1h@*^2ZW9iZ`?
zo`fWlq3?sO?L5{Z@4E@4$Y0Dd&noEwDIByQm)eKA!Y;*VFm39G!OT8Eb&SYo=(5?h
z$!Cw@IuwbD?i#In+~D<Ux=XQ_szSqyW=6=W7b`FzyqSsPv^+ZZ%>y}MdUrBvsYv**
z4&?D-71na(nC`RYo-AkkNP6+0v_F5%s`vh|wdfPtS;ut3&RhkPaR`$a1$sigtX&78
z5K&WBb#Kb($g1Qih+W_^#p4A)U2jXb_Fimh&q?6A#=LfxWPdqnTb%}n)UO<*@xmbP
zoKbtZTUOf#BHQGI)720>C;IFe<ChM34>lUzb~SglJ5+77lI(NlB+<-xo4q6UUB9n#
z)~^RcLpF``_3q|{8w<SIkn$nUE_^RzP1)$xT4*1O*mU8Kc?|biOC^DSX;tKIWyJPj
zJe1(GPjS2~wWT$7SJ1$^Vg`G>{y%)ZWmwb=*Y&NUgp`0tmy~o2NQZ)iG@OFKz<`v1
zQbP?XEfPa_h@^Cg4Bg#1G(!&Eo$sIXy080qp6A2+iBH1;6MObvd#&G29_dP(BBg`*
zLoUZAo;p+?UP9Ef-$nMMKa*Ipxw(=$NUz<qKY2Wln1i}^fc#0zRa?@CzU;4^%<2H>
zg1c~OMln`cdb2wY-OTzN?UEldhvaG%dE-C$I%UXxd^Ns3uEr;BiU#p%;lZ!OMUeiN
zA3{Y(?}1xGTd(CR?Y0*3t>>-9Jj+$kDzF**R-strHC4{uHrl<VCRKeeJ<t#ujNmmb
z6<-R(tvrjYg}dY2cEMk-#7&$$5L{zi*#n_dh(xrHpP&mr(XqpYAEdz}jQ0&u$Cg?*
z(S~W$Skf@hO$_z5;-x0ZFK#<7BHjU`&+2IKi$M@dwA|wCs|RQ~BFzT_$-*bn?F6qu
zoA|}@G!GLLr`%0Hv6v0sf2s(v@*R5$Oa#)cctKpsqj>J^jBq{|V%5pf*}g+J^R-J!
zz?&)@Ro9-Rp+@du*OgnqsrF+l9LlJE3S`Hl>6&l;HKf7}@0&!r56#Mqj!)FTHwTv|
z=#D@I?k%WBx4=zM^n*TAhDZO0B~_E7Q;G3j{*21Yy>CPG5t@);Amu$Cf##%v{Ks*A
z^WJC`g-Z(Cj=gMcXS8+sJk1D+e<<q*xFCi2w+JY3e>6u)p?{Kp=>q(wUtx8L&4nz_
z;zM|u>^;k^BR58Ws!1mXs7(G+B`5YU8q3Z9;c*?faGr1S4m>IU2uQ&H{s(db*sqhH
zeOYzYY)E^a{#*%M$>jO#k2S%9d};P<mq^u&XCFf0o11Iz=U{+VSQ_OG(#iSP=oKjq
z<X8T1GYFTO&=ZK3F)~>E7J^C_OMXl;%ls$DC*^ygz10|#`OuhvbbmyS?EmFL<?Igy
zm4-3t6{XqZ6X#bXCPeBr)>&1)_AZbWTYiU{v{6ioq8V{)o`X01Zy}W6cl=iNIN)>K
zGZEjgnkQ?@7^`eUH7kokreo9ig=;cm6FV#00dzREP{5eGlky%=#hJ&K1^UBM{Oc|1
z+D*4%4ROft=;O$D<8hxQ?oGg+^pl^snNE<@{mgR?7r*1w?W5X8bNjM@X0^eV8nhC6
z)mi4FpR-4>@!{Z}Q^TI4<4~N0Rk*y#Gnn7YgI_71=1P3H+_Ve&4M133W}oPw5V+jA
zU>_4`UCYIpmvi)0?^GsU0-qDRVMT|P>umt+e5%O1XFG1_Tl(xFR`peGtpJ~%v?6xf
zB~Sfsd|~`1b+4d5b$maa$Fbr!`v7`tIqHwJtN2euKmDGnxF(UyTiK*;JmkMz!Q4;i
zq-4a~=hMc24aN5mpl_8=_n>UNu9u|1EUfQ&FP%g7(mEbIXwtxYDjHsoBHTzw93jUg
zGgV1q(zF1nihzV0zDzk5LsF#Z)cRmAFbt^58LiQVP7(xCSGB^|g&_>HcQMeiR-evK
zoqq5j$tkBX8!@BqDUi`6|7ZUt{A+#`kYyv$)-_k09Y`h$N;&unc3-x=R^#0LbAiPm
z1^)@zi%4X@m=>`*eHyRwGMhIm3`2AE(cjtlqrlr>UC{m^&N5XYN~Mr&zaNXP9XeH?
zl-(KHA@2&Zrna?WTTdiIFQe<yY`iW-{$&09B4JHbDC|X@G!0HWGud@VoF9F6k}sYa
zd<Ue29KZbgYWiUI_rkGbqXwQ}I++&1O?Sq1d}d}%r)Gh#{;WRSj~;7yoR#Olev<A2
zOoKpslTP}iTe6Q+;nx&TTz96edE1(N>Ol=|{o_P{myos@JV&3!LGGgovd7p(aLjEx
zkn9Q9Z$*nO#!`KKb3tx~TUf8rqGOI2)L^YG2)v>lOMhra?0gWhdhwA$$eHt>7A%?w
z>>B_GGWY$oM(1<UKXKa;5Ek>mBFTM2@Kq6s!Qc5~&j(+tkP~%_tWtxOR;j6Gdzrn~
zUjAY|NqwX88VwmgKQR%N+}8%GlqRH38(yqme*#B{8lgag$b-s^myI}D!gPNl2Q3Fk
za7&B^w4`(LpKW$ciLe2)d{^>)?wmK{TB<(J;*9y~lfq;w{P7`Q*PN*tfFGLE<=K%*
z3`&ofuZAQ7Dj6SFTyHOKL6U1r>D8m`kvGET(Rje!aG?^J7Q?p4QbH^py}<&Ut%|FM
z;g2`D-Ktedkf}SS);@bT7q+B$ZKJl2U);_e#i4nwaf_W4=(@s|+@8AcJNsXe0-TG;
zDwjM@%;fOoCZ%j<a-x5-^A?u;idtZck6rq<!Q>XxmhbF-FXpl_Z%dvq94&)kn16yG
zWC~<^X-JDZA<h(<ymTMnx41-fSqtna$$<Ym2!H=~5caUM%8EfqJ*{0LszT+V<9=~l
z7&iU@7p4)Pr$ik$v#L@L()qF+{W%!_X1gw3LK&*|IWf)JvHswqaT`fhjBLrXD7q+o
z_@2}(9un=zbPQPE7>Wu(_Uf#Ogq45H?e;2zy1qO?YWK>cpM6<+d}$p6G5TTqH)x?L
zPx;?&?5&~jW<xQ5yhBzs9YaVt)GtM3qFNu^tqaf}wq|3gH!pz<c`)o(ZFkVnvs!dF
zC``0VVA&)=_r+@@d(Re*p&VBQ6|Gl4xo%Q;jSXD_hn9w#Jiqd<KW;z$&;8VTlph<D
z5CDBAP9^U9jn4O;Ko_m>>u&~_2gsf8?g~r5Jg9F(dIq=XUEK&yU%_qH3Y+T6mBc?i
z;BE|H(=(~QRj*!h<o1s&>B}aRB<}ip25ko|O}06OSxOl5KqX#_9%P}3_+HgVRs0}G
z0^fG;`j0+}*MI5hyVRX~tQhrnP<fut^N`JBFOZ6AbxrC<Vimgg((o=>iT$o3@OUVN
zqb0g-*r7N5ZqZh~q;Vig(V*PoX%OUQu_Vl?GN%*WXD_wd&q85Glcx15mNyG^AZ2&I
z#fjZHjS)J=iPv*v@$_L$_X^BQRk?i8xRCX7i%Xl(6PKsY{bA$PRbv^FFLxQIqv-GK
z$Van_>~;O~NLRJaYYuSa4y?sjDvqY&<>;k&sGoqMLY-IHBiP^4KH?f(dXD`zE$Dh?
z^`|I<Tg$kPw$<nr%K5CCwGN2PIdmRz1z5Q*X68&>L2L6t0PC!f_6SBl-1>dR(=*VZ
z>hf71p3wCv+|a!?Y#{*9G|x@mkj|yPFt{4QD{T0$7BE1;S_rKfij{Mo5<6PaoV*vf
z2^2o$Hi+ArZX?b)Ke949i57zBT%Ws0+&!Wg>Xevq7^e8>1-1tkrPWaTTN${yJ3*na
z4d>sqdWA+2wdy<L+26@RX_c)_Ee%KtEAHXjr!v5DuBDtSE$Ek~O}ww*<0xh_{pXjX
z$4>5c7YZzDOZ_|@Wn{Ur{swFL>fO6uuOwbWYS$>iFS)j9rB_IwvZp>hk*Z=*ONbEe
zyrOessu)eITVL5e6VFQ4RxD5}zP)O6$&|X-!ysg_2q(Nq#{g>BNF5Ludkt7Z-4BT8
zubNu_WH$f`BHCZ>^aow#QbUkv9wlT*@F>^H{EL|w$JitPe<}=xoG%pqs2VGz1{r>=
za$1`!VQ3e+2$D2T$GLd6MZEF*0oAkBCvFsDBiIhE9QNs#(n?s4v4r=Gg@mv!f`KOU
zx685$ycus8$CN>Sa(Rj7m|>C$=4)DcDyiZWTFZMCfs!(k-rZD`d2g%4ujL*!YZuFG
zZc*d-zYYlK`}DSjR$v?Z-P&uW;z@BroZ3Td{~>?phyF>})oE#mT}lF=>_ALaoZw_G
zynp(SsqD=yZ6^Bk|0I&0?!tNu&V`^C3Vr`rthe9?9{L}50s@{!Zy`uXNz%OAW`fQ_
zZd#;8`8GvFuQ6rf$J_(-6TL9xPCc3v8v_U)m70AvCk-b;6^8#J&@?efPk=|ztiCuM
z!cUSn3e;fDB>x_?aHl0a^yaJwU_u06h}e8Dm~ro_|Fpu0xhKJI!t5<3RN)8{b=d8~
z9p*dldWm=mn&?ya05C1Levyd}*MSZF_e=k1-9;hc`K2wHYSpElhb0iZ4ZRNAbd~g<
zn@3KuusK5jP7!MEM#Hvko?5Ltl8jHsU%6KwKG-LWm7OOad$bE&7VpZe_NO*Vi)glg
zLP>A;5J!x3J4t;~vF?f&Ol_q+Kv0BX#kBnjnpYhaZTvQsB=2*al)V-Etok^ij||t+
z_bf^+!~O?hb9QGK4tGznqG;D~e2Y@j|3nF$H<9b24veA$BkcJ|c9Q(kj6m{76oDqY
ztl2S*Z7L_CcF55+g<6wX3@2JIzYb0<TBKC2etuu@#Jeunwi5!0=nL%e16?xl>zei#
z(G?iH*tLsX7|E-*D&WhvBS)7*)rJ*M6|HF!f)*5hSt&Xew#W^0Q+m+NVZB-#!N9On
za;9$$)epn?AU3&zAu|@>Gl%u^=bHu3Z~fQO(jO*g4(5YKl5@3K)V>^H%pBG+IInZh
zWGMcf|LiADkdkfVdNXZpbm)I@KDTfi(3!T>&kz@PW6^lUXy|e9uI}Q4wQ<Y&f#yRt
z>@K4DzcVXyKvhf2CR<hU<1E2i@rzOXqh@57DNH#T+Q)0QBs<`PMe8*tB0xE*ToLYi
z#|YOX?AXLVD2Hr|mTr&{v<2}`Ii6wc?+)(x@lbn;+5nr;b#vrm?asGh&&)cx9-}m^
z)>91XBmTNY^K6B7CN^ua!9DMF`}MDu7i!D>7_f|(0#v{YUH3UXo>rmLDZyw1yPkL{
z_>J=<v3}!Ss#o}#)CoA{c!y)7pHptXj>6pIgfy=CYW`S{t!xC?0*zK>->E%Ecj5o&
zy%x#tiI@p{PCdz|{JF9YP(3)F(ae0N?JHIqc<Z5A5Ix$Mo*IHn3u{s7IB<$)LG^2~
z8ZYHJhHXUakx3j1?|K>27Ja*oS#++jFzU!#x^u725V+o%Lff&F97W}S?a4NN^8{?S
zqENuqqd@0u{IMf+t)@bFBl&vWSJnAUzG!&rM0VezvQ+Z=d|BBT6%i6lP9M?dZZEke
z3Avu?#91y!v#EXm6%11K?%<8-<!&IKKUx!V<f1xX_EDT<46?(tee4&a5iF{jz)LVp
z>-o~Nr!tz3aw$7q{gMgw6M5Z%Z0SQ3$jJtNm=Cgn9dcY3h#&iO9TEVsu-v@bpzBDf
zMj4&~TeHB_T#K*TrxvyZ+p9IkdxR84&(539SyZ*wT68xJp!Gio6ZmL=c=d12cUNuy
zuo1HMrxdVHo#<EYa-?bl2FWWGQv1AHA|c1IhcC94t;VW_ogq5FjHSyvqtDeM)B`M}
z-V}*lu*px8+0&S`#8d%$OaKrQlO>ve)5zL^KgQ>OpEqS?uadPU3S1Y${KP%>?j;@@
zwB5ONHP<!cIv`b~1f$X4f8#ppFov*iBlV)p_cYNbe>rksV{y_Ha_&a^E$t~bm;*Ve
zD1YxrhgZfx-u+R7Nlr0Md0B3b_|!^bPMd75D|*IZq9q+W=L%MM3`;WFmFS{oDiA<>
zCB!>H<dN|bUcYepFKz4u^CthyDc7TUMqM%nJP50Cu0YTNHo@=WvS`sxK1f&I0)488
zCuPS`vLi&FY^&@=`kaziGgeSw{@oC;&C&C~cu%fr=Ss88rt;Uhc$pgrL9GXo=z}dp
zyn(g%T^Ab72|47jZv(Hx9~fLF0vRQF=5%3bp7T1a|BA9p#EfT~X}dcy(-*6mVsS1=
z6Ks*jJa_|)t5|-b4dnoCl2NBb6lS=~<}x~%x@EZ+R}1NGY>|P;z1TtK+Uzl$nS^+>
zp>Q!q&7rL2PQcUa;@8(9v*^@&69+svb3(cM$iZ-Il=yQ-I3plp5<_%iwffcF99kle
zN*j-d{>a&sq(MYhw;t)t`rI?*PBCFO$J3*UWPeRd95$W?n><ZtNju)LR=E7b+A}Og
z*tlD2IVh9PSi(1MU_=Xhlo(^cX^@$;F-u6i98Jo#K);*O2_^jg8#?fo`e0COBz-xF
z&*`a(A*Xz)N}>Q!iLS|qy0|F2%BPU8Q_LW5GcAu6`%L-8qOAtv%OjZ7%?=#`dwLyq
z!&Sx4QM%~1_3U@=#3Gh*E$_tL;cEOrP5zuBiz>O2%bI!$u9h2*qo_Qms`W_hMX06L
z>{am<UCYstAu7ch?Z$o^%6a5H=frdKU`MCeLYd>L&@WU?N{EbMu+KBCA-e3g0OFG>
z^_MSv_N%+{BGm-fACDbs8d6qRVmR#N!>GNBbp2G3NnYoLo(Ihz0hHA4WyyQ#^uI}>
zX1>U57p&ti#b*x)3J%3f{`3)lgiSG*j_@mesw9mI47Z#i{PJz|Yz`kF4FZObL#0{Q
zEeJW;0p7~3y+}$aF>5cENHWwYvHb-z<vX{x?eLU_?Ic&p!8|Q;uX{l=GAXr~W~Z3&
zjuMb*PXTWfY1atN<@@E1PZIOsU89~4XsJW;wADc#%|7zEpflz4AF)d5yKcThp(So$
zA<?F)J0Bs{G=CwL#8AE|d3AMb=(_hM2I2AsnWvxCgzu&H(7VovwT;>5DHa(J_i-uO
zPK}JNOr{Ld7xvRvEK+Xv54Rf-l<X?H|GYes*(ihc(z$xN5$)GRk(71p)u1Konk2Mp
zhCMwKM4(A2ua4tK0**NEi0ck^*$H~NtA)8G7l)##wUd+}tMXp<I&x;!!o6Z2I1?ti
zPAt`Yc~;@6E5Da<JV_)4EeLL*=sCnraqYp+g;HDNVBHGMN8vlx6QaqhT|7IRTT5z_
zVXu;9w_XI|#mR#yu#z*k>D-^+L#28rJCi+bzmfP>_@`{Z3h&dR>L-LZP1t@_-|uA%
zf@9|MrtD`^8KO>Ob6f9TBnJN0VriC31m}BUDzMp&0V&`5X1oUhsh|I2G*m?Yu@c&f
z3tAW=!UQxG22O?#yd;X$NdzEyF7N$}44#A#EKQFk_F;S>+&comQ3yz3_diIT$@>b!
zl66NI0dt{f3uk{nXCsMioMVlWjrO`<@`){B<85g>wVAucKyGv&&s0zkV=?HyrMO?t
zy8D>t2pGzf{0GHC`AqQUr-*n9XD^0;18n8(od*GL$E$y*ei!W595}hL*MQ;igUqiJ
z?E8Ls&P1Y>US#l1r8bvjmBsx8Dl|0sT<69AS>D2UHz%2<p~fr|P5pR4gqs17(F(m)
z>D2r9rLaj~3M5eAhz<AEEIC4@Dpu4!qrMFTI;vKx#<iCvrFTSfH{E$hD20rE$S*KP
zrsNyIJ?IeN#Z*doP1G-(WEg*WemN7|%d+98*XxPZsRbtDvFVUac}3@Qm7@V8F*hIE
z0phk}Jv|qGaPg$Q5PPLRv>1(efMKws`9b(M%+Uu~!~WFYxP@=(pbys7jt3qpP<Lqn
zu`a>K&Y9mhGtBp2UyFZGU_2!KbCkvB_D$t81#up!%#&<Bt0tB|csOH}PoDcFU2uju
z+5Gdddq6~ur8B>{Z}XJaAy4(b@8t3glTSdi_HVWjeZd^t-l6_-$Y|sWuo!?64F%-1
z(9?(J6favD_MdCEiJkrHD8#LGB+gVN=l=+>!7|d|o;Y#W_w^j(<h|wq6&N7D_^Dhz
z)ATm5T-(qxS;TT2tQ0c4L*ZC1HrUH9y)Nw9j=csp7k+Oakb3{LE<VC|J&MDdh4{i$
zs?UA5M3rHr@7Zo<&}kW-q_l#Mq#O%{s$;g`Bi#kZM$!cZ#IMh_&ReByTRFX?&Njz&
zGP=Q`)#_0ny>*du)ViQg7G;{Lv2lh!y!MkFsur%Eq01>X3_c&fj>N;iyV&y_(9zW{
zi#x{rRJLiYCW?(rbL1_~z;1MJlbpO8)i+)~S@_m{`A_22RTIL$D@h|-)B;o0({4=g
zYm)9r2%{~geRvo-S}&cSDqAgq!sxQxTy`F>hmdLIJ4&f9DI9rqNBqd<2JH=o`~_A)
zD_r(&dYT`Eok&&VpAPQqyV1KmM0wrV`F|xZHKeNidw6bt<5i=yTP1l@_`uEYrZSpk
zv8XOlI7cnSNpKftOiP;@Z^OzZVlMDHNrW^6PLmp1S@zEBCK|e5kelYSmKA1T?Xrjo
zNWf%%jPWRJKSnI)h~`KPG2gRs_5eeL+^ASej1Q8+a<s&<AR-KTy8Q2YP%^sDue1-7
z8?R|DkBacj)tr|(o&5HHY<d0oT;e*#eru_`5s8^42eEG{(DtT~J3xzXcpv39uH7vV
zCeCR<ac%}1w%NDcw|{dB%^r$LyOE7irW!zgCN4Tz7bRZ(o(ByMFsn&=CVEqxNi8}S
zp7?Nq?=9QAwF8?4A11C{Po;2r?Tw02WotKxT`HSfnzs<Z;bcVe8dtob6vI=uC~IqB
zfU9dMdcjEeWA64nA*e%g4)s{yjs76$LLft~e&Bb()C{c;sry_b9j(2O;|Z+?`H<FS
z(|cLxhGYQXBbv@@{OCn09|j4l3M#HPgwUzc260-yO;#5QCf#dr!?|~WWn`56ifP1%
zf8X+`X7s&6$WmMN7d_!>RtN64k@MAoPgdR!LmFy49~A%7?p9%K(8H;!HFfn)@&V>w
z5JT!@<-_;gH@%y%x;5e?EL2Sa&JQQk|7rn667l4tm}HwmPcWkE15ovHwBPR5ej1j4
zs0!Zt-g9bBFo^Yc1s*U^8Dtc4AEpp`ImkA;Uw7nhKSC*h+|?X;vNGHggFH&P53pAl
zEh^DSq*${zI&+5=;)b&+Mdkv4h`XS<U1`zifHPoA@I<Zyg`Z#$-JV!{F}?#V2lh(o
z;lHD*gi>@7Un$x8_6Bh!<l}}iB?prcX=0l7w<4|Q0&mq+g&kDA``J=r5yfO~`|7+9
zjPs5r;XXZ6OqK(zwzzr3Z~@V<o`>MeUmY@Zlj#N}o{OviT$PS}Gq2}D47y+W{+Eu7
zvBDYkmwcIh@Y__zj0x^9*<ZP)vfokNTPL})Q>0ueZptx61mE8CT?Qj6D~rYHs$JNp
zfWT>hI_Tp-#Hplu)c4PaxSmFHQpf!XoR%w7L$7%i0aC7Hpe5JUiDt?6ss~Uj-g3$3
z2^%-JXN8Re^4Dxr-g{!$Q<-Vkf`C$yOTTy4{jw;Fw<J$%uL6pJC#Uth*O%=35(6aB
zI~;CrMO<RG;(!Jt#l%fDDvTIBSaE2L9vdnF?DX<r))>`aHUEBnRONLlOu788#je>s
zM0`u!B0u`jdCh@sW(M|SIiZ+BLULma|7@E1u6h4B6{7@{+E!?odk(o><T*!rkFv(i
z|J|K-%&36li1fSdHyhzv7nM`TfgM?H57Wi$fDv%<5^|SzHPnK+RsYm&G?IgJRmVm#
z#{rugFOp%+DMm#TNd|UL-`vz97>%?6Ka@Ie=faEm(2!!a$2P(=(Na$+;d`HW)Tpye
z75rY#a`&Q<F8k#kS4X~T3t)&k*Wr8AdwaOvCc_hoh|v!v60kcaMWlhP?}k+x<1yw>
zlXQqz-~80^!VifPSq86S+@!j6Oob>rmB^<hv_cEnQl~N-B7U2_VyZx2GT7$;jySpT
zn9{-$2=r+!UH+D7LGZXMYtjH#>B_o>>t5*Zk5;n@`TD1zs9W)0Hi7kVdu-N*PVcvi
zs|T0e;gUY`kWh<&tUZDJV%)HBQSzs?=~^3(;8euc+|O3Df4yNOJH<v1g;=j?D$~i2
zRCaVC$+B=}l#Wr3%Ug-aocAuISk5uD$!bzpoPVcHAbrVaFXt>xu|RpaPRr;75YJDp
z6T-$Vnv|hn1Lr8s+$c`~(T57#TIYKre%69Jc@mMyPe(Zwf_UL|mD{*@ghlO>Iat$V
zwwcv^?8N%1KBz%D)z78gOrkG=zde->cBtra*o$R!drj7@KNb0ubhPC@U>f3WNAq=`
z3QXsEb(vCCN}e9SfEeHqR<oXOM}pf9a=%Oy-|eK|#g$yVDt6yoQ7nu;jK2|x=N;Ms
zNF6KAcFRtw{tyzi%e>!D^=9^emFLzZRSsF0r%;443X3wgBxej5^Pe~2MA9hYU<bAN
zJnu1bHtmn%=L1;EveJIpZ%jHK5@AqbIpf7{A$kv*uP*VlTsys9^ZaG2`z!~i$R@^i
z=OOyC>X8*I+DwLb^Gd?DXVgcDIm1s^Sz)rjYf1^{0a~GGn47ic*u(`MWuRqe6vPOi
z<`%&ZnYMBJ`jy#^#LegID^@JDfjayiiIW}eZva)i1Mg8Jb@M24B*P!)2WAms0)pNV
zcFXRhl8w2#)>k_k0J?*NZ;mMl%HX1xXP*C7?0U|HxAI7%7<bptb&yD!nWy~43IC6W
zFk$m`#foYpdhYbQg>LEOks^ufM<$GZLiB@{hub5DXM3b@aX)E@eRpHx=v%391thOU
zYYSsZ8QzmPBnZUc(;__{^Z7}OGD0}P%=+aII0cAOD@VEGQ-!(lVHVr^)@W|#<t(8>
zf@GrEH^9+G)^q85W}!n6EcuY-3q@m*;Hu(5a}Y`Y@pSxVez@+EIU}5N!<~8ydq5?J
zHjx}px*P`|^QXHi<mbwuNQCfEppk>Kt5+$o>F9dH>Ws(wHtgMGhNwEUMNuuXdoq#q
zHvx{=82{L<bO)u{*fVDts}DAUSI-c+X4D#)L=TsBDDSyLxLD0On{f<2)@5K{#?fyo
z+K&CJU!`|#CAZqLqq}6tM>=kpD4LYHC024$BH@!j6oaCYec7nbT-GUr>zPnNN3>f*
zJn>~Dr9Af!nxUuN`b^u>gTkQL!@t5hw=b}q8+JD;Wj>LAuTu76*f`0~$DKiy>4{B%
zS8)F4&Cq}~qKLUP8~(#vtjg5l<tii9ON*?BIXp^TY_$xBEl~{vGE&dCWvp_dQ&vmR
z7t7u@oj$qggF@x{Lw6Q>uxe(Cl>tW;g?AHv@k3lU_R|TLt;iCLdX<Z4$ij~;+Y3MW
zuch-fZKk<Oe5}Kg>XA;Fa$1a(ta40t%Ahd0fa<{LLM%FRA;Y^9S}1TIY-u{#D}L1y
zo-B6uWZUI%>NfXje1agxR?&sSnMxX^2~uOU_jM_~bvFsd%B$@zeYTN^PV3W2Ej44f
zNrO*kT9O~2ye~@FDqN`vNvBEj4K&FKJkp)1&RfUtwsEvsM0#J45q-Qe;~;fQH0rwP
zGbs1*r$IGIYJP@E(5rCC7^$ZichlMRiLh=ycl>+@v*9)zG6*5~t6s!sFW%uWI+4te
zW1BIi#U<#Bmvb7{(zD!wnhQ~GF667E`lR~{R(QlX|80!5V-1@2o63h-gRIn57XYlK
ztG_|1eID2B(fUiKEi-}<ZYh1vXnp)h_#>sT&<|0f$~AU^?JjNpBq=qU(_I(TWwN*5
zpy!GD>=}wtot+Nv{EWtBd1q!DdrtPzOrhmy=_=MjD@EA0!oaJfW+Zki?abHM0-lCb
zw{657gX?v-2zKrM-`d^w0W6weGX0~uGtz?MP@R%$N_1q<=z31@hb5o3&TxtliNANk
zzYJilg9ia6bbeTLZg}|^<nYOB*Vi+vN*4!piyumwmMSbBBznSkeo!~8-86)=o>LFU
zPX$!nReAPr6(8^q@?818FJwNvPkUlEn|tByn><Obv>yTnnTB+}>5L8`9KD;&#wB|N
zxQJ*4=*eaZx3Vl_?e^ROw(&DD-52j$4AFoU<Aa6QvE97bm_46anv^R&B9a6EBlW$@
zF%gA)JKiYKs7u~+#uW8kOewvR)KFQ;7qOrFxgA<?4pL0jT5Tj1f7FGs*jz@2^>zt&
zlY-r8j0n?KUdpJt^!1q{!E?aUv|}P7d5{-vrI7opCEk~u3=9m4gq}R=E+@S(UnSPx
zP{3_US56P^?BN(VVpH4q-=OZEry6)VyU^9i;gf4<GGZOK`44Oz^0e#8)o9to@B5C-
zC2TgvK~l3Mx>HM|N-I0;y_c#mf`so9$nxPo-Fmm#>~uvBbMD_as%Rrh2i#nM8MlEc
z(p^Ir3AAHQK^}o9%Z!rZw-b9n+Y=tDf)s_?r)@FvIFZ&uVP>~9u5O_(PEp~<E~Z|c
zD8|r)K@+2Xjm%44`)k*}gx92?T(!<NoaGxmp<DHzCnxX@v~9zCUbRCizyjyrQN)49
zomW!s#Dp{+VnWEfc9xkZmh>DIx9XT4>z6an>(LKT$DR`t-q1(Hmxv-$55Ir*{E)@s
z<g)Z9a4airgJe<oRhmeJ0OJ%ev$+S0O09Y{ds65{s=2CGR~>FuOB@n^Xz%?Ed_V*(
z%2^x9vC4xM=p(Rn54i11CIIw9@pR<vJwS;z1JYNRfqpO!{54|@F-P}?U%8@ii>S`j
zZ5dSPxags)1C2{;Zk@nz?2Fjrn~b#g&V19Ci;kai)n2Hz%!6!{JJQhBK$L~nNf`xo
z&~tGMTTk!J?c#wb649OdmvbT3Cwni5ZSCjST$b!PecF?vJnev%cA+PI$@l7H^pXCE
zkiDLSByjRZhwNzelnBMyJn%!;fY_N;FpE&|cdz08u`|2NJ61Us7pui?i?rsF+kK%F
zx9;&t^f~C@8u#ehn`fu&#N3g4Nl*)0XvBR<nTc5~0ou>Jf|mm^<~hPQtRh(0dDH;i
zQ3FJ}y^j1|uCUeku{-<C?Gk8<sjg1;N^aueDO{HvIo_CF$hKFzfZ#SP>-j<J+E*Pf
zo$fZ;&H&FlBVRyBqLRr_f8BRo8t4AbJ~!zI?a3dCb{~4XEt;89Wpzp*e*HZy!Oz{^
z6327JVY7>}$M6RfzuKMO@Gg3L!h1IGsJMZkmd2iP*Zo{0baShftZEJ~nnhV%;Hdnk
z`LWtTD#DT2d>56g7Ea^Q;j$k;vnvZpUlc4TnNEn$j(J7GV#0$|IV~iBGb5IPx2V}V
zGJeyX7;HXHA&y?;)#-Fi+Pr~4(>wRl-2N69?-!YK`A&IAos)zNG_7c4vcHb}{pYJV
z^vB&oF;X>Y9nQ0{b%?e|YlYK#6T@8&Hn`h2$)mEMKkM_3CNqc5Iz#0B%a4@Z)qNBT
zG^jqV>!$ik9K{DQA>D^tcHKl`0@yYdX{Jn|^Vb*WEv%B^LWdoLFdaj`4??rgZKpik
zw-E~r;Uzcwug^PoT-J06=C+RN-iW8BbpLrV&a9Lw>Yziia1e+@MJL<DC{qtsFJXPW
zsi$jpuUdGLezS=@$S1T3sFW-fx%aeLKB4nlKIr#5TQp%l#GZ@6%oXS7QSW>qd3ON6
zPp71Mh@{=lag>f=QZ0ui+XfAK?x@$HwE$lC(N*J(pSICKBFJtm-lc!*AlLj)(S^HI
zQ}4nN5&Q-ZS$Eo@Z`>dD+E%~fQ;<?q{g@NkMY{?2^OBkNY@V4b^mNo=nsaM2T1c|F
zTX2`1<uS2d-~+t*sI*Z`TCaL(o<*5_v=+g(`t71D&AkvV1PUFUbDM8Z7c?Q_6t%|8
zQA_vjj%GEwMwEGI(1dAZhEm~kQJDWfR<>>%br5J%nvY<6WympssPY=<bv~4*G@`tk
zY(|V;1Eq<wmuWE^4Xwxmag-9a&-S?n!CVoWf2=Ng>%IV)v##7!PTRx1aKBE2Q><j+
zhX8UfreugPH92u)1=cSLJWhy8@;<hJQY8;iumN0j3~MRS2j+>i-yQ--Hr2bNQ_^lO
z{EEJ?nmu-Sn7sWMi4W{9m^LjN>`Z@>j_vrZh+AwRUKR&BT>)N{t0>uB#eZYENGbt|
zryd5F&+sQGEHT=R=B76O>tQR5Or|J`o9X9V*0krIzqk4yG)SH=yrC0w7GMdb3Sx`y
zIJ!#tozQRFLI#Za0QI(Qvdkny4V;*mDG6h405-91G#kB0qPlRS(aX(Cl)%x6Y&BqJ
zTe%$5OSC4K_@t3ly#)Mkzk8kS1NjUY-F)-G12b(hjl9n|dkBiOun7Qi+MeXc9D!1M
zBl(=3Awf;j6!ueJV6QmTVbDsi^g{YGrHC}JuHMLyYYFEMO5zZqxM$D%UX1q9gseRH
zuNEMTao_S&6?_}#Br7HD>x!5OtzZXz6QxQStA}a)!ykjN*z>KWJNge#XMs^R4eLuF
z3KjD&RuQL`<+(HQJr|4V-}UUIU`A=Q>sdydN;}>c>bfiGuW*gdO*YSOx`AC0DXCwK
zcD<-4=N16{rw=$RMFaHlhR|-5s~fjAI7-`)=e*0fcVr7Iz6qHq5MMmd%;Je{+3x)Y
zVfFCx0&kvJ%{ua>z06xv;d|siLp}S6FVFMGL%+FWx67HtaB6`_hSHoum=*?>^DnsU
z>2WHi9m*1IQXxUuB7Z7QPB*_y|D}9Or|c})V(FK)Z4-duY3&7Q%efwAWPK^GpL}<1
zvgn##uxadF7BUHcwi;3mAluTjgm6K`g1VoE6F*wVlJ2jJ4oZJ*MK&f4O_9Mk>uBt1
zCcJs!85Jq#se61cSNR9Tzqh)0Ux##%7oFund9tg9M~5st&o?b3!+{|2yzPTs=*ZOM
zX@UG=1gIg*ga`2mvKZFP)!>0``}{U`uRUxDKND^=C#Zek+AH_SeOpwzg}Wd}w)dIB
zC5l;g;`n!M|EcJ!qDG8MK9}#cvYp^V@4JC3ld4Qr;KVv4q?Xnd8<eBkJY2i?%}EDB
z>b6aBZpLo)3@ho`{6PJt+n4Gy<MT-!g5Cqq^aUguId|x;yr%M})p<VLwvfj+hLA$e
z@Ijyz)CSu-p$`+?QSJZ0_`5=1z*lGXEZd0pHkSZ5z*fC0d#qN{$%)=J1;Fd~d#Ppa
zN;gdV+fP~szbo7HKQP_#<SdygvgmIU%T-$&{E)p>ymGl;2RolPQA1U!NrmKyGP|U2
zPJ$7g;nb7usC5iLru0uKr;6&%^55wFcG(kpIo5v@QPsvpAwnr!$|^e%nly(0^}Ajs
zZWM{SUU%bO4KA9_i8s!`gKr+wda<gG!I8ig;2I3L`!wuJ-MEa!JGZ~sb0>=dd~HTA
z75cHCJ0s@pwk6$-a=C<L{;;m~HRCtl(hM|QTU{@QFUd{E00+T}{LWe_3kn~Dn0brU
zzw1>fFN9}a$t{jVhc|WXx#IrX2prtIJ5@_@n)+ZU6mC(?{Ng@QoH*FZ@!{~K*>0A8
z!h;1__X1gnxP4-nyT6g<XFU>^^%20Ey%V3rbE*|K+Qs?=_(5vkESrQ|^FI$G<Ty1~
zRcfD?0dUQXPIfQF8n+I2TkRa?Vz|)2?t{#sdwp3<X8AmDC@VOc*K_)xzK^CveM=-W
zzktEAY^s9SeOQ;#Hw5iu?pBWqIZ7rgGT{X`L_J5Qsr`Mqr;JC1=KHO>lHPyAdDPB-
zrSS9CD<7HIe`7QUAQ(k0Y7HbUA)@v)eoHNoI#4=JI~j0&N|G1&(T*T!Up)oB0-g*k
zU8HndD{PSsP`-pCn%o)y%J_+eTrcu7;OnycRopKwbtZ~1>2L}sPH#UF#Z>`!GBuV8
z9d`A0zLUQja`DM$I1oQZUf=nnKewHI!lZNmU7SYuB3Xi0&C89N%?6XMq{YV-U<QQn
zBwZX-ssNwp`&JbovmUu+&=DVgWVa8#I;!0&@ZcNIk=&j;>H@if`?g5!pP;K(-F)LU
z(58Hz3z1WPtSQ}FzDVL74Evjl_$iQu@v!bFpUJc%C%+Rvi%Lr9!E(p>nb=zT%E(#d
zwR7rTlhe}WJG1r9=)U=24%N#@S<k@<NWH22>CEoN8BOo4k&?CCX|hX~M{;$8&OgeR
zMXxWKlaG^*ADz@&i>LwpJL{O*l$j^M5844tE{(Hc)PFwuE<F|zU3})OT7Txx^O+ce
z6ZBFoDLYa}-kH3J=*<VkSV5)n+Qq}T^a!lh${bxvtu!Ej_CtH(JDs?WsfJoL)5y~x
zjhLj`pYOTv{nI#=N``tEC(UG-n<9DODj<iQcSFpsI@xwpcX$qrE*l~fl^!-PMk-by
zlhF;RLghwZGUtsL#jTOL=&pIi1to)eIiBipu0tH4jg}{d>6Jqh2Q=*XkuFOc#?pk8
zQ!xH<Kdt3CtQvwx)gpbrOaXea^I@OJ#aZj93*~;YGF<$Ci3u)w@th@`E@(CWBi<#Q
zYS3;ujq3SQc!GopCCGk`TEhE@4~(Z_{h()<Y2&W*RcVSm6bDF+AtQ%v$?I<ft)bkW
z*lh4u<8i9u!8TEX<1t<UsftgNZ(7m#hr7-0(M>UI091oRfA?I-vqzR1a2c1*b?mhi
zZj9O?JqedOh3;q<Y8T~ZkI{|G0WhAWlM*mZ=gtL1-4=e0aqf7|$FThArL)|Y2<@+C
z&040EmA(QYuTVJi<Q^-*x#cHS%cG*^g#UEB+@+9OYk}A<ZQkW>U?L4?Jjl^Bb*vM5
zPERm-i-{q2lv7HxH+elZlFZt12g{vrFND02`mkk3*21g959{6Z&Z>@|?}NGgyA=Y6
zG>lpfYLQa1l!~XU#<_pHgs^vuC3!I->!VoFfJ<p^cTkIIdkz}6KDM{mUktz5Qk^{?
zqZV(wNVzyV=nFYIAg8mg8cYrGymhA|KwLefhVA(w{Lm*jn`Y^tyLaN}Ex3qq_=ego
znw#2wQ0AP14p{>`b&OlKpI^VkvNfl3*^?2zTkM39I_tf$FgWY%GEk7%2^jg{`tm@W
z3CeAA$e=^2nD^^9ifMbyJk`H`Znvk86+;K;6gJ8(IL}-(B+&-2%d$yFzmuCa?HA2d
zEP*bK8z<+BiL6VYWbf}*m=!X$<O*Mhf1A39#b#dO1?^OWip_V=O71%TCP!+qs<g!I
zd6V7RwO_d2%`EhNUji;=lzbH0&=-G1O3dGP!lk?tHhdH=j!i}jqn|&tk|^oX?)uXm
zU3L>B^=)fF5{HAcHVd6F__0Xm)y9#acSC_-<KB+#Cx@bph^`OsYRbY7S#SOwRS(&b
zxbq|{B<yGT@akjpCl6(vvF|$?Oq&s^Ne_BPH#AD`)28XGsm1=hZc(6t-8WbKO+*Q_
zACt|Mt>>{$OyL1Pj5tdC{*<So7=1h-ie?`dsQs$`NL%SChG~=4y@TMivftJ?=!M!=
z&z+mLDplgDk`0m^+@CHg><lveY%YHKhgMZYZT8E`Gt2~C?$QD3L_&Ts%Iaa$_xztt
zrJ3)Kx?0QX5hBdVp3jCJaU&>hUYW~YCKIulx1pS}`jwq&;)aaO)j=eB0nzwPi_REw
zc)HlDZm1fugCRK6TP}TgqhGT98!8uOtV<~8<%3yed3|T3(BmDj?Q?~hz{Hn+pLBJT
zo(ywn6FUh)gh$Yw+0&L>7)L9)M4>x=dLj)Vz|ZmQ_6wn5RN$B<HEFOp05M*H9a`rQ
z8j1+>oukSIkI3vXprGC@D)=~H7L0Bn1VqLzWb7su9p@&Ax;dul1!kwdM-h_s*Jb&+
zd2!u_d+-Wm)r~7&QXQ(e?|hGVJpPXc``V*x%u8k6wIA4e27Y_6{Ptx-n@>K?dQ$K3
z10P(4$=^oz=<TJsAVd2+J_@ma$N;0>I$WkdRajSg#nPDglvB;Z2HUgcja`nmZD=%6
zBwV4G?~KPDd7nOpM_B%`din}eaQVxA-YYHg%z!use(Ho?k}rpkGowBW(4$*<&!S@v
zlQ#b+Z{b4yJqSXzxgP2V!!&iSKneI9VX9UZ@@5jg(mu)6)5F7Z%dVrHEY!qO@Bq$(
z*l$bwc>^#@TZ&1%o&s3Zv1sI)KxU7=qfMe=&|6GvK)+CquP^=p11jbRrC-Y=f#=-&
z34T=!H0(8Rpnje5)JY;L+W=Ht0^#HDY0AqHhqPX@pew~HzUx>-+&aF;DG|Sw_SpIc
z+&xzN8jLKiro6nAgFU5l#Wn+b&*}Va=U7mCneL#~cA})RZ$8xU2-EcCZG%uffmFsG
zT=hcqMWQIq&;D09%`E1?tucq2!!x%~>lPl*rOZBJ`#@keZ`<;3bWqs5E=Zs6SuPZ~
zzxbzLe@1hDngQt$0=z0%-p=~l^>b^&Ht<1IRO?wg13*8pE<}LYeo=o-5OK;!YS(Mb
zBJ(Sa^31Tkw4M8Y+;wjRtyXW&!l#<d)7WUBwRe@QG`>fK^SJWcH4^hj9Y~`V#KExz
zxqK=Kc1DMIoH}C`p=#k8Toi{#!T~aPw?SA>ro{6%@9o2m0-?pAg#&Zi8RN-x^v~#Y
zMN6Y))Et%-R!AhkFYTu2__dvq7o@%{f&O+1BBMvI=iUSfl{?q%*lhPF>*vnhVGp>j
zYfyU)VoaVwTo!-Hr!|4<e3<7fY_E92*TPCbmQoiD@}=n1Gvi#b-FAb)#%~LU9Xqrx
z^C6zQHH5hfcf2dmNeRMFSRLT~uH~WJ?n~Xb$%>udwh@=|A`km-yBm5Zl9xB6u4h+E
zkRI_5AIzG%j#C!Y7@kT&oFcc(pu^HqrA;*@t|Dm-f~$y=9^7cU&!#R>i*6-)9A{TM
zX6Tx3ER3df2@zMdJu`A`LmSH!_ckBIU5B;ZGH{L&0`YiFdp=HRzo8gpQeTODq%^v~
zeh#1oT0x?;#b_QK@7#U@rn{<!({aQ)LgrwoU#bHF`y!MArL?&_SVio`BT-aXdl)z6
z*16ZU9v(;HcWhW5i3O?`m*OQK5RTk+#+3(R$WFlp(TDKzc{*+>I-wL#_FJzL7kebW
z&eFN(S(|2sg?r(3za}jZL=SEZv%cLe3tC##N388Z{L`)arD`4#+VwApf2QLsTjv~n
zSp3eOp&9ZtPf+3Vr#bao;nkW*+{qRerv9&Hv~EjzlE)N6$qTPxXUz+oD@~Hm(E4P%
zOBgqPRg57Yw*6K@p9Dy}H*4&d33K~C(g9viDHsNqOQ!%C%v=LO*O1iIEvkeq9{`zw
ze+QJ`j$f;yKw%}}f3l$dbyd?2QH<(lMTA#VFG#?}F)|(AYtp2K+(|6HYcniN_OEa6
zlpX=r9E282?^9V+Sx^69o*iIWElqn<PF<mQJ40F{5B^1^&lVr|(YZOU&GK=pd3DbZ
z$lNvhiPO_MmCd8-<!`?Ycyb+@^Slzp8VPbl89QXn@ljoiTR`6^NeNm<DJ~rmZTd6s
z{vbXx8%Nv@s=t%^CUIn|yQZ_OSJ4w#Z#}<6+Uc}%%h*&Iw(6!reOb>?%(~s$?6mV7
zhRy^^Kh+oex!v4KE#E4JuZO)S5~zj}UC(q-?$DMg^x%$}?=DL_Bq$>5{`#GO7f(|s
z@fp*_e~^pKEMsTvExv<ibs2m9(^usU_p9Mxu7>BaM_6<Mhi{TU9Y>77NCG2}JGgC$
zRnG}&FtAG0ByzV4H{95%XGBuRBq)kneRVY_4&JqW!VC~C?qa-OfD1SXuGW1$0DHEp
z7T;J^K3}iMI*<WBNGtzGo;xRoPl7c@!p#gW?o${UF49W?GXAd?P@sC>(bB#Wim$Aw
z0bZsp|GtjwBc_eX1fczFur}o$-`XyTDpX9LEv{}uMsB+iygy~nrP3O03BGd84+W)d
z_R-q&&<JpcOF$t1b8&p60ec4KcEh%<BEF$TP*l+atRy<MPjLVOBR)W2%;=G!`v@oW
zv<S79+0vLt^|jof6_~})Y?9liW3k&O*7?A5A|ade3H`L%E*zXCYJp)#^Q?Yl``}6Z
z1f4W)p;~u{hsx|p;aZmyFb*`q%=h97@|Rkq(2=>Jg(9!q*GkA0w^M=CH<B`I&)?HS
z4ceYf*13iB5}7}k)_IfuBWWPnQRTKZ^DK3#Ttci2B{{m<bTe}4$C}lAVq{Xdu3mlm
zhkD_O#qVF-H-2IOo5*6lGpk0B_HuVPzNOxT-|5GMMjPS$uF|1TZNG=)&iAsj!eKS<
zq&-6LSsQiAbyKVGX+zMp9CD7Qub0uWb(3yT0)9m6MJ+$-HSGsSk*P@-R7aky*Ik?s
z0|eY93^-!&9k7|MP3Lh~>8?q5?jAh>SsSk(ePc}+_&u%g`9dT|mA{t_60EsYjPy}d
zvs^h^U1_1i2|gb0&TPE3IOYH@_-I35Pwv`c=s+j+O=Tu>Ce_(5I;~wtZB7d*467RJ
zt`&t0N_1~fsp_J^hfl((gkEs)G~yW^^^BJRSAmR=*EQ1AP9yehmrUfK{T{cYVZaWa
zyTye~?<>E0`0cjWDdH@jrxEpb!{6x!B~m3i11NGJ^xDwSd+9p?HfWLoVFI9k<~3;S
zn@c{DkX2j7_*o};^6(WD=t1`i<9%A@Qw_qOJ6}?{VhG>>t6r*V-SGuZ;o;WcK=Jv$
z5fAJ<tYTdvIuEAO_8P8H`~Chep9+*{y*~UyfWy<zsdndlk+i3OSm00r_+%cz9+%EG
z4snzuKIBaxy+oNSN<GVs?@YF5xxdQgi`00nXds1607pNiQ6aJGivS@p?7->-S>oTG
zS*693yp&fMWDi&8*m!5Q$D9Ncl)cZ!Vg~13xHOX*=R~ePg!5XXN1lJ`CR9-H#u%Yq
z7rD3njai2ROJ~`W00v;wkYNJh`h#-Qdhi*oNZ3I1Fo}!dCaQsFS)q$Aoc)r!y0Tn6
z@$MTK`KVDIq_o9H<@GpOS0m`T`406o)n=<CbxJ^Dn){m5<q&}9d-abh4m^|EqS-9d
zv9}+u$3(YIH(vajeezR2=ln@<vTja^!_6Q^g(-+6us*z8aq}_*>iH`_Z_t+V0{;^$
zpxZV{K6mQ5(979lzI4Tmst@+#nu?NQ3v6L54mAfqChd_&U5tDW@YPfNOI-qZm!ycX
zU+@v=#ruT$IW2WRPMXBGl62s;A{P3;&fE`BE4bywUdvkAlfMZim7PP)Wr}m@mklNK
zy!g&Bo$#dZ(+!TARr|lwyMs!@UsT)uo#+E>%4JJ)F3@rt>H&twCmbUKI{@>Ay2TCG
z?j3FG$Lp?qxOEE9YZ=QcOtsZepX?;CoCo}%Fc!W|e+EAwCPK4$AzH+EfwjkcC`Rs`
zs*$P+YvoQhr3V0q0TFJuqA#3plsO6v&;0wr){mdM$L2yA+()41Mj)nnebc}1?^&`=
zvH;CeTSi)MT^R3j6S($baI2^=ISK}B)aHs!ITZX{llkC2{vBV2k20Tt7}Ia)MxfGW
zrKp3J)Bo=k=}@Q&b1lQU5{~EUT4u?h#mbI?ihR8pfLagJuM$7Xlwx}D2QmbH^x7EP
z(gxRnuuL-<<_G7btV;_&@m4@sHI3oxNy!s&QVV>G)k1@D-}{@yvPx}!)^OP+*_>=n
zf2?6C7pJ(=e*^N|r#uzh2PTF5xX0jV-p60~)UbEI#byDO(T6SQZ()iHFE!Zu9M=!`
z>Zf_$R!~T5{z-ny-#%_n>#<kIQ+bkBQ~J+OXn*A%`UD4WU+;!Oors;$j6QV?!49b`
zv~C$Z(QmdlIv7aJBrFM!dj`HLG<jG?&HKkTtlIX)Rc~S<ZM7}Al`r>ggZclydzk%1
z@B)8aYU$C|#oGlgE1uph97*yO0{cN!Cz6eOO21kHu`Ar`O+QdIlaQX7qQ5(rxV8C<
zP-3Gk5-O@$K<_XR*b#ZSdJwGDU0nA;b<K@nyO1kjBC0*aibkM3e&-KjK?%z#9FgRa
z+Kd$@>dex!T!WfUY)MzjYXh$8nPw{JFU}4=&4mjy==;2EbAz*4M+%+aDdo}K_I8rg
zRSDDGlRkXBTmpIW@2~P*u(pzCR+5R|U`7KRrMHGAq>b9Rb9P0eH|6IKVdqZ{5v1v9
zO2W7|rSxYxQB`8Qa6!1zEmu)BF7RP`(=Z$}u5v+)getMlFTG=`-xg&Z(C4zL;3hW=
zDHlTy$HI(-?y@FO_b#^^l$mnL!S9CSW~`7phx2Li^hfW-{>>dN#S7;}_XX+cVdQP4
z`Kj1H?y!7(26hi64id7t`<|(-Sqy0VJdd%QX|dq%I9QBrmluV;bWP_cqgl^XnQPTN
z^PXANEE$OK=^kfX%7f1mfWs)D2y+k4E6o=K`BpHR=H9$j=Clr99r#OKF*Dr86`}*h
znQp1;|M#%(MZhFR@$*#=2^8Q!69*h<jDQ2}7p+VB)^kEn(&$u^+Z0Ck0a7KLV)R0J
zJ?i-90x*T+$o#{))*>2TEHx}BK@ON2@85YEAXlM06OOC<wQ3OHLu2hp2Jlo**{%rt
zv<$<i1lzFp#!M4vfyFcz1DQOJq4?(5JqShi1F@@t3gTrDL&gNB2Il`#KNo0nOgKEm
zpgXdMiuWa9iy-rpXv;skChO1@rsK3~++DBteb7WmD~A2r34%NFcVZ-fOiRCfb^@Tp
z_lhm^+Rtp&7^o}%3CfrH5bGha)Wc>hT9PXgAW<X(`0k(!7{sUS@xD<2->D(Zu4u<w
z!ExPd+Y+S^=0Z0Tc|L}9=wG+wq2~E>li3GsP!@h%ky7BX|IR_q)J2NFGsXI4WJXhr
zqPU{nt$<QzoR{8UslNL;KJ5psUrx9(hzG?o);Mnlnk(`J$r=vd_!%Td(a@4v7jC(?
z#xjo&D_0U*)sKXT0JB5>_w8a<=)K+0h&hevxJ4s#Sm)M1e&cn*uwv?GimGA}nvK42
z&Og>;G))fR`}i#VWRH^q!@T}+CikjJ%AWOayb}+<(0u-Q2G<Z=tLjt?{32S1xu;xc
z6RYo7ffBAf!+oyXb;lq9rP(j9^2l)#w8;5|2?{Q&pni$nzg@l$Ts(7%*zOVzsfc%c
z)xQe*XFwRV_VTR)9|=}U>wjblxCr|N-g+0XZHmBsTg{CiyeE)#zKFrnZFv1yy^PU%
zF<m2~bF3_^3Y<!Kxgp9*!-6rnwFWf!`3%GP|9&T$ZyyQO)m9;Il3{vElUK63))5J*
zGS+7H1`a<rrRWC_Um(?g48rE-p9s;|ck{T4mA|-odN26^XV#kkuu>#BtpQhcUtePv
zclH^@JvKNzR%FANZ46*Xo{@N_RoJL`Io<ij?*K?J9A4wzW4*afJ;oq&(YRk}fPtzN
z&bjEGx2y_{LD;7u9!`Nj^FA=UYqsxrl>Prv_1-~EcG32*ih|e>kSayGN*9q%R1icI
z#6~A{M1&A9(uqj#MS6><6ltM%h;*byQ3*W|N|Y8tfB<RV!+Y=j&3ykbnW2Q7=j^@q
zUTd9wd`CloQD7%O)ON3h#D}%Vhdy{4Ck{BMCJR~s2i5nFNu%p=cL#O4E-35kjB#eG
zKKZ2`GRmqpL>2UEhce&##6BPp2Dp1}v^!n>cxzdC^!8W#u`j?Bu$|*hOYE;p`R`ho
z>vw+8_gu08t}_kI{>l6Ruswc0-aHpL4&1>iYHas;-}&;lxc~K40W&&Ep7XId+!8B2
z>;5=*S(<)yzeJ<_!yPdt;R4wH!`v{zcXuXm-!6PK&CPm<WMf`-&syQQoCNGLLd7!-
zhnvhRU<xqcuA_eGkQy^soheDu=HU$#@^_qh_oeY1PpW?Y3A^F%BCDQ*n}gvA7JNLN
z`Qw~zVs|T+qz3Q9_HXArzH;uXcZorkF6I3eaE_(zc2)Fb)#vJllmCN-{?fZ=ls!(7
zk1jOz6#y(DVc8;kGrD#I%?5VX-e!M}azXp;ryPcB_n&gS74J$86MUunS#s_EOTH5{
zuNDc7`H54QjzL*!p5dKnKY4bB!=wJqfDg=>t`5f*GyLy&KGG}Y6eXckkKG7jGm#kd
zYh4VADk9r|+tsyF^4g#s{@Ex(WU?O|{uu6-ylEJmZ8%(N1q_<1f!!NDLib2pB`lk-
zR@LM?ft|FSJF*+{C1u{F?`|Hu+kEDTC-m^$KXoEb)D9CDmZuw3=iwXAe+m+a`~Y#^
zYL#<I=yY98QA!_O&w`V!d=`hGTt+%uZ<nr1?=9eDK6Njgm`Dz0%84}S+O%TR{ilB-
z{@xJmJzJb?$JaB1-v&6iQ1crlR<79RppDMQzDp*rQwEB2<&_r<T#VO#Pu-uGR!du#
zwU!ChKX)->GD~$?_}#B)t>vA}Y*75V;Q9{9LEK+J{(Vm}^($Mx!Uj{t8<&n#4P|lL
z;=g77eBJ(mx|GB+`dMxq@Nr?|0-03Yzu?_SpC9$-tZ8_b)+JpcgoTcZh!761fuwSO
zt36NCe%J1C!KU|s_d;bZ$1ol?zyn-1T*`@277v<;jCVuUCvd!yC;9*O0fv7EED2?7
zHv%)3NHmLU)H9WC=UxI%mkXAD`AfoqKS~@vFF|wN@<JDag=%*9bJYfkm7iyUN;=O_
z<-I-Kppu(S*<kBBKe+qXLB*<NR)>c$KZY!N4IXne`t{VR6>u@9Fzb@*UXUs6rhfEV
zp!ggvwB$8dVKg@_P(tYN&Xp$Kx0M>ptTy-jzib+5)-V!V;if6#loo1LeQj$Q1%A-6
zz``5v%w#)!-|u9?FyHCa`^TAMbojqZU9o#+t9R<gF{LQqW4A-&@W;gG{RWAa0f>#p
z)99_JxTw+y%%sakJrXZK9xjh6Sr_`N_hRV#>$}%2;*HfNFEg%q)7c>uvA>k6(VPRb
zhorMJ6kzmQLTuA~m#X$T%MRx~Y=7g=V&2HAXiF%f0M$2z)lAmNydQ{@orAL3Yq#xe
z`Ogrd8fkoggOF=CQEcrNo8pwpHkKxD>-RwWy7|i0G5YV<3lHJDceDsnnbkcyylkW^
zS&DdJVgo2)J&h)R(AbPZAQxj}5ou^nLXb6C9T~9Fv<=Ge=Ey~npTTk{YXh{s+>$s5
zW7uy?0OWnTdpxGGPb-rqKcDLO!)_-;K~7CikNLbfb4A2P;`ZogJ#LNff^NhRKFiJJ
zJe42h0Wz|;teXD9k!=%$i!6XG<_C;4pvMjZ925C!8^K%Ei<80mF5-<f6aiubigU7K
zC3u}=l<V|=TtI~%?n4u~y%HbborizYl;&qP|GACi;oy<{*2Z|PPpfgm+b-j`xqYSg
zi=ATrAml{6Fz05piYv_4V?XnQtyI4`G1QY8qk2nJs}dNx+}j=&0~!+S4>(!g)lI;t
zg2)d@E~3a(wG-qV>Z*3(+O&(JO2Z6JkSw=e`!9GTzJagZc~KGlVU(s(NtomS(<^_`
zEpxjipx5W;{F>-W$*bl!q&%ER-+@DI)a_W&yY>T^GfziYSq738=R!y+FVkC0o~(|Y
z`MmQ@vVg^2SA55Xn1qb_Sd;{Oz0K2=Ge*?THS4ciRXI<8_~py^Zh~(ZSt$2-BCmfB
z@ImDiyLNd3bfHGM9fkT<cQ#%dFL{CD4?m6zv>#v|PpueYRP~tM*fRp8#go)bI_8<D
z5h3j6*4FYk^~9?IJ+Y5Fh2_PTq(vJ9xK%|@JR10xH60O{=Hj$^|7FVC-5xIKJ81_R
zKeS|K(JfAB_ki^M-ouu07(E#xsai=jURh*ROE9J{1@F6VW$GaW6Qit*DPs9Ot)pkW
z(QI3z8j0&^+Wo`;Mr2(y*mp9~cUrjn$1Pw>2I(QW{3H|SI}&$wKU!9LG9sS#Yyne6
zeoFgdtbd@)>v!--81W84IP~eh3uBBC)!1%gHP?@ysh1Vjy=*A@GN#b0cMeHnzeO3z
z<1`^MZAl|tJWXvdu5_gWvvWE&#U>BWxw9L_+sSved49j9cF$Eg^3lVwQyKDBCPHQd
zuY6OGNq@G)!3(VBcBN|W8wx?`QeZ{Vu9ML^LcZbTgTFC%oS=M`AI);Y|0VQW2VM?}
zAwGVMdttR16kaR{7Nz%Cwk-<jZftYQRX+AExXb(EB6FDCDZAT8FU0kY5L=$ai#$&g
za^-yEnu-g^LZ4n4#hhLekV>79pg&Fca1?8v{^1fY4&Akrhcms4JV!-G;3r#(d)JhN
zqMHUyL9rkGxqTqtk+3vV(%r8L%)x0sd23OyojYg!uhng`8Patgr%-MvJ~4E(xAKA(
zDyP!3KLm~zR)D97nax_<mT|I;zWrKEkX`ldMw)<sp~&)ReBqyS=+584zj<5O(~>Pj
zIlBYz$2|y0z3u^li=r=-`RliBAa$<SUU2?{$^D|-=u!Q1!mCpv$C=%<pTD4%z~AUD
z(VWiNwm28P=|l{U>*ts{d~4MkbQ3OV_s9NUobPG<v0N-weJu2TqBq?-P}1JPkv`uc
zZz*($WYjWHbUcHO`o##N_A~H|$D(^oekv`+g%k_;!=6^w>J&T_DyQ9Tk<oN_<;f3Y
zEA*l@S*9lJ5n~0}`8w^_68T`ie2u9H9DI<5syEk>>|t_zy*`2sq4#*s79a3?XPs2+
zlZuex>6+L|2#^@hssDow;@<po6|2jY!Pw>X<ngJHAk@swF=RH;zh@iQ4%RVkG<Uef
z;fF;SZ6#NgoUL-;c_Si0nYCmO>Y=8YcAjTZ$ViCqrd?dyiiY^R6+_K1=y$~%CCb|(
zamsjCqKz{Hh`{{F4wh$^*OYx{&Ai&r5}GnZToy;y4lj3X7YBJ_KjX^NoK%dJrLgkS
zQZ(y~OPKZ&%-bscKIP*O=-uGWYKuJVF*6gvque$-gxlpq8XR=sTQ)#AC-Sg22fgy;
z45<MWF?I{GvglUPjA&l9A{sBw7DLNjDzST!N%biiXzk2^<B9uAbJC2iRwFT~WatR`
zGb*EeO^6uH(hc1Un04{(_4CoRT<YI{R8hkc+Ym&61Z?@RP#k)CpKl^2t<k`Y?u`uw
z`+%eutvzAQs>iGeKK7&cGhV4>r1(tE;>av=Gi&Xt{B(sT)2x>@u-K>Us^rF#;?L%}
zP?Av_NL_gsYt+H>hhk6V_}7V-I^@TCJKrpy{0Gf9bsW(?7<*+ys(Gk=A-j#+I%pOM
z|Ji|0W|pqXm{n_+5sghv_37uOHX{h{ewkfCOWXsXx^$Wai?1J6B}|vo0MKyTS+QzV
z%M4)hmYoL>QTk_pO(nc%I{18hVtxC8guNYV_&{q|f3a<4SL;^AKhTQfV;7?QOhdT>
z71QKS;6}R6lCs)HA0K!dS&d+0HSguBi4g>c?py7Tv*plsmqWsBnN@x*rufWs4}2<F
z#ib4yg_pRZaKfEjktjbL@Rq-l!)sDxa`pu_uh$E^X-9W8Opdiw9|W0YDYpi@Dhqp)
zt9;RV`usc|&gR#%V7b+r%1A%+ma+50x~4)<w(U0ehr9I#?0S_BSLFC_^EP1nrD5L#
zQhnyUs~YdtJGr{1p1d*Wamp?*zV%p&%j-7|VmMOnhUZ#(gC$CWGO@JdDYS*ZoU0?)
zlySk1nmRMI)_v=O4L(1%uM2Z^m9Yt@7$0I8v2bHXB%FxeZA8(PH+ElnZnqw1$<<wz
zg93}_jpRT`A-n!rQ<Z{*Ev<kX5o`1kuB`1?<UoGDo+Zc-ntuIts>)ZRKW|&Jx!1xL
zKs~&yyBmT<qP9a!qu3_BPDmJ=e86`~d`Ma{-ifofFFDXKv04lMF`}N0V)DZdy4Rr6
z!YOZjd(PbS>pc0;$Ftwa+eX6Z9jGF=%J?tmgn%+dGsnl;L3gQpv7=;N<07F};gcuf
z2!@n?*2~zRKYKkpQuIXE{Wums{Hz{-6W_(?tI_P1b9*|!<M-R)y<!9HU1C*Y>{sZg
zFGe4eZ^~$|F^qX9#{Th{RY4ShmXGPjA;c?JM58i9=VEU@yB~8pylF1#&4(AXrM0MO
zmrh6~m{rAC?AN1wERD5%0ej(E#mY*s2xRD#@V{ajW#72T&7wvgIxZXFG2QybAHD=_
z#k0$|y0BA3z-#+Bclfz9th+J>aS(_ut3+H|-h~NO{@U$4@1g|+dm~M=X8aM|U5GuV
zx?{^C1%6eu&hwi62$_!e+8BrSOwawrdd8e~T_QjUpl-pZFiE=HJfm^EzXY`mVBFh-
zJnvy36!d<ho)B8td&TAw>xNxADY2*DhzzMKNT4oDY+JN!cIiwV7G_zRQ%>2Hj9+2x
zdh7+g!^`o(JsNj|CI7p%hc)s*Ly@d1fA@Mv|HP#5{PrKek6*u4alE|y?V{<&v&VI;
zLgY@yg^a=E(yaZj$4J+F>a*e<i-?u3IyP+A6jDvXu88VbB|KXd2?^mvNFFGJy(#pV
zXxJ7e)^X+lg=KzYJ24%#*d-0ziP_n68+#yDHOa{(%<g<5mH)v4kP6V<<(JfA_fqaA
z&g*jMJXr>H6<;(RfJqiz`*@~c+j|5QE3+Fk(~%O;>{jlSgW4#xCWQOUNdK&tohz<(
zLhB5|8W_PsD%+9ZQdL=jG-wWI&*?M1Z7j3VMRBVbs>D@rnRd};oPljDA$ga#p|v?s
zP2;g>Syb~)v`F4kb*vj*$!??28CiA{n$>&Twl+i1XJQIIpg*^c^?G1?dROb|?W{ck
z&I`HcvNYKpOpmH#%?HobnIHH-i_LqSUWYj6agqH--owW=oZ}m*YZIJ@&ayo@jBUdK
zxBUzT4qH5pa9Fa?Ikeq)vXrC}lHJpU?;6OYnKnHgr;E+)nc`U1EHRASNU+Hek*g6H
zaX$r__4+Q2);8=3vWl^a^p;hh2SBH#VOggmaM4iP?8A#~5%BWUsa_b1&tG){r%=M#
z!OI~E%rWez9ip-fuIrw!<F^xAmD-<PWkQ0fAv};9+b>ST*M^dR4HH@I&S@O8`+_re
ze41KEFJv=fR)79Df^oKOtz3ap;k&1XrWJi*q(Lg<zaD5PyrpGhLsRF^|8PxTnftJ&
zi7=JNK)z~glTs|(NWpqb3y#0F+q6$FrZ_l0Jg7o0D%{9-D1Q70E#Fo;*>HZ7CY|rr
z+VyL+J2?tOObX!JAv6({@yd=iq&&n^u^zuPc#q(MI-J>2XT65};WBDaW7GBTi-9MJ
zkaahY*)FY{!(N^GbEh+@*Ufhc;Mdnj>3U{F!l1&5Gp3s7rSttXwCTbYpNzvv;^m7G
zD2A{F8w1o>RGNe4*lnE~Ceu|s6XGlz%F7NUyqwEjszHMqi2*HT{dcdT$l&b+C8HUo
z&xAZ;QY+6`FycU+&NZWqp``?zhl@rNbFAC<YTFh^?Y79FEod%yg2wm_;yt$=Z1m<m
zf?FPjsz2YumI=cGPw>}(>GR$g{ouQCvRmzpr$%#q5To<R_Ko<7u=$GoiA3K?R$d~;
zPaUeo((V<bSZYHG_<?UpfY9GKrfn)=mP;Bmjn&X<8$HG06&rq2ru6d=3ZJ85&WzNy
zl{bb7y?s=ih}4p*D_6)@CS`uAuoR2}2-AJv9qBfT^^~`pMKz&Vo>S9JuM1sr&baqu
z_~{Gc<+(lK$ZAV8d!nnoF%F+h-aWUIkAan2wsgRTWH&SGAC^NGUK7rM?FUgiO^H5p
zYQuP!?WybZsKt?555`avDx*5TnQpCF`zo(Y^BJ@Dg_NwE^#w`iz5qXbkl^g(*|!o7
zq_P3ITYH^B#$z3e=A4!kV{b1jNP-HXR>zoPuxS=ccFuKL0&g{-1p5>49sQbG2NPBP
zxT6Kx$>QsX*|9HK<)0B=Z+TmJ)T^na5EcR)hw;6z2%vlivg3<YIU<>4#i9HvFZX1N
zyG<+6Y_**GsD#?=25W1#>C(XTKaAu@47EPSE|^xPIS&Q}FEsVv!5_EpOSwEnstbUN
z(a)eMh`09NjzUco={VU}lK?!|@t3o>U4F~_k=9Lq&|0!jEaf*50mZm7g3QQNRX9O@
zbm8-FObTUoC5$xe`;014Y|-L{8y6xrpa=MxH?Pq*axRlP#kR^ov@=B3tR+@h?5!(t
z71maPQ{R6`Cf=StwqEd?>ABTKy~z~4e<F&P*iZXk;qbr0a&>{yBaEQ<$-8{OQUz73
z(XQoa)$?@TL+}@KU&opR*iic7lRu5}6BHP{XI%Ivl|#*LRc5bNvx}zl<f^@d#lHr`
zvLN}??-s=S!f=;+ybde8m#8LFg<ZT?wfYJNKg4a<mqJ<^Q1A7tSa^hZp?UhLTJ|5A
zZ($eb;GMJ2Vt8SfsOH{p4A{Hnu8H3ZyK7-k{$`yg`1RN=J@t`ZpnaQNx&=xc41_kz
zd1h;jkNJ%Ye>iLu=x>h2LTt){9Ub=pgxh{};sBL5#HNTZq#0-yB|f4>O>8e50W-zK
ziro-gBHC4@vsZHzaRi;4NyyV=H+l$AOdWF-ZaF*K{VCZ+Fq%oIlRs%sKQP=_2Dapr
zcRn2?syBn5LH*%1sb=p>fNLMBAku@W^|IP#i(~i!?4HXN`L#C{qnGHdoh&|8<A1EI
z60lzV7TR0<mfRkZq%(=sy>v8xKg2eOHFt!Pv;jFhDv~dVVc1{K;;Z%UyuY@t^O&#T
zJx7@0|8W5cPop};LsE*j#QzBBNwQv8u}!J;{<{7|q##7HQtOoqg#O^%L8<wUe8q~g
zyx~O=Ifrv6tFm1~8%}aV`5dmiQ@$u70#3FV2@vA7UuNjyB|X}Vm$uKe2>GV_%&1-B
z(a2oW(FaS!tc@Y91HDfz<VRpjHAmh85PbMa>+Qja{0}!)pCJQwCgm+wO~WN!;iQ77
zN=S}G72khb6SjkXZ}lYgC>r?wB4pOoN8D>?hI*IVxc^eU`x^{5F>MWd=(2E%%$Hit
z-$cUg7WYGC_-TotY$<ozSb|GK8)0k^dG*|-*rqdDED!&EJvf(WO<kPPlC89*veyu1
z149?m6qiRk1s?j4Od@|@F|~>oF)JbD;k@UdpcCFsWxK!<%17x5)wX#+x%$+E_@O4e
z0dlN4O*NIUq5SCvZfaIzL(m=UPSH_H@>Y0Lk>Jk#l{zkKZ_oQ=FZk0h?f%n-7sEsB
zigYC-y5J`m$Ac-mDr%byI)om-tx~+>4Q6bE_Q|^tMmKy!R0l=dD|-*xX1-KvryHZd
zCO9G%`lNGo!t3&jF&KV7jm@$r9d2uh(Ew^I01<oF6dSC(h*K&rwyzS}WDlcCeI_wh
zxft`!rUW=k&CTeqlur*HVw%GYw=b1SCr2ko=t}k}_Ir;&E_Wqa)>$p1fHAO#^S{=?
z!NlS&90a1~mHpA)erBXU65>6_4rx`K{uyT?EMQ+1gjR%55#BDfaVNGPKxYSAM@b{*
zC#b9?u(PQu&!u#);kHrEwdm8mbM)^!U)v~}F>|$;$pfH0c1ilM{4kC3h6>Z(pteQp
zDd=#aJa4WlPOBCA^j4E@ALg4q=DToRBSe1Q2G<e{MV24BtDWO<vzORI;C21c-)^yW
z=dAk`)veKizoz7mTp9^1_gM*GoRZ3_PC#?6tM8f5yEZ2H=3O?LJugh;TV<^lzA~oN
zSUUeNFg0)O7DLGawMEbZ5-f-X<z`vj<j(!iTbog2O22feKHZn#K!mG2LUB!V`bBWy
z87de#4+7|WZ%gfF6lBw7YVYhERQ}H1j_YhYLjaAeFSjIqAfJQFZTF28!-fb1*+1kn
z<ZPMWS-vF#cwcPj(ytzOB2!OoC}>-yHXq%(sa%ejG-LqTxAw2g2rU6ermtC10~<XN
zg$0*+<mAZ56KDtDuF`P0i7Z&>H2uNOlkr`E_CXdX-0*$ts4V6Eq4-nH8zXC;UtJ#*
z792mu9k)Ao;`IPmf~(RE?c%fplR3Y5>zV`i@~G_g|LGgIl=Eb5LMvM~y?drR^yJHY
zM@HP(TuNU!j=11j(e7^^83w`MY%o<%vH{mAXrfLVI5!bwM!@g1!>t;mR#h16e>ad6
z54B>&ann8A@UB+Bw&RNC{RFp7!U0~D@3%Rwv27#1?mK-11As_JpMI~_cry}bO%~dj
z8z;K>_2=p2pV^G2Jfo^@rouGM{gB+{0j-`lylnZ*z}%kM__o?cVU<_vXBA)L0BmP6
zpUwQLaZ_i!{;pJazRz6HU!n9;v*tukyr%Ihh++GR<<2YVqIIAjYfYFfFe*|1V@2Em
zJNPT8Ubw<_KHRT4U@NXWXCK)AAI#3$O7IzzbS0UG4Ub<rmnsFl?!KxO-C7jxRWF~a
z+?b&7O8CXazUTQ^70(-EAn(gbE}odGs<Fe4x-vI}6G7^A0@(&htSc7FKzwkWs<qAb
zI^18@!3NX*$kFf&B%_$V4BsNC;fgQ8Cw37GpyF!YgrI1jz}mrfdFye>ePZIT7U3L7
z%3_hk?)9oSWDQ(fi_<AiWY=+{;Dxl-ElYY3wadEu$(koJ#ZYeCM7uv=B;4AKD2-_W
zKP8brwN_w$QBSm=AJ>`|Ue5F3`r1*Aoo{k85LbK{``KMJEaZ=6MG{&S+)s=}N%pX0
zW=Uvs(bI*K{LZ|l_iWDIx2&K55RK3w+%-3~V#liz+}LHeeM93?S2z!TJx?&nWvrtR
z@bztS?pSsvuY7-$Eumic*$$39@uRm4KTsWM<6|nolN#?h?j0zv%inS0y!V<tG)H>>
z^Mc{CFV^nA7B%0`jIxMTLK~$6!id1$!~e(=)iiCZkFrf8EKcnnB_>{p@FqPFim7$s
zt;j1BY>3N)B(v`_8w2jVY`NFA!9?B!3J{y<N_XOu_{5>e!~lszlEqL8YFW5wXL6xQ
zUvXm{XaYZ2E$Tyb9l_@}T}saVfvgCUb<e2``tO{`0psQvz~g3X;5tK4qX?0rVq$$o
zS{lN4b!CEn&)oXb41an}^vePx*LdnM(XUsQ4)AhBNEn|b_a@?x@Q%Nb-VQdX)T2jD
z$OOuc)OjE++Qf3g(!Ow-Ipalxyyw@|`{9a@ugh6~6cGD9q<ims@~^Vyz@K3v%i?@b
zM+{o}mfe<BU^9vw!)DZr5zS;-DeV061z2E7rEFpz<9NQ)cP1_5niPb>rZ-hK{?yz1
zd|A`_&tFYt;Wsg{zbm2BGVCJku&V)#&$(@$!c_t8s(UNsg0fRjA8Xxaa|j$1YY6@;
zNe3WLXxPYPtwl;+DOaCEXZy?u%Pj&XCDHrF*J&7k^<a=xV7Q|9v}9Zyv33xIT*dcX
z`mYZsIZo&NN$7BgGsmpesyC4y3OF?Pn&Tw3dk`0uQh2@cl9>Cx0aPqMnHbV3rq`}u
zvTtlQ@_l$|Sv7k&NPBtv`5Gsm(B)KQ8us^{Ovl%gPy}fTv6*m6zFAgL6WLoT^yF=<
z-yErzbln{bUHE!$w7KJV<yPI0X$e~MA(#3{H*0lIKi*0MPV%vDGWX3p&8x(gHgz><
zkW~Ypal<1aBcTaBYqw#Xu;9`~o65#U7J%scdE{RBPY}b0Zot@J5I{fShj2<_a4B|g
z8<I~eW)R^$Q*_iJp0Pt%HPv1}TqJ|G=azednj<<)-2zDX&pa0`RwKUraLM&K;f#VA
z>h7oQ$^0-!ZDRX0R<cBUi%`sPIiPt@tm$aNN%B;uvmKl<9^iWT)M(jQxtQWxq@cJo
zXL}A{4pD4{R)dY$Kc;zS*D(;(HITT2{qN%C37YGM%!tas<(uM;52u8emo~Nw%9#Sj
z5xz<(sGYF^Nd7oVVP?Alb;98f<|uy)-?6CbpDHHtcv$A?OoDq`D+AKrfDmM~q^3Ze
zMKOli?qTrN{78D~yx#iSuaAf480=C}CT@e7)|y6rF!<iO@0Plc`avz@D8>{tyyQrj
zt1%eN9?zBj{`QW~Y^=EtHu~3GgH>9jYL<xa14n+U>@KLOBI=~<TDq#`x{>=leO(SC
zayym_`t$~#U{kwBfIYJ*aI@HB7*_`BO{Bv^2kFI7M8(>zJ~Mri^k1et$|48|Ujg%>
z(he#l^6d<I{0XBq!FQ5}kq!{zM&%B9SgOa4O_CbhEDW^hxA_^qx>UaSD+2Vh!_8|5
zE{i|gFo0dpp0N1N4hgW^Qfl91C^fs8OLj!X?fP(#zXp$>-fL4}bn`hVvL_l+UI_*(
z?JnEf>~TriRztBu%Xyeg+P`1aGlPoK6yS%#pNFaCEMK@1r=iBD=CxgV>mYP^&&3l#
zX&GgAxi{HJlV5y8^tZy|n|2IW7WFJtUewhCjrphi8?{Z9AFPeH;v86_d%(Sx^v`W}
z_#ENlfx*qCJo4$W_=?}w|4D^vU%sH<2R);5B|!d}(y2lp{5+}Wc-=_v6e_ptloZDh
z13e#4Nlz?;>m3}e`Wzf{8(2Ey)H)7mf0ZtRu&-zt2LTKTBtkxqV37_8XMVVLQ*7yE
zVC)e8V6d=DaV~PrXO4Rsf#xLBxurDLVANsS&18m=ks-67KKS(FEvcwv1E%kH%IqjW
zQ&*DQ%iQR(z&w@0qS}NG;HK6FcM$@r63|nlm%VzX>6aWwFsl>JM4NcofK9DBdFXG$
zyr5xv12$e;q;$j&@2BS_{e7=SdEYohV5H{4-nb^w02sOHKN+Jm&^^z4CJ3_b)7sSl
zSwvGb2)9~_3J((`nrX9Law=*7x@siW?@4qVC{u?BC=A5E`X8KvWYp7h7)y-L3?k}K
zeiuYFW%NGXg3tU>!?}YO;X@Ym4b%Y$$|=rp#(>S;I7aJ#oar+2Zm4Pgd7xQ+a0&`(
zI=kOyli2pY0-r}8m$k{LUbdO@Biu#o`p1vN+l2lMUR1<lL;F?x?|&i)+Ttuv%b~xG
zC!A%va}G&hH)?!160JT$(3AJdgR3Ab282(1_8%7ZrR`0t1f9IO#MZlHY+~}^%LTjP
zy*h)f+i_80^s7?FQ%kYZCjzc+v^Cb=f!^C%A%(z&8C=>Mhes74lk3;gMJ?t4JbM=}
z@%kKWwycLH_8_roXVK1jcwh9kNMAaSS97Eu=y51E^5A0h^(QNa02;LPDc-m%BDd{$
ze#ZNt%j3rfMbXx;YkHRweYIM2!d#}L_nB_7=seNADlUF;D{1k=B}JTg_?M{1_hV;p
zV;p5I;|C3yD5lx&F<QCh-b{mOH262tO$Cc%ftWpeHVHtz>0b-(;1Wk#=3sEFevhO!
zPMpxx_fy_}34Dj3ZcqFlc{xwpkS>84h4&263+{fcItb#O>I0f#mCu+2O~9A}?mHCy
zfn*Ink_M+hQ1L`SPSj((_%oJ>>L8K}-Ht%_=|16v@Ou5YVlQlNPwY|#W-_=$uG!5}
zd%X{0y;Jn{flsh5v^$?uug#^xGnyxZ^ezqiu((OOf&}C=Y{(~89h(e5D4fNKMs@aS
z{dko*e;tquSzDK`X&NX;CL6pDRm)sDJKX8`AT07#O5DFegBux0JhAjyZ3)=oWAs|y
zUmNbJv001n67m7)Dc#21YXdrCu$m#(d}#UA<oz<=A$Y3FI)CQJkEc%PU3z8vzN*mv
zQU<$$#!VtOq3M(u$%B*-z}voean`G)r(Jl|40k1NDf(fYVM202)a_E?SO1PjD&+S`
z#VD@$Kiw-KEH<D%v}OQ`S>t-MyBj-3N!4jvAkG@yE`b_<ZZmQgpbdOufmT)g)$e;}
zUrE<(va}9P(=R-WgBg?<aQx)R;thFC!#!|2E&O!U_Ck@ETw$?uf7**$zv19%nFijY
zdItF|2nm$;kqT{IMKjINe#KKAH4(?TYd<OsZ=7)W_-t<lbj<ryS;q(>@!1!)+Eur6
z8_XDh<Fx-=z5L$r)`)0jg7RG#tg^@S1Fs5GV3m)g!b2d&=k`wN#LDdmV$8L1EBk^F
z${7<rLxC`MnXW|+T8<5zF$CV(m_{BhhhlE?rTi-PQ{_YSH;dhgivg-I@M0vRHWo!I
zLeX~F{y^TEggy}3UScx3#M7bG$QJ#L<<<SMg6SL$gu?%E0o*3^M7!9DBMh_tg@gU~
z+3+U8WLpU!J6Qg3BeDOn=;6AN@je)*4vZw>xTe!?`S$K<t0R^H8)@EBbW9UiuA*sw
zv#QAWkj>+L^VRrUSI#*_afLy%BT+V_P}}9*WKw1@WiKAJyE6ZD{O+Uh#qRn^kIkE6
zBCZhng<+Mau1oaW9R{yvycuOm(;9U4%^3;EpbcRjYu-e811F471^*g<!~`X%LK>lj
zEJ4i!^J}xj-E}K34qm>8QPuWW;?Sy4-K1e&=!nnXw2NW&xNNX!<a#~lKVM#vCC$92
zY7|X2QrtDnng{THoct6%pKzy%)x}z;@LVVVD3vKU@#AdJb-R%QR|vz^$aY*UBy8#L
zzBofVhk7Eoy>Nwan_Sg|s$Nckn^N}7s$)@p1upq{TRsMhfQ1DAm>;TH``mBqCt-l#
z@>Y;>b8gL7bfp%tJ8{`J-B>&4Ikl^G6!R0?Jr2u3{v_Mt3ZS_gE`Gg!jeyvwPhUxA
z@b78@0^=X4eM*;)?g00OPcDUV^%AB9^rm(c*X4X52d;lXd`UT{9C#L?pi#6Ly)iiS
zR{AVQl-<I`KCzj!aX+9-)>BlRU~&6G04NEKpF`$kw_vVc14|>vNWN#_50d>17QcKj
zUCwrwci(OxqIhQAX90#~c0knJ%~cuOde)_)b(2J<PtS1qTNk#{&-O@6(q_a^`>zG;
zC-&W*8&VDCU@!hY9T>~6l47a7H9^(?m}ocKc;NCEhNPX<cK`v};&tQo3pUtLC23Nk
znqY|=N<zuQv!8aK$d923FOQNYFSpKRPtQ>W2deSyxCHV1<=~Yz?S4$gDelwVg$f0K
zCWtpUf>3$glS|eMpI`3w!+U;pY(spf5ee&gX-<<p`hIw>m8|krVDEt<v<qM;@0oU)
zxmu|8LKLEGhKr>|!6nJ|VXt7viqG3hm*1anO0Le$3pVyXthh!pgwbLGxC!d$PODc&
z&*h&>_SL+JLJ9i{mpC=PSJ+%My1nB6*PN$r#4A>#X!*tK!}fX;l%HsWE;Sl32v}c<
zR$i5<$qY@Z!=JSKc-UPC>Y!Dk7`w>BeiZEyW1lRXcodokAJ;AmchR22I_5bj;Z;o%
z$U%yd%K{0$?T3~f<G%F|2bX-9nEj8VmpAQ*hjBo-zg?X3$*XnTYw0<n4F%Lo#~nuS
z&nH~moEaI4hIrj;N!4Ei0AB5R`Ixy14Zq*h9B@(Vi9sdwTlCC6n&i4`$79~I|7{4t
z%bc%tKXV)kNd0Zb%eN-6gY1a5+b1L;*Q-+lnjDIojc7yi-op9NPfKAawNjhT)=EWD
zFT!SMjEyEv|6@SJQZh}49XbHL!3_$7M)XIu#-AL6N4o{9T(3#+0-3&%Z8*Kdsrg=2
z{Dipn30=`|XE*nxTfan2YxW@G%6v0LH37UrT`+%l7eK@wWd+e&R*?BOn6XGg5$=<G
z?Y5v5R9S!I=L|B={iVmO*M~&ygnQI!k#CyW^2^e}EB7*%gF;%1dPn}tftUsTO}quo
zVh9JZ`D?xuJdi;;3t$ntpf9m6%G2C2r<e(axb~ipi@_!IEQ@5WPr{42&He^_(gnP0
ztb0Q2ru&hiui<R3Z1i_EhBPXFqJCatA1m<@#v>sIIW~&hv8@p`b6xH^?@_<lA=dkt
znFa@-<W~H|sH~yEJ@2Jz;b8aw1#-6`0CQ2zPIoF*Kpj)_JBuW~S~s6z<joS{c%MD2
zpj4K%YhUCl_@>LiS`t$Hs{CC-&gyD#uWR4M|8=8;44Gn%7v$p)5nFMV2OxmN7XK1A
zPRmC0kG>dZ&yf8#?`-Fv9eW>o&;Co1>0dwZ7rUmKGlVn78Xf<$^Je4clm%DX&}w$|
z9G7ZN{<Q{fVai?Z_-ei24vOXM<xRQUrxbVw+A9F>aR-0tK!QeTO76)PYwmMUf-bqn
z7ulynycV%7prmK<X1egQ=36?G-1FQBu$71s41C_^DpwKvZoO*uNKgV0XEEDc+iLd<
zTJD}@d#LDL*WdJM+sO8!!_V7m>6SB!<N+lIB+|V)U9xiZIzhIFYy1q;eP@Z^<SVaV
zyj%#8cp*?4p5r>AV^uI}`v2s^z~c@XaA5!XrItQFm+Ao}Xk5SlRljJdZlzY6ity^!
zG^s0t0pIuj5j$`8t~9c%$|E}abkc)(-L-4^3fI_-tS<J=T8S&x-ObSK*4WG&kam})
zy*I6brkT#*P<`&TP5D4xHqGlrExSWfMKQ2gx1M&uBLb*}ozH6Us=UjbYtL*jO@a+7
z7W%vv_zK?%A>1G<^NldcN(JV@Z@yxOb4ZFHvBogm@np-J?+1^~%F0Ilc#i<<<eb1l
z{4@CA*#X7_6_{jS`Umn?#0fVPHudOVN#lL(4A?oe?z7H$<~h4=YPF2g+Fl9b<%9dp
zO4%T#KZmJkam|NuP8%2dB>D$3eNR0DM8oFX_c@13rn|1eA<`&xzG&Q_8qQUi9Bcc)
zW3e$<G|H(GPz!xxy`SXlue^Cckth}o;$|e`Wquc*^{sCvmgT;y10}TC7E@DDi~E6c
zZXikF$GeZZdJYuj7vGbt{fJLS+vx6*BOk!`)>=6ftUM!;G?#s!Q4c{CUk0ddkC9lR
zMXvq3`-UolC`G$6wCSw5Vv7$mU^2N%g~24l846IC_G^s<XXKt53ns$*q&9b_u+$T?
zXR|i`js{4gDO0e{C5ND|jT?B~1c#O+p!u^{A0c$l<KeUT!GJgo%nf3%^K0{_nncFv
zlaA>bvXkJE=tDg3J&Okj4)0+|{UY6*tabUS!`VG~=<4h3k+1*S>#Wb}J6U<f2^ld<
zXB{w0iRv4bwXFqS%2^!UPH2tjU~!`y8BCI_n+R5HqhGyHYCGfc0{8mN8^0-ywk&h|
z4BNbH`3fCEC4zu>ucmzSHU_bd7kG<0XpIo=)J$@yglefH4}Sf0(_Lx#YY37*&UVZB
zba#scrhYloK!PKjubl=Gj=&5M4=K{uK|E$e);T}mN`?3p`flxtIyi6{>ov{&PYX88
zE>Bqo2Bx{-_z|Q8jYxf$xjjC=z8Uf|K!As>`+YDK;AF}>ui*Vn=-^#pUUc<Jf(0pv
zItR~hO+oSI*=ge3u~*7&lC=~X1c>W*jQ-OP1O8V(oFA8+i>+SfCTFYPs$Qch2x#O}
z<TaH+7v?nR=;o#gb|ROH(+JchPx`()b3&+ZZd@+}w{1<}G&(&blDQC2yVAjP)Bz+m
zznQ8%&DIl?K{bSXTq~{)^m-@_aW7M<MJ@rx6>T;*dBgVq>eml}Hrlth#PQB*nJ@A6
zo`|YcbOV<$C7lxdjNP7yr!gxDzov^NnYPF{m}7t^;PMjDOHpW;8Pb5nxAM0=RdjbG
z0F&Hkd~;Bs9`GiArF!RfOL<<OH{UYDXM|F^tJ-O9;u_X!>^?x0#|1w&J!sC*_r)CN
zdo2<xE<~)UWs1DZ+e6szmmhOME%X|!P79+*1sM;-lT<u$#|qK3R?WGg$(|!{;gHhi
z&+R*m`!$~^0!e~w$2vUuL&?>zgD2u*G?g&X6O_d+`Eb$nrWJN4RB!Yk_4Liy3qQ1n
zk{Myvt<*KER{;gjc$o^ltx8qDdgjQ3n}seVnR7|;ExS3X&`P!5D>wc47PY4NX`P*=
zB#-7%IUL0c`=YZMWgdlqMd#i=g6lo+tCeP~t3|;i;gC&N0KyZ8R<Ht(ofm?u<z~^+
z#%=5(W1o}MT^YU?5{Zm~u@W8=m>BZ~c+WiK_S>?kLTndkY>vu7rUSK1P*g;U_PhJK
zeu6dlN3_mRx+|7=dOWNS^j{xX4*F@oRNU^Xdyew|^g(wj4niUQK$+B6VySuiBJ{&d
z6tNdP{%vhWdnhvSk=?9UzUka8?e}+8t=Q&+{oc-YEsW1$_e?*THUPgt<Mos4O!n0h
zp@(Hk7<XRcsQteVPQ5dFs8gJs4Uht343#W6O>K|!hMa!!@{v`@Dch4cqGtI6<yh^)
zKW!^ctfD=z^A0Wyb+(pM&(nDOl~i^)k)m(sfDfen>UTJvACZ9j)NjSJn*ZG$HCj)S
zzV317^2LbPfhYPZkL0pA8#iArwQGPntNl&d>AP`0XVC2k(W(E@{{XYI&jlJyHRB@J
z5ojp=02z$KvZtLVy`htHCq@v`{WC~A!9SqHQEx<iU5|=<Pj|ConQt4{zlMJpsz@p@
zlVo!#OBT`n!_m>+OqxAI8Q@_XW@IA%l*E-!Y6`7X+Cfh_4COb{xS9yht*nwc)-Qys
zy}NpjYb95_zGkjlI@D3`iiQw=KQK|BD(zSK@(&)ce4YAP(k+8DwF)=Ud{**!(nm9!
zEo?~i+G2&}m$P!yVDX%}9aVrtJ0H;ii=B2}&>e%!*5Gv^)P4bD$Gxb;yIKifZlnkP
z=NJjgL7msH{h2uTQpgEQd}HhIg^{FTE8(Z}qK(9?_c}<pdrm8xar%vMY*Spn=$v&_
z+Dw1Y$>*)4h9)wySrw^tWGj_<WWRkFSHkft-{FbPLRPe0#rnlQKcl7V+Ru%3&Y5G*
zbS3#!0;Nf=#<8r$pDG7Ffa2ju2h%^%cB@qaDKxf6ytHV(Bt&-5dFyyo9rt5oY9T!p
zGO&_UeRI&5wG-gZJ0Gs!nqyduXfKX~vMO<?(N?tij!=7L0>BocB60;>ie~z&;n{#6
z4A=Hm?}kpJYVwZ5+pW}}y|ibx-J!{Rf-EmsI)CPWckS}Dmd_IMrlHm5h8^rx*<vwg
ze1jtH2D&ruOrZTM`iGnz+02_6Qy`zv5p8Ol9!7*mbVc$R%eKw&_|fZidUwXFm)+so
zEjfi0^P`3y&P~iYzE+<P)KUV}O7}cmgZUC%rJGHBO(GWShJY)*rlOGC9>@}!7T0uz
zl`UMhd|L$?z%Y;-&x7d&dV_v7fC1|(s~2-l3wq&T-DS2^#SguO7lp{UuX2;gpH@j~
z2;Y}C-e%u4aj}46L&Hf)=iy5b=UKD{vU*Jg>_8h{F?ZH#IO1nwg2%^qk={hoY*$cf
zgoh@&cUk*eF2Nh(k-HsYa@Y$4D7^pFy&QOi=53(^iFH-Z&uhFnAi<y)16G)p@S<~W
z5*PLU<*S_RmNgn!Zc2MIj)mf@Mcue_{?p%wbi+&;LT@r)*cF5wa?~%uvMH;gy$pyp
z!Ot3I0(P&P=YvZ~y6tjH?=h<yARTYf@s~%)(tv(>%Fb~^%68NJ`4Q}<{dKSc3|HPK
z%BP83rn$`>ER&Hp$>=jX9`^so1)T1;_LAw5rBi(I);iNNn{KZsNezg5AnUaWQ(|QR
zn?Gc2e+7MSQ=L2<RJ!>;I^S;j7VKrK+I6OQTW29=wmPk1wHF#nLKYKH-h3QE-S!q!
zt(-5g25L2rU*tMf{*Q>mG(6YeF|~%1-+Z1?0kqQ7?cR%~ewb_PF@I+3hk|2$@)eaH
z=blfBNk4Pi4GtXB@QbJHHz0c2xE|6icngoE@LjdxIA-@TcS+X+hwYjDbyuU|nOnG$
z^X#5jzRSB0$;8N+;{)sZ=oYq*Zf0KJmn<9C)hZ7=!tFr{r1eL4r+y_5p}#k5FP50R
z#SJB-?B%}Zr}yvQFEUy_f*G#K)gmlF%`&g>)h?EwA1~A0OZ2exwwX;)B$o1j^BI=*
zA%aG&yKxD94(w~&Q!N<x%CZ1YDU9FwmRGy=EA`xad^wZw5WZ|qxuoi7p#Rvs{^DPG
z&QZ?ia{ijDjpys?F-t#Yry1FLv8%-YYVckNu9cB1Qnt+W3@v@IoB>cgmbCPYrtM!f
z@&(w;lyvosTym--yQ%I0W~Swo3bZXmZ$P5|{x@BEn0m;M=bC!w8jMRggW*#yxgMT(
zYe%IOMYrRMLfA2Wx|3pn?ML*L74Sqi8a)njr5l2s&^JGIaJ$a0oS{c`$Tq4P#F^<z
z&%!q6*_UFZ0oRVC#_tclm}|pElLT#mxxIa>5++=2Ln{9K<&pKj_d}-SMvvzCgNh&d
z9Mr<NN#uNFb`{>$s;Is7An`W2&KK5~t_7j^Q3q7MW$csM{C%jA*Xp$|7Dh=Iu{n3L
zdCq+9Zfa+UWA=aYu$Pt{t^vFAY-ZkzgR{jddn*g|?O{F$wgx_nLm5p`M~bDQS!{Ta
z{yD+l$C21?XI%F|_zzRyrmaEnK0v48u*Z~)I<W;^_-Disa5Ov3Cy#CK$~`MQyHldC
z@Yr>XSmjt+uEU86%ex}~+7M>{{M(+r{hHKeZhBo#Zu%UPa@8W>$~BJ|4_b07?|=IX
zZ_86CT55HZT{bydL=F+U#q+69t19a3xnt?J4<&v?Xfg9wy~w*=dps_Lx!et&*(eB<
zbAThf#w#s^<K?m1`ji#^7tqPizh-`lj1ZHjvMn1Y9Doq@YZ5ULS&r7Us$B~K#BwhG
z=be|Ho&C|x3&yce2fiGqWGVRY56i@e_=Rt=b|vNaeXT3iC}^ek^b8>QI2(Xeo@&g8
zM?ljL)oSV|>6xzs$k`bd8*s@OH*2=*r1Su_{@U+sM5&%Q@ras+n_EYi#r4~^)ZbwE
zO{}zz_uZiL{!W)%p3%he-yT@>W~KZq$lc;QuXpfXA$8`6zDION3}u8q(2S+to{Qgf
z{ns%Lk6Smb+WIZ(VsyH<wlnIB%L?wyZWhbKGb5TkTxTN<q=j&21p8P#!l#f;qX2t)
zPK6c8blhR<U3$z59fX(tpuEJWKrfR)Yts+Xxws#7mW?yGgo9|u+PC9>0%KJ*lPdB?
z>|?jY`5gZ|_>|fvIVm&kHkMy(w~U&9P`q<@Sh-^LD8aH#UJlCew;U}qN4<YR$pLQ<
zH1)!T32pi&F^}MaTY$Zzmuu2=(%1^x8IA^;K3GRrgC}(If-PCbA=@jZqpS8LkZ^li
zY$mcf$9=@wYn_aCKr6v3QBUm7t?x6%<pqr}_H~GB$SE)k{PqRI<vaz<;3qv*l0^M;
zo%>s-4526;IYL34uAP@FI7P!$YKrb6u|ZSd04pkTzS8w;$L8}Ie8PbV4&GJ08FVDs
zTv7?YywG6|@m%9JiZ(Uka<~A5x{ERNC*o6Tu^es42w%5oK)p^-51+iYHrKB~(7(dc
z^G{|?3+E1s?>IFekhn<;>SHC|_0swpur2NDFr<ntYS|(QzIkhNU4Ow{o~oT8J6fYR
zi3?!l1u_^*+o;%r4*1jSYXoZWTXzWKm#Rw^jBp$AcLve6g4Q2>^OT{XB7(RgB(kU|
z^=`S2;id|O9G#JxcG;Oq&Pr5Q>c_W`w=~I>I>DqKpf6CdTY`8!dR?&uY^1Jvmw;IY
zl34lF46g4vD+?^h53;@W5vb%1h$WH3<u6oq<j!EhkCtoWDSF@hj7CiYr!Tvv!g9cO
z)SR7Aqta1oIbhLr{%&yCfsv73LT+2>Bl?wE8s7}Qwi2*D{9A3Bq`%q3f5UZ!=c}=v
zEBupNHh+t&7FFM6Nsno9bN-dH&xQ8*brXq?D$Xm>-R2~>ZGd~I_MaP2<1@tvN<Z<{
zl|Xx8RbbjL=!jzT_G(X16W$Dh`0aMyyDHQ;OzKQXwu=C|q>G`M$!vC-@hrW(-beip
z>91Ba0#fh6DECB2FvbX(^$Y=@#QwtZx+P%q@#JHF)%(63^=ozc<C>3VLl3m)UN=XQ
zTsDhi{RvBTjz6F~;R-41NxU-3>u@eY%g%svsAc0mGoNM0KoDCX!(yfa=0M624Vd^X
zJaa2nn0rx114UM#sAlNQ`S~oWMynAriz6*F)<lAbdc#@Z)8J@<-Xd)AjGN%vU=sir
z=Xcsm{F^U%NIcTKI6Y0+@@`wZ`DB3UE42aqDZos9^yswN^n=;j-aSCp;wi5ON)*B+
z=ZnVn9v3ygH)mat%<gtM=k>v7hTHm>UFz&nq{|b%H%}rk0m-JwHm0f_T3jRgFCIJL
z1qdRwKU|tCVev?eBdYnQU*B{t@*arGj})kf_tgexnG#E`8Xg_BR7&!gv)_ZYulRf>
zkBX_`XGhE<NE-66>2hAnzqY?*0sv0j1Wvn5K?#_GwhlKMAvLO+?^WL14aB`*tV-Jh
z0-ekZ#8*!<(zsO}$l7(kTj*Ww#q;M>J>%E`PZ6g5!I!QmrWp#j_p3DW&XD>otIj8(
zYMZ(SpFIkmO~Agm35bbZ!ij>%IV2=-2B|TI;NH`(V%%(dU_vH)QJ4a0ecyCZ#=EVg
z6p7K9TaGJthO<8##_+y15V<CLX-rh5scD?}LjrTMTKGP2N~T_R7JXRO3lS<0xCHL#
z<>rArzKX;NgBOJrw_A<u9)|PN#e_@_HWGc4eC7oI>O}F<z8wXX{ZodH`giHdMMP|Y
zd;1E{-+ED=y<}nbZS}>onxb{1i7&OUouED5JA!@Lzu59^h}pd+5S*1CWyeKSBea>~
z08{5T7MG`MuR8Rheu4o3-ZK^yq&K-HaN<!L>}Srsk~f&xs~!{HT~Xxn;*T25iA`|;
z&ks6r?`ed8(0hftWwTfJP1!#?ni|>3J{h?-T$tTGAa1=d;jQqUCo}Z>Z@#Z9VW%7i
z-X1)7zpeVhdE}Fa>(P0e_oty+OpBk49&1%ySL~Ci9FOOJ`yavQbB3*3(xJC@`be0&
znY`Zvz&MYIcSqCRk?=EiW_NfmMsS54|Np&65>Tt~Z8DFFy{2zuhKQSUOCLTmc3vEP
zH@m{u-!rfeI3Pt&u-E8M%eVtoLn4N3k57B(jangeUt7hWGR%Z0Of=x>1`d?uD7TGJ
zkJX^Q*)m$+nr4&m-m9Y{s-q$%Il&`v$!DID4{wiL1stk97vrwED6sru&lr2E1Xar%
zdnIE$g7J0yLX&N%qkGJdJ%WY({{ZLsDz6lMQ=xpW%l<GQZ~mAUvp*0O@}yT8&g9(x
z903GBUL@`BP&r-bBS4SK;%+oF-Cxt2xitbLb8~~r<>PaHNL@^WuY6y+q0lSvLV{aA
ztNlyv4Qgay&j|hEb+Od?OT~WSazy03gJNo>HUR7H$^6f@uTm0<nJ$abLMc`aGsk0f
zWm*<RW8lLFzyTc>pc<XQ{1<9|mk2L<9*lZJF9@&trb^G~?<uaI7>O6&=28dBMVadj
zyMRlsmF=JM;d2|J0_z(#1rM(iIthcUM{4^%zt8a=mkFG6#bpSzKQ|qM{ep#K>dQ76
zT)=(32Vxa;&(T4lwGj*Ywx+-c4cRXMXY(m9+?MS2<usiSyA(6DE9e%63&_V>LT4)(
zdCYEebf1r)khj7{s-T-59eR)c^`dh;E@;o6R2VaefnHAhpt!Dkn|I~8@cTcxnsrN)
zkltzSA6a~ji|*hgowpTgn@6Nlf_6ZSxw=cpk!|6@&Y6|NTx(KK=Ni?#5)&gcLq5-h
z-}JqCBNH`feS$dgySECT=~buo9TB*F`PiB)(6OL6tfz6ifCL#xe<UA#C5_P9P@U0+
z(<HqfVL&P@XRwbjM1;5NzMo{77ZlVjzW|)?+d)w3gA$8X-LO4eXcy3irFOH*9^fIh
z#s}|^QwrJ0nv_<ffxSIIcYBGmbA^-cBIjUKTfRg;0N`L&TS~LUPIo!YMKXGQ^>P+G
zzBOSZJ^>7zCFGp!Y0Gzm9T_)&S9yZI6vXQPa`FEzH9VI=NNXBCj?>a0tlf`&bc7;q
z1EI^wuyqwbo)y*~ah)OJhHZn9(`$yxp+ERdyxYP+Wq)s`qkc<QI72$>BsSA#tpC^T
zi4Js!1cTnDX@^hGBpV77zVu`*D>XU?hBP_OnMj}Ro^|#EBrEA*Et>^*xYS|5bPE>n
z=l*nYe3MU%!qWsP<*K5lZ5{p2&w|+uH%d|4d&IL~Y6DDg4bww++jE)n*qxvd7J|}k
zkR$-?vC$nte-ewCx&{KyUN$4Y8lgG)4u4G&lZt%u?ehUoQnxpl=TTVe_G}x8-~7qA
zEB(eBvDp8Qvo{Zix_|%vuXaTVi4sCm*^_-Ml1h<OcCuIYb?lR57rA7~HkC@Yne4_k
z5ym=W9~xU@nKBp*24iOK*K~cZ@BRHA_x(GL`}qCUkq(vjykE<CKA+FWDZtN)pqrYx
z7}rtzceP4-vWiEPP#TJOTZ>+HNYbYO$5O|i2JIsiqXxx6h2y-(<n~#6Z^2rvrA;p{
zY?~`UISQ)_DZsjSBmVMZWMzoFiLWS+quW9cxOd)!hEF}0%j>p2?oB@lgOJ*R${>A;
zRQf8bvtK!ud9i_Hb@r(1khzn>A(5xp!!1_@uN`lX*5ywSZV42C;qIEWg8@U0?P0<L
zTDvYmjXN{0!RtSV<$2GeEam!=^aF{iHLWCHdOC2vCF+;C%Q|-EOmMSogucJN_%r8?
z^o1|dvPoJ%c)N5z%t2NQ>G=aJyAaJCbL=O1`FWJd#^1`}d$S~tVJ=CMW0@P|W5`P}
zEHBCugua9KTq}5n85bk_jwNbyXB&xmU8?xZ6Dm4F&>2kIx=3#>Xx1p&0`b*ygtGEA
z{(?ZX;xYyAk;t}bL%OCXE3~Th;3k)R0znNI+rL73eF*NA67dM95lvU({^fX<+gM0<
zY0Xq)@6=(TYiGFka0~Ad<(j^`?1Uhk(;J@`VK`c~#jwmKAinqi{!8t_8?6Oa>P&T&
z;z6LySrP07d%7TgZNq02(Ya6Z0{s5%1!#y~E|p+b-z2rOPj){!gXlOU)%}dg*QY3r
zJhouQlwV7s`H(HT-EF+{^p;~nODW(5Q;+E)ZxXl;4?hgzk3Ys74Aho<HH5|VHqTSV
zT&HHI=DFUl81iVJ;EI>j5dB)iY`g&LFM?7+`cXema4o_|pg^62{A8ks(H+|JaP|Jr
zUkSK|MaEm3jp~La_8Tj9(^f|DDrm7wGAwZ}NRunVhNP>9%23CFyoR(_T(C6NTjGx}
z7ZJhAnETAGOUc-taOen|V{hqmv1+=^Hka@#<QlI(ili~L*>b2h)ZZrmhIMUdg#2-~
zRf&6vSNV1GQX)cRF0MqsslW*o9+eSi|9$ZSyyNz1O8)3WHKr2eW9^xXbv16tQjyYK
zqrtG+d=GwLITKR?rzLpH4DDYQ-|$edqCI!0Hsv~XK<xniMGZYDGfkAZnEitnxNmYA
z9<5<^sH?cG$|9G>kKu-Q*0ZChYH!l$6`ek^5R7Q$&y6*4mV^(a?cy>$t5VyxMy7|*
zw%c{$#me9L&8zvBlLFZ!@{M1}Woh&2uOeB_I>`Ib;T=7F&U|d=mj)fQMr`a@azL&_
z+TziR##Zu`w67l=Fv%s{eBkZUe;3e*@bw;Ec(Y2dSbhF^;`SHvp3}$X|2naIihtix
zvy4Cio!;J$yqw<h@-HW5hWS0X3HDtnJR>1x27Z&dIajhS-_x-8I-7}{rDW^XB|~y0
z-Us++q4*kO)nXPb$LqwOiC!(wGPzkOP|8oa*LJ|}2{tO_y?USc$Z9Y2;O=ALZnYM~
zHz%7->6%_2ylqfY)%9_7ZpF!qKEP@`t-UY!C@^ZSMfS7O4T5!2wCacLyvh6W0uFly
z?uc}hPOZC#3z|F2C_Z3atd`{9zTQr#pD~Z16mSf#c3V`FKP}TH)wamc-6*4h^OHlf
zvZ&D3d1Xa9B3ih4l-1$!?021hRdTDuN$1GLI1ihFhLPG<){z11ac!h4LO1iKunP{}
z959o^FXgwLQD>fh{q5U&*nTMM@{NRL-?q*RcrGJ#PJPksxB_Ii35w#E<oiJi7sTt?
z8^*lTad32_oB=L~Ht&4l2G&i!rAYq-^4qexBc2)kM0dBhyG6*uW(|x9jt6rLtv=eO
z+N1FYtW2MI){^qBSQE73w)(PSh~ScTuSA~8h%y=#L3~>Zd~6y5gda>b%$SSt^6#s#
z7~1w&9iPPV(|P2{f!)2Usvgza5g`+#;LduP(Oqm}3TjNz+fSS&%#r`{pOPe>fs{BA
z5_(6=iHv%~?Kfc~<1S1#)-AM^GYbU!li%0spPZ6#V7Dp-k;KBXLKnlk<OB8Go|Jeo
zyH-A<7e4~Kr@V3flKK4kyWkdz12v#K%Q?zFRzy29Uy<-i7;}-RX+(=JpaTqre6n+D
zf8GJ}q4R`?Idw=rIa&nxCPb^6mGE)GAV2A8Jt|-V1>7U_5<2*Uf__(>V>7Er@?uQL
zM4LHX;tXHm^$(86(D!1cvH29JR-zT991b2T^|&@fg$F|{XH1gK4A7P}cZTGu7lZKZ
zV?wJ2cPK60c}}*$9zl2k>b5&7Y2!|y^_-_6Z=SGomV94LIDd5-lzAt2P7rrfA=-Sn
zMya2u_9K`pCZ+kv#n#1HlkupLRrZ?Uge|oZ`*byZjinN`l(3S1>V@qU*xd3$LlP_q
zhdg9HcpmD7mkJ92*6U@(Q3l06??gA|;R|-7-sFA6xecI7qy%`Uxb9q_zJ*hayey={
z;ym*}7gS4*I@_cUs?JP<pNkjfBLW2t7<7i!eZw53jr)!9{+kIb<1hKUR=!2OGO<zX
zR7Gde^224#<fh*>9wLY!QK~$bErB>r^En{Iu~(mSZ4J5A+#zY5{*bm3oMj6-eEQy-
zf0DFdBe7X7ElZ+~DJv@}*Cl&<qF}zR%G9+p#FfMA3VU9Ye{PINI=b989Pa{^%OUS2
zR{451Qrda2bsm=@sB%Igatkc4(v-oDAFg<dDOv)F%$yeRy#NcJ-oV#*?rhS?1WggG
zYcqF$_kCAcO&PE3f*lLQ*Zi71sid){MO9Zab47awwSs!_#bTx!J7g+0icIen8`nM;
zC3<qqS3`g)!Y71#TIunW@z*7axv{;O@ru5HjAo3%L;cHLrkmIHymbnRb#1dNw{FUF
zOYZPk*a3O(<?BlXBQKZhfu9@SoZ`wDPuKfE_^3nBy<}bY!n-X%db#edRT=kC3H6vC
zX97*Y(qlDAJ(=bi!A{K{8xWVR4>Y-2oBz7D9LfQ2S!MR!rwPw`lbD@zE)l}Vxl+Q!
zY=D$#wsV!&yK}D5A>$1L=Z(>#h1RB|Yq7iRd5U7U9&FJX3F;r$nw3gsLmDRT#-=vR
zD5)4f`;SzYPOCXB*2QP%#uQqrSX{!+Fpd^EY3@deYnf4eS9NiuyFXC^p<ai&pa3e-
z6d$v|WfLSE-BZKeEPBt1^D#MZqQI-xg{F=)tzO0f!4An>Ns)`%;;~QHIAC(K=YNFu
zrdhv}k0}7yle>5Bdq2J5N;o3*m)P;<Bc&G+U@DbW#XJVoOCfRrAW-_QSZ`lxOlVuX
zPjg_0Qnjh~LYL&83Ssb8h97IwYeNe8ts8%+m7$+reRYfX{w3pg&l5;U{`$I@ao59K
zxr5@%EW*UTQwG8{cMk(qJ7O}YDvFiZ`;TH*H)6cnI~B*cRlbZHSL)77=-y<-^*XBO
zN2LF@ow<at9CvvS(z>|Duc*Z*BJg{wMA2a-e^!yh?#eeNOEL6`;+JPXGQ%VD2{r#3
z@lAAg>{nJg+!Y9E)s43|8{xhX&Zk<D1JBy?A`9tXBEo;mCRm%&%Qk3lUmbD2kpRd7
zF5j&BpIP^k^)Capj%@HBweH7EET?+7`8ofFgGQAeTp6o+<-hMH&y(Bws%=3mV<7#z
zBTcG>`?}rZ%!?^;?^j^oQ2IF>mKztInbv@S)rN+w%mrQ<wc~=N2kVs0uHSA=zW{#^
zBNUG&PI==Wt(6T#P42o}MKp`b%!m@Iyh>(W$MtQiiZPm2Ip%1AYys_A$;uj3g5(Ij
z|Bxr`B$c5KoVPc->qfYu;j0?^auU~J^T2!-=!b*8R7VeNgXC!+F(^cPH(A?now+<v
zyRdy~_Vn&*25Lm$3xh5BFQ%jdstlBGGe^JPiX)WMjiE%v`!XaYa01V61cT^$1N{xm
zst!}tux5lbq-E21hzdD1_%GNya=K3xV&uL~KmJ@vEIcj{@tb+tr)$V(&R;M~ZXgS|
z-j#nQManJzJU0*%lo2y`Xe=!GmlmR6d!obID_51gpV}$CDiyI87uY_Qai5y+-o#ld
zaQIYiaUPKr5ORjD@@VsKz#Cz>v<AONl{9SouGVWIOo1EbBX)Z?+s>F|vqim<X{q{Z
z#??1TyR#9qs6g;sOLBFDVW<j>;90jiPl9Tmt!436r>j=8`m$<=fJwgRu;emX9Jke~
z>sU{3lISdmbJ*PXy}}9VL-y$9`!89J#**bq5R7VN6d!#tG#zB!i3DPO6jA4N-Kqv(
z25ygIQ`vIFBdegG<VUqf4=&$rvFwLH!4U)?Ewgp3zKX1FlFNj!#XhloKdiuupC_gc
zrPQ1XVG3%H{C4SPrxX*uOTR+Q8B=q|t#NcvO}(=DTs9Yro5VaobYvmgObgneJ%SG2
zFIVrCzbX(pxC|^=36Mo&D?BU~S@5v&PyC6IS2099VO|h~uQ3as-wt_ASAfV2j8B>3
z7*Rae#zDU$QF?i>ZWY*BGzo|_|6TBv)Ai02g<p-OGvMFEia>Hh2z9s_DuZBHxCQ>s
zlj|Ah+%!xc^rY~>dCOJMc8-t#Y~@A^nZ>pgbf2P>%u_dH2E=AY3$;X)!@l7u)qLwt
zaVtFL#5@h*!#(w@QuGXYubK3V(JOmAa^^3cQt9o&pI><|KrdBa9i#1XWQVt_lh56c
zk6%Bv3Zrn8UYs%5*pXzBP=E*B?Y%o3r`FOTU0E8Gr}{F5@fQEQA+kP3JVPTmD}RKV
z|G+1R7<jTMkc_M1c3sOc%!`dU*EgeqeY|kuZ_R}(vWvmrk@2!n{8W6meZScu%4g=?
z<ueKU_)1Kp=EZx16b+_lO-cK(JL=1%Uy5dCf00%!EUx%^LmHgX=9sm3l44z?t2Uo?
z>5iE%LI;5hP;k&9F6IXn8tnS23|E}v`5p!k|9|Wjyw1OKsx|K3N$mdg*m2wivbW`n
zh9uj}YuY%DF(0SG-MBb%4QBqM{}p%_^i}BJiKq!ZORc_*-MHN~5@LsrfDX?l<6{*J
z8*qx65wt-i+}j(P89AB!V+eXLERHJ$b~XSN`^P>4dmnbvcyM%05k5LEiF<uxNa8&l
z$JHqHens?T5IAUGttY>$spZz?+SC7ye@kl8AIugX@?<E8unz@m5<+{(=v%P)Tb8Ky
zVfw*g-bwg%RF<LBoe-@ah4B^g1aNo)_o&4mqoe~+*&47k>MFWnWPrhG5<C$%ZX(fs
zWzEp%m9R9|Pd~?OL?deEbj%d?L}&1RT`Ox&4Z=?wN#;zBrgJWypUYw=^umY0R@%Kq
zb<rZ_FR2aT3X&faVU=^C)9I)}UOq-V9xWTX#0t|rKPA!CC?M9r$M8Uhk86YPBBh)R
zvMoaNNgGUUCKUT|@f^98?CbOCp;p}ktGcWGiSHLBWY}h2u#4%EuWx_2sJkp_d+Xk^
z&Wlryzk>yHIJ~#d%)Zk!wO*2ab3|9f_PvWwk^6!;M8MnxBSOD-!ZeYW|GnhN&z)%$
zg+RwopC;uYiEUi%x}Di4xzkLR=S<gHs^R;T0I)CX@sXkfzw8q0RhE=jS%TUQ^xQl~
z)Fnu;@U1S(A{iGa^4mP;_D>k62rjp!PJDS56O`wM8*sH+5Z=Z!IDpss*cEImIJjcY
z;a!ZMjOf}w>CUgcvI6d7?3ccDzM+3R{q#D$>{nVD+l|uv?T2p=4|6WQ73w++>woNq
zYz~tl?eYh)$9GHFBwh1NIQS=dfK3aF5loKCc;x#P19UY0c$Y}7TiBj9-US8D%oABb
zv66-$9e*b`IbH;abZnIM{fXAO4u;s{{i-0H|D}^c)HrwO6nE*_#B$4P{0dZ6D=&f9
z>qi%ZUGeqnVPvrQk2G>sAGMl$YPHR&dcbG)`ilqed)f07xAv}HsC33D^i%DuS?iS2
zA!N4ey*nu!-d2)Ce8{|I6J)TP4ld~gUnpAe{Rt#|lLVqCz}nQI)wM&2&$epyx&{65
zZ!f??Yql6;I=Y!7_WG-&EP+3mn-h1~TYj$N_xa=$>h1NWjGX~<8*hWqwI^CDdREpD
z7JcgBE^Uez#rSM#swtuTfib-gk(_KBSn+_(Gsy^h4VuMwXTw?6GxSwmW;yo7Ads8A
zWet|TGY9J0NKfhd`OL%U;G<w6a=t%rb9h_onAesyUdOSWCFC347%mrXQE9F>5>uWE
z$&mGnzn7%8Qa-4<6v&P0syBSE{tyO4D(v$!u}18V$vNy@4<|PrW?v0GWaypIB15WS
z(=WHC|43`<ds$L-$jnjZ<V0w~)W(tJtaLgv(iKbRP{p7`(mE=#_^aSXyU6812Ap<y
z$BY=<3e4v){mt?s$lDq!6zk#;XITrA{|&^jGlsso@t`8ozD_=>x+F0|%bY>1G;ji|
zB+ty2Ik2jR<X>l;$F)AXo#iRNHD*PHxWb~t$k0UG6xVpc8n8FRBAWOB?qDind|m@W
zm9>^!rWrRhMVDB9budF4LA;;25lkDFAn%@F9#1?h*ghHeCFL42Qo<`8S*Xlbs@x_E
zNOmu@sQ!~ZX!|VN=}G4PW#1gytc<(2okM~tzHYU6Trr?UG$1`l@#z%JRKwIasv!4L
z+!l`~xFyGJ_uU_~CBa#~E7Lw=ImVOKMh_p!bqam%`-lVfBGsI`N=^<@`%ucm4%UCF
z9lU>eFUyKS-khOQ4%tM41`i{=DM?l){E?Q?DC6^_zgDmO93te`hDM|>w}$Mb$*}t}
zLIOAC`{8mEy&y>2RrdOA1+)G)#hZR<4vvm}SAF`PjWRBfHJ&|?cV5@%(9xgWLy$jT
z<MCUClrHNtm9McMr&EWsOwp{hH6U-thV(8OjL!*!qhW8@-UnGrAPcusy}j7M%t`1D
zd!7iD9(ZvuABJmJ3khrAlz{J2y^35ePAL$#7hh#)WW0E*7kD;_6j-B;uE((Q@xxAU
z*EPNiR`3R>`gDgYyG$)l1-+^^&$6{I4J!j(1KYMMk6`y3-y$eKPWTu7sulV6&=6a^
znFMMhTEm1$ND4F?GD%7?{VG+wV^%Xu=}{}S1i@d+MNj(a$u-+<BznHWnyNymu7~%p
zwnyPK8`{(n<e$=*pZ9C?!l*N5soFe+d7pd<kASsFIbXS|3$|oavJ}ERY$Iam>>qu?
z2uA7gH9I1C%Zk`wgk7pQdt=Jb%iM&<ZjO^h-Da*Nj}!4TLx*f+C>bD=uyI4$GwIOX
zEw+{79PS}25Sm~^zkHsU90&rT4ohM!RR*8agt*)^f6?Ne5JN=y=!M5-rA~ZuRu^sE
zb-mzD`NUG$>cub1k68KSg@SOYY0!1Yw{V_6Y!!mum+9maTx+~sN8YeubvXCGjCm=<
zrt;qjE3+phd;}5J4Yf*)<~?H!LqAyqY8At6HG$&aOWGB)9aU$MF@@z9lItSTe!2P&
zLjOTxN@Tix1t2ZfBD*~?v(?Dd{n0Ahun6`7Y;#|=A%%V2B88pSk<1n};e9BXt#n2V
z?hC?i`<u+q>ovT9OdOyKJT!nZTDXMQ8S*Mo&_}X#u(Sl)=EAN_iFu@zE+B&T-<1a@
z%S@j3u{Tq8m^ib*ZOsIgImK~KZ&MqhGV|>{sb~?z;Dz(i)v=%2zw+7H)P8*ZASm#e
zlvTN8!G*g)QIGGe9hiT7xy{6(4L_L)&-pr@oMv3{<dH?Mt4;b@9V^7Q(cz=P=5n09
zQtwv9n|ck~dyU42tj#wWycxbAHa%m|3S%YEZVkySXC_Dvh5w&qOw+*HCx28mK8+jW
zVCd-af5@2fhL?~AjDK3-&j%%?$_6|sagOad3Q@i%pEAVyG^K4|t2bM#Hm{j#7xe5>
zo^e@X+Usj(ao@mvESCEf?2s4`d|TIJ50;$WkV6TJBV~ESssJKHoX^xk_cubdlV}C#
zX@bdb@nSNTFRSK21kYu<)CL5KVY-Mb=QjCc0aqo)?TFD$`_U7TQJp1+ERMSBwusm%
z>}}uUN#l`MFI@mF7OKWaZqnm)RQs%JZ>i;pA2i<mHSfaXAh{7^uD{?RVAo*15{T{{
z|HJM}>hOxtR>5{MT}0>9`$dGx?3~3e8R%-2MNPd3G5PDkITSKMflEM)a)^p_L+(2n
zcOlm_n_HC?aqzPxCC3FSi#}S@kioR-KOk|N{yLrUf<d^15}JmS8Y*tG#}&>PiyMi^
zoR7|H7tiRrNV+|5oVs?T+2_7Z;rvG{hr$8H)@l~Fhtto<V1)iseO~`osq_$?_l(g?
zC98-OyDc>Ia|I4P_HC*uY>?GiRE7lUy50X!yNej!y;07UwOO&Nei%avgnp=*Ut+Nr
zVP_B|Wukc7mS2kU&L{-`>at6@$2F(XUuF)@3b}Kw#u3pRL_{F|5cfU*Y)-!$JI7RR
zaXjPHu9?1-b6e}`yPf>d6yn?apGn}nL2;-SYm}7<Q^!`)w3i}5hfI}F#z}eL+g0!M
zisShXY$tAKTzltUkv<wEL#ZxTQQvG46qY{&1TPWTz`I>k>m_v-DwBQ`YI<cEw8uQR
z)tA+}P+`{(Ym@%UC+yzQ<u{twpq&`Dqc<{TFc!+IZ4_5AAg2Y9NAb`+NG|@Dul2$j
zha*ZHLFeI&nSpzkVX8n5&Xio&jCGu8LC_*+AXbT6TW@GC0mE^L+JtKKdM>{RS>HQs
zL|B<L@S42#(Dh{U2kf2iR8_tVGS}6-%PzfbiVu<Nx~P{jRdC#{!U@A0n~H#Cf#Pmt
z`U9`hW}Z*~YfbyE{>^iDs6O|V#3;TNZ?Tm4lD7qD{3ndKZ1)w~R5OUO0oJCulxw+D
z;|?B3#`&%`mUpR*>-dTxh)0}Qx9M(oaCl1TGwT(LwsG|PoF5aR7=ewfNTh_E>kF{4
zAg+5tt(j6}m3*q5pP&Q9ptU9ZEhXepUQaxYwyws^G>K?vLwVur{@{N$JyuVTXv(TY
z>(l+6yI{tIXAFh2HBZM~^Nz8Jsk*)6>!HuM_K>QC)2{7*Y3Jf|{$TnU)d_UP@Fnto
z;of4-)m|RfS)Wvro8~yyO7t=<q?^r*D_12WH8JWjyyg|OH;*Xt5cdSCo7<SL>4mBL
zWkKf80<4}||2*gXK{AQempj^%@4Qw)_J2R{m&8oCO`*XgC=~M|8+nVQ4GhFizBUd3
zl}*+7(c`e71Z?AmWo`1^<<i8gUY;^>f>CH@s#!kfe8Q(J6Ro#f6Q4oChD-R??||Kw
zTlTweG)%h*{K%%}FcfAbSW#v55<U*s7lqpd|0?oP91dOV9n8nPGlf2h%aQaLEzejU
z4%q=#CS3oBKMQyR=$I9Vf9aT>i)|7J$t6%V+SzZ#=4|+^S7=jp$Gl{5)i+4#f-xgg
zZHu~DA^YHv=D1rl1^H|*D=0mCokn&pm|Z_)1D~H-+t~tFdZ9Di+rO7u(H@BfEAYWz
zZT@t&Ni%jO6*<w?j;8il0vF;ct}-_7|4zmPDUEDneBjdB#V)h9C;ei5h!wWQoBLz6
z{|T|JNz(2@+w{@5;%|b^POPidZ_eNDH^oY67jfc^`{rDSv3?Vf@2PTJ*plruFW*<B
z^F;L@Y>Hbox{1=gbe)N6cC7&;n(3-JnFrh+lPWyMeDRaw!!)sEye5FYX(o(vZd;)F
zJVWwJE!w~>@e-;&ReOrkMN#<Jkk|8@2hM)_I`iwm8Mkolf618r+70Q=VtZ*ZqKT(R
zcN@P1Sr6B23(*A(xkO%VX)e=UY8{G>K^qe|!;e7|cPzD{pw1ans%QZ2bGS~I+<*%h
zYY^x+yFq*n#fq<$>@!)bHx@;J!OgXm8wN2}5k~h*uMK1+xUN*@OW21Ws9UUC23K~;
zKH^t6J~ZLIET#YB!aeel8h-%TeJY_X|FJ_Gam~Awq+4P6ZvW|TRu;XtW#F{h{79)+
zyZnJYOI#UZdVVZdy<JZ>_kF6_>er=z6Kq?c0V3NcdE|3P*By>^)nggbk^7wE&)&G1
zvjG{W$Vv9n+j#BGAv4#x9WWs;jjq+{z!l{0md!KF9Sg}bn`z_S)(+D6&>w4{eF|;`
ze>?(Vr!6-%jN&SuX+O*RNeO(QdD`jjzZ6V)`N_!qv2nz<!M&zuwjc7>j%+u4d>wry
zS^xi&fmtOT-#y9CRzh{AT+~|o6S}^7oBQ}eNYV4)V6k?%Erpg+74s#X=R#0?mIf5F
zuSW0h$guMlZ$*1<4SGz7{+3zJk&O*NvaTrCluN@NH3}N#JAS?XW(sIwS@gn}j=u2)
zvv(5x`0GL1=bg!XD4+oXF<!WMqm~RNhZwt-c_JO8L5+=^O>=>X6SQRX;NOuafx8iP
zs4b22x;?_6q!)M_6Q=HbH@yJrkpL$RyLO|%#a$p#yfNTNNgFgsv1}{^&9^4KkxT=Q
zG`gXXAoO_%bDGc<t_}yw(q*P*>I7srfUkR=)JhRt!=dQ8%EnPE?I%6u4hc_e+g|3Y
z4h!y^3d#T^riGbF@sQ<A*u&kjU%~EwHb`8xSA4@jR+66jRD6i+xyzS62N42gyawhK
zw7FU@o1WRI*$z}<5Nsgrzd^wX<5T@B09C@mhCcnJa6LUZ)WyP=l-|JkDB5ZzMY$f~
ziwX?rc+&+De|*7e^-4)#I)0U`aoCl%hs=x_VKB?8h~b~dt7nWTg(LDn0P}SmFaP98
zF_`T!!`edu4;Z5TQ6_`_2>`*wB_bNc!+Q%J3gTUstHeMLYf5dBIt?nFd95KMhQ#;G
zh20R4wnpcEpLPk`DBSWLFH4V;Rm#`?*2ve0@V5a$9ur1vwhH^|ue&$j<A@uTOpn>(
zPd-JHA2^$+d@!1kfFa1OggBg63tv1?|FyYjGd@G``-&~`ck9NP^{xx;UxGox3^u3M
zv^|)T?+rsPAHbUQ`u5h2^D0$W6V341s{&1d7%<wyWF}4nH@U&0GD7Ty@{FDWNT=p6
zUrV$y^mMR$hZW}pJ>J*CG%y@tXRErRtS_E+=Y;cmml4Wc!!^OM6@YKic5WjQO=u4s
zjzP?)Hmp;qYkx1;?wmq7j9e~@iK=Ln42`?U9H0Q(Ht}oT9z-c2Sw*5EIQs9#Xv*0T
zRLSRssWt_YXfiiP=n3ad0>VcEPDhU$^Y}L<ov@SgKg;o~LWde7cd(|nMN6)zjauUG
z;A?uSDe>dKy@0UT`a_qA`61E()n%qO6?`P*=Enegig0w$eJKS~-vd-eR6)CR*PW56
zhT}2RCtH{9XQxm#Q{u{gR@V0B&Td>$d)f<hFjzqvYMY*E&|T4+Zk}qAMH}CA`IQ64
zW*tm6imI<zWo4oL&0H#mSoL(&sY)$L;r4hkJ<_*=ZOtpRTcUx&9cMJ#bp9lkIKQ7<
z3lT-Qjjfeqz=Kt^s0nOrPj{if>)S(uXD4RZ3n{p9e?T1aPfi8_cfuK^+nS_hNH$L%
z79)RO+F-7=6nMB{DGG%HZ(HvlOkdR?tC`B(RV`C{T{Z;VowoW!GqbV`rS9uVOVTyF
zf;H`ysxEY!Hzb+WpisBiW;H%2-e^Xf;Tbwe{(I-$M$#MGaQZ{&b_~juAl7to^yUX<
zTb5I|_bU~ePOli~;qtx7foLaxX}~03z?87fpDgvmgRi2VTi{H;R<4w=IrN-~e4%~2
zo)uL?*FFgP+qmh`#$DW|=?dHCbjv<5I3>1RpJV9Te8@OWwl@1VSANn9ZPz53i}s`9
zf2<&qacN2PmgKuX+HV#hYwg9qWRL$L7zApz<2o6ZeJ%9p7mr|_%CZldZoOM&_V`%+
zfVIv{Gn<F$KZLoENwL)YTG8~TdwMVJVuXzd)<oSCZ~hOMrMu0Q8ctOLSIOb0(ALNX
zijqoMT4o!kZmT@iQ}KorBMOpBd=I5OW!<Yl{SdR2U>NG9Wm$q!2kKY%q?Ofj{Tw4C
zYHlB*Y)%96!4;l@e_T|p3_Wx(7Z(O1pCO0h&o`g2k$lkw3cWIdZkk-QMB%*L<y&5I
zhf@7=4V*HL96ox*d&yWmgkoynVcPov`meb$w|TT}V*c93S%WxvY|R$8>J^XqzM^)X
zAowQ|ON9nf_h_?~@IvnR^p9=cw3>HE*>shfjynvYt|H{eH6`@G!*yAO@4I}Wf8)11
zFXkHqm}?RFC~X9d)dsL1ZbUD`q;LfHipnXFJmt%nv3N(p3gTsuwv-<h+N6&FO^Ko0
zL!<VAR2l>nI^rOgmJy)QxYlGKiTWUSPYRd~A3L|Y=^>jPh|rvb+b2!s7;IxykEZ68
zu1qt}vx+)8hd<u9c_Ctm?XdXk(;~LUFIDfb8}BQ<@uiGB2hLfStFi%&N%I-8QKj<T
ztAtC5z8Y5uALL|^U*jZ6|6os=VL`5VzV*AF3;(g!i7GvD<2v&FbvZR=i^t5;S*T0n
z=u5etb*Tq^8HJ?xmvutmUusQ1s7q};HG6q#f?cP0PmO(97Ar<1h?mNBnedTddSPyZ
zch#1KabqM(XIM3CzDm>RQuj>IYFV(}#MY|RS3!H-0oB9tBDV=uFD(=9dpKkE;saAr
z9<if<*y4~x%$ibqDN^%9m4LjFlb8rY9_^3>K=B5pKdC&8=;|_vkALWpd5@Kj)61gp
z9;-)#Pf|PO7hv?%b-ZUCb*EOjd37qB>9EUeXr+ZTTvN8zhrS>}{fWvSUV(j>QHL#f
z{%|S?xBZ4>2GElS?Y<EBl5S`^s~4=pRRTn|)>40039Co+C~-$_o>>-$lX$6JMU3?C
zUS-k!Obv;@!{n1gE0rl4CO?904@@5VVWv-$?F;Gs8jt!tg-#{O6MsTJMfslFpII=W
zM)3CtB>t?R57_#9@%-NQZzz)8$cD9O-@1q5>g#rASb=<6Bgm)y5x^dYLO0ctw;}bv
z{UtVWH<+k;LmveGDE*E=axLuVdUBnD%arL7t=1$*6MDLa3Y(!TW`^W5W)&kr>=bv_
z^LjsyXtjax8X025#dLYk+qkSfC5+PlS}hqv&7`0TtF}OL8*-535>Sd>?Ir7J>%!*9
zbR2SP+v6wl^*`CPs(o)gXETrTv1%UedeRO!7f-ddPLHJw=k(moi_aM-*jOQ+jZJxG
zc>D&K_raE~iLN~L8~fBL9H<s(v%IXZ(LW*3pRQ`A^wWOB{xHx5Oti@>`xLY^S3HcE
zGcEYUXmPI?wRbBdr^5ZuD$yc5gFwe=rpX3x`yA=Az~J~rzSXT(%kE(9B#W_{@?F$*
z#_XG|eLG|63uQK9I?o2IdV&J=X(}DSQtH~m5|iUYLeuN1tRvyS!6x_q7i@ButH5IN
zyX!C6Mlj{z0Fc0XS+z=pMvz0`oYDzrVH4$jRE^ZHQ!#LN?+<@iRM_Sp`1{4%CmRRj
zFR~b17&}M_PZ1^$@6mJng1dIN0wxNHrYM9a3`$T8ML!jGbY0dO&MC4jQe4_iGnJv%
z19J4$$JxntgXD9Nq^OnRjYVC4<ZNOD0Eqojbg|<HXHShQN+D;B6}E3189w(;=cQ_~
zA;`9cvp%3pYpu`i>Ui0x^{R5Yg`qRg?RPBnNdR!|0*4e^d72SznGW&Y#2AtuKK{K7
zX$2}+Oq?m{>ik2Dy=OSE;bi=>NVkXyNwe}POIlN%bd_1mO0Y#f>Rmkzuq;N-0LyY9
zSfIqWn)S?B&PH%$vJuleCFfZc;QhjdjmIICDhCk-(K7(X?4i(7`QqilL?L`Nx95|j
zws5dx9fyy+-j)EDQj@!wqDJ_(E%Wmh$+jCp-0eGLvkbIo`dt*AQGZ@5#bNvvmq>dK
zA1FDv{F3yBu2hF&cr8)okiP%`IQ&&@!MpM}(dyXdUf$jQ74b_0@ao^*Lf1TqkzA5V
zLUuA2<(~skvcq_%zgRel^C=IAHFxZ-T$b1ji-wFpeKT8kdV_v!G1}mV@Ag6<>13^4
zI{Px&qr!AKUtI>Z=j$<WKll$5S4&1Xh{J#}(=bv#>$x3sv2nT8o73TRkOZ>wl{Vq@
zhK$#&?PxLqG5THIP~COUe*q=a1&@$LXn91gG``jAe$wouIJ1Q!q<aS!)l)<7<rP9r
z4(jx*=e@QSVM>?fF3g)I#W*TIbA8*?VZZQ6_|ElzvS!C_SdBD)WIOr2@bvAy*^l;S
z<aHE^moB_FX#2$e;Bo33S03E-&Yqi)Qd$@8nc(NmsbuSycOD>bidu;B=vrwVvZfTn
zH<P{GgF<s%1Qwp>;Wkoh=n~h`-&>gW_9~VT%JmD7`MPR}$?M=~#XFa^jdF8wo5z$>
zr<%X}s|$^Lg|db#H1<idf9~M0ZvA;*?tt%ep?3a;vPG^Cn}8Rmwg_qx?lVwvEN`IT
z6}y|uZdzXRDyIg%8Xb@J%i_5;fpKlUgnPTf+uq}zEqD3K0YsX~0*xk5t|d-aD;M`F
zYVfrUhrvabx9==^dH_>~l>E$+f$^7n`wk@wW>km&HWaGgdiPwvCqQo%@=m>!mNO?<
zb8Wk;E&q8>5#jGLaqGO>q06qQQkbv){$ZW2ZGZlH*6yRp8B$>V4^Z;Q&@p7KPT2gO
zRGk8#jiqlrzjTF&PG>1orjKi%1X};!n3BE!#gqi+5+Yx@P5!Sr{ne{~<Ia&SM?ajm
zUV9g-Z+GxxR_aH=y1zcN)3lb^$EE+cuZ8tJ&sEOG{11HO#{a}e9s@*2U2nZj;}Jg7
z@mbLkP=ftDjC}F5t8lk)-cJ~N;(YYDKw<>o15LD`>G!3@5AH3Tcg)z80*0Nfa}#a3
z4k?$gb-*L3?g9|zHds(&vuvGQHXj`)xaGHmp*JB6Xnkef0@C`_vN3aqlljgTN`J^O
z&1}|>=9ui8JF57G6q-fHls&MT%VgeZY3J|$aW*l|RL?0=uBpRc6V@{9vX!iIEwLy?
zz8=6JNZ~L=!-L^#N;x5BITCww&vvOFTM_~B*%^+C-8zqL_uq{6d2Jq_vpGM?CqaA%
z`<MAzU_{gWuSx1+3~^fPqvqkkyBOu8E%QGie>wYDj>Uir55P!@5Z^3;!^IRhati3$
zwe~|Br^+$g%2iopZ($Vmd)SBV#kxreFzHEuq^U@jY57iI96K;TuFv9QfoZ?T`InFs
zQ38#8ju>6Y1U4{__6w$_O4_Piq9>WNGZHQFlV9{1&OjP7U`b<dEvTqP>`%DU+bvOr
zkwY!ZCL7t>JYgfGKZBS4!;lo)n6vv2LlV~1T3Fv{yIKu>v6f}Z8ZXgu+aBYL+{ZTa
zPueUVq|GYFckm3hopD@HOwO<hoL=%5yZYS&FE!hy{I8l??}$5)#}0&o%2KdHRO^+^
zwy(cLV0&4@bpnDQ4NQ4oDR&Wus|U%o`YdIPMHG^QU>)1{wFQ?VJwQ;j&CS-^jaCa-
zlB=yhfe(r5o9BHeG117;zVAg^?f#eE-Oy7;+%uJ$Y|cI4Y}O~6?}ip{*v^yb84cli
zeoe0C01!xwquPWOJ5!`(TrbeVa&mo|;6Q;2ti|;RKq;Y3j~MfgF1rV)gF3q`Y|9?Q
zBaun@vM*V)KRP}}%)T4`N(XB7P=|dD5^yA^9uup^r<)G>%BU^}fW4HJa|$;D)2?c%
zLuGL}&A2`ZohT$w!BfU>mp8g8GEcq6H<rXSDjJ1yQ=5uystFuxa--qz$!T;Cp#8e<
z20_8J8C>Oqsj_o5D9h2g^F$V;v}~lQRT;&uFiNAI|8@weAX&BGRT1-a#V1K%pPPz2
z=Sl<gt?Bl*hI`<~Q<^#u$Ie_U?XGL1zmle|VM6$J4#IJx<G&R7mz0Glbj`p-T6G=P
z2Mc0XG+11y6H@$WZL+FQ-LxPi*2eGi`~$3Bk!tRAz7x(nt1Vj*({jW)_Y)8H9c#J+
z${|l0t?9ch^*Y7X%_a~@EDwpSY6n6v&q|HwfHqxSYI=3`6KBKtrYDffc2;6+LieKk
zT2C|!Y_d6^@tAC96)_KAQQqe94{08FcI3zg@4z(m{d!OX=$XymNxT=E&{TeK85wG)
z{Hv2cWn#!*EMC7sXhNh#VTpHlPj)0LT*l4K7TB?RE1uu`Zx#mYqaJ)M&DO$xPBOr%
zvyC?vUEEhCZOtkgAUzeWvJ1GXEYH<QWvNR=EY!8@gJD4?7M>YRKbRcbL)v0l3s38#
zVpE_8+IY*h-pAL@0#NIix_`zlJ|{}$4BLwCg)T`FxZVTah0-#pvraXhpM49mXK=nf
zQ|u(Fr;1)lSgNSd&s^N7VwUX(X#TU`SlfGR%E-w`la-8&hbXXC01uMd&*DLbm<QUh
zeKDI;O>o7khCh3<nVsPJ3KRF3M_v7m2DXmf`sthQhA$!k$^Z5Oz&8s=09VJKDRN6l
zxyvelaaNu_UmGtcYt<qXbj0X>ubt!H(~pmx-`?vh_m<n(q1!1xv~=;a(O1*9EWO5o
zy?3ox0#0B0^2lwOps|pV^L3>V5oPA!R+@Hw?(`{i7k3;gzGhcH=sP^(@DYo%(|Hbm
zYkZ32Z+Eb=I;ZevLqnH;q-%d?3eRWR54aq0pSqG7>US0{F-0RKjx~hr1XnCXL9Wl_
z!{QRmo2-p4ux6Y{qq1Z&sf$o&v;XiRD{4cGJ(g|95n=8R^E4?}uV50k&n0u=ZaT+G
z1^^nm0E<gYz8b|Jal%5L{cxJ9{yR@(?ZD|4^c#iD$ltLBzYE8_KMlJHRZJ-*NdHN{
zOL|SQa_#c#UAkSl0tUsW{<s$9{lqSbRkdU))HE!4wpw)-*-}Us;P;@tlQDHEHB^Hm
z-cjX7A1zEsfaS+=@%p*yB|uKyr`%WumS>;q*FaRe!(sQZKVn($DliiBez=^j!Y0<*
z8Yr9e*>?(jAkyWJE^Bs$OJJ}2go;@lN_}C@lX&*v?p3${Vmvnelg@uLrD@j5a+m26
zazd|Ho%D|C`ScD}i=kjbPCP}j%GPjU=iga-S8h7mXL^wAnuU}O)*a%HMCak3%e@f+
z7ss&i!#DHZ8(ZCQG~rw3H^7%N`479(WUNH=_S?TX!4dfWjajN&I$iPi-vuVkurtTl
zGCB?q-dblOND0CLaio1<Y<)84T#U^-ZLWr0(?C$k#VNn7VUZqJ^>d`OoE*<*ic|vo
zj+vK=aLc=~?>QC^-tBQ1dfKErndcz2di<cO*s&Hl+*QAk19tDQ0Pw+*Kw^SEznPKK
z*k@Cd!3_3`S=KfT8bs0Ka-2ko*(xfBpOj<_<0sE#ZPu&CnY-LTaI}p6kWcL2yjJX)
zs;#<nG-BiAKkyZtgIfyJAckDni!&>m8m^v?%8Me0TuLe<OzmD;Z`foFx*+*Pg}1v1
zrD^--Jw+>06=>X(VR^9tD5AN!KW{D->&%N<fm8g~kqDBKZ9X=X(5{XF<8=rPmU+@^
zVo;NWnAc&*NolZ`pGI&dXYBO8N&;5xvTc*s?h__x?1CBt^p>>0df9#g;j>)lfdeqP
z5L<tvGX)K9HTDg2<l2gx1|u`S7Qkoaae_yT!ZI<ETgMM4*nfTRh*lZ5u`P~!n`3d8
zb2aAgB3lf4d#-RSThjeBK2Wv}U&mx6$?ytlSe6Ai5yJ|hA$(0Oc95G1txl9A^K1OW
z_#-WWM?n5;{i2hr(P%dF<~p?+#HL{Hu`WxtDyM1o7_xCjtkVooX@u1C_7akU=Egib
z6S<(#>hlu>MR-Vf6m1c=?dlOift*D*A#pB9m?{Fhx-s|sK+E)e@Vj9-k&kS~$-c*2
zQlT%Borhst^KsyZFw)07XK7=gjN=W4)6FP{d8>O*l5D>h-K!vFu*5MVAddOXN|$6Q
zsy9_;;Toj!eblUiy!N@|I6GXDWZueidbIr|^NRw@Ra28$sJOHy3AdWW;R10%$2RX5
zR!bcfbLe)z%KtC>ahKjkTsif_1vpJY#%ORKC0x+&7>V+vR#4u`yw(Bi$N3NYKWj>`
zi4EtR<rqqNFpKRnr#lNr(#8jyW;PZ)w=HIdrMY+zS$i;KFi}a`CK-(B!g~M`vu~LP
zVnP|a^-D+%;cbgpipm3XLwn1j!m6D&wG-dov~K^5VXZ^u4H0)E4Yb52`I?_hSy1}p
zy4mZW=^MXXV2`R~-pt2ER>beBTi`vwIdQHTsTJvx?`rWRE##{Q0KE^K*SdB7=PgJ3
zZv$y26x;Crbt5Lc)#c7_X3P2<IPz#S04YL+?z-%3ZSd*s7oB|z3P`xC=GnwWzA+<X
ztM8xdgD!|#&7SA}$^t$X?L1v?yt=e2DHK6IlKd^{`tvQZtLOGMOi#9V$y_8T0no(E
zC85u3Sk?=td-CJ!6I@5U8@Ya;@1?h!F8BB<{>JUJz=jZ&rB{Ha(Wx(t7G*3Qe=O9S
zvBs-S`LKPkBDKjL0=jX3Hef_r@;J6is4Bf}s-dr<gZ^5U_~+WF`?R%}>bFw30;sB8
zq$f<^h`2{R1U^t<{msfE;YnJO{!1OJIN^A<0}tZByh8h20Dt_#x{WLDC})Z4oZbcv
zQc%6+=`Gb$7Hdw(LVdMtQ~eX@t{!-KB7%S2e77d(zx1+=o9ud0VfTzylkgups#?Ww
ze|K(`&7D8S(fL}GO?TLm`=z(w(p7#OozT+RSK!~OcU+gGvfa}0dTA|f|D4{hFca$u
zgi0?z;Td2mwttiL+FnpQJ4CT!^5l6-G7DH<sW<(s_$Ez0fY+%pOSfrn!t0iSXUDdW
zgz6kIpjZ)9&+W>lHry%}k`!7F`QOu1S&_2n3*A?>I}hVqWyd9Ihme&u%<!JX4s-aQ
zNLhu7aiYjYM~&}bgj^2@$TB&~hp0j5be3}V-$0PC{|69cqe>PwEE~0du6R>I?GoZO
zR`1Bun-t&}noK14RMo~^O9CMR7Ry>#oK|&$X<Hk@b3i}Is&nM(l7Yd*{V8=%22(qM
z%s(CbD$()vt@7JEb6$~l{!}*Slc~2K_S%>{C0tI>`97M;-NviCZ(ml=?I%p3#M%q%
zQc-F)BJe(G_}QL89yuldq_rgVq!QKZH91#1O@?N-U(n8+hfY_=c8~7$_i6ue5Vr0*
zUM<m8r0kyzTE)i(M)ws4U*I66f4OzAJH0^c++1@UdrNJ0!nx>^zy3~M!Gwsf8Jhai
zSJdZ=8wk!!MUU*Z4bZ=ASm<E@_j5jQK!zZ1OtS9C65DI9WXF6$+JeD2*S1SbU}E5-
zaiy2<KZP}a-#l(=DEC_AiZ_6RA8hBAM+CBY8X8@jqP@F+w9*V`OItk(#p7x>raG<h
zq8CXP`mO$a66n=uXSR93H56ng!FXWS)z6}VU$)XIhQ<`?h_P;VxpO@{c!)GT==5<A
zGWBX|oiM1P^=KU$Mz3lUPL;uZMT0oCpL+s0l76Do8YqO+gP0O`$)Wa|X>$^gSvR;>
zC6;|^3iQ#dQjWVvm;Ftx<~R*Uggj|Aky^xYBo>$q0Z1jO;hOCb>PsY+l(`fU)lbst
z-D9-)`$clYPi>lY#R6*SYhh59yw%Db=7&z`OXyFG?94%`r;bxDsO4VIsD)?1im`S~
zr9ZgHlf9%&RhJv|`Hb2P&|^vt$)d}svVWv6GGk$Mw?wrh{EQam6O*+Oj>RaNlQ%w2
zRzr{PC}*d;PR)Q^R&xy8AC|mbvx)<g0x%6*iHxgMoAt@`AmDv;X?iR}I|I50H=su4
zIrJ?N_SxYFW#5?>4PQNM+Ws{ha1_J1cPerwM$T)<YfZ4>?=RJz>dwNqOi-F2iT%sh
z>IW6LE22w&gcSsP!M=0lc_(af2BD=>&KKu=!tRW);=ebZ;qvq$i@m6WYaa-QouwTF
zLxAV|^)t69A}-{U2c<s6ii+>W@BC!^Fj=+Po8^v7;;eNr^O*m<+>qp1**m~W=2Roe
z#*^MyUBtCeW-;XpSrNT;hO|}nwXtMOzKxhk@Wo<R;l3QCu@#F;P1^_7N`kCY>8zam
z%SF4ie<6{nnrl%h0q5H_#~-GzqLJ#dwxFlIB<Yxjt0mw15raaSI?*N?NK$3kW0oTm
zKR3;TlSia2mlemfI=?87C3|-z9f2ibQ!R$FgPt`_Osa<^t;LJUQ(D_B?ow5%PSLzo
zPE|}fnv?e#8l>yWMc(~T&(WGsIk+PvH3J?~a(>7_@Pco)%M(LPb{omS7e3{`;O2ra
z4#b5Cjo8cwgZ~Ss-TCd^(8tr)Cb36~#X6BEhkC%gg57KhIFcNvP=1mTYQvf=ViVUe
z=yYl^Vxtxd-aP#$FxKuq-kn>K=Kji(;naX-u#s!gUzd@z2Ml@4Po9p!Im>UFD`xXG
zs3qKMw*p5&8d%ENeVms_TUW?xAd2SL-<qt7_quQ`@nPs{DJvOg;D{TmcSnPu0lVXD
z7Hj2;m!DN??P%NPT0M`TP#{yJUEI_Wt##40i!)D!1A`O`$Xk6RtoFtPr}m{6!j&TT
z?OMNq*QDJ&6i>d2jGk|*>-tp9cN?r{wf0Z(sYh_zYiV@jtIiK|9N!?KCe|x9*+!;y
z{-e1qz6)3sL~Yo5eG<1HN(n%Uofioo5ck<DU+orz2cnX_$d}?B@J{`iPOT+_&)Djr
zN88rHO!KzhN8C)-S@=j_KO;mm85Z0S1(RsL{Y>WHJ=)>HD^JZ<b!`Jw$Qo9nHMdpg
z94u%vHwfT(m+ju$j#MSJ9!q9Zm5J6SoF&(`_h_5^8#W6YN6qmYBe~i!P_4X~*3-l~
z#@#PSZD>RsNJH@k4%8X>Y7zgY@e*av*r|4AEG@};z&_DOq!kdgZ#^kX#M-0lcc<Ns
z2)dTi$yck@Hy{AZf$s3%f9M`5HcqmYt@VQW#q?)}=pZ)&!Yl6N=qH__t0p$`^EyXE
zINTU_{tSr&!(o#H_4c14TyDSmm+M&_ohJJy?K9*3KUaE^=x?)kB22ji$gKMfZ;8x_
z2(~>N+$V75T7JU?wVxT_?Lz22x)@cP=`(vS$Q@Ymrj1^GLyzu&Ueh5^yLEhE9H_w#
zfKjtlAL1E4sHXEp2X}@V3Nt}r&4weN>;5wvjzI9SV!whS_h|fGLkAD>EzRwtflYu0
zD`iF%op=<Mt^Kkpp(JA)Lg`vl<+yv}d~_9e*LhQnh;4+-$FG&Fvl#Xo`@z+$jx~u8
zzj<kF^O6kw=Hbn_mNQpRL?7`r{M*8u{4?#^WwF;slO00q&|-`<4b#eBzHb21^vRH2
zI!+SaazW_QgD;B$LcNDtoKoJbj!1(s>PxbJKlBU+yBYNiM=9w9kk#WpPSrVe$JuOC
zRr5L)xrC#F&)jnA+5UqFW>ba=Bsu2`H}*e!N4$2r?Z6MavS)xErX=-|bZ3=axH?u*
z+ip-N3wjjbA;EDlwwBsz#Ah!;^%ic9(}WELxk^Frp%x8f){+3=Py&pC>m(_FS#Xv~
zw}PTvz)xMS%a2w~N!WUzc~sufT9Qo{7YOH)5To<d><KyuIm!x5f~bA6!;{?lpFfDT
z{7cDd?3N|Y#@RZbqT^m@t9Henc2!S54Xa50@TN#D$@pmIzrBF^T{P?jlxd3H>6Lla
zjljLvIz;drAT#<%Xkp5CjY*k^-M&{w>-;*|V4l^1LkjQnuu-FIcbKjzVfB2uMOgG1
zPk3@%vxR#{=o?;wC0Oqp4O$a0+Tv<8`2+TR_tyf~TCnnxp1pOMxQszRG?|Xu6baM*
zF@I@fa4t^Ebvf2=I!NYG6_NpVAMHK#c_<Rxs%P>dZ7bm>0KHT>Kj`^lbz{I4w#{eq
ztanvulqs^-Gch;SPWD2mla4|EHx^Q<n1zM>(OvhD+|#(m$V=FL{PbZ>E$Y!j*uEUa
zfZew-T|x6rhdQw?=}U*=T@FFr7`>%HFLqdu`QA?X1p)7b@p{F)mLN1&QrjvZr#6uk
z=)Rj_Wrf*yqvUEH`{4&R#L&ln0LmoUZ(u&+$>2I75$U4$$hWS2sgnNmi(8t>NEGq8
z-2L9eEjJYlc$<9^c*;+of(^Fpf}?B3EJZPd@@aUN3&CbHh+M$EE0&>MVX`&me1guq
zFIj5>$w#R!wJoJRT^buR!Rcer^rV3z61{m!n;^WcPL9e9u^a-2Fc|30Z;dKTI>=6P
zz~CdY(4IElneOLQRO`50+qYde{SEh*RWN~%M88k|B;xzlm#wO@o-m*SQr}Ul6FnJL
zvv6PRc)^0ujG=jZY8tkkJ1CUjjLmu8ZsjW8C(EHqVdj05V9d{p4ER201v%0Su-Jvg
z*qz$U=P!A%vZNs#t_WWbZ$zD2FS{mwIafft8?^mQOP1l*n_$jv;@b#<+w%vN53ZWg
zKt2KEI^JGGKRe>^P3>}?ecT<6%#8h4`7az&O)1_|_NG?$$pFl>-B29}%jjyLJdXEt
zY{lW9Yed#ZgCyEBo0-}L(#d%Gx7J3StH#prl{MpMnWI(BK9@PwEnd}cv3+J-+I|5U
zx9pGUxvf!7POT;D4?AE_ARs}X@RK=^K|c-J1npZqa=nI5`IX1g-ZI>fxanH+R<(?>
z3@aqgM$Gay!@_T4!L_%My)hi$3%8G+zs}ZS)+RV72;nXE8@bEsPaLUuU`SoPV`txE
z@Inqey6gOD$pjbS+D?U}Z>}8<3SrU}sBP<x{t^P%0+qpyk(lMy+c@7EKJdDuwYK-L
zJ!_|k*)4#HYb|oa#GU98hDOY9#kfs8iqU6;Vtj}-i#-{9m7iVPFnS39MgqA~TaOx^
z6>}bIoq2qQqJLZh-g@tPrrSN1twYV3xM<4&$06jb0IodQ47NRJJWvGpYo05nS=Lys
zgo@)$UZCE{(*$?#@l<QPqEz~Wi{u{%-tZ~bMuA>^qx~0bCYiD@u_|HmESH6N#7H<d
zLjdA&qPCQIHsc10Ysw0I^005maiY-qk^>=>l^-@O_1HM~=y@##*6dUPpolE0+b<W-
zSBv!i@i-o3qJidieF;IJ1`S_C`6obUx;uzAmodAQKX-W}v;?UfiPPU(GD$c7<viZz
zl1i$7eBp3gLG30*+=;XB^$p4Y!FNpm|HF4QVDTNtXWW^m{|~<7cffbN3;2$#LV^pd
zG*cm;o2S>V3&F=WSoaIkuQV{(O`0{?EndHb^4^?m`EA@zu7W>$Hmw<ZJbL|#;U~Qb
zg*p=KEq^GqZXFh<I^+0}sS)@dg)>{Ab^LIqIg~FCyJopoG2dQ*J86FD0YU3CgO{}b
zndjE^W8fRu-JBoXi!59ammiddbMzkGQ2do<oMXH}4g4|Z%H?wVbBs@m%N2gWKDp;3
z$>z`*c1%*n_SmIWskMFE99n;q&#>|s{*Lu8-WHrx_0_qMcl5?NO&&hhM7PKHpAbag
znW}dzR*suKQP%PT5e3%lAjsp|TY-XX{E>$$A5@;+dCgO?M)tWla~@TR4l_LF3iaWb
z;`YFegub%5g5N(9P^fZ@bM}&v*!!iapIwn6hWjs9&b4%Sy&Q(T%lNwZzbZTPc&OX<
z?{~FOQ6jP%M3QVt$TE^8DN;$cku8<2X_9@WLe|h?UnV5V7P5?OBI{U2iXqF$Hf1c0
z!C)4@b6nT`+`s#|pMRczdU^F~v3$Shc^t>*bG$#_7#qKyhtJkZ$$!uAYejPEQX+3s
zh8@}By)IW?hwmfZ11x)fYgdR{2)uQVpk9}0<J0%9vni);haR*8X>6I*pYM+W7Ml=*
z*&$-^5Wmk5q`C=^zS1B2jdM7(Ny}3Ko|#^QIFb{-Slff$vm&ysyfwIf@oI6sK-u0o
zl5!y|tShqC>Q>O$l@En54do9kYAN=&`<aQYG*;xg3*K!MTqxJB1Yc-sFIr4rWoLD@
zzp6)k5JK#o($Wdqod0cMiMy7}a?3~jpvWMT{4&WYnH3frpt{C#JkZbRt#1Sm#Fq};
zKgf6MyD|<b%Mf1G%3(t_s$!|0AGomCotMVBW^VXzU@y7FR1{fOtq-E)h%8Zi*3zwl
zC1M6{QxuDK7#Z0*-D`7uOuLWs?5bSp2K9xS!@ySa<qo-M6CCKz?T;$-)b>Ez)M(G1
z$yl*J<*>ykmx8~iYU&XhB1jlN@#S<m80nKH)`}r&+O-NQ5^JI06kFOBAPVx=Ce3u8
z_bK8D!}ghVAo_wF2gkq#A(s^}T!XH;NHdEjO<l_n3EJ@T>1M^OS1DhK!*l|sV~oRp
zG99g0lCJ>Mk>+NTzp<x(0RD>kdlVnu8qTGQ;1jx7sAb*crEnYN5njy@@FjG=v!-xm
zjU5DWZ39s)asb(Z4hxnlsQ|uwp!F$rv0D#9nfVuA+|~}7#0z<1ZL53t`N`7rSA=-c
zKlz<Le!nap8ym53?vx7-TxZa@3|V^Sln-?id6ll<5R9#D6{pttFCj`{Q}(4yj|{@~
zHM*vQrVp*4ewJA@+V%eB>RHqza;}E+-ylcN{{lIR*y(lt2gvc}z&{{I8Br`vWkWOB
z;ct+mybt;xkYmp_$dMQ&*7IR2I;hyi;V#>-s{e?rXg(P<wfRV}|NE|hgLuWw7oAxM
zv{_w9(wv#5hYFVeQ5hLAzTKV*dw9{Pz1m^I*XhRx(i?iH32LYF;h(3iUN|i7jVO8{
zaz=!`6&hXfR3&K?V7$a9sDaAMB`N3~Mf4v@cx`%_x9V07qD`+klX{6VtVnj4>QW!^
z@dnheGbGCi?z1IJ!-`pW>sc$k6VZ4f6^bH9oy3WQvD~F(;S6t^6LNEBfLhz(#u^Lu
zET-Bkv>q;0d;77xrOGP+*p{gx!4|<p1n`%{Cx_Iz^XZ%#CTj#p%u;7x=CWE4s<0TK
z(A85vQz2VPto3iLuw%;1&s~Kq3JJYR$8O~=A=l6GGE^)g%ks32kDR7gPVc|_hknJj
z-OL0i+1oN((s6lSi=6BBn<tI0T(keD{i;9cpw(Q#zrh(6@%kiuvP$YOk8_fk!_}6L
zX8TQfvlDJ(np!JkBYH8%BANO>*dDdt$U&ka@|ALr^3TahPHtS``fo%qL)3P$qDYWr
z>9<bvH+0=vGtueLUOKoUWf+UR1!82}%RZo9N=#-Fj$38U(wx?ZJAAK?O90r1MeI7)
z=q6->H~W2wui2Wm!cJm|C%ckKFGJ;?Xl8D3UC6lE<%J?O@NHz6b!`F*793+vI#;on
zMiqSfF@qhpma)e;adACz@|mJstUo?*f9)%JWEXgUN42k<b}Asq?LF@im-p<UKv#zj
z<Bs}mB`x**<HfTdqyFC!YwZDUgD2+_Z%|(*%SIj|sHrH;?H<@w$mh~Md2g)13Cvzw
z#S!^`REka=(WzTlPN+Z2i24-;UMvfP%f4Vlz#;fSXRN2y=+t>@YHRqb?3JKrDn*I=
zULKXZWMQx*Yc}&XQh!ukC!5px-@o`yNJ9jOZE-K2WM+J9F~Fh;1VD7mknc^omzBFv
zYC<aqL0N8H%*=Noge&%D+7CAyUFjyH4L^M9d&$+^w^7ppY)GjPpZeyTaDLX|$^8MD
z-Hze{&bzPP$s0-<5jn%RbC!Gd);*=X8)|D}m+q=3<<ENPoa$#Cv9m>Kcn4{Keeb!1
z2kzE~u1%yfENy#C|Fp>*kM#(4ZP9-}nTGwVVk(C{f}kc`TyaZsv;*eIC<T>MiQ*xh
z#da!(b4-hd#-#!C@=C-!t_|Igso@&WrlbEjQaU#Dp!57fUG$GljbJiy=BUqd1V~Pw
zFVyT-co>J;1BuCgxT=NI_J02T%}bME4IS|zq2G{EQu*w`6j|p%aY0MQ>6ub+jy(Y(
z1CB0TAR4UQlJQXL$b*a+geKTPE4dFDzB{xhP1FKV9&y@>$4>ww%D*U&<GvD)IP`c_
zlr-ZKinX$j*q#$YPbocK=e8Ry@|{v#Orc#Ypvw>Gg-OM9rxw{=5x)Cf7V_x8L;Vli
zSqk9%^h-#5Zn+V9sA1L%wRgkw!WPr9wG=xyVBMhSI670ege5GYSawhbBWAr!8hXw}
z0xgsy&^~3sBbSA&Kx}9rV`GPToDOMEN^&F4kZk{+RmHJhC(qv<1J6vUA$s&Wy22w%
z(|=4ksVm0|jaiC$9u9az@e%vGN0UF<8F_C;*|efQ!)MspY4MktZP@AokliM6gm$LN
zb7LhP794VtC|K;G46@H=hohC>Yqm#|1p;AUgIDO{(Kz>yCjhqbSTZY_0&73t@uPHl
zrUJdTyhN$MKdo6?qLv__n;xC^$w666`v{26S1i+PMfWUXD$|`Vp<D+R(U5(yYVmT6
zbo*7OQZff*0(p*cy$D0sEcr^d1qpYD8*pw|vONaU9#uGaQo<LV{mf_9y*uuGkaOK~
z`4~<u;mC?#<p*$FXINf}EpqW>sjK)kOAC1(x0y`JmwSHad4U$J8Ev&P@8Xt<Xz0JU
zcH1m{3f4L1W`hFHkVv`knk(MjdP&6O#<viqsfDs3AXCoQq7#D4kO@A5`4i^yY?XgL
zt*7+XqOTKh$*z>0WRE)CR|13`+J}OTKb2vZiS1;MkLZ3}x|aBRZR)U3y4omyQ@v~}
zjhR|yr(4Aes-X>1+CcROiyBR0AX~&uN2f-cI+v1hdie%%8Dew&x2P795u`?bmn)ol
z(ZqJ`QdP5=uo=nz7q{AUDRGqvNgLY(mF}1B<pl(W-iqms9&&))mhYmy*+PeHXSagS
z@cWbMBQV<@Ggwl|rzY-)rA{b5zsh;-xfxZp0S~^TUyzr=420<Q2DjNwjmTZx<NN7S
zFa9+PaQlsSPQpc9l+2w2PjRPmA4ixa66~YtE$(h{ADyInjrqrDzms)oNVHVb+T2fp
z0<SpNTc_t|V?1XiWfru~2^AdO+k6wg*JbUz5OKHr`$AvtMS8-T_D1q$oh9$Gi~zrb
z_mS}kND8@oauow(ziDj^L%^u?s3#KzIU6{P1vx(^INj8_f6$JAL5+u*v?XqV0TEEt
zpvlcGLk#g~?a&ubn)QFLw=~(f&5TW8yqsZAF_E?|gOJhMR<Gw^&iZFf_Q%AVBcjD%
zwaJ{9L!sxzH(f?G@$D8XewwGDK1s0ack8P449W?CWm57Pf88{UjNc~!Kol=_FO%wl
z!%CWbr)XF6al75eTOtkLfXkyridT}tE6Mj4?0&V~knI13a-2c80LYow90W{^F1{`;
zYh*+%Og!VtGCnq$N`lMLuvj&@n1vYy$B+$9jzKvw+~WY7qYG+}NVc`;)zYK+qsc)8
zTW@MK_2dJK<;res@AjMJUE5C3()hZNunc|0X_X&Xl)J(Ea9phYhh8^v)8cJ}^9oO|
zwDdtBlknWLwO$>W@*<uGE7gV<a>qk5u#HB{AlpPN-XR%Jy6%rdg3%i5qRL!xz=%6&
z!#>xbO|HXQ$O-+?DdgN^C~l(?S%AOzoEN^Jx7d=vE&o(SMWslR`$Aj>taT=4k~=_r
z86W{WXB3_vM;j8kJ`|80NvEA63mMr42XsEq6i$h#le(-&&J~d6TrMwrW*ygU%fr3O
zdOB%a!kOl~)LxSF0tNMZ*P7bKhnKQkb)sZ1O-C$nZCPf)r;oiv3HWT}>nxp2kyblB
z&)Wmv7ZSlHF}CcD^3}O*x4OUE{2CNE`d(y(x*zFDFm5=?5S!eug%30h5r?|yaC)oL
zXcArS7>{lP(MA&(`_LHcnhX)OTjtk{nH9Y78TUwo#|=rk`zHY>u}e1Gq+tGK^U>=%
zmjFD`<;&FjVE$aI0WgAD6#f<BF21pUfhs9^4En=2&Z=BPCbub42D>ZtrWwhm+7sjD
zXjbKc>20-AxV~s=&m{o}`TJIN^}jTUJ$?$^<?`k)vY5~L0!-?s2_TG3^Aw~A1@gAN
zTLd?o-bJeu92foI{Z$mbh~v3e<4<al!8#5|QhPtZX!vDx|BU{sk<-m;!^^ub+(7J?
z_stb>ktnZ`<n{s{o$vl#78&Q?t?%)n^FCxLOqv(2h7nb}LO^t}Uz}{ta*>_%;#99q
zG?2uq?*8%ltAPXbU5s0w*e?H2rLIP=M0k@+M7~3_XjbF?2W0DzbVrk<RI>w#>;e7r
zT-a%dW=%~w@j%HMmUryi<m&dIfd0!UC|6N*(eM(W7+7l=KRX5uQ>9dC1ZJ<HwnA43
zMCC0<p?in{@&lJ(SthF;vN{3^MF<LPk?1h~+z<YgwpFRQS@98?vk+KkA6%<XT&p;4
zJbcRUClsd^mlie67Qk{H+u`fNs8Ga%lfwatK0N_yd_S{t$32NLC~W3|k6joaP~G_q
zX+>a49N|K38*c_QKP%ktZsAe<Iq%o=e&BjNt4`Ps$21BbuO^gDy!-Ko;^XSj<HwkW
z1ccHxvdi($NNNT!IuBJ1|B5;ui6I$bb(PS<fSo5!iml+GJ$!@5GZ~&^G46wz0VUz5
zvHHPr>GKv7Fj_fmxrA$xQnhus4_o%h-knNUS?{Y{44M(2imS{B;061PnDTh&Q1MN8
z7k=n=9qmC25u{~P17K+SX%x3Z*Mr;mwj(vR8pxz;E>`%Av~jLSvg5M?Ce4w`S-UGK
zN!Y29Tx(-hV|LqFn!VK8j|4TPlWXB(g(zO>22wLWgLZa-D{IZ6arrju<HI)D@&c>w
zLQP+U@~yR9;O{s_1!(F$FN*`Ms>iR8lM5yR?c&Czys494$Er2+KTY2JxuG7xoLPT7
zmGfP?U0E(R6@7En(qxoCYH}9(7MKQwG+0w~+enB5)qwYPcD#1x(gBw)fSBnEqQd5a
zhTY=V1VJ(G(Ga&PwvA-8?nS2>sq_&5k}(|32^RoUQ~RSvLbt7mKT`F0oJ#sTd*6+>
zXFQH|ajv=B4(0JsMKo-GazU>j-MFiR8}k*0Qot&(=;KCmyGEu!VA~59&%0X^w6t#o
z@EDGlV5eYl0arbbTJP%x`Dqd`1@aK+X@%bR^u6YB3huD!#}ReDb{37S-l$*L6|!cw
z#eT77uWD+i1xl7^w-cA}va>Bp1<7+((~ZS!cU}-=O?Y6ue&5n+XUgRxzNHVA0#+_#
zeYpa94rAh@)@+XGEO;!2V0Q9w#C;8|307)6wQQd3Ru)kfHyi&3adQ0c7;Llp>b6tk
z?!-~xdX#7@W+How#oceN#=#Gw^`VD%Y)JHCIXin_XVfJ2DEIM9>ax5TKxF)HFr)ed
zKAY+d_0cvlQlm8zcCW{KdNUIWVv^+sr3M2>!2-aK&Z~0t^EzC8MQFDgo*4qlbc>4Z
zw}1{)xV7x379jqsIOLj75T%L0GkzMqNpUfhw>%O1q+b=pLjv*3NcY;v`xCjr4wRAl
z71T2mR}J3=uxRa<bB4lMqb9BM4Tg)26wNqpa>;=4*37?}&)Rb&B}A#@=H7dQL7cS_
zY>OwbVu-gdn0d}3zbHE_mn)zm-+)&ts&GEPTm#Mc!jg=)+d7tv-qQ#(0uej@y5&Yj
z-63l=E#pxhTV#KlR#f=iMKx*_F&tJG9%A29!4tKXtL+_c5|+e@46UEK;s5S?heZ%2
zQfN(`=A&i&TDf_MrTD{r_y@Y3DSDk6xXxvgag!R9fX7U;<gBpqS}3`_;50k2rUwf^
zGzRQ8vfM^4I#l1Uk=sTt&j0@+7Y+Ukx%lpH<l-3$cx1Q+Z)MN-b(iet8OE_rm^%b0
z{{6NAt+1e`ApdJVXpo@%*mvvkm>ed){XQjy+y<n+M2`s|!0r)_{)PNhz2AMC=LX5e
z!juVL8JTR=3)$mU;fbm7^m&5YJmOVxp^O3{>7~0NsRlZuX14|6lcfi&!5DC4$-uPG
z|F<LrF5q?QQ_-W&ycL4jvcSzS9Z`pG{l3L^RUnkSvx?xmxF~hm{fcc52o9)(sP`!|
z-O9)xpo7Tc+1*+O$Y-hIGA`88C|Gy-_DeFk4<2sM<2Eso9U9!is~q#T$bC#&$%X5B
zF?NS_!+Rp5LCBV-;GJ${i%9WA8{T|+oSRz>aAZKUw_Y9j%BfJo$ZPHl3d*7QC0#5s
z?#8Y$(Ua1$&Sw0CJ|2pZXPZxr7nhde!)%SMBf#?**`*n?{@du}G~z$8ilB%3@q^eZ
zKxP3zNZHXwhTj8{?FGBp{LXKOLYV;^hn_7?n(My{Ua?|{gH4=FAEr8=En)2b0>VCa
z%_K8X@kT|#<zq`Gey;Mdb3}&v1)j43u1qxQ>oDXYvxyV7dDgn25o^B0a1>>2mO@>%
zn16JkQBx72uo&o`?^>9<NSyzx!>IwpgPYf2H`Eq#H^zQ7T)TtQ{;Z`N*Q2(O=^;#V
z@xUcr(^!ZzI{w(L*W#623w({=_DhHVk^Jj%CCOoTyHuGjCJhvHGWedY8!Zx~L%Q>c
z+*HD;Bt5FKiY3{6-u>fNaS12pX0>2n=?ekn2=|RtrMy8c%2%3t2CQ&1o>D<e@jU@`
z<Wc}D-qO%Wk&r?Z98Fb6&Yml8U;>FMZh(gypTz8J*px*xDHB-CK)`e7G51Y%#~i3m
zW7`PpBwMO-04uK{k=>20R%Oj?A+J9tg(xY}{yH`OE9llk-Kk-dxN?xdCKo6Vp1kDa
zdqdq#{t>I(I#P@0z94S7zD@fUeM_sQ`rLGJ+x7^HEmP6|m`zn?km<F*7Q0qYJLV+Y
z)X%2+_*JYW(`;9lzX$gaeZ6x%Zi?L<P4t|)d!g~pv&P_wV!QcMRcyi3u)9HVZUN{G
zheKi!P;<0zT5^LXb)~X>&0*30Et9ob8;jQBZBh5>COvQ>F2|`=)gZS4^0Y|8$5{5p
zlMBI<wKuS|tA3Uy<(IAoCbQdJ4qu`p%M4_8GW)}xyT`<e-Q=i(5^jVE%W>rRN9tsC
z)G7VKJ)3t4@7>3fO}N933#<qr=sv5g)>=DDGrfLk1B{*tzwQB2!t*uF9P@%tX$mDw
z<gBNLvPI8f6Pt~n0;(t2^*a!&zFahBrBx&WOTl=6k8$ak!N_Q`Z`jY=thbn@)G4K!
z107D#G8@ug4|&X#QiI9zLVRUz3%MCJaTXasp_<nEvzuE+YC%iOZ3w*0T%E919)rv^
z!AIB?m(3HJ%10ChEmMFzuW5;4Jy})i+W@>ojms^mehoY19%T4s;&X#+>vv9_basH*
z(Q44-xh$||g$^yb8d4Nc93IkkdyQV{?AhCYg|wbeIoa9LfmE1J5)%H%-T7O|d{!E)
zyy3D=9ClGU;1nEJx1+fR)_xE)a{OrR`%T~Cj(+X(7GG(&pj`_Gz3-uZ7Xg~2pY32-
z^CowzRP1c!Pgk%a(_wMQB`!i`9EV!B+$1aihN9#d*i&L7>mq-wpnv8L&{2qWI(lnR
z8O6wkFyfPE^4~CaeE${C`CO6RDZhp7)~%0Z3swhWpNOp6usMk$zFgpYf#oRISENT%
zRk0BKriz6vUA<&cqoCx^BiYTdhbLTqEIVaQJVUYL-T?-fa1SWuzyJmMvyBW?2Eq0$
z%k^Th_KTpo7R~s2PRyrX>_lz}T8iee)l$vcrDK1Gx4Qj{$I%jIJYp@yS46fH`fk$;
z>U2<X0T75Ach<^D4+`@}AOCug=3{IW_L@~On87o;tWi1H42ZJpsmj1&!8)LF6dmJ+
z_Hz!SH9P7K#nX-X!420hy>y;7HYIinF2c9pRKSBf{Owf6&AYtuN&?ABSNPqJlVgBy
zZKAoOPusHb4laR?v*vqUmvD>2rWVF2cfOG?Rmk)(;#4BubiY7Oc#T2R$=ULVtR|Oh
z%9voAR}GOhgCOg2b>M>N;GtLD_ID2_H(WfjEbt2$3=6fU75?m#KUqARa4hKU8gDgz
z^1@Wf^kuH7XnBk2pJ@&}o`CoEuUIla_z$4I0Z7FY%&QKY#pECAaj)1OLp4>IkZzxL
zODP6ZYC4bvvYNFqh@`7T$JszLqE|>m5^O4?y8FqC<bTZqNFXlgihbAFKApoOC#yB(
zYNC1gGBlzL-d8(-pK$t%tFa>)lE#ry0P)iE4%t(h6Fg9B_-xts!NZXQZAqe|q>{Kj
zYC2zS-$Zo@DYw5#XZsJqwMD{JeR<a24Zf<I?)P4(asQoAHu+CN*=3MW#)H`N`;r5X
z!1+5}0x7x;J6x{$&8~3&?AiBP$LMkvbXH2MBLS>7von!WYG@%%Ui$s+{K*sr)1^ED
zuyxpH3o2ut71^4;2CHQ0iH|I59#5;wg9Mh0y$P@Hng0s6Yy)SATu!oKu2>duD+WnC
zYiXPf{OQ+yuh-(QgUh(|DMJ0ib6yBt+nWc7S(T2QprmFmlYK3~8pB(gl}pZAxYgIJ
zX_=@nc2Fcfn4UU2aNP0GvxCd`?YFsK8UeBO);Tm?LNc&)rBA&wp^Ag)^YmQ(6EKWp
zuT8A$#47T_ioV<1l{`l!$Jca1%G1K(4g9F-&=S;^B9rO(J0HEOXrJ%n#M|%;f@GLt
zmz$DNQ)F$_iH`O%M$JpVt0bFGeUzzNCq08$RT?ixw)O<G@*fSQ3-+f9l`d$FcDZKq
zKh*UwKECif{K0d-QG))Fw)fv_$H2HN1T;lGtVhiCq}A+Uzv%Xlt1ipUCzSTRA~x*;
z<kL>o*P^WAx(yNRFSZNt2Se0;8722c@WXG7LVsg%+Jo^BJ$>{C^iO*pIQV+nU#P*p
z*L9C<Vmt7?Vj9$PAT&e1sL`Ble87Jt*q|}}5q*=EIr(p(qUknJab4qO5*gDQ%411p
zRiU2SZMoFz{qaS!6(JNy;1ci$0hr=#iEK4@axzZ1p^psTS|fOL=yAb?aJ0R0?upn5
zFYGQ~Kz(y`*`w-ye{n~%{|QLzoy%@*pdSD^XHw+*x7%g~fz9y=T`XS@pquT7z?gXC
zT1sJ7d5EXmQUKY94tB<@zj9>_l>Yft@!{{-cHPL0oo^!?gBGiSdy{(wbCP@-%&lz~
z#posVoHYoCr%V!Prkpz;ictLEPlXYBVH6dfm%`WB_7!G_O*vj`=?smq<Q5E{A#B({
zebxuJRB2fx+lF^q`3yw-Y`C~1t<M)U?fLsji&=?;(NYMZuC)`#pl;ZAgp%re(F`xt
z(f;VB{k<42i_TP`yJ8o(Z4ZoW-(5*o_%xmliK*zivQ|!a&kY%xZiikjY|R*@P|iv7
zpp4sTcw-2jbeVL91FGHOjm6`8ub7(n3q(D%@CF0{$M7UjN{wv$Zmm#%+;lI+53yRp
zx70@6vEAqZrEt4WX`MsumBfX3V1ERa=2hQeRo(de?L~RL_p88cq_m9iox$g^P!R$y
zjuY>`HU#gmzE6gBU{d+11+{}2f#OkR-|h<lvvs0R-dYIA`Xd}&x~27W&SmT+UX5Pi
zjcN1pDZ{RM_;;ZcNfPP!N5d}hBa5}h?V|3z9`O0$HC@yQ^Q>*#0{mcdbC>&$i|9C$
z*3TPi_Dj6xtCxDB&Te<N%7K<p{3J)|Yi?Zbg{;Gcm0GRe(%d6^<cn0`!c@I6T1(J^
zy7-KMhPThLpq}v#>c@k=CDmO(-!fa3J8IG{*W~-kFEc_#)U_}p_*lslPc=&fl#a_@
z!F{c!GnzAu=a*T}ONp%Y^VlttGINDodNzdSP~3-pU~9%LZyCscv_PulpM*|WM2Xl>
z8&5g@m(n_+`&l5ltZ&y}a{mkIQ87Acs5Dg>B}l+QH6?)vx9A2U8qtbKwZ@`=OuTaT
zGI}{;UvJQUXlnt%mut$t;HQs-B_*Dk$ta=!HJc^Kws}l-z~0wEu&d~|R*dehM(|*=
zO=)0EQ7VA>7|)1IAc*_@iR?S2=Nyj~c;fRCguZI$qAGA8uk0s_A$#1sXr`Y%mS7}2
zTJb}Jf6y4NI5jdJX_rT}-Z`fnV3=agigX!uDiOA%?9!||N#lPw<2E)+<cn@qnf4WF
zZRry!`!2L5-L00K@$%ZunCpoBh;5{YppIfqj?PO}9kot^z@=;EySH(QzpQP0Ae896
zr&?CIV=rgEsoF#B>)t7Xo+QtokBx8<sGeB1{a-A_(1Oe3fUSE^>H6L;`<oxLXO7z+
zOn2OE`qFA(e+ldncDhXK9%!H)vO-)nlx)|`Zt0~Ev?`nVT44XAqo$zmwh5^-SI4v}
zGICe^a)NB?m8P;HJ${Fp6C*sgxcz+O%d=|I*pAUZ74>AX^Et+jpWaj(z<8*1%l^tn
zA>p;xkmkJ``#*{Nb>RD<!@IhLyPLk-Uo5^oVpce;^N1N&rrA8iuBP{R2Z7=i0*H!l
zM=@oe(tc{C{D>DhuaR@AC{bT14=8b06=L5nr&TkfQZkRMZeKB1qkL7mN>w*(ACQlP
zS0VQ_DHfn79o%oNiPVz8bcsEy>?fCd4=+a^a*+}($qjC~Ou0HZ@bSFR?Tg(}LI<EX
zr@#O_^H-uGT^$=IW%co)KsD=tUtH_$sY4LU!StG4w*gntuZ~aEE_Qtg`y3mgJ=h;o
z3_UiP&r5mY$!y1H9)_GNHnY$6u;0HKQ^*K>TvtMklU9^@7iW@~QYH3kTD}GRn8)lN
zTr^KrPBpoVQ`p^Q8jzQE_|eHc+-~3JXZ~gxgPa~oz0joj>W^Ll?I8z>D#L24pDq{(
zm3L%x*6vAsVeGK%M9}Aa3nDw|35l_m0il<C*FZHAQ}iM+;8)#J9&sy=y2XHOpd1R&
z$o^{o%*Ixu)iiTrNIn|HRD`Z?uEs-GcSQ&_Nzvq@q70#tK*sVMf1kz4KbxO(^T*b~
zha@+&fFP7xf^15kfVsn~9%BPOXj#ENXpK!cB;O=76cE-FBIQkH^KN`gN?t{)(nPml
z3t$wpoeAgF=5e)A`5qC-PVQN`tm;qxsl$^*vAVb_r77%NCn$0u8AXqbMb4(vQ@?Z<
zfbx0)ggl`>U{{H)HslkH{(AJgj?{`E7oRQoIB0_Kz9n613C!90VLZ>fn-)|xo)~I(
zh(!sdJZQCq%-LFlpYlYt?}1E=&#pSbTeU!N3t%4c+*@oX*9}%Pq}!S|%+3qOXW{3O
zNU(%6CxMCkN6;$54}3sU<F9B6r@8|x6H0a#XR|x>fQ;Gb@=y5-a&vsy-|hs7f)EEn
z%7#|u9-Ur=^4mTopVFX{0`N78JJ$NXwd0@{i?>{8a5{1ZyyWfTCWM-*v_-`4YWI?*
zQ9hHT()IjRz=z$YD}D!b#eNVUb|fVz0N8L8zP5iX!nThf4}=)InTXO)N6ZikgumWk
zsh5^k`a&|Wcm+Jt?DiD`u*7=NZ6_;F20>rZV{5a@HmV<w#tk(1EV}oQ)o5L0O>pFz
zza4)f7DrELsd-tw`X!*bO_H@M>)ZlLIPky`4V5aLWRfu4pi-`4@!Fl35So+Q_xZB`
zR)Qb<a#j1&jdDCGn%prAv$fWY#28wOvF9_QzwTkOX3+*8ikHE?NE4fvwd}F$kt;lQ
zQd5|{83yYb+tFDH-PMp4zusRxphmE>8GM>AZa0~)6@KsgaBNP>jZrULctlyd$<<nM
zDB`6MQ3gLyu4!E2bDtQ0w0`_RRse0GMOYi{ht<4IpBm+Qm}yh5N6?lY8Jct+v$7af
zA=n%>a~uZ$yPvpMapPb;zFE&sjlR@&GV$<xHiaq?I*_qAmD=3W;al?YV$a&7d+)%m
zGxjp7+a!BlligvIQ;Y6?K!D88{A{RP=zAy)WnxBr8icQ^L`}B5Wu~TFeygTlfu9&u
zJR>SMyngwcyKJcCjlE8{dV*ejJD(xbmcipxA5OLD-bi*_e@yoIjoNrac0?U-B!!la
zey`RF`3CV<jPJ&-u5zIzSs(>wjsV^I9*<?<BBJ%|k&kgrTv2<k?o@AS*^&38%-H#;
zL8El6Dnq1Z_M?;X7D%$9C+v}zF#@Yvj=aB>6gRu95rE?%g_`up!}xYx&MI{^d1p9X
za*Z}kJfd24nkE`FqI6$~qq|GQYq5-d{uHqbem~Pyy_v>QU^yA9h}7*QoN5G2U#|h_
z#)bAPOycY%+Q(%Ew|uD_Vl#~Vl;bP3=rm_KF}}z*5tVKd2K22`w?C1ekypbkcco(m
z)r$)^L0kq?^a=nf2Ab5koXEnCx0-?v*6WpA%={#Xn`&D~wz!o-mEOi})$`m<#6P2n
z^8PZA(2uH5>UF$-cOm%^W+z%E>DA=ES5iiYIR4^R*t_fH(R_FKMvf30b${qtl6_-;
z<g)9E))lL<(hZUG=-K4~U;S%OoMijL9!r(z3+{YYvlDPFcIA=nPt;wnd7g|@(hZx8
z?*5*_b>0>Z-*e=#7Pp4V8P<rsYh>4pi@Gu@ho-*C_#iJh_%(g0QqWmg2g^U>lj43F
zfo@Iw!%w1~=nXWvbxk}@m5$`)GhqS>Z}-J(D0ukI!7=}1QK~cIKS`4IQl!k(UU;XM
z!uuuBJUYDxp|!A)^{ZAE6ylI<!n!aPq3F;KUP<aFO*Q&e6|jc<O=o%BkYIV7{6)Yy
zERJ&j<5Q^mWL_|TzSZh5Fi7&_2s!cZwO#mzCK30>hIEX(FDp659emw!QZ;#2>uspc
z8F&v?wy5Fzyl-WdF??8b*OQrXPrVkCaenMiFUXxz`|1tr&u_311Sf#OyhslItt1g<
z*W%{+UV0gk>Fh_31q%Rw>sy##$6nHu3vck{$yR$ueY{rg9hG)0>*9qo`TiGsTP{SD
zkw0ziIO~R!LxSouvqRfMkzO3IE{@pjYMiaI$?)+6j71Il($v-Ivu7Q(|L&yxz1osq
z1<&jXb>4lm`WSEWf?{81#PjUw$&2M}r)RFOT}McBx$eDe@5HUDW*T1b<i=4?!w|hq
zo4qFp`drnxeb)+@gcn2l{3oD+lKaQnJNFsdl7?@;z<G=FS`V6N7<?-Q#gfJw!mUo<
zulP+DgHtZO;VQ?xXAa3lX3I-7r+|H>a418Pxt6{{K;>;wQ360;ZX6)a_9qrLD%rz>
zyWTB<2?`YP3kx5@ZmlLGXG1?ikSvVej;Y%u)JCsKW0dFH1W1PSlp+KzL5<=F94>pK
zmduov;6avKgJ~ChOU(8Bq|A<`V;WgvUl3pOUSO0o?gB&1az-)t6Q1JFOVMUsm?cNP
zchqoVNMk`yI9JxQJ$^M?b%}<Hxp3f_x<^lQnVpZM`kb-C#A68aHF3~xeD0#?i=#71
zJwODMcJHXY&4ww7Br;ovbFVZmIDP^LztzKEJv(-A95yvPcl`i9=IolqsE0|KqhzC7
z{n9YdSuceYpc#-j)`9#PJ#fRvJN?PNH%5zwwuyUaQJvK`cZ~*p4YHZto&(~8f5O(l
zdg}6r4`SH2y~rZLoy1M(^!J)C%1ck=>8~PiZ`^;V%FKo_0kWEOYf;8*=6lbQ!BQbv
zC><(pGw^}6hjdA+>3yj$mtB_*`N(?Y=|a+*Ph_<{))Yccm8!)wX03#CyO5&(36^ki
zU}GH@P64drR}aH?V2Wv%ajmYIS?T`U2bS%BCB=c`oSMb^Kw&J1fDaT(Uj@4gC<&m0
zF?&cZ_0y|N_q8QTx%GikkIvyEx<52%zfzX*x{Fhpe%$27AVmReyNxXVfLe^xdg6-6
zB97_1<n791y{xMGr|kaiGe4hH{Tx4ZLt71r*2cxqb#7E(%&CPPA8xEQh2Z;<p>;9r
zojkux*)<!d^yR*aEI1hg$d-C$WO-36;Zu3_mY3$E@(~|0I^Z5sOp|jdH$W=xQ%sC_
znjWs9%8eyp{u{%?Dg-l%gAc}LMZ0ws89htw_9F2+TXhmVbvK2*;q5n1#2tRuR)5g4
z&daW-!q1z{3xGvbR&Os^TvLfz?+$)5G2#2BXQ3kav$pb!A;ZNWXG*=J0&<K9UospY
zE}sd=1c!>*CvQsNb4C2DgI^SFrK7Gr<_$F&Fd3nOWC{FgDdHf+M3=sZ>V%Uj5Mu9>
z@*YeMp26z(zP;#vsF*W}qPcYTc?|GYwcOKhvlnc>fE3SkahieskfA*w4B;Bo<Jw7U
z!-tO21{rqxM_SIQJb>$53rdM`ST9{}lxoS_+HXN`M)A-hT%jyU=4N_}yW;Xz$sg>N
z0<dhbOd$^fXo~qaSnvJMW-g<A*SmbMWN^b3Ls_h)6|6pEgGOAPQpWzGgF=%Qd}?Ei
zM(m>S${GC$y=G{Cr~6`hjr3C+HG*PEy|l3yWl&m&>&$NNE*U%X>FHNsFZ#EebctKY
zowdM!G%*kZ+)nvqnu#I)F-xwW$3ggh@rR!k(2HvC#Wv+xVwt=H&`Bl$5o46E^EwSl
zx>uBg4a-tXkn9-!_S<E1{kAc-9Jbk2f5#hA-hR}eH-;BNkzA@5$dcEc%WLpA<ff<n
zpAa(gSFDvfjih{h!}rl5NM@QeMWEdrz*1NMJsm`Jsgsl?owR<cSBa6#ANI&TV7x0j
z`h>o!=c-+Z1WmH;vwq!xg9qOwq{vz{O(VGAs(ZwWXAgDAfOwLBCy#9_hQW%<mnbsz
zyg_>ae2n=kR!BjELw4%Cx6dKj9A~NO^;2hjy>B}c{H5`g4|VT@qgj<-P&;Mrd_%IR
zy(kJ{G~=<Z4wh7TzO=fO2!=YoA@DV)zmn#-H*wfMsUu2H@;t8t@r>CmwW`rB?NWF;
z5m@X?iI}&?*@~3HS7LxY7JwM7+eNa!(K5;P$QaMKbPQhqEbhGc*1@+UABf<O<zMMP
z;rQdv3XZN+%!qE*F9X}ePg8kc3CwWBKi`5Yov^WQT32@+soU89MZv|n;Ynm+AEM*k
zpD>wcmoEth55f27!DXM_(klMABx`J3uu&a`S?<sxB#SWk%8KUw9z1C9DgS^MQ1YC_
zfxHUEYA^Y9HJ`imu*SK|nc)1V-RcOjy=1F#(F1y^%0l|&Iew03sbHSFe`_DZLjR(Q
zfrE8f$q2B^^&%iguCf7)hW`a%{I>Mi#=O_2WBZG)R2)Z_&Ag038@Cup05`lb<nF2x
z-NZg)tRFjFr2)1U`eok1I6t&pw>L=C37@;@>ikv;U{N&u4mKy)eVV7(A2v5`vl!)Y
zoty;oRzeoTZ=31LuEk>#;#@qPm!?7Vg64@_W>bz1$LvnQj1G}6j$uG`&Xn&h*zAFv
zzjviGclmE4q~inRnf#^3!;shuP}XrKBc{duI0?#9WUf~CvK;wYU^i@&j+)!0q-WCU
v&#Wljg6!C_wI%#g!eR%wAK2H!t{uk~0xxOS8P<T`*<osAZdhV)>*@ah=yt$R

literal 0
HcmV?d00001

diff --git a/README.md b/README.md
index 4fc96203..e819209a 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# SSI Agent
+![banner](https://github.com/impierce/ssi-agent/raw/HEAD/.github/banner.png)
 
 [![semantic-release: angular](https://img.shields.io/badge/semantic--release-angular-e10079?logo=semantic-release)](https://github.com/semantic-release/semantic-release)
 [![GitHub License](https://img.shields.io/github/license/impierce/ssi-agent)](https://github.com/impierce/ssi-agent/blob/HEAD/LICENSE)

From f6478c2a757a723d1badb617c79534bab5842c1b Mon Sep 17 00:00:00 2001
From: Daniel Mader <daniel.mader@impierce.com>
Date: Fri, 29 May 2026 09:36:47 +0200
Subject: [PATCH 06/34] ci: check license compliance for all dependencies
 (#276)

---
 .github/workflows/check-licenses.yaml    |  28 +++
 Cargo.toml                               |   2 +
 README.md                                |   7 +-
 agent_api_http/Cargo.toml                |   1 +
 agent_application/Cargo.toml             |   1 +
 agent_authorization/Cargo.toml           |   1 +
 agent_event_publisher_http/Cargo.toml    |   1 +
 agent_event_publisher_nats/Cargo.toml    |   1 +
 agent_holder/Cargo.toml                  |   1 +
 agent_identity/Cargo.toml                |   1 +
 agent_issuance/Cargo.toml                |   1 +
 agent_library/Cargo.toml                 |   1 +
 agent_macros/Cargo.toml                  |   1 +
 agent_secret_manager/Cargo.toml          |   1 +
 agent_shared/Cargo.toml                  |   1 +
 agent_store/Cargo.toml                   |   1 +
 agent_verification/Cargo.toml            |   1 +
 deny.toml                                | 250 +++++++++++++++++++++++
 infrastructure/stores/mongodb/Cargo.toml |   1 +
 shared-kernel/Cargo.toml                 |   1 +
 20 files changed, 300 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/check-licenses.yaml
 create mode 100644 deny.toml

diff --git a/.github/workflows/check-licenses.yaml b/.github/workflows/check-licenses.yaml
new file mode 100644
index 00000000..8e938753
--- /dev/null
+++ b/.github/workflows/check-licenses.yaml
@@ -0,0 +1,28 @@
+name: Check licenses
+
+on:
+  schedule:
+    - cron: "0 4 * * 1" # run at 4 AM every Monday
+  # TODO: remove workflow_dispatch
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - main
+      - next
+      - beta
+      - alpha
+
+jobs:
+  check-licenses:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+
+      - run: cargo install cargo-deny
+
+      - run: cargo deny check licenses --hide-inclusion-graph
diff --git a/Cargo.toml b/Cargo.toml
index 0cead50f..72338fb1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -25,6 +25,8 @@ members = [
 version = "0.1.0"
 edition = "2021"
 rust-version = "1.76.0"
+license-file = "LICENSE"
+publish = false
 
 [workspace.lints.clippy]
 # Enables a large group of strict lints for idiomatic Rust. 
diff --git a/README.md b/README.md
index e819209a..66dbd71b 100644
--- a/README.md
+++ b/README.md
@@ -1,12 +1,13 @@
 ![banner](https://github.com/impierce/ssi-agent/raw/HEAD/.github/banner.png)
 
-[![semantic-release: angular](https://img.shields.io/badge/semantic--release-angular-e10079?logo=semantic-release)](https://github.com/semantic-release/semantic-release)
+[![semantic-release: angular](https://img.shields.io/badge/semantic--release-angular-e10079?logo=semantic-release)](https://github.com/angular/angular/blob/main/contributing-docs/commit-message-guidelines.md)
 [![GitHub License](https://img.shields.io/github/license/impierce/ssi-agent)](https://github.com/impierce/ssi-agent/blob/HEAD/LICENSE)
 [![Docker Pulls](https://img.shields.io/docker/pulls/impiercetechnologies/ssi-agent)](https://hub.docker.com/r/impiercetechnologies/ssi-agent)
+[![twelve-factor-app](https://img.shields.io/badge/factors-twelve-blue)](https://12factor.net)
 
-<!-- This is a playful reference to the "Twelve-Factor App" conventions that we try to follow. -->
+<!-- The "Twelve-Factor App" badge is a playful reference to the conventions we try to follow. -->
 
-[![twelve-factor-app](https://img.shields.io/badge/factors-twelve-blue)](https://12factor.net)
+![Check licenses](https://github.com/impierce/ssi-agent/actions/workflows/check-licenses.yaml/badge.svg)
 
 ---
 
diff --git a/agent_api_http/Cargo.toml b/agent_api_http/Cargo.toml
index fa54e6d4..5011efb5 100644
--- a/agent_api_http/Cargo.toml
+++ b/agent_api_http/Cargo.toml
@@ -3,6 +3,7 @@ name = "agent_api_http"
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
+publish.workspace = true
 
 [dependencies]
 agent_authorization = { path = "../agent_authorization" }
diff --git a/agent_application/Cargo.toml b/agent_application/Cargo.toml
index 78bf69bd..5d3d6f00 100644
--- a/agent_application/Cargo.toml
+++ b/agent_application/Cargo.toml
@@ -3,6 +3,7 @@ name = "agent_application"
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
+publish.workspace = true
 
 [dependencies]
 agent_api_http = { path = "../agent_api_http" }
diff --git a/agent_authorization/Cargo.toml b/agent_authorization/Cargo.toml
index 32a6e239..8d3f62be 100644
--- a/agent_authorization/Cargo.toml
+++ b/agent_authorization/Cargo.toml
@@ -3,6 +3,7 @@ name = "agent_authorization"
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
+publish.workspace = true
 
 [dependencies]
 agent_issuance = { path = "../agent_issuance" }
diff --git a/agent_event_publisher_http/Cargo.toml b/agent_event_publisher_http/Cargo.toml
index b37b2cfd..a28518cb 100644
--- a/agent_event_publisher_http/Cargo.toml
+++ b/agent_event_publisher_http/Cargo.toml
@@ -3,6 +3,7 @@ name = "agent_event_publisher_http"
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
+publish.workspace = true
 
 [dependencies]
 agent_authorization = { path = "../agent_authorization" }
diff --git a/agent_event_publisher_nats/Cargo.toml b/agent_event_publisher_nats/Cargo.toml
index 7c5d9455..9bb9b10c 100644
--- a/agent_event_publisher_nats/Cargo.toml
+++ b/agent_event_publisher_nats/Cargo.toml
@@ -3,6 +3,7 @@ name = "agent_event_publisher_nats"
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
+publish.workspace = true
 
 [dependencies]
 agent_issuance = { path = "../agent_issuance" }
diff --git a/agent_holder/Cargo.toml b/agent_holder/Cargo.toml
index b50474fd..22cf6415 100644
--- a/agent_holder/Cargo.toml
+++ b/agent_holder/Cargo.toml
@@ -3,6 +3,7 @@ name = "agent_holder"
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
+publish.workspace = true
 
 [dependencies]
 agent_shared = { path = "../agent_shared" }
diff --git a/agent_identity/Cargo.toml b/agent_identity/Cargo.toml
index 2b93fbbb..bfa8b0c0 100644
--- a/agent_identity/Cargo.toml
+++ b/agent_identity/Cargo.toml
@@ -3,6 +3,7 @@ name = "agent_identity"
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
+publish.workspace = true
 
 [dependencies]
 agent_shared = { path = "../agent_shared" }
diff --git a/agent_issuance/Cargo.toml b/agent_issuance/Cargo.toml
index ec7db3ca..d88f1d2a 100644
--- a/agent_issuance/Cargo.toml
+++ b/agent_issuance/Cargo.toml
@@ -3,6 +3,7 @@ name = "agent_issuance"
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
+publish.workspace = true
 
 [dependencies]
 agent_library = { path = "../agent_library" }
diff --git a/agent_library/Cargo.toml b/agent_library/Cargo.toml
index 62d09ea6..ca0c6e56 100644
--- a/agent_library/Cargo.toml
+++ b/agent_library/Cargo.toml
@@ -3,6 +3,7 @@ name = "agent_library"
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
+publish.workspace = true
 
 [dependencies]
 agent_shared = { path = "../agent_shared" }
diff --git a/agent_macros/Cargo.toml b/agent_macros/Cargo.toml
index 260fdea0..5c633b48 100644
--- a/agent_macros/Cargo.toml
+++ b/agent_macros/Cargo.toml
@@ -3,6 +3,7 @@ name = "agent_macros"
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
+publish.workspace = true
 
 [lib]
 proc-macro = true
diff --git a/agent_secret_manager/Cargo.toml b/agent_secret_manager/Cargo.toml
index 873aeb4c..b4949f97 100644
--- a/agent_secret_manager/Cargo.toml
+++ b/agent_secret_manager/Cargo.toml
@@ -3,6 +3,7 @@ name = "agent_secret_manager"
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
+publish.workspace = true
 
 [dependencies]
 agent_shared = { path = "../agent_shared" }
diff --git a/agent_shared/Cargo.toml b/agent_shared/Cargo.toml
index f11daee5..8860ca20 100644
--- a/agent_shared/Cargo.toml
+++ b/agent_shared/Cargo.toml
@@ -3,6 +3,7 @@ name = "agent_shared"
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
+publish.workspace = true
 
 [dependencies]
 agent_macros = { path = "../agent_macros" }
diff --git a/agent_store/Cargo.toml b/agent_store/Cargo.toml
index 8fbede00..f5fc0b90 100644
--- a/agent_store/Cargo.toml
+++ b/agent_store/Cargo.toml
@@ -3,6 +3,7 @@ name = "agent_store"
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
+publish.workspace = true
 
 [dependencies]
 agent_authorization = { path = "../agent_authorization" }
diff --git a/agent_verification/Cargo.toml b/agent_verification/Cargo.toml
index f911c074..1eeb6c36 100644
--- a/agent_verification/Cargo.toml
+++ b/agent_verification/Cargo.toml
@@ -3,6 +3,7 @@ name = "agent_verification"
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
+publish.workspace = true
 
 [dependencies]
 agent_secret_manager = { path = "../agent_secret_manager" }
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 00000000..9a8559a4
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,250 @@
+# https://github.com/EmbarkStudios/cargo-deny/blob/main/deny.template.toml
+
+# This template contains all of the possible sections and their default values
+
+# Note that all fields that take a lint level have these possible values:
+# * deny - An error will be produced and the check will fail
+# * warn - A warning will be produced, but the check will not fail
+# * allow - No warning or error will be produced, though in some cases a note
+# will be
+
+# The values provided in this template are the default values that will be used
+# when any section or field is not specified in your own configuration
+
+# Root options
+
+# The graph table configures how the dependency graph is constructed and thus
+# which crates the checks are performed against
+[graph]
+# If 1 or more target triples (and optionally, target_features) are specified,
+# only the specified targets will be checked when running `cargo deny check`.
+# This means, if a particular package is only ever used as a target specific
+# dependency, such as, for example, the `nix` crate only being used via the
+# `target_family = "unix"` configuration, that only having windows targets in
+# this list would mean the nix crate, as well as any of its exclusive
+# dependencies not shared by any other crates, would be ignored, as the target
+# list here is effectively saying which targets you are building for.
+targets = [
+    # The triple can be any string, but only the target triples built in to
+    # rustc (as of 1.40) can be checked against actual config expressions
+    #"x86_64-unknown-linux-musl",
+    # You can also specify which target_features you promise are enabled for a
+    # particular target. target_features are currently not validated against
+    # the actual valid features supported by the target architecture.
+    #{ triple = "wasm32-unknown-unknown", features = ["atomics"] },
+]
+# When creating the dependency graph used as the source of truth when checks are
+# executed, this field can be used to prune crates from the graph, removing them
+# from the view of cargo-deny. This is an extremely heavy hammer, as if a crate
+# is pruned from the graph, all of its dependencies will also be pruned unless
+# they are connected to another crate in the graph that hasn't been pruned,
+# so it should be used with care. The identifiers are [Package ID Specifications]
+# (https://doc.rust-lang.org/cargo/reference/pkgid-spec.html)
+#exclude = []
+# If true, metadata will be collected with `--all-features`. Note that this can't
+# be toggled off if true, if you want to conditionally enable `--all-features` it
+# is recommended to pass `--all-features` on the cmd line instead
+all-features = false
+# If true, metadata will be collected with `--no-default-features`. The same
+# caveat with `all-features` applies
+no-default-features = false
+# If set, these feature will be enabled when collecting metadata. If `--features`
+# is specified on the cmd line they will take precedence over this option.
+#features = []
+
+# The output table provides options for how/if diagnostics are outputted
+[output]
+# When outputting inclusion graphs in diagnostics that include features, this
+# option can be used to specify the depth at which feature edges will be added.
+# This option is included since the graphs can be quite large and the addition
+# of features from the crate(s) to all of the graph roots can be far too verbose.
+# This option can be overridden via `--feature-depth` on the cmd line
+feature-depth = 1
+
+# This section is considered when running `cargo deny check advisories`
+# More documentation for the advisories section can be found here:
+# https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html
+[advisories]
+# The path where the advisory databases are cloned/fetched into
+#db-path = "$CARGO_HOME/advisory-dbs"
+# The url(s) of the advisory databases to use
+#db-urls = ["https://github.com/rustsec/advisory-db"]
+# A list of advisory IDs to ignore. Note that ignored advisories will still
+# output a note when they are encountered.
+ignore = [
+    #"RUSTSEC-0000-0000",
+    #{ id = "RUSTSEC-0000-0000", reason = "you can specify a reason the advisory is ignored" },
+    #"a-crate-that-is-yanked@0.1.1", # you can also ignore yanked crate versions if you wish
+    #{ crate = "a-crate-that-is-yanked@0.1.1", reason = "you can specify why you are ignoring the yanked crate" },
+]
+# If this is true, then cargo deny will use the git executable to fetch advisory database.
+# If this is false, then it uses a built-in git library.
+# Setting this to true can be helpful if you have special authentication requirements that cargo-deny does not support.
+# See Git Authentication for more information about setting up git authentication.
+#git-fetch-with-cli = true
+
+# This section is considered when running `cargo deny check licenses`
+# More documentation for the licenses section can be found here:
+# https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html
+[licenses]
+# List of explicitly allowed licenses
+# See https://spdx.org/licenses/ for list of possible licenses
+# [possible values: any SPDX 3.11 short identifier (+ optional exception)].
+allow = [
+    "Apache-2.0",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "CC0-1.0",
+    "CDLA-Permissive-2.0",
+    "ISC",
+    "MIT",
+    "MIT-0",
+    "MPL-2.0",
+    "Unicode-3.0",
+    "W3C-20150513",
+    "Zlib",
+]
+# The confidence threshold for detecting a license from license text.
+# The higher the value, the more closely the license text must be to the
+# canonical license text of a valid SPDX license file.
+# [possible values: any between 0.0 and 1.0].
+confidence-threshold = 0.8
+# Allow 1 or more licenses on a per-crate basis, so that particular licenses
+# aren't accepted for every possible crate as with the normal allow list
+exceptions = [
+    # Each entry is the crate and version constraint, and its specific allow
+    # list
+    { allow = ["CC-BY-SA-3.0"], crate = "ssi-contexts" },
+]
+
+# Some crates don't have (easily) machine readable licensing information,
+# adding a clarification entry for it allows you to manually specify the
+# licensing information
+#[[licenses.clarify]]
+# The package spec the clarification applies to
+#crate = "ring"
+# The SPDX expression for the license requirements of the crate
+#expression = "MIT AND ISC AND OpenSSL"
+# One or more files in the crate's source used as the "source of truth" for
+# the license expression. If the contents match, the clarification will be used
+# when running the license check, otherwise the clarification will be ignored
+# and the crate will be checked normally, which may produce warnings or errors
+# depending on the rest of your configuration
+#license-files = [
+# Each entry is a crate relative path, and the (opaque) hash of its contents
+#{ path = "LICENSE", hash = 0xbd0eed23 }
+#]
+
+[licenses.private]
+# If true, ignores workspace crates that aren't published, or are only
+# published to private registries.
+# To see how to mark a crate as unpublished (to the official registry),
+# visit https://doc.rust-lang.org/cargo/reference/manifest.html#the-publish-field.
+ignore = true
+# One or more private registries that you might publish crates to, if a crate
+# is only published to private registries, and ignore is true, the crate will
+# not have its license(s) checked
+registries = [
+    #"https://sekretz.com/registry
+]
+
+# This section is considered when running `cargo deny check bans`.
+# More documentation about the 'bans' section can be found here:
+# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
+[bans]
+# Lint level for when multiple versions of the same crate are detected
+multiple-versions = "warn"
+# Lint level for when a crate version requirement is `*`
+wildcards = "allow"
+# The graph highlighting used when creating dotgraphs for crates
+# with multiple versions
+# * lowest-version - The path to the lowest versioned duplicate is highlighted
+# * simplest-path - The path to the version with the fewest edges is highlighted
+# * all - Both lowest-version and simplest-path are used
+highlight = "all"
+# The default lint level for `default` features for crates that are members of
+# the workspace that is being checked. This can be overridden by allowing/denying
+# `default` on a crate-by-crate basis if desired.
+workspace-default-features = "allow"
+# The default lint level for `default` features for external crates that are not
+# members of the workspace. This can be overridden by allowing/denying `default`
+# on a crate-by-crate basis if desired.
+external-default-features = "allow"
+# List of crates that are allowed. Use with care!
+allow = [
+    #"ansi_term@0.11.0",
+    #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason it is allowed" },
+]
+# If true, workspace members are automatically allowed even when using deny-by-default
+# This is useful for organizations that want to deny all external dependencies by default
+# but allow their own workspace crates without having to explicitly list them
+allow-workspace = false
+# List of crates to deny
+deny = [
+    #"ansi_term@0.11.0",
+    #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason it is banned" },
+    # Wrapper crates can optionally be specified to allow the crate when it
+    # is a direct dependency of the otherwise banned crate
+    #{ crate = "ansi_term@0.11.0", wrappers = ["this-crate-directly-depends-on-ansi_term"] },
+]
+
+# List of features to allow/deny
+# Each entry the name of a crate and a version range. If version is
+# not specified, all versions will be matched.
+#[[bans.features]]
+#crate = "reqwest"
+# Features to not allow
+#deny = ["json"]
+# Features to allow
+#allow = [
+#    "rustls",
+#    "__rustls",
+#    "__tls",
+#    "hyper-rustls",
+#    "rustls",
+#    "rustls-pemfile",
+#    "rustls-tls-webpki-roots",
+#    "tokio-rustls",
+#    "webpki-roots",
+#]
+# If true, the allowed features must exactly match the enabled feature set. If
+# this is set there is no point setting `deny`
+#exact = true
+
+# Certain crates/versions that will be skipped when doing duplicate detection.
+skip = [
+    #"ansi_term@0.11.0",
+    #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason why it can't be updated/removed" },
+]
+# Similarly to `skip` allows you to skip certain crates during duplicate
+# detection. Unlike skip, it also includes the entire tree of transitive
+# dependencies starting at the specified crate, up to a certain depth, which is
+# by default infinite.
+skip-tree = [
+    #"ansi_term@0.11.0", # will be skipped along with _all_ of its direct and transitive dependencies
+    #{ crate = "ansi_term@0.11.0", depth = 20 },
+]
+
+# This section is considered when running `cargo deny check sources`.
+# More documentation about the 'sources' section can be found here:
+# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
+[sources]
+# Lint level for what to happen when a crate from a crate registry that is not
+# in the allow list is encountered
+unknown-registry = "warn"
+# Lint level for what to happen when a crate from a git repository that is not
+# in the allow list is encountered
+unknown-git = "warn"
+# List of URLs for allowed crate registries. Defaults to the crates.io index
+# if not specified. If it is specified but empty, no registries are allowed.
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+# List of URLs for allowed Git repositories
+allow-git = []
+
+[sources.allow-org]
+# github.com organizations to allow git sources for
+github = []
+# gitlab.com organizations to allow git sources for
+gitlab = []
+# bitbucket.org organizations to allow git sources for
+bitbucket = []
diff --git a/infrastructure/stores/mongodb/Cargo.toml b/infrastructure/stores/mongodb/Cargo.toml
index 59087da6..f4d8634f 100644
--- a/infrastructure/stores/mongodb/Cargo.toml
+++ b/infrastructure/stores/mongodb/Cargo.toml
@@ -3,6 +3,7 @@ name = "mongodb"
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
+publish.workspace = true
 
 [dependencies]
 shared-kernel.workspace = true
diff --git a/shared-kernel/Cargo.toml b/shared-kernel/Cargo.toml
index 1325cdbb..50801d1b 100644
--- a/shared-kernel/Cargo.toml
+++ b/shared-kernel/Cargo.toml
@@ -3,6 +3,7 @@ name = "shared-kernel"
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
+publish.workspace = true
 
 [dependencies]
 async-trait.workspace = true

From 8b59b515247c3778630c5bd8b3ac1e670e44eece Mon Sep 17 00:00:00 2001
From: Daniel Mader <daniel.mader@impierce.com>
Date: Fri, 29 May 2026 09:46:18 +0200
Subject: [PATCH 07/34] feat: configure multiple HTTP event publishers (#349)

---
 .../issuance/credential_issuer/credential.rs  |  21 +-
 .../v0/verification/relying_party/redirect.rs |  27 +-
 agent_application/example.config.yaml         |  14 +-
 agent_application/src/lib.rs                  |  43 +-
 agent_event_publisher_http/README.md          |  20 +-
 agent_event_publisher_http/src/lib.rs         | 559 +++++++++---------
 agent_shared/src/config/mod.rs                |  30 +-
 agent_shared/tests/test.config.yaml           |  14 +-
 8 files changed, 396 insertions(+), 332 deletions(-)

diff --git a/agent_api_http/src/v0/issuance/credential_issuer/credential.rs b/agent_api_http/src/v0/issuance/credential_issuer/credential.rs
index 9c1e3ac1..9e806828 100644
--- a/agent_api_http/src/v0/issuance/credential_issuer/credential.rs
+++ b/agent_api_http/src/v0/issuance/credential_issuer/credential.rs
@@ -406,16 +406,23 @@ pub mod tests {
 
             let target_url = format!("{}/ssi-events-subscriber", &external_server.uri());
 
-            set_config().enable_event_publisher_http();
-            set_config().set_event_publisher_http_target_url(target_url.clone());
-            set_config().set_event_publisher_http_target_events(Events {
-                offer: vec![agent_shared::config::OfferEvent::CredentialRequestVerified],
-                ..Default::default()
-            });
+            set_config().enable_event_publisher_http(0);
+            set_config().set_event_publisher_http_target_url(0, target_url.clone());
+            set_config().set_event_publisher_http_target_events(
+                0,
+                Events {
+                    offer: vec![agent_shared::config::OfferEvent::CredentialRequestVerified],
+                    ..Default::default()
+                },
+            );
 
             (
                 Some(external_server),
-                vec![Box::new(EventPublisherHttp::load().unwrap()) as Box<dyn EventPublisher>],
+                EventPublisherHttp::load()
+                    .unwrap()
+                    .into_iter()
+                    .map(|p| Box::new(p) as Box<dyn EventPublisher>)
+                    .collect(),
             )
         } else {
             (None, Default::default())
diff --git a/agent_api_http/src/v0/verification/relying_party/redirect.rs b/agent_api_http/src/v0/verification/relying_party/redirect.rs
index 846e2191..fddedc7f 100644
--- a/agent_api_http/src/v0/verification/relying_party/redirect.rs
+++ b/agent_api_http/src/v0/verification/relying_party/redirect.rs
@@ -140,16 +140,23 @@ pub mod tests {
 
         let target_url = format!("{}/ssi-events-subscriber", &mock_server.uri());
 
-        set_config().enable_event_publisher_http();
-        set_config().set_event_publisher_http_target_url(target_url.clone());
-        set_config().set_event_publisher_http_target_events(Events {
-            authorization_request: vec![
-                agent_shared::config::AuthorizationRequestEvent::SIOPv2AuthorizationResponseVerified,
-            ],
-            ..Default::default()
-        });
-
-        let event_publishers = vec![Box::new(EventPublisherHttp::load().unwrap()) as Box<dyn EventPublisher>];
+        set_config().enable_event_publisher_http(0);
+        set_config().set_event_publisher_http_target_url(0, target_url.clone());
+        set_config().set_event_publisher_http_target_events(
+            0,
+            Events {
+                authorization_request: vec![
+                    agent_shared::config::AuthorizationRequestEvent::SIOPv2AuthorizationResponseVerified,
+                ],
+                ..Default::default()
+            },
+        );
+
+        let event_publishers: Vec<Box<dyn EventPublisher>> = EventPublisherHttp::load()
+            .unwrap()
+            .into_iter()
+            .map(|p| Box::new(p) as Box<dyn EventPublisher>)
+            .collect();
 
         let verification_state =
             Arc::new(verification_state(&InMemory, VerificationServices::default().await, event_publishers).await);
diff --git a/agent_application/example.config.yaml b/agent_application/example.config.yaml
index 7ab2c965..73eeb923 100644
--- a/agent_application/example.config.yaml
+++ b/agent_application/example.config.yaml
@@ -29,13 +29,13 @@ signing_algorithms_supported:
 # aggregate. The events will be dispatched to the `https://my-domain.example.org/event-subscriber` endpoint.
 event_publishers:
   http:
-    enabled: false
-    target_url: "https://my-domain.example.org/event-subscriber"
-    headers:
-      Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l
-    events:
-      server_config: []
-      credential: [UnsignedCredentialCreated, CredentialSigned]
+    - enabled: false
+      target_url: "https://my-domain.example.org/event-subscriber"
+      headers:
+        Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l
+      events:
+        server_config: []
+        credential: [UnsignedCredentialCreated, CredentialSigned]
   nats:
     enabled: true
     nats_url: "nats://localhost:4222"
diff --git a/agent_application/src/lib.rs b/agent_application/src/lib.rs
index 5ffda050..6946dba5 100644
--- a/agent_application/src/lib.rs
+++ b/agent_application/src/lib.rs
@@ -40,17 +40,38 @@ pub async fn state() -> io::Result<ApplicationState> {
     // TODO: Currently all these `*_event_publishers` are exactly the same, which is weird. We need some sort of layer
     // between `agent_application` and `agent_store` that will provide a cleaner way of initializing the event
     // publishers and sending them over to `agent_store`.
-    let identity_event_publishers: Vec<Box<dyn EventPublisher>> = vec![Box::new(EventPublisherHttp::load().unwrap())];
-    let issuance_event_publishers: Vec<Box<dyn EventPublisher>> = vec![
-        Box::new(EventPublisherHttp::load().unwrap()),
-        Box::new(EventPublisherNats::load().await.unwrap()),
-    ];
-    let library_event_publishers: Vec<Box<dyn EventPublisher>> = vec![Box::new(EventPublisherHttp::load().unwrap())];
-    let authorization_event_publishers: Vec<Box<dyn EventPublisher>> =
-        vec![Box::new(EventPublisherHttp::load().unwrap())];
-    let holder_event_publishers: Vec<Box<dyn EventPublisher>> = vec![Box::new(EventPublisherHttp::load().unwrap())];
-    let verification_event_publishers: Vec<Box<dyn EventPublisher>> =
-        vec![Box::new(EventPublisherHttp::load().unwrap())];
+    let identity_event_publishers: Vec<Box<dyn EventPublisher>> = EventPublisherHttp::load()
+        .unwrap()
+        .into_iter()
+        .map(|p| Box::new(p) as Box<dyn EventPublisher>)
+        .collect();
+    // Issuance events are also published to NATS.
+    let mut issuance_event_publishers: Vec<Box<dyn EventPublisher>> = EventPublisherHttp::load()
+        .unwrap()
+        .into_iter()
+        .map(|p| Box::new(p) as Box<dyn EventPublisher>)
+        .collect();
+    issuance_event_publishers.push(Box::new(EventPublisherNats::load().await.unwrap()));
+    let library_event_publishers: Vec<Box<dyn EventPublisher>> = EventPublisherHttp::load()
+        .unwrap()
+        .into_iter()
+        .map(|p| Box::new(p) as Box<dyn EventPublisher>)
+        .collect();
+    let authorization_event_publishers: Vec<Box<dyn EventPublisher>> = EventPublisherHttp::load()
+        .unwrap()
+        .into_iter()
+        .map(|p| Box::new(p) as Box<dyn EventPublisher>)
+        .collect();
+    let holder_event_publishers: Vec<Box<dyn EventPublisher>> = EventPublisherHttp::load()
+        .unwrap()
+        .into_iter()
+        .map(|p| Box::new(p) as Box<dyn EventPublisher>)
+        .collect();
+    let verification_event_publishers: Vec<Box<dyn EventPublisher>> = EventPublisherHttp::load()
+        .unwrap()
+        .into_iter()
+        .map(|p| Box::new(p) as Box<dyn EventPublisher>)
+        .collect();
 
     let event_store_type = config().event_store.type_.clone();
 
diff --git a/agent_event_publisher_http/README.md b/agent_event_publisher_http/README.md
index c0031871..aabd8954 100644
--- a/agent_event_publisher_http/README.md
+++ b/agent_event_publisher_http/README.md
@@ -2,7 +2,7 @@
 
 A simple HTTP event publisher for the SSI Agent.
 
-To make use of this publisher you need to configure it by adding the `http` object to your configuration file.
+To make use of this publisher you need to configure it by adding one or more entries to the `http` array in your configuration file.
 
 - The `target_url` is the URL to which the events will be published.
 - The `target_events` is a list of events that will be published to the `target_url`.
@@ -12,13 +12,17 @@ Example:
 ```yaml
 event_publishers:
   http:
-    enabled: false
-    target_url: "https://my-domain.example.org/event-subscriber"
-    headers:
-      authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l
-    events:
-      server_config: []
-      credential: [UnsignedCredentialCreated, CredentialSigned]
+    - enabled: true
+      target_url: "https://my-domain.example.org/event-subscriber"
+      headers:
+        authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l
+      events:
+        server_config: []
+        credential: [UnsignedCredentialCreated, CredentialSigned]
+    - enabled: false
+      target_url: "https://another-endpoint.example.org/events"
+      events:
+        offer: [CredentialOfferCreated]
 ```
 
 ### Request format
diff --git a/agent_event_publisher_http/src/lib.rs b/agent_event_publisher_http/src/lib.rs
index 0eb1604d..519be84d 100644
--- a/agent_event_publisher_http/src/lib.rs
+++ b/agent_event_publisher_http/src/lib.rs
@@ -63,273 +63,275 @@ pub struct EventPublisherHttp {
 }
 
 impl EventPublisherHttp {
-    pub fn load() -> anyhow::Result<Self> {
-        let event_publisher_http = config().event_publishers.http.clone().unwrap_or_default();
+    pub fn load() -> anyhow::Result<Vec<Self>> {
+        config()
+            .event_publishers
+            .http
+            .iter()
+            .filter(|c| c.enabled)
+            .map(|event_publisher_http| {
+                let access_token = (!event_publisher_http.events.access_token.is_empty()).then(|| {
+                    AggregateEventPublisherHttp::<AccessToken>::new(
+                        event_publisher_http.target_url.clone(),
+                        event_publisher_http.headers.clone(),
+                        event_publisher_http
+                            .events
+                            .access_token
+                            .iter()
+                            .map(ToString::to_string)
+                            .collect(),
+                    )
+                });
 
-        // If it's not enabled, return an empty event publisher.
-        if !event_publisher_http.enabled {
-            return Ok(EventPublisherHttp::default());
-        }
+                let authorization_code = (!event_publisher_http.events.authorization_code.is_empty()).then(|| {
+                    AggregateEventPublisherHttp::<AuthorizationCode>::new(
+                        event_publisher_http.target_url.clone(),
+                        event_publisher_http.headers.clone(),
+                        event_publisher_http
+                            .events
+                            .authorization_code
+                            .iter()
+                            .map(ToString::to_string)
+                            .collect(),
+                    )
+                });
 
-        let access_token = (!event_publisher_http.events.access_token.is_empty()).then(|| {
-            AggregateEventPublisherHttp::<AccessToken>::new(
-                event_publisher_http.target_url.clone(),
-                event_publisher_http.headers.clone(),
-                event_publisher_http
-                    .events
-                    .access_token
-                    .iter()
-                    .map(ToString::to_string)
-                    .collect(),
-            )
-        });
-
-        let authorization_code = (!event_publisher_http.events.authorization_code.is_empty()).then(|| {
-            AggregateEventPublisherHttp::<AuthorizationCode>::new(
-                event_publisher_http.target_url.clone(),
-                event_publisher_http.headers.clone(),
-                event_publisher_http
-                    .events
-                    .authorization_code
-                    .iter()
-                    .map(ToString::to_string)
-                    .collect(),
-            )
-        });
-
-        let client = (!event_publisher_http.events.client.is_empty()).then(|| {
-            AggregateEventPublisherHttp::<Client>::new(
-                event_publisher_http.target_url.clone(),
-                event_publisher_http.headers.clone(),
-                event_publisher_http
-                    .events
-                    .client
-                    .iter()
-                    .map(ToString::to_string)
-                    .collect(),
-            )
-        });
-
-        let oauth2_authorization_request =
-            (!event_publisher_http.events.oauth2_authorization_request.is_empty()).then(|| {
-                AggregateEventPublisherHttp::<OAuth2AuthorizationRequest>::new(
-                    event_publisher_http.target_url.clone(),
-                    event_publisher_http.headers.clone(),
-                    event_publisher_http
-                        .events
-                        .oauth2_authorization_request
-                        .iter()
-                        .map(ToString::to_string)
-                        .collect(),
-                )
-            });
-
-        let connection = (!event_publisher_http.events.connection.is_empty()).then(|| {
-            AggregateEventPublisherHttp::<Connection>::new(
-                event_publisher_http.target_url.clone(),
-                event_publisher_http.headers.clone(),
-                event_publisher_http
-                    .events
-                    .connection
-                    .iter()
-                    .map(ToString::to_string)
-                    .collect(),
-            )
-        });
-
-        let document = (!event_publisher_http.events.document.is_empty()).then(|| {
-            AggregateEventPublisherHttp::<Document>::new(
-                event_publisher_http.target_url.clone(),
-                event_publisher_http.headers.clone(),
-                event_publisher_http
-                    .events
-                    .document
-                    .iter()
-                    .map(ToString::to_string)
-                    .collect(),
-            )
-        });
-
-        let profile = (!event_publisher_http.events.profile.is_empty()).then(|| {
-            AggregateEventPublisherHttp::<Profile>::new(
-                event_publisher_http.target_url.clone(),
-                event_publisher_http.headers.clone(),
-                event_publisher_http
-                    .events
-                    .profile
-                    .iter()
-                    .map(ToString::to_string)
-                    .collect(),
-            )
-        });
-
-        let service = (!event_publisher_http.events.service.is_empty()).then(|| {
-            AggregateEventPublisherHttp::<Service>::new(
-                event_publisher_http.target_url.clone(),
-                event_publisher_http.headers.clone(),
-                event_publisher_http
-                    .events
-                    .service
-                    .iter()
-                    .map(ToString::to_string)
-                    .collect(),
-            )
-        });
-
-        let template = (!event_publisher_http.events.template.is_empty()).then(|| {
-            AggregateEventPublisherHttp::<Template>::new(
-                event_publisher_http.target_url.clone(),
-                event_publisher_http.headers.clone(),
-                event_publisher_http
-                    .events
-                    .template
-                    .iter()
-                    .map(ToString::to_string)
-                    .collect(),
-            )
-        });
-
-        let server_config = (!event_publisher_http.events.server_config.is_empty()).then(|| {
-            AggregateEventPublisherHttp::<ServerConfig>::new(
-                event_publisher_http.target_url.clone(),
-                event_publisher_http.headers.clone(),
-                event_publisher_http
-                    .events
-                    .server_config
-                    .iter()
-                    .map(ToString::to_string)
-                    .collect(),
-            )
-        });
-
-        let credential = (!event_publisher_http.events.credential.is_empty()).then(|| {
-            AggregateEventPublisherHttp::<Credential>::new(
-                event_publisher_http.target_url.clone(),
-                event_publisher_http.headers.clone(),
-                event_publisher_http
-                    .events
-                    .credential
-                    .iter()
-                    .map(ToString::to_string)
-                    .collect(),
-            )
-        });
-
-        let offer = (!event_publisher_http.events.offer.is_empty()).then(|| {
-            AggregateEventPublisherHttp::<Offer>::new(
-                event_publisher_http.target_url.clone(),
-                event_publisher_http.headers.clone(),
-                event_publisher_http
-                    .events
-                    .offer
-                    .iter()
-                    .map(ToString::to_string)
-                    .collect(),
-            )
-        });
-
-        let nonce = (!event_publisher_http.events.nonce.is_empty()).then(|| {
-            AggregateEventPublisherHttp::<Nonce>::new(
-                event_publisher_http.target_url.clone(),
-                event_publisher_http.headers.clone(),
-                event_publisher_http
-                    .events
-                    .nonce
-                    .iter()
-                    .map(ToString::to_string)
-                    .collect(),
-            )
-        });
-
-        let status_list = (!event_publisher_http.events.status_list.is_empty()).then(|| {
-            AggregateEventPublisherHttp::<StatusListAggregate>::new(
-                event_publisher_http.target_url.clone(),
-                event_publisher_http.headers.clone(),
-                event_publisher_http
-                    .events
-                    .status_list
-                    .iter()
-                    .map(ToString::to_string)
-                    .collect(),
-            )
-        });
-
-        let holder_credential = (!event_publisher_http.events.holder_credential.is_empty()).then(|| {
-            AggregateEventPublisherHttp::<agent_holder::credential::aggregate::Credential>::new(
-                event_publisher_http.target_url.clone(),
-                event_publisher_http.headers.clone(),
-                event_publisher_http
-                    .events
-                    .holder_credential
-                    .iter()
-                    .map(ToString::to_string)
-                    .collect(),
-            )
-        });
-
-        let presentation = (!event_publisher_http.events.presentation.is_empty()).then(|| {
-            AggregateEventPublisherHttp::<Presentation>::new(
-                event_publisher_http.target_url.clone(),
-                event_publisher_http.headers.clone(),
-                event_publisher_http
-                    .events
-                    .presentation
-                    .iter()
-                    .map(ToString::to_string)
-                    .collect(),
-            )
-        });
-
-        let received_offer = (!event_publisher_http.events.received_offer.is_empty()).then(|| {
-            AggregateEventPublisherHttp::<agent_holder::offer::aggregate::Offer>::new(
-                event_publisher_http.target_url.clone(),
-                event_publisher_http.headers.clone(),
-                event_publisher_http
-                    .events
-                    .received_offer
-                    .iter()
-                    .map(ToString::to_string)
-                    .collect(),
-            )
-        });
-
-        let authorization_request = (!event_publisher_http.events.authorization_request.is_empty()).then(|| {
-            AggregateEventPublisherHttp::<AuthorizationRequest>::new(
-                event_publisher_http.target_url.clone(),
-                event_publisher_http.headers.clone(),
-                event_publisher_http
-                    .events
-                    .authorization_request
-                    .iter()
-                    .map(ToString::to_string)
-                    .collect(),
-            )
-        });
-
-        let event_publisher: EventPublisherHttp = EventPublisherHttp {
-            access_token,
-            authorization_code,
-            client,
-            oauth2_authorization_request,
-            connection,
-            document,
-            profile,
-            service,
-            template,
-            server_config,
-            credential,
-            offer,
-            nonce,
-            status_list,
-            holder_credential,
-            presentation,
-            received_offer,
-            authorization_request,
-        };
+                let client = (!event_publisher_http.events.client.is_empty()).then(|| {
+                    AggregateEventPublisherHttp::<Client>::new(
+                        event_publisher_http.target_url.clone(),
+                        event_publisher_http.headers.clone(),
+                        event_publisher_http
+                            .events
+                            .client
+                            .iter()
+                            .map(ToString::to_string)
+                            .collect(),
+                    )
+                });
+
+                let oauth2_authorization_request =
+                    (!event_publisher_http.events.oauth2_authorization_request.is_empty()).then(|| {
+                        AggregateEventPublisherHttp::<OAuth2AuthorizationRequest>::new(
+                            event_publisher_http.target_url.clone(),
+                            event_publisher_http.headers.clone(),
+                            event_publisher_http
+                                .events
+                                .oauth2_authorization_request
+                                .iter()
+                                .map(ToString::to_string)
+                                .collect(),
+                        )
+                    });
+
+                let connection = (!event_publisher_http.events.connection.is_empty()).then(|| {
+                    AggregateEventPublisherHttp::<Connection>::new(
+                        event_publisher_http.target_url.clone(),
+                        event_publisher_http.headers.clone(),
+                        event_publisher_http
+                            .events
+                            .connection
+                            .iter()
+                            .map(ToString::to_string)
+                            .collect(),
+                    )
+                });
+
+                let document = (!event_publisher_http.events.document.is_empty()).then(|| {
+                    AggregateEventPublisherHttp::<Document>::new(
+                        event_publisher_http.target_url.clone(),
+                        event_publisher_http.headers.clone(),
+                        event_publisher_http
+                            .events
+                            .document
+                            .iter()
+                            .map(ToString::to_string)
+                            .collect(),
+                    )
+                });
 
-        info!("Loaded HTTP event publisher: {:?}", event_publisher);
+                let profile = (!event_publisher_http.events.profile.is_empty()).then(|| {
+                    AggregateEventPublisherHttp::<Profile>::new(
+                        event_publisher_http.target_url.clone(),
+                        event_publisher_http.headers.clone(),
+                        event_publisher_http
+                            .events
+                            .profile
+                            .iter()
+                            .map(ToString::to_string)
+                            .collect(),
+                    )
+                });
+
+                let service = (!event_publisher_http.events.service.is_empty()).then(|| {
+                    AggregateEventPublisherHttp::<Service>::new(
+                        event_publisher_http.target_url.clone(),
+                        event_publisher_http.headers.clone(),
+                        event_publisher_http
+                            .events
+                            .service
+                            .iter()
+                            .map(ToString::to_string)
+                            .collect(),
+                    )
+                });
+
+                let template = (!event_publisher_http.events.template.is_empty()).then(|| {
+                    AggregateEventPublisherHttp::<Template>::new(
+                        event_publisher_http.target_url.clone(),
+                        event_publisher_http.headers.clone(),
+                        event_publisher_http
+                            .events
+                            .template
+                            .iter()
+                            .map(ToString::to_string)
+                            .collect(),
+                    )
+                });
+
+                let server_config = (!event_publisher_http.events.server_config.is_empty()).then(|| {
+                    AggregateEventPublisherHttp::<ServerConfig>::new(
+                        event_publisher_http.target_url.clone(),
+                        event_publisher_http.headers.clone(),
+                        event_publisher_http
+                            .events
+                            .server_config
+                            .iter()
+                            .map(ToString::to_string)
+                            .collect(),
+                    )
+                });
+
+                let credential = (!event_publisher_http.events.credential.is_empty()).then(|| {
+                    AggregateEventPublisherHttp::<Credential>::new(
+                        event_publisher_http.target_url.clone(),
+                        event_publisher_http.headers.clone(),
+                        event_publisher_http
+                            .events
+                            .credential
+                            .iter()
+                            .map(ToString::to_string)
+                            .collect(),
+                    )
+                });
 
-        Ok(event_publisher)
+                let offer = (!event_publisher_http.events.offer.is_empty()).then(|| {
+                    AggregateEventPublisherHttp::<Offer>::new(
+                        event_publisher_http.target_url.clone(),
+                        event_publisher_http.headers.clone(),
+                        event_publisher_http
+                            .events
+                            .offer
+                            .iter()
+                            .map(ToString::to_string)
+                            .collect(),
+                    )
+                });
+
+                let nonce = (!event_publisher_http.events.nonce.is_empty()).then(|| {
+                    AggregateEventPublisherHttp::<Nonce>::new(
+                        event_publisher_http.target_url.clone(),
+                        event_publisher_http.headers.clone(),
+                        event_publisher_http
+                            .events
+                            .nonce
+                            .iter()
+                            .map(ToString::to_string)
+                            .collect(),
+                    )
+                });
+
+                let status_list = (!event_publisher_http.events.status_list.is_empty()).then(|| {
+                    AggregateEventPublisherHttp::<StatusListAggregate>::new(
+                        event_publisher_http.target_url.clone(),
+                        event_publisher_http.headers.clone(),
+                        event_publisher_http
+                            .events
+                            .status_list
+                            .iter()
+                            .map(ToString::to_string)
+                            .collect(),
+                    )
+                });
+
+                let holder_credential = (!event_publisher_http.events.holder_credential.is_empty()).then(|| {
+                    AggregateEventPublisherHttp::<agent_holder::credential::aggregate::Credential>::new(
+                        event_publisher_http.target_url.clone(),
+                        event_publisher_http.headers.clone(),
+                        event_publisher_http
+                            .events
+                            .holder_credential
+                            .iter()
+                            .map(ToString::to_string)
+                            .collect(),
+                    )
+                });
+
+                let presentation = (!event_publisher_http.events.presentation.is_empty()).then(|| {
+                    AggregateEventPublisherHttp::<Presentation>::new(
+                        event_publisher_http.target_url.clone(),
+                        event_publisher_http.headers.clone(),
+                        event_publisher_http
+                            .events
+                            .presentation
+                            .iter()
+                            .map(ToString::to_string)
+                            .collect(),
+                    )
+                });
+
+                let received_offer = (!event_publisher_http.events.received_offer.is_empty()).then(|| {
+                    AggregateEventPublisherHttp::<agent_holder::offer::aggregate::Offer>::new(
+                        event_publisher_http.target_url.clone(),
+                        event_publisher_http.headers.clone(),
+                        event_publisher_http
+                            .events
+                            .received_offer
+                            .iter()
+                            .map(ToString::to_string)
+                            .collect(),
+                    )
+                });
+
+                let authorization_request =
+                    (!event_publisher_http.events.authorization_request.is_empty()).then(|| {
+                        AggregateEventPublisherHttp::<AuthorizationRequest>::new(
+                            event_publisher_http.target_url.clone(),
+                            event_publisher_http.headers.clone(),
+                            event_publisher_http
+                                .events
+                                .authorization_request
+                                .iter()
+                                .map(ToString::to_string)
+                                .collect(),
+                        )
+                    });
+
+                let event_publisher = EventPublisherHttp {
+                    access_token,
+                    authorization_code,
+                    client,
+                    oauth2_authorization_request,
+                    connection,
+                    document,
+                    profile,
+                    service,
+                    template,
+                    server_config,
+                    credential,
+                    offer,
+                    nonce,
+                    status_list,
+                    holder_credential,
+                    presentation,
+                    received_offer,
+                    authorization_request,
+                };
+
+                info!("Loaded HTTP event publisher: {:?}", event_publisher);
+
+                Ok(event_publisher)
+            })
+            .collect()
     }
 }
 
@@ -442,7 +444,7 @@ impl EventPublisher for EventPublisherHttp {
 
 /// An event publisher for a specific aggregate that dispatches events to an HTTP endpoint.
 #[skip_serializing_none]
-#[derive(Debug, Deserialize)]
+#[derive(Deserialize)]
 pub struct AggregateEventPublisherHttp<A>
 where
     A: Aggregate,
@@ -457,6 +459,16 @@ where
     _marker: std::marker::PhantomData<A>,
 }
 
+impl<A: Aggregate> std::fmt::Debug for AggregateEventPublisherHttp<A> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("AggregateEventPublisherHttp")
+            .field("target_url", &self.target_url)
+            .field("headers", &self.headers.as_ref().map(|_| "<REDACTED>"))
+            .field("target_events", &self.target_events)
+            .finish()
+    }
+}
+
 impl<A> AggregateEventPublisherHttp<A>
 where
     A: Aggregate,
@@ -532,14 +544,17 @@ mod tests {
         let target_url = format!("{}/ssi-events-subscriber", &mock_server.uri());
 
         // Set the test configuration.
-        set_config().enable_event_publisher_http();
-        set_config().set_event_publisher_http_target_url(target_url.clone());
-        set_config().set_event_publisher_http_target_events(Events {
-            offer: vec![agent_shared::config::OfferEvent::FormUrlEncodedCredentialOfferCreated],
-            ..Default::default()
-        });
-
-        let publisher = EventPublisherHttp::load().unwrap();
+        set_config().enable_event_publisher_http(0);
+        set_config().set_event_publisher_http_target_url(0, target_url.clone());
+        set_config().set_event_publisher_http_target_events(
+            0,
+            Events {
+                offer: vec![agent_shared::config::OfferEvent::FormUrlEncodedCredentialOfferCreated],
+                ..Default::default()
+            },
+        );
+
+        let publisher = EventPublisherHttp::load().unwrap().into_iter().next().unwrap();
 
         // A new event for the `Offer` aggregate.
         let offer_event = OfferEvent::FormUrlEncodedCredentialOfferCreated {
diff --git a/agent_shared/src/config/mod.rs b/agent_shared/src/config/mod.rs
index d64cf2ea..f516acac 100644
--- a/agent_shared/src/config/mod.rs
+++ b/agent_shared/src/config/mod.rs
@@ -421,22 +421,31 @@ impl ApplicationConfiguration {
     }
 
     // TODO: make generic: set_enabled(enabled: bool)
-    pub fn enable_event_publisher_http(&mut self) {
-        if let Some(http) = &mut self.event_publishers.http {
-            http.enabled = true;
+    pub fn enable_event_publisher_http(&mut self, index: usize) {
+        if self.event_publishers.http.len() <= index {
+            self.event_publishers
+                .http
+                .resize(index + 1, EventPublisherHttp::default());
         }
+        self.event_publishers.http[index].enabled = true;
     }
 
-    pub fn set_event_publisher_http_target_url(&mut self, target_url: String) {
-        if let Some(http) = &mut self.event_publishers.http {
-            http.target_url = target_url;
+    pub fn set_event_publisher_http_target_url(&mut self, index: usize, target_url: String) {
+        if self.event_publishers.http.len() <= index {
+            self.event_publishers
+                .http
+                .resize(index + 1, EventPublisherHttp::default());
         }
+        self.event_publishers.http[index].target_url = target_url;
     }
 
-    pub fn set_event_publisher_http_target_events(&mut self, events: Events) {
-        if let Some(http) = &mut self.event_publishers.http {
-            http.events = events;
+    pub fn set_event_publisher_http_target_events(&mut self, index: usize, events: Events) {
+        if self.event_publishers.http.len() <= index {
+            self.event_publishers
+                .http
+                .resize(index + 1, EventPublisherHttp::default());
         }
+        self.event_publishers.http[index].events = events;
     }
 
     pub fn set_secret_manager_config(&mut self, config: SecretManagerConfig) {
@@ -578,7 +587,8 @@ pub struct Display {
 #[skip_serializing_none]
 #[derive(Debug, Deserialize, Clone, Serialize, Default)]
 pub struct EventPublishers {
-    pub http: Option<EventPublisherHttp>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub http: Vec<EventPublisherHttp>,
     pub nats: Option<EventPublisherNats>,
 }
 
diff --git a/agent_shared/tests/test.config.yaml b/agent_shared/tests/test.config.yaml
index 5080d2e2..b0a58869 100644
--- a/agent_shared/tests/test.config.yaml
+++ b/agent_shared/tests/test.config.yaml
@@ -35,13 +35,13 @@ signing_algorithms_supported:
 
 event_publishers:
   http:
-    enabled: true
-    target_url: https://service.example.test:8291/events
-    headers:
-      Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l
-    events:
-      credential: [UnsignedCredentialCreated, CredentialSigned]
-      server_config: []
+    - enabled: true
+      target_url: https://service.example.test:8291/events
+      headers:
+        Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l
+      events:
+        credential: [UnsignedCredentialCreated, CredentialSigned]
+        server_config: []
 
 display:
   - name: UniCore

From 6e94770a481d9ad64757b1c8f2b96b4d68abc2c1 Mon Sep 17 00:00:00 2001
From: Daniel Mader <daniel.mader@impierce.com>
Date: Fri, 29 May 2026 14:41:12 +0200
Subject: [PATCH 08/34] ci: ignore non-exploitable security advisories (#350)

---
 .cargo/audit.toml |   64 +
 .gitignore        |    3 +-
 Cargo.lock        | 3079 +++++++++++++++++++++++++--------------------
 README.md         |    7 +-
 4 files changed, 1800 insertions(+), 1353 deletions(-)
 create mode 100644 .cargo/audit.toml

diff --git a/.cargo/audit.toml b/.cargo/audit.toml
new file mode 100644
index 00000000..f506975d
--- /dev/null
+++ b/.cargo/audit.toml
@@ -0,0 +1,64 @@
+[advisories]
+ignore = [
+    # RUSTSEC-2022-0093: ed25519-dalek v1.0.1 — Double Public Key Signing Oracle Attack
+    # The attack requires an adversary to call the signing function as an oracle with
+    # arbitrary, decoupled private/public keypair inputs. The ssi-agent does not expose
+    # signing as an oracle; it only uses internally managed keypairs. The vulnerable API
+    # is not reachable from outside the process.
+    # TODO: revisit when did-key is updated to use ed25519-dalek >=2.0.
+    "RUSTSEC-2022-0093",
+
+    # RUSTSEC-2023-0071: rsa (v0.6.1, v0.8.2, v0.9.10) — Marvin Attack (RSA timing side-channel)
+    # No upstream patch is available. All three versions are transitive dependencies:
+    #   - rsa@0.6.1 via ssi-jwk (pinned git dep): used for RSA JWK signing/verification only,
+    #     not for PKCS#1 v1.5 decryption, which is the primary Marvin Attack vector.
+    #   - rsa@0.8.2 via fastcrypto → IOTA identity SDK: deep internal SDK dependency.
+    #   - rsa@0.9.10: no dependents in the normal runtime dependency graph (dev/build only).
+    # TODO: revisit when a patched version of the rsa crate is published and adopted upstream.
+    "RUSTSEC-2023-0071",
+
+    # RUSTSEC-2024-0344: curve25519-dalek v3.2.0 — Timing variability in Scalar subtraction
+    # Patched in curve25519-dalek >=4.1.3. Version 3.2.0 is a transitive dependency of
+    # did-key@0.2.1, which is pinned to a specific git revision of an external crate.
+    # There is no upgrade path without updating the upstream did-key crate.
+    # TODO: revisit when did-key is updated or replaced.
+    "RUSTSEC-2024-0344",
+
+    # RUSTSEC-2026-0002: lru v0.12.5 — IterMut unsoundness (Stacked Borrows violation)
+    # The soundness issue is in the lru crate's IterMut iterator, which is used inside
+    # iota-package-resolver (a deep internal of the IOTA SDK). This code path is not
+    # reachable through any ssi-agent public API or normal operation of the identity module.
+    # TODO: revisit when the IOTA SDK updates its lru dependency to a patched version.
+    "RUSTSEC-2026-0002",
+
+    # RUSTSEC-2026-0049: rustls-webpki v0.102.8 — CRL distribution point matching bug
+    # Only relevant when CRL revocation checking is enabled. The async-nats NATS event
+    # publisher (the sole consumer of this webpki version) does not configure TLS with CRL
+    # revocation checking, so this code path is never reached.
+    "RUSTSEC-2026-0049",
+
+    # RUSTSEC-2026-0097: rand v0.7.3 — Unsound when a custom logger calls rand::rng()
+    # Triggers aliased mutable references during ThreadRng reseeding only when all of these
+    # hold simultaneously: log+thread_rng features enabled, a custom logger defined that
+    # calls rand::rng(), and reseeding occurs during the log call. The ssi-agent uses the
+    # tracing crate with no custom logger that touches rand, so this condition is never met.
+    "RUSTSEC-2026-0097",
+
+    # RUSTSEC-2026-0098: rustls-webpki — URI name constraints incorrectly accepted
+    # Exploitable only after successful certificate signature verification AND requires a
+    # compromised or malicious certificate authority to misuse URI name constraints.
+    # The ssi-agent does not use URI SAN name constraints anywhere in its TLS configuration.
+    "RUSTSEC-2026-0098",
+
+    # RUSTSEC-2026-0099: rustls-webpki — Wildcard DNS name constraints incorrectly accepted
+    # Same preconditions as RUSTSEC-2026-0098: requires CA misissuance of a certificate
+    # that would otherwise pass signature verification. Not exploitable without a
+    # compromised trusted certificate authority.
+    "RUSTSEC-2026-0099",
+
+    # RUSTSEC-2026-0104: rustls-webpki — Reachable panic in CRL parsing (DoS)
+    # Only triggered when parsing certificate revocation lists. Neither reqwest (v0.11,
+    # via did-web/hyper-rustls) nor async-nats enable CRL checking in their TLS
+    # configurations, so CRL parsing code is never reached in this application.
+    "RUSTSEC-2026-0104",
+]
diff --git a/.gitignore b/.gitignore
index 5b8c7353..e6a9c055 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,6 @@
 **/target/
-.cargo
+.cargo/*
+!.cargo/audit.toml
 **/Cargo.lock
 !Cargo.lock
 
diff --git a/Cargo.lock b/Cargo.lock
index 40fc37e6..eca0019c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4,24 +4,15 @@ version = 3
 
 [[package]]
 name = "addchain"
-version = "0.2.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b2e69442aa5628ea6951fa33e24efe8313f4321a91bd729fc2f75bdfc858570"
+checksum = "2e33f6a175ec6a9e0aca777567f9ff7c3deefc255660df887e7fa3585e9801d8"
 dependencies = [
  "num-bigint 0.3.3",
  "num-integer",
  "num-traits",
 ]
 
-[[package]]
-name = "addr2line"
-version = "0.24.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
-dependencies = [
- "gimli",
-]
-
 [[package]]
 name = "adler2"
 version = "2.0.1"
@@ -86,17 +77,17 @@ dependencies = [
  "agent_verification",
  "anyhow",
  "askama",
- "axum 0.8.3",
+ "axum 0.8.9",
  "axum-auth 0.8.1",
  "axum-macros",
  "base64 0.22.1",
  "chrono",
  "cqrs-es 0.4.12",
  "futures",
- "http 1.3.1",
+ "http 1.4.1",
  "http-api-problem",
  "http-body-util",
- "hyper 1.9.0",
+ "hyper 1.10.0",
  "identity_core",
  "identity_credential",
  "identity_did",
@@ -110,19 +101,19 @@ dependencies = [
  "oid4vc-manager",
  "oid4vci",
  "oid4vp",
- "rand 0.9.1",
+ "rand 0.9.4",
  "rstest",
  "sd-jwt-payload",
  "serde",
  "serde_json",
  "serde_urlencoded",
- "serde_with 3.13.0",
+ "serde_with 3.20.0",
  "serial_test",
  "siopv2",
  "thiserror 1.0.69",
  "tokio",
  "tower 0.4.13",
- "tower-http 0.6.8",
+ "tower-http 0.6.11",
  "tracing",
  "tracing-test",
  "url",
@@ -148,14 +139,14 @@ dependencies = [
  "agent_store",
  "agent_verification",
  "anyhow",
- "axum 0.8.3",
+ "axum 0.8.9",
  "chrono",
  "did_manager",
  "serde",
  "serde_json",
- "serde_with 3.13.0",
+ "serde_with 3.20.0",
  "tokio",
- "tower-http 0.6.8",
+ "tower-http 0.6.11",
  "tracing",
 ]
 
@@ -209,10 +200,10 @@ dependencies = [
  "async-trait",
  "cqrs-es 0.4.12",
  "http-serde",
- "reqwest 0.12.20",
+ "reqwest 0.12.28",
  "serde",
  "serde_json",
- "serde_with 3.13.0",
+ "serde_with 3.20.0",
  "tokio",
  "tracing",
  "wiremock",
@@ -251,7 +242,7 @@ dependencies = [
  "agent_store",
  "async-std",
  "async-trait",
- "axum 0.8.3",
+ "axum 0.8.9",
  "base64 0.22.1",
  "cqrs-es 0.4.12",
  "identity_core",
@@ -262,8 +253,8 @@ dependencies = [
  "names",
  "oid4vc-core",
  "oid4vci",
- "rand 0.9.1",
- "reqwest 0.12.20",
+ "rand 0.9.4",
+ "reqwest 0.12.28",
  "rstest",
  "serde",
  "serde_json",
@@ -294,7 +285,7 @@ dependencies = [
  "anyhow",
  "async-std",
  "async-trait",
- "axum 0.8.3",
+ "axum 0.8.9",
  "base64 0.22.1",
  "chrono",
  "cqrs-es 0.4.12",
@@ -317,8 +308,8 @@ dependencies = [
  "oid4vc-core",
  "oid4vci",
  "product_common",
- "rand 0.9.1",
- "reqwest 0.12.20",
+ "rand 0.9.4",
+ "reqwest 0.12.28",
  "rstest",
  "serde",
  "serde_json",
@@ -364,13 +355,13 @@ dependencies = [
  "oid4vc-core",
  "oid4vci",
  "once_cell",
- "rand 0.9.1",
- "reqwest 0.12.20",
+ "rand 0.9.4",
+ "reqwest 0.12.28",
  "rstest",
  "sd-jwt-payload",
  "serde",
  "serde_json",
- "serde_with 3.13.0",
+ "serde_with 3.20.0",
  "serial_test",
  "strum 0.26.3",
  "strum_macros 0.26.4",
@@ -397,7 +388,7 @@ dependencies = [
  "rstest",
  "serde",
  "serde_json",
- "serde_with 3.13.0",
+ "serde_with 3.20.0",
  "serial_test",
  "strum 0.26.3",
  "strum_macros 0.26.4",
@@ -412,7 +403,7 @@ version = "0.1.0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -441,7 +432,7 @@ dependencies = [
  "oid4vc-core",
  "p256 0.13.2",
  "ring",
- "rustls 0.23.28",
+ "rustls 0.23.40",
  "sd-jwt-payload",
  "serde",
  "serde_json",
@@ -471,11 +462,11 @@ dependencies = [
  "oid4vci",
  "oid4vp",
  "once_cell",
- "rand 0.9.1",
- "reqwest 0.12.20",
+ "rand 0.9.4",
+ "reqwest 0.12.28",
  "serde",
  "serde_json",
- "serde_with 3.13.0",
+ "serde_with 3.20.0",
  "serial_test",
  "strum 0.26.3",
  "temp-env",
@@ -531,7 +522,7 @@ dependencies = [
  "oid4vc-manager",
  "oid4vci",
  "oid4vp",
- "reqwest 0.12.20",
+ "reqwest 0.12.28",
  "rstest",
  "serde",
  "serde_json",
@@ -551,7 +542,7 @@ version = "0.7.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "891477e0c6a8957309ee5c45a6368af3ae14bb510732d2684ffa19af310920f9"
 dependencies = [
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "once_cell",
  "version_check",
 ]
@@ -572,9 +563,9 @@ dependencies = [
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.3"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
 dependencies = [
  "memchr",
 ]
@@ -612,16 +603,16 @@ dependencies = [
  "ed25519 2.2.3",
  "futures",
  "hex",
- "http 1.3.1",
+ "http 1.4.1",
  "matchit 0.5.0",
  "pin-project-lite",
  "pkcs8 0.10.2",
  "quinn",
  "quinn-proto",
- "rand 0.8.5",
+ "rand 0.8.6",
  "rcgen",
  "ring",
- "rustls 0.23.28",
+ "rustls 0.23.40",
  "rustls-webpki 0.103.13",
  "serde",
  "serde_json",
@@ -655,9 +646,9 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.6.19"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "301af1932e46185686725e0fad2f8f2aa7da69dd70bf6ecc44d6b703844a3933"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -670,47 +661,44 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.11"
+version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "862ed96ca487e809f1c8e5a8447f6ee2cf102f846893800b20cebdf541fc6bbd"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.7"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.1.3"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c8bdeb6047d8983be085bab0ba1472e6dc604e7041dbf6fcd5e71523014fae9"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.9"
+version = "3.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "403f75924867bb1033c59fbf0797484329750cfbe3c4325cd33127941fabc882"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.98"
+version = "1.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487"
-dependencies = [
- "backtrace",
-]
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 
 [[package]]
 name = "anymap"
@@ -719,12 +707,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33954243bd79057c2de7338850b85983a44588021f8a5fee574a8888c6de4344"
 
 [[package]]
-name = "arbitrary"
-version = "1.4.1"
+name = "ar_archive_writer"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dde20b3d026af13f561bdd0f15edf01fc734f0dafcedbaf42bba506a9517f223"
+checksum = "7eb93bbb63b9c227414f6eb3a0adfddca591a8ce1e9b60661bb08969b87e340b"
 dependencies = [
- "derive_arbitrary",
+ "object",
 ]
 
 [[package]]
@@ -918,7 +906,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94893f1e0c6eeab764ade8dc4c0db24caf4fe7cbbaafc0eba0a9030f447b5185"
 dependencies = [
  "num-traits",
- "rand 0.8.5",
+ "rand 0.8.6",
 ]
 
 [[package]]
@@ -963,10 +951,10 @@ dependencies = [
  "memchr",
  "proc-macro2",
  "quote",
- "rustc-hash 2.1.1",
+ "rustc-hash 2.1.2",
  "serde",
  "serde_derive",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -978,14 +966,14 @@ dependencies = [
  "memchr",
  "serde",
  "serde_derive",
- "winnow 0.7.11",
+ "winnow 0.7.15",
 ]
 
 [[package]]
 name = "asn1-rs"
-version = "0.7.1"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56624a96882bb8c26d61312ae18cb45868e5a9992ea73c58e45c3101e56a1e60"
+checksum = "b7f43a50ac4fdca5df8e885c21b835997f0a1cdee65494a6847694a98652d9d8"
 dependencies = [
  "asn1-rs-derive",
  "asn1-rs-impl",
@@ -993,7 +981,7 @@ dependencies = [
  "nom 7.1.3",
  "num-traits",
  "rusticata-macros",
- "thiserror 2.0.12",
+ "thiserror 2.0.18",
  "time",
 ]
 
@@ -1005,7 +993,7 @@ checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
  "synstructure",
 ]
 
@@ -1017,7 +1005,7 @@ checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -1053,9 +1041,9 @@ dependencies = [
 
 [[package]]
 name = "async-channel"
-version = "2.3.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89b47800b0be77592da0afd425cc03468052844aff33b84e33cc696f64e77b6a"
+checksum = "924ed96dd52d1b75e9c1a3e6275715fd320f5f9439fb5a4a11fa51f4221158d2"
 dependencies = [
  "concurrent-queue",
  "event-listener-strategy",
@@ -1065,9 +1053,9 @@ dependencies = [
 
 [[package]]
 name = "async-executor"
-version = "1.13.2"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb812ffb58524bdd10860d7d974e2f01cc0950c2438a74ee5ec2e2280c6c4ffa"
+checksum = "c96bf972d85afc50bf5ab8fe2d54d1586b4e0b46c97c50a0c9e71e2f7bcd812a"
 dependencies = [
  "async-task",
  "concurrent-queue",
@@ -1083,7 +1071,7 @@ version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "05b1b633a2115cd122d73b955eadd9916c18c8f510ec9cd1686404c60ad1c29c"
 dependencies = [
- "async-channel 2.3.1",
+ "async-channel 2.5.0",
  "async-executor",
  "async-io",
  "async-lock",
@@ -1095,11 +1083,11 @@ dependencies = [
 
 [[package]]
 name = "async-io"
-version = "2.4.1"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1237c0ae75a0f3765f58910ff9cdd0a12eeb39ab2f4c7de23262f337f0aacbb3"
+checksum = "456b8a8feb6f42d237746d4b3e9a178494627745c3c56c6ea55d92ba50d026fc"
 dependencies = [
- "async-lock",
+ "autocfg",
  "cfg-if",
  "concurrent-queue",
  "futures-io",
@@ -1108,17 +1096,16 @@ dependencies = [
  "polling",
  "rustix",
  "slab",
- "tracing",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "async-lock"
-version = "3.4.0"
+version = "3.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff6e472cdea888a4bd64f342f09b3f50e1886d32afe8df3d663c01140b811b18"
+checksum = "290f7f2596bd5b78a9fec8088ccd89180d7f9f55b94b0576823bbbdc72ee8311"
 dependencies = [
- "event-listener 5.4.0",
+ "event-listener 5.4.1",
  "event-listener-strategy",
  "pin-project-lite",
 ]
@@ -1138,7 +1125,7 @@ dependencies = [
  "once_cell",
  "pin-project",
  "portable-atomic",
- "rand 0.8.5",
+ "rand 0.8.6",
  "regex",
  "ring",
  "rustls-native-certs 0.7.3",
@@ -1151,7 +1138,7 @@ dependencies = [
  "thiserror 1.0.69",
  "time",
  "tokio",
- "tokio-rustls 0.26.2",
+ "tokio-rustls 0.26.4",
  "tokio-util",
  "tokio-websockets",
  "tracing",
@@ -1161,9 +1148,9 @@ dependencies = [
 
 [[package]]
 name = "async-std"
-version = "1.13.1"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "730294c1c08c2e0f85759590518f6333f0d5a0a766a27d519c1b244c3dfd8a24"
+checksum = "2c8e079a4ab67ae52b7403632e4618815d6db36d2a010cfe41b02c1b1578f93b"
 dependencies = [
  "async-attributes",
  "async-channel 1.9.0",
@@ -1205,7 +1192,7 @@ checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -1216,13 +1203,13 @@ checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de"
 
 [[package]]
 name = "async-trait"
-version = "0.1.88"
+version = "0.1.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e539d3fca749fcee5236ab05e93a52867dd549cc157c8cb7f99595f3cedffdb5"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -1285,15 +1272,15 @@ checksum = "7460f7dd8e100147b82a63afca1a20eb6c231ee36b90ba7272e14951cb58af59"
 
 [[package]]
 name = "autocfg"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.16.3"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ec6fb3fe69024a75fa7e1bfb48aa6cf59706a101658ea01bfd33b2b248a038f"
+checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00"
 dependencies = [
  "aws-lc-sys",
  "zeroize",
@@ -1301,9 +1288,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.40.0"
+version = "0.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f50037ee5e1e41e7b8f9d161680a725bd1626cb6f8c7e901f91f942850852fe7"
+checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4"
 dependencies = [
  "cc",
  "cmake",
@@ -1345,20 +1332,20 @@ dependencies = [
 
 [[package]]
 name = "axum"
-version = "0.8.3"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de45108900e1f9b9242f7f2e254aa3e2c029c921c258fe9e6b4217eeebd54288"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
 dependencies = [
- "axum-core 0.5.2",
+ "axum-core 0.5.6",
  "axum-macros",
  "base64 0.22.1",
  "bytes",
  "form_urlencoded",
  "futures-util",
- "http 1.3.1",
+ "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.9.0",
+ "hyper 1.10.0",
  "hyper-util",
  "itoa",
  "matchit 0.8.4",
@@ -1366,8 +1353,7 @@ dependencies = [
  "mime",
  "percent-encoding",
  "pin-project-lite",
- "rustversion",
- "serde",
+ "serde_core",
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
@@ -1375,7 +1361,7 @@ dependencies = [
  "sync_wrapper 1.0.2",
  "tokio",
  "tokio-tungstenite",
- "tower 0.5.2",
+ "tower 0.5.3",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -1399,9 +1385,9 @@ version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "93495037c01c639b198ecb926b58f7f1c0d61ae663edcd61b2dd679f2a0bffe6"
 dependencies = [
- "axum-core 0.5.2",
+ "axum-core 0.5.6",
  "base64 0.22.1",
- "http 1.3.1",
+ "http 1.4.1",
 ]
 
 [[package]]
@@ -1423,18 +1409,17 @@ dependencies = [
 
 [[package]]
 name = "axum-core"
-version = "0.5.2"
+version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68464cd0412f486726fb3373129ef5d2993f90c34bc2bc1c1e9943b2f4fc7ca6"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.3.1",
+ "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
  "mime",
  "pin-project-lite",
- "rustversion",
  "sync_wrapper 1.0.2",
  "tower-layer",
  "tower-service",
@@ -1443,13 +1428,13 @@ dependencies = [
 
 [[package]]
 name = "axum-macros"
-version = "0.5.0"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "604fde5e028fea851ce1d8570bbdc034bec850d157f7569d10f347d06808c05c"
+checksum = "7aa268c23bfbbd2c4363b9cd302a4f504fb2a9dfe7e3451d66f35dd392e20aca"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -1462,33 +1447,18 @@ dependencies = [
  "bytes",
  "either",
  "fs-err",
- "http 1.3.1",
+ "http 1.4.1",
  "http-body 1.0.1",
- "hyper 1.9.0",
+ "hyper 1.10.0",
  "hyper-util",
  "pin-project-lite",
- "rustls 0.23.28",
+ "rustls 0.23.40",
  "rustls-pki-types",
  "tokio",
- "tokio-rustls 0.26.2",
+ "tokio-rustls 0.26.4",
  "tower-service",
 ]
 
-[[package]]
-name = "backtrace"
-version = "0.3.75"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6806a6321ec58106fea15becdad98371e28d92ccbc7c8f1b3b6dd724fe8f1002"
-dependencies = [
- "addr2line",
- "cfg-if",
- "libc",
- "miniz_oxide",
- "object",
- "rustc-demangle",
- "windows-targets 0.52.6",
-]
-
 [[package]]
 name = "base-x"
 version = "0.2.11"
@@ -1507,6 +1477,16 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
 
+[[package]]
+name = "base256emoji"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e9430d9a245a77c92176e649af6e275f20839a48389859d1661e9a128d077c"
+dependencies = [
+ "const-str",
+ "match-lookup",
+]
+
 [[package]]
 name = "base64"
 version = "0.12.3"
@@ -1542,9 +1522,9 @@ dependencies = [
 
 [[package]]
 name = "base64ct"
-version = "1.8.0"
+version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55248b47b0caf0546f7988906588779981c43bb1bc9d0c44087278f80cdb44ba"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
 [[package]]
 name = "basic-toml"
@@ -1696,11 +1676,11 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.9.1"
+version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967"
+checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
 dependencies = [
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -1747,38 +1727,38 @@ dependencies = [
 
 [[package]]
 name = "blake2b_simd"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06e903a20b159e944f91ec8499fe1e55651480c541ea0a584f5d967c49ad9d99"
+checksum = "b79834656f71332577234b50bfc009996f7449e0c056884e6a02492ded0ca2f3"
 dependencies = [
  "arrayref",
  "arrayvec",
- "constant_time_eq 0.3.1",
+ "constant_time_eq 0.4.2",
 ]
 
 [[package]]
 name = "blake2s_simd"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e90f7deecfac93095eb874a40febd69427776e24e1bd7f87f33ac62d6f0174df"
+checksum = "ee29928bad1e3f94c9d1528da29e07a1d3d04817ae8332de1e8b846c8439f4b3"
 dependencies = [
  "arrayref",
  "arrayvec",
- "constant_time_eq 0.3.1",
+ "constant_time_eq 0.4.2",
 ]
 
 [[package]]
 name = "blake3"
-version = "1.8.3"
+version = "1.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2468ef7d57b3fb7e16b576e8377cdbde2320c60e1491e961d11da40fc4f02a2d"
+checksum = "0aa83c34e62843d924f905e0f5c866eb1dd6545fc4d719e803d9ba6030371fce"
 dependencies = [
  "arrayref",
  "arrayvec",
  "cc",
  "cfg-if",
  "constant_time_eq 0.4.2",
- "cpufeatures 0.2.17",
+ "cpufeatures 0.3.0",
 ]
 
 [[package]]
@@ -1810,11 +1790,11 @@ dependencies = [
 
 [[package]]
 name = "blocking"
-version = "1.6.1"
+version = "1.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "703f41c54fc768e63e091340b424302bb1c29ef4aa0c7f10fe849dfb114d29ea"
+checksum = "e83f8d02be6967315521be875afa792a316e28d57b5a2d401897e2a7921b7f21"
 dependencies = [
- "async-channel 2.3.1",
+ "async-channel 2.5.0",
  "async-task",
  "futures-io",
  "futures-lite",
@@ -1859,9 +1839,9 @@ dependencies = [
 
 [[package]]
 name = "blst"
-version = "0.3.15"
+version = "0.3.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fd49896f12ac9b6dcd7a5998466b9b58263a695a3dd1ecc1aaca2e12a90b080"
+checksum = "dcdb4c7013139a150f9fc55d123186dbfaba0d912817466282c73ac49e71fb45"
 dependencies = [
  "cc",
  "glob",
@@ -1925,13 +1905,13 @@ dependencies = [
  "ahash 0.8.12",
  "base64 0.22.1",
  "bitvec 1.0.1",
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "getrandom 0.3.4",
  "hex",
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "js-sys",
  "once_cell",
- "rand 0.9.1",
+ "rand 0.9.4",
  "serde",
  "serde_bytes",
  "serde_json",
@@ -1941,9 +1921,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.18.1"
+version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "793db76d6187cd04dff33004d8e6c9cc4e05cd330500379d2394209271b4aeee"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
 [[package]]
 name = "byte-slice-cast"
@@ -1959,9 +1939,9 @@ checksum = "175812e0be2bccb6abe50bb8d566126198344f707e304f45c648fd8f2cc0365e"
 
 [[package]]
 name = "bytemuck"
-version = "1.23.1"
+version = "1.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c76a5792e44e4abe34d3abf15636779261d45a7450612059293d1d2cfc63422"
+checksum = "c8efb64bd706a16a1bdde310ae86b351e4d21550d98d056f22f8a7f7a2183fec"
 
 [[package]]
 name = "byteorder"
@@ -1971,9 +1951,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.10.1"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 dependencies = [
  "serde",
 ]
@@ -1989,10 +1969,11 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.27"
+version = "1.2.62"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d487aa071b5f64da6f19a3e848e3578944b726ee5a4854b82172f02aa876bfdc"
+checksum = "a1dce859f0832a7d088c4f1119888ab94ef4b5d6795d1ce05afb7fe159d79f98"
 dependencies = [
+ "find-msvc-tools",
  "jobserver",
  "libc",
  "shlex",
@@ -2006,9 +1987,9 @@ checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
 
 [[package]]
 name = "cfg-if"
-version = "1.0.1"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "cfg_aliases"
@@ -2035,7 +2016,7 @@ checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
- "rand_core 0.10.0",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -2105,9 +2086,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.40"
+version = "4.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40b6887a1d8685cebccf115538db5c0efe625ccac9696ad45c409d96566e910f"
+checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -2115,9 +2096,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.40"
+version = "4.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0c66c08ce9f0c698cbce5c0279d0bb6ac936d8674174fe48f736533b964f59e"
+checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
 dependencies = [
  "anstream",
  "anstyle",
@@ -2128,21 +2109,21 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.5.40"
+version = "4.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2c7947ae4cc3d851207c1adb5b5e260ff0cca11446b1d6d1423788e442257ce"
+checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
 dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "0.7.5"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b94f61472cee1439c0b966b47e3aca9ae07e45d070759512cd390ea2bebc6675"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 
 [[package]]
 name = "cloudevents-sdk"
@@ -2151,7 +2132,7 @@ source = "git+https://github.com/cloudevents/sdk-rust?rev=6f02d23#6f02d238e4de9e
 dependencies = [
  "async-nats",
  "base64 0.22.1",
- "bitflags 2.9.1",
+ "bitflags 2.11.1",
  "chrono",
  "delegate-attr",
  "hostname",
@@ -2165,9 +2146,9 @@ dependencies = [
 
 [[package]]
 name = "cmake"
-version = "0.1.54"
+version = "0.1.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7caa3f9de89ddbe2c607f4101924c5abec803763ae9534e4f4d7d8f84aa81f0"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
 dependencies = [
  "cc",
 ]
@@ -2195,9 +2176,9 @@ dependencies = [
 
 [[package]]
 name = "colorchoice"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 
 [[package]]
 name = "colored"
@@ -2206,7 +2187,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "117725a109d387c937a1533ce01b450cbde6b88abceea8473c4d7a85853cda3c"
 dependencies = [
  "lazy_static",
- "windows-sys 0.48.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -2261,21 +2242,20 @@ dependencies = [
  "fastcrypto",
  "iota-network-stack",
  "iota-sdk-types",
- "rand 0.8.5",
+ "rand 0.8.6",
  "serde",
  "tracing",
 ]
 
 [[package]]
 name = "console"
-version = "0.15.11"
+version = "0.16.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "054ccb5b10f9f2cbf51eb355ca1d05c2d279ce1804688d0db74b4733a5aeafd8"
+checksum = "d64e8af5551369d19cf50138de61f1c42074ab970f74e99be916646777f8fc87"
 dependencies = [
  "encode_unicode",
  "libc",
- "once_cell",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2305,18 +2285,25 @@ version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9d839f2a20b0aee515dc581a6172f2321f96cab76c1a38a4c584a194955390e"
 dependencies = [
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "once_cell",
  "tiny-keccak",
 ]
 
+[[package]]
+name = "const-str"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f421161cb492475f1661ddc9815a745a1c894592070661180fdec3d4872e9c3"
+
 [[package]]
 name = "const_format"
-version = "0.2.34"
+version = "0.2.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "126f97965c8ad46d6d9163268ff28432e8f6a1196a55578867832e3049df63dd"
+checksum = "4481a617ad9a412be3b97c5d403fef8ed023103368908b9c50af598ff467cc1e"
 dependencies = [
  "const_format_proc_macros",
+ "konst",
 ]
 
 [[package]]
@@ -2336,12 +2323,6 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "245097e9a4535ee1e3e3931fcfcd55a796a44c643e8596ff6566d68f09b87bbc"
 
-[[package]]
-name = "constant_time_eq"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c74b8349d32d297c9134b8c88677813a227df8f779daa29bfc29c183fe3dca6"
-
 [[package]]
 name = "constant_time_eq"
 version = "0.4.2"
@@ -2358,7 +2339,7 @@ dependencies = [
  "did_key",
  "did_web",
  "identity_iota",
- "rustls 0.23.28",
+ "rustls 0.23.40",
  "shared",
  "signature 2.2.0",
  "tokio",
@@ -2385,6 +2366,15 @@ dependencies = [
  "unicode-segmentation",
 ]
 
+[[package]]
+name = "convert_case"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "633458d4ef8c78b72454de2d54fd6ab2e60f9e02be22f3c6104cdc8a4e0fceb9"
+dependencies = [
+ "unicode-segmentation",
+]
+
 [[package]]
 name = "convert_case"
 version = "0.11.0"
@@ -2420,15 +2410,6 @@ version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
-[[package]]
-name = "core2"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b49ba7ef1ad6107f8824dbe97de947cbaac53c44e7f9756a1fba0d37c1eec505"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "coset"
 version = "0.3.8"
@@ -2479,30 +2460,30 @@ dependencies = [
  "async-trait",
  "serde",
  "serde_json",
- "thiserror 2.0.12",
+ "thiserror 2.0.18",
  "tokio",
 ]
 
 [[package]]
 name = "crc"
-version = "3.3.0"
+version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9710d3b3739c2e349eb44fe848ad0b7c8cb1e42bd87ee49371df2f7acaf3e675"
+checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d"
 dependencies = [
  "crc-catalog",
 ]
 
 [[package]]
 name = "crc-catalog"
-version = "2.4.0"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19d374276b40fb8bbdee95aef7c7fa6b5316ec764510eb64b8dd0e2ed0d7e7f5"
+checksum = "217698eaf96b4a3f0bc4f3662aaa55bdf913cd54d7204591faa790070c6d0853"
 
 [[package]]
 name = "crc32fast"
-version = "1.4.2"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
 dependencies = [
  "cfg-if",
 ]
@@ -2513,6 +2494,15 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
 
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
+dependencies = [
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "crossbeam-deque"
 version = "0.8.6"
@@ -2549,9 +2539,9 @@ checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
 [[package]]
 name = "crunchy"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43da5946c66ffcc7745f48db692ffbb10a83bfe0afd96235c5c2a4fb23994929"
+checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
 [[package]]
 name = "crypto-bigint"
@@ -2589,9 +2579,9 @@ dependencies = [
 
 [[package]]
 name = "crypto-common"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
  "generic-array",
  "rand_core 0.6.4",
@@ -2620,21 +2610,21 @@ dependencies = [
 
 [[package]]
 name = "csv"
-version = "1.3.1"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acdc4883a9c96732e4733212c01447ebd805833b7275a73ca3ee080fd77afdaf"
+checksum = "52cd9d68cf7efc6ddfaaee42e7288d3a99d613d4b50f76ce9827ae0c6e14f938"
 dependencies = [
  "csv-core",
  "itoa",
  "ryu",
- "serde",
+ "serde_core",
 ]
 
 [[package]]
 name = "csv-core"
-version = "0.1.12"
+version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d02f3b0da4c6504f86e9cd789d8dbafab48c2321be74e9987593de5a894d93d"
+checksum = "704a3c26996a80471189265814dbc2c257598b96b8a7feae2d31ace646bb9782"
 dependencies = [
  "memchr",
 ]
@@ -2685,7 +2675,7 @@ checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -2731,6 +2721,16 @@ dependencies = [
  "darling_macro 0.20.11",
 ]
 
+[[package]]
+name = "darling"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
+dependencies = [
+ "darling_core 0.23.0",
+ "darling_macro 0.23.0",
+]
+
 [[package]]
 name = "darling_core"
 version = "0.10.2"
@@ -2770,7 +2770,20 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim 0.11.1",
- "syn 2.0.104",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
+dependencies = [
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim 0.11.1",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -2803,14 +2816,25 @@ checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
 dependencies = [
  "darling_core 0.20.11",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
+dependencies = [
+ "darling_core 0.23.0",
+ "quote",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "dary_heap"
-version = "0.3.7"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04d2cd9c18b9f454ed67da600630b021a8a80bf33f8c95896ab33aaf1c26b728"
+checksum = "8b1e3a325bc115f096c8b77bbf027a7c2592230e70be2d985be950d3d5e60ebe"
 
 [[package]]
 name = "dashmap"
@@ -2822,20 +2846,20 @@ dependencies = [
  "hashbrown 0.14.5",
  "lock_api",
  "once_cell",
- "parking_lot_core 0.9.11",
+ "parking_lot_core 0.9.12",
 ]
 
 [[package]]
 name = "data-encoding"
-version = "2.9.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476"
+checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
 
 [[package]]
 name = "data-encoding-macro"
-version = "0.1.18"
+version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47ce6c96ea0102f01122a185683611bd5ac8d99e62bc59dd12e6bda344ee673d"
+checksum = "3259c913752a86488b501ed8680446a5ed2d5aeac6e596cb23ba3800768ea32c"
 dependencies = [
  "data-encoding",
  "data-encoding-macro-internal",
@@ -2843,22 +2867,22 @@ dependencies = [
 
 [[package]]
 name = "data-encoding-macro-internal"
-version = "0.1.16"
+version = "0.1.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d162beedaa69905488a8da94f5ac3edb4dd4788b732fadb7bd120b2625c1976"
+checksum = "ccc2776f0c61eca1ca32528f85548abd1a4be8fb53d1b21c013e4f18da1e7090"
 dependencies = [
  "data-encoding",
- "syn 1.0.109",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "deadpool"
-version = "0.10.0"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb84100978c1c7b37f09ed3ce3e5f843af02c2a2c431bae5b19230dad2c1b490"
+checksum = "0be2b1d1d6ec8d846f05e137292d0b89133caf95ef33695424c09568bdd39b1b"
 dependencies = [
- "async-trait",
  "deadpool-runtime",
+ "lazy_static",
  "num_cpus",
  "tokio",
 ]
@@ -2883,7 +2907,7 @@ checksum = "51aac4c99b2e6775164b412ea33ae8441b2fde2dbf05a20bc0052a63d08c475b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -2938,9 +2962,15 @@ name = "deranged"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c9e6a11ca8224451684bc0d7d5a7adbf8f2fd6887261a1cfc3c0432f9d4068e"
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
 dependencies = [
  "powerfmt",
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -2973,29 +3003,18 @@ checksum = "d65d7ce8132b7c0e54497a4d9a55a1c2a0912a0d786cf894472ba818fba45762"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "derive-where"
-version = "1.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef941ded77d15ca19b40374869ac6000af1c9f2a4c0f3d4c70926287e6364a8f"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.104",
-]
-
-[[package]]
-name = "derive_arbitrary"
-version = "1.4.1"
+version = "1.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30542c1ad912e0e3d22a1935c290e12e8a29d704a420177a31faad4a601a0800"
+checksum = "d08b3a0bcc0d079199cd476b2cae8435016ec11d1c0986c6901c5ac223041534"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -3033,7 +3052,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustc_version",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -3042,7 +3061,16 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4a9b99b9cbbe49445b21764dc0625032a89b145a2642e67603e1c936f5458d05"
 dependencies = [
- "derive_more-impl",
+ "derive_more-impl 1.0.0",
+]
+
+[[package]]
+name = "derive_more"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
+dependencies = [
+ "derive_more-impl 2.1.1",
 ]
 
 [[package]]
@@ -3053,7 +3081,21 @@ checksum = "cb7330aeadfbe296029522e6c40f315320aba36fc43a5b3632f3795348f3bd22"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
+ "unicode-xid",
+]
+
+[[package]]
+name = "derive_more-impl"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
+dependencies = [
+ "convert_case 0.10.0",
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "syn 2.0.117",
  "unicode-xid",
 ]
 
@@ -3103,7 +3145,7 @@ dependencies = [
  "curve25519-dalek 3.2.0",
  "did_url",
  "ed25519-dalek 1.0.1",
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "hkdf 0.11.0",
  "json-patch",
  "libsecp256k1",
@@ -3154,7 +3196,7 @@ dependencies = [
  "identity_stronghold",
  "iota-sdk 1.22.0-alpha",
  "log",
- "rustls 0.23.28",
+ "rustls 0.23.40",
  "shared",
  "tokio",
 ]
@@ -3336,13 +3378,13 @@ dependencies = [
 
 [[package]]
 name = "displaydoc"
-version = "0.2.5"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -3368,9 +3410,9 @@ checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
 
 [[package]]
 name = "dyn-clone"
-version = "1.0.19"
+version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c7a8fb8a9fbf66c1f703fe16184d10ca0ee9d23be5b4436400408ba54a95005"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
 
 [[package]]
 name = "ecdsa"
@@ -3451,9 +3493,9 @@ dependencies = [
 
 [[package]]
 name = "ed25519-dalek"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a3daa8e81a3963a60642bcc1f90a670680bd4a77535faa384e9d1c79d620871"
+checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
 dependencies = [
  "curve25519-dalek 4.1.3",
  "ed25519 2.2.3",
@@ -3467,25 +3509,24 @@ dependencies = [
 
 [[package]]
 name = "ed25519-zebra"
-version = "4.0.3"
+version = "4.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d9ce6874da5d4415896cd45ffbc4d1cfc0c4f9c079427bd870742c30f2f65a9"
+checksum = "775765289f7c6336c18d3d66127527820dd45ffd9eb3b6b8ee4708590e6c20f5"
 dependencies = [
  "curve25519-dalek 4.1.3",
  "ed25519 2.2.3",
- "hashbrown 0.14.5",
- "hex",
  "rand_core 0.6.4",
  "serde",
  "sha2 0.10.9",
+ "subtle",
  "zeroize",
 ]
 
 [[package]]
 name = "either"
-version = "1.15.0"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
 dependencies = [
  "serde",
 ]
@@ -3558,18 +3599,6 @@ dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "enum-as-inner"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc"
-dependencies = [
- "heck 0.5.0",
- "proc-macro2",
- "quote",
- "syn 2.0.104",
-]
-
 [[package]]
 name = "enum-compat-util"
 version = "0.1.0"
@@ -3587,7 +3616,7 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -3607,12 +3636,12 @@ dependencies = [
 
 [[package]]
 name = "errno"
-version = "0.3.13"
+version = "0.3.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "778e2ac28f6c47af28e4907f13ffd1e1ddbd400980a9abd7c8df189bf578a5ad"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3628,9 +3657,9 @@ dependencies = [
 
 [[package]]
 name = "ethnum"
-version = "1.5.2"
+version = "1.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca81e6b4777c89fd810c25a4be2b1bd93ea034fbe58e6a75216a34c6b82c539b"
+checksum = "40404c3f5f511ec4da6fe866ddf6a717c309fdbb69fbbad7b0f3edab8f2e835f"
 
 [[package]]
 name = "event-listener"
@@ -3640,9 +3669,9 @@ checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
 
 [[package]]
 name = "event-listener"
-version = "5.4.0"
+version = "5.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3492acde4c3fc54c845eaab3eed8bd00c7a7d881f78bfc801e43a93dec1331ae"
+checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
 dependencies = [
  "concurrent-queue",
  "parking",
@@ -3655,7 +3684,7 @@ version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
 dependencies = [
- "event-listener 5.4.0",
+ "event-listener 5.4.1",
  "pin-project-lite",
 ]
 
@@ -3687,8 +3716,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "531e46835a22af56d1e3b66f04844bed63158bc094a628bec1d321d9b4c44bf2"
 dependencies = [
  "bit-set 0.5.3",
- "regex-automata 0.4.9",
- "regex-syntax 0.8.5",
+ "regex-automata",
+ "regex-syntax",
 ]
 
 [[package]]
@@ -3698,8 +3727,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72cf461f865c862bb7dc573f643dd6a2b6842f7c30b07882b56bd148cc2761b8"
 dependencies = [
  "bit-set 0.8.0",
- "regex-automata 0.4.9",
- "regex-syntax 0.8.5",
+ "regex-automata",
+ "regex-syntax",
 ]
 
 [[package]]
@@ -3737,7 +3766,7 @@ dependencies = [
  "num-bigint 0.4.6",
  "once_cell",
  "p256 0.13.2",
- "rand 0.8.5",
+ "rand 0.8.6",
  "readonly",
  "rfc6979 0.4.0",
  "rsa 0.8.2",
@@ -3745,7 +3774,7 @@ dependencies = [
  "secp256k1",
  "serde",
  "serde_json",
- "serde_with 3.13.0",
+ "serde_with 3.20.0",
  "sha2 0.10.9",
  "sha3",
  "signature 2.2.0",
@@ -3775,7 +3804,7 @@ dependencies = [
  "fastcrypto",
  "hex",
  "itertools 0.10.5",
- "rand 0.8.5",
+ "rand 0.8.6",
  "serde",
  "sha3",
  "tap",
@@ -3796,7 +3825,7 @@ dependencies = [
  "num-integer",
  "num-prime",
  "num-traits",
- "rand 0.8.5",
+ "rand 0.8.6",
  "rand_chacha 0.3.1",
  "serde",
 ]
@@ -3825,7 +3854,7 @@ dependencies = [
  "num-bigint 0.4.6",
  "once_cell",
  "regex",
- "reqwest 0.12.20",
+ "reqwest 0.12.28",
  "schemars 0.8.22",
  "serde",
  "serde_json",
@@ -3834,9 +3863,9 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.3.0"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
 
 [[package]]
 name = "ff"
@@ -3885,16 +3914,20 @@ checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 
 [[package]]
 name = "filetime"
-version = "0.2.25"
+version = "0.2.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35c0522e981e68cbfa8c3f978441a5f34b30b96e146b33cd3359176b50fe8586"
+checksum = "5c287a33c7f0a620c38e641e7f60827713987b3c0f26e8ddc9462cc69cf75759"
 dependencies = [
  "cfg-if",
  "libc",
- "libredox",
- "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
 [[package]]
 name = "fixed-hash"
 version = "0.7.0"
@@ -3902,7 +3935,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cfcf0ed7fe52a17a03854ec54a9f76d6d84508d1c0e66bc1793301c73fc8493c"
 dependencies = [
  "byteorder",
- "rand 0.8.5",
+ "rand 0.8.6",
  "rustc-hex",
  "static_assertions",
 ]
@@ -3914,7 +3947,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "835c052cb0c08c1acf6ffd71c022172e18723949c8282f2b9f27efbc51e64534"
 dependencies = [
  "byteorder",
- "rand 0.8.5",
+ "rand 0.8.6",
  "rustc-hex",
  "static_assertions",
 ]
@@ -3927,13 +3960,14 @@ checksum = "37ab347416e802de484e4d03c7316c48f1ecb56574dfd4a46a80f173ce1de04d"
 
 [[package]]
 name = "flate2"
-version = "1.1.2"
+version = "1.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a3d7db9596fecd151c5f638c0ee5d5bd487b6e0ea232e5dc96d5250f6f94b1d"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
  "crc32fast",
  "libz-sys",
  "miniz_oxide",
+ "zlib-rs",
 ]
 
 [[package]]
@@ -3978,18 +4012,18 @@ checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
 [[package]]
 name = "form_urlencoded"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13624c2627564efccf4934284bdd98cbaa14e79b0b5a141218e507b3a823456"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
 dependencies = [
  "percent-encoding",
 ]
 
 [[package]]
 name = "fraction"
-version = "0.15.3"
+version = "0.15.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f158e3ff0a1b334408dc9fb811cd99b446986f4d8b741bb08f9df1604085ae7"
+checksum = "e076045bb43dac435333ed5f04caf35c7463631d0dae2deb2638d94dd0a5b872"
 dependencies = [
  "lazy_static",
  "num",
@@ -4025,9 +4059,9 @@ checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
 
 [[package]]
 name = "futures"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65bc07b1a8bc7c85c5f2e110c476c7389b4554ba72af57d8445ea63a576b0876"
+checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -4040,9 +4074,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -4050,20 +4084,19 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
 dependencies = [
  "futures-core",
  "futures-task",
  "futures-util",
- "num_cpus",
 ]
 
 [[package]]
@@ -4074,20 +4107,20 @@ checksum = "1d930c203dd0b6ff06e0201a4a2fe9149b43c684fd4420555b26d21b1a02956f"
 dependencies = [
  "futures-core",
  "lock_api",
- "parking_lot 0.12.4",
+ "parking_lot 0.12.5",
 ]
 
 [[package]]
 name = "futures-io"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
 
 [[package]]
 name = "futures-lite"
-version = "2.6.0"
+version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5edaec856126859abb19ed65f39e90fea3a9574b9707f13539acf4abf7eb532"
+checksum = "f78e10609fe0e0b3f4157ffab1876319b5b0db102a2c60dc4626306dc46b44ad"
 dependencies = [
  "fastrand",
  "futures-core",
@@ -4098,26 +4131,26 @@ dependencies = [
 
 [[package]]
 name = "futures-macro"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
 
 [[package]]
 name = "futures-task"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
 
 [[package]]
 name = "futures-timer"
@@ -4131,9 +4164,9 @@ dependencies = [
 
 [[package]]
 name = "futures-util"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -4143,7 +4176,6 @@ dependencies = [
  "futures-task",
  "memchr",
  "pin-project-lite",
- "pin-utils",
  "slab",
 ]
 
@@ -4172,9 +4204,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -4206,7 +4238,7 @@ dependencies = [
  "cfg-if",
  "libc",
  "r-efi 6.0.0",
- "rand_core 0.10.0",
+ "rand_core 0.10.1",
  "wasip2",
  "wasip3",
 ]
@@ -4220,7 +4252,7 @@ dependencies = [
  "proc-macro-error2",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -4233,17 +4265,11 @@ dependencies = [
  "polyval",
 ]
 
-[[package]]
-name = "gimli"
-version = "0.31.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
-
 [[package]]
 name = "glob"
-version = "0.3.2"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2"
+checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
 
 [[package]]
 name = "gloo-net"
@@ -4255,7 +4281,7 @@ dependencies = [
  "futures-core",
  "futures-sink",
  "gloo-utils",
- "http 1.3.1",
+ "http 1.4.1",
  "js-sys",
  "pin-project",
  "serde",
@@ -4315,10 +4341,10 @@ dependencies = [
  "futures-timer",
  "no-std-compat",
  "nonzero_ext",
- "parking_lot 0.12.4",
+ "parking_lot 0.12.5",
  "portable-atomic",
  "quanta",
- "rand 0.8.5",
+ "rand 0.8.6",
  "smallvec",
  "spinning_top",
 ]
@@ -4353,7 +4379,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
 dependencies = [
  "ff 0.13.1",
- "rand 0.8.5",
+ "rand 0.8.6",
  "rand_core 0.6.4",
  "rand_xorshift",
  "subtle",
@@ -4361,9 +4387,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.3.26"
+version = "0.3.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81fe527a889e1532da5c525686d96d4c2e74cdd345badf8dfef9f6b39dd5f5e8"
+checksum = "0beca50380b1fc32983fc1cb4587bfa4bb9e78fc259aad4a0032d2080309222d"
 dependencies = [
  "bytes",
  "fnv",
@@ -4371,7 +4397,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "http 0.2.12",
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "slab",
  "tokio",
  "tokio-util",
@@ -4380,17 +4406,17 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.10"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9421a676d1b147b16b82c9225157dc629087ef8ec4d5e2960f9437a90dac0a5"
+checksum = "171fefbc92fe4a4de27e0698d6a5b392d6a0e333506bc49133760b3bcf948733"
 dependencies = [
  "atomic-waker",
  "bytes",
  "fnv",
  "futures-core",
  "futures-sink",
- "http 1.3.1",
- "indexmap 2.12.0",
+ "http 1.4.1",
+ "indexmap 2.14.0",
  "slab",
  "tokio",
  "tokio-util",
@@ -4399,12 +4425,13 @@ dependencies = [
 
 [[package]]
 name = "half"
-version = "2.6.0"
+version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "459196ed295495a68f7d7fe1d84f6c4b7ff0e21fe3017b2f283c6fac3ad803c9"
+checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b"
 dependencies = [
  "cfg-if",
  "crunchy",
+ "zerocopy",
 ]
 
 [[package]]
@@ -4447,9 +4474,9 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.15.4"
+version = "0.15.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5971ac85611da7067dbfcabef3c70ebb5606018acd9e2a3903a0da507521e0d5"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 dependencies = [
  "allocator-api2",
  "equivalent",
@@ -4458,15 +4485,21 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.16.0"
+version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5419bdc4f6a9207fbeba6d11b604d481addf78ecd10c11ad51e76c2f6482748d"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 dependencies = [
  "allocator-api2",
  "equivalent",
  "foldhash 0.2.0",
 ]
 
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
 [[package]]
 name = "hashlink"
 version = "0.8.4"
@@ -4482,7 +4515,7 @@ version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
 dependencies = [
- "hashbrown 0.15.4",
+ "hashbrown 0.15.5",
 ]
 
 [[package]]
@@ -4542,46 +4575,71 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6fe2267d4ed49bc07b63801559be28c718ea06c4738b7a03c94df7386d2cde46"
 
 [[package]]
-name = "hickory-proto"
-version = "0.24.4"
+name = "hickory-net"
+version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92652067c9ce6f66ce53cc38d1169daa36e6e7eb7dd3b63b5103bd9d97117248"
+checksum = "e2295ed2f9c31e471e1428a8f88a3f0e1f4b27c15049592138d1eebe9c35b183"
 dependencies = [
  "async-trait",
  "cfg-if",
  "data-encoding",
- "enum-as-inner",
  "futures-channel",
  "futures-io",
  "futures-util",
+ "hickory-proto",
  "idna",
  "ipnet",
- "once_cell",
- "rand 0.8.5",
- "thiserror 1.0.69",
+ "jni 0.22.4",
+ "rand 0.10.1",
+ "thiserror 2.0.18",
  "tinyvec",
  "tokio",
  "tracing",
  "url",
 ]
 
+[[package]]
+name = "hickory-proto"
+version = "0.26.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bab31817bfb44672a252e97fe81cd0c18d1b2cf892108922f6818820df8c643"
+dependencies = [
+ "data-encoding",
+ "idna",
+ "ipnet",
+ "jni 0.22.4",
+ "once_cell",
+ "prefix-trie",
+ "rand 0.10.1",
+ "ring",
+ "thiserror 2.0.18",
+ "tinyvec",
+ "tracing",
+ "url",
+]
+
 [[package]]
 name = "hickory-resolver"
-version = "0.24.4"
+version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cbb117a1ca520e111743ab2f6688eddee69db4e0ea242545a604dce8a66fd22e"
+checksum = "f0d58d28879ceecde6607729660c2667a081ccdc082e082675042793960f178c"
 dependencies = [
  "cfg-if",
  "futures-util",
+ "hickory-net",
  "hickory-proto",
  "ipconfig",
- "lru-cache",
+ "ipnet",
+ "jni 0.22.4",
+ "moka",
+ "ndk-context",
  "once_cell",
- "parking_lot 0.12.4",
- "rand 0.8.5",
+ "parking_lot 0.12.5",
+ "rand 0.10.1",
  "resolv-conf",
  "smallvec",
- "thiserror 1.0.69",
+ "system-configuration 0.7.0",
+ "thiserror 2.0.18",
  "tokio",
  "tracing",
 ]
@@ -4653,11 +4711,11 @@ checksum = "77e806677ce663d0a199541030c816847b36e8dc095f70dae4a4f4ad63da5383"
 
 [[package]]
 name = "home"
-version = "0.5.11"
+version = "0.5.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589533453244b0995c858700322199b2becb13b627df2851f64a2775d024abcf"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4684,12 +4742,11 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "1.3.1"
+version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4a85d31aea989eead29a3aaf9e1115a180df8282431156e533de47660892565"
+checksum = "8be7462df143984c4598a256ef469b251d7d7f9e271135073e78fc535414f3d0"
 dependencies = [
  "bytes",
- "fnv",
  "itoa",
 ]
 
@@ -4699,8 +4756,8 @@ version = "0.60.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "000bed434eb9b5dfb8ea5ed904f02ffc63aa0ac7ac034d480dc24fbb97b748d8"
 dependencies = [
- "axum-core 0.5.2",
- "http 1.3.1",
+ "axum-core 0.5.6",
+ "http 1.4.1",
  "http-api-problem-derive",
  "serde",
  "serde_json",
@@ -4733,7 +4790,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
 dependencies = [
  "bytes",
- "http 1.3.1",
+ "http 1.4.1",
 ]
 
 [[package]]
@@ -4744,7 +4801,7 @@ checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.3.1",
+ "http 1.4.1",
  "http-body 1.0.1",
  "pin-project-lite",
 ]
@@ -4761,7 +4818,7 @@ version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0f056c8559e3757392c8d091e796416e4649d8e49e88b8d76df6c002f05027fd"
 dependencies = [
- "http 1.3.1",
+ "http 1.4.1",
  "serde",
 ]
 
@@ -4779,9 +4836,9 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "humantime"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b112acc8b3adf4b107a8ec20977da0273a8c386765a3ec0229bd500a1443f9f"
+checksum = "135b12329e5e3ce057a9f972339ea52bc954fe1e9358ef27f95e89716fbc5424"
 
 [[package]]
 name = "hyper"
@@ -4793,7 +4850,7 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
- "h2 0.3.26",
+ "h2 0.3.27",
  "http 0.2.12",
  "http-body 0.4.6",
  "httparse",
@@ -4809,16 +4866,16 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.9.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6299f016b246a94207e63da54dbe807655bf9e00044f73ded42c3ac5305fbcca"
+checksum = "eb92f162bf56536459fc83c79b974bb12837acfed43d6bc370a7916d0ae15ecc"
 dependencies = [
  "atomic-waker",
  "bytes",
  "futures-channel",
  "futures-core",
- "h2 0.4.10",
- "http 1.3.1",
+ "h2 0.4.14",
+ "http 1.4.1",
  "http-body 1.0.1",
  "httparse",
  "httpdate",
@@ -4845,21 +4902,20 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.27.7"
+version = "0.27.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
- "http 1.3.1",
- "hyper 1.9.0",
+ "http 1.4.1",
+ "hyper 1.10.0",
  "hyper-util",
  "log",
- "rustls 0.23.28",
- "rustls-native-certs 0.8.1",
- "rustls-pki-types",
+ "rustls 0.23.40",
+ "rustls-native-certs 0.8.3",
  "tokio",
- "tokio-rustls 0.26.2",
+ "tokio-rustls 0.26.4",
  "tower-service",
- "webpki-roots 1.0.1",
+ "webpki-roots 1.0.7",
 ]
 
 [[package]]
@@ -4868,7 +4924,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
 dependencies = [
- "hyper 1.9.0",
+ "hyper 1.10.0",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -4885,14 +4941,14 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "http 1.3.1",
+ "http 1.4.1",
  "http-body 1.0.1",
- "hyper 1.9.0",
+ "hyper 1.10.0",
  "ipnet",
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.6.0",
+ "socket2 0.6.4",
  "tokio",
  "tower-service",
  "tracing",
@@ -4900,9 +4956,9 @@ dependencies = [
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.63"
+version = "0.1.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0c919e5debc312ad217002b8048a17b7d83f80703865bbfcfebb0458b0b27d8"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
@@ -4910,7 +4966,7 @@ dependencies = [
  "js-sys",
  "log",
  "wasm-bindgen",
- "windows-core",
+ "windows-core 0.62.2",
 ]
 
 [[package]]
@@ -4924,12 +4980,13 @@ dependencies = [
 
 [[package]]
 name = "icu_collections"
-version = "2.0.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "200072f5d0e3614556f94a9930d5dc3e0662a652823904c3a75dc3b0af7fee47"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
 dependencies = [
  "displaydoc",
  "potential_utf",
+ "utf8_iter",
  "yoke",
  "zerofrom",
  "zerovec",
@@ -4937,9 +4994,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_core"
-version = "2.0.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cde2700ccaed3872079a65fb1a78f6c0a36c91570f28755dda67bc8f7d9f00a"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -4950,11 +5007,10 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer"
-version = "2.0.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "436880e8e18df4d7bbc06d58432329d6458cc84531f7ac5f024e93deadb37979"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
 dependencies = [
- "displaydoc",
  "icu_collections",
  "icu_normalizer_data",
  "icu_properties",
@@ -4965,42 +5021,38 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.0.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00210d6893afc98edb752b664b8890f0ef174c8adbb8d0be9710fa66fbbf72d3"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
 
 [[package]]
 name = "icu_properties"
-version = "2.0.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "016c619c1eeb94efb86809b015c58f479963de65bdb6253345c1a1276f22e32b"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
 dependencies = [
- "displaydoc",
  "icu_collections",
  "icu_locale_core",
  "icu_properties_data",
  "icu_provider",
- "potential_utf",
  "zerotrie",
  "zerovec",
 ]
 
 [[package]]
 name = "icu_properties_data"
-version = "2.0.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "298459143998310acd25ffe6810ed544932242d3f07083eee1084d83a71bd632"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
 
 [[package]]
 name = "icu_provider"
-version = "2.0.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03c80da27b5f4187909049ee2d72f276f0d9f99a42c306bd0131ecfe04d8e5af"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
- "stable_deref_trait",
- "tinystr",
  "writeable",
  "yoke",
  "zerofrom",
@@ -5025,9 +5077,9 @@ name = "identity_core"
 version = "1.9.6-beta.1"
 source = "git+https://github.com/iotaledger/identity?tag=v1.9.6-beta.1#d3fb5246d017cef360cef289e0f8e34ff2ce65ef"
 dependencies = [
- "deranged",
+ "deranged 0.4.0",
  "js-sys",
- "multibase 0.9.1",
+ "multibase 0.9.2",
  "nom 8.0.0",
  "product_common",
  "serde",
@@ -5051,7 +5103,7 @@ dependencies = [
  "identity_did",
  "identity_document",
  "identity_verification",
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "itertools 0.11.0",
  "jsonschema 0.19.1",
  "once_cell",
@@ -5089,7 +5141,7 @@ dependencies = [
  "identity_core",
  "identity_did",
  "identity_verification",
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "serde",
  "strum 0.25.0",
  "thiserror 1.0.69",
@@ -5143,7 +5195,7 @@ dependencies = [
  "cfg-if",
  "fastcrypto",
  "futures",
- "hyper 1.9.0",
+ "hyper 1.10.0",
  "identity_core",
  "identity_credential",
  "identity_did",
@@ -5165,7 +5217,7 @@ dependencies = [
  "phf",
  "prefix-hex",
  "product_common",
- "rand 0.8.5",
+ "rand 0.8.6",
  "ref-cast",
  "secret-storage",
  "serde",
@@ -5232,7 +5284,7 @@ dependencies = [
  "iota-crypto",
  "iota-sdk-types",
  "iota_interaction",
- "rand 0.8.5",
+ "rand 0.8.6",
  "seahash",
  "secret-storage",
  "serde",
@@ -5252,7 +5304,7 @@ dependencies = [
  "iota-crypto",
  "iota-sdk 1.1.5",
  "iota_stronghold",
- "rand 0.8.5",
+ "rand 0.8.6",
  "tokio",
  "zeroize",
 ]
@@ -5304,9 +5356,9 @@ dependencies = [
 
 [[package]]
 name = "idna_adapter"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
 dependencies = [
  "icu_normalizer",
  "icu_properties",
@@ -5370,14 +5422,14 @@ checksum = "a0eb5a3343abf848c0984fe4604b2b105da9539376e24fc0a3b0007411ae4fd9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "indenter"
-version = "0.3.3"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce23b50ad8242c51a442f3ff322d56b02f08852c77e4c0b4d3fd684abc89c683"
+checksum = "964de6e86d545b246d84badc0fef527924ace5134f30641c203ef52ba83f58d5"
 
 [[package]]
 name = "indexmap"
@@ -5392,12 +5444,12 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.12.0"
+version = "2.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6717a8d2a5a929a1a2eb43a12812498ed141a0bcfb7e8f7844fbdbe4303bba9f"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown 0.16.0",
+ "hashbrown 0.17.1",
  "serde",
  "serde_core",
 ]
@@ -5420,14 +5472,15 @@ dependencies = [
 
 [[package]]
 name = "insta"
-version = "1.43.2"
+version = "1.47.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46fdb647ebde000f43b5b53f773c30cf9b0cb4300453208713fa38b2c70935a0"
+checksum = "7b4a6248eb93a4401ed2f37dfe8ea592d3cf05b7cf4f8efa867b6895af7e094e"
 dependencies = [
  "console",
  "once_cell",
  "serde",
  "similar",
+ "tempfile",
 ]
 
 [[package]]
@@ -5466,7 +5519,7 @@ dependencies = [
  "move-vm-profiler",
  "move-vm-runtime",
  "move-vm-types",
- "parking_lot 0.12.4",
+ "parking_lot 0.12.5",
  "serde",
  "tracing",
 ]
@@ -5483,9 +5536,9 @@ dependencies = [
  "iota-metrics",
  "iota-types",
  "once_cell",
- "parking_lot 0.12.4",
- "rand 0.8.5",
- "reqwest 0.12.20",
+ "parking_lot 0.12.5",
+ "rand 0.8.6",
+ "reqwest 0.12.28",
  "snap",
  "tempfile",
  "tokio",
@@ -5513,8 +5566,8 @@ dependencies = [
  "object_store",
  "once_cell",
  "prometheus",
- "rand 0.8.5",
- "reqwest 0.12.20",
+ "rand 0.8.6",
+ "reqwest 0.12.28",
  "serde",
  "serde_yaml",
  "starfish-config",
@@ -5539,14 +5592,14 @@ dependencies = [
  "digest 0.10.7",
  "ed25519-zebra",
  "generic-array",
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "hkdf 0.12.4",
  "hmac 0.12.1",
  "iterator-sorted 0.1.0",
  "k256",
  "num-traits",
  "pbkdf2 0.12.2",
- "rand 0.8.5",
+ "rand 0.8.6",
  "scrypt",
  "serde",
  "sha2 0.10.9",
@@ -5599,16 +5652,16 @@ version = "1.22.0-alpha"
 source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "bytes",
- "http 1.3.1",
+ "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.9.0",
+ "hyper 1.10.0",
  "hyper-util",
  "iota-tls",
  "pin-project-lite",
  "socket2 0.5.10",
  "tokio",
- "tokio-rustls 0.26.2",
+ "tokio-rustls 0.26.4",
  "tokio-util",
  "tower 0.4.13",
  "tracing",
@@ -5680,7 +5733,7 @@ dependencies = [
  "schemars 0.8.22",
  "serde",
  "serde_json",
- "serde_with 3.13.0",
+ "serde_with 3.20.0",
  "strum 0.27.2",
  "tabled",
  "tracing",
@@ -5696,11 +5749,11 @@ dependencies = [
  "fastcrypto",
  "iota-sdk-types",
  "iota-types",
- "rand 0.8.5",
+ "rand 0.8.6",
  "regex",
  "serde",
  "serde_json",
- "serde_with 3.13.0",
+ "serde_with 3.20.0",
  "signature 1.6.4",
  "slip10_ed25519",
  "tiny-bip39",
@@ -5726,12 +5779,12 @@ dependencies = [
  "anemo",
  "anemo-tower",
  "async-trait",
- "axum 0.8.3",
+ "axum 0.8.9",
  "bytes",
  "dashmap",
  "futures",
  "once_cell",
- "parking_lot 0.12.4",
+ "parking_lot 0.12.5",
  "prometheus",
  "prometheus-closure-metric",
  "scopeguard",
@@ -5754,7 +5807,7 @@ dependencies = [
  "fastcrypto",
  "fastcrypto-vdf",
  "fastcrypto-zkp",
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "iota-protocol-config",
  "iota-types",
  "move-binary-format",
@@ -5762,7 +5815,7 @@ dependencies = [
  "move-stdlib-natives",
  "move-vm-runtime",
  "move-vm-types",
- "rand 0.8.5",
+ "rand 0.8.6",
  "serde",
  "smallvec",
  "tracing",
@@ -5791,9 +5844,9 @@ dependencies = [
  "bytes",
  "eyre",
  "futures",
- "http 1.3.1",
+ "http 1.4.1",
  "http-body 1.0.1",
- "hyper-rustls 0.27.7",
+ "hyper-rustls 0.27.9",
  "hyper-util",
  "idna",
  "iota-http",
@@ -5803,7 +5856,7 @@ dependencies = [
  "serde",
  "snap",
  "tokio",
- "tokio-rustls 0.26.2",
+ "tokio-rustls 0.26.4",
  "tonic",
  "tonic-health",
  "tower 0.4.13",
@@ -5859,7 +5912,7 @@ dependencies = [
  "msim-macros",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -5873,7 +5926,7 @@ dependencies = [
  "schemars 0.8.22",
  "serde",
  "serde-env",
- "serde_with 3.13.0",
+ "serde_with 3.20.0",
  "tracing",
 ]
 
@@ -5896,7 +5949,7 @@ dependencies = [
  "anymap",
  "async-trait",
  "bech32",
- "bitflags 2.9.1",
+ "bitflags 2.11.1",
  "bytemuck",
  "derive_more 0.99.20",
  "futures",
@@ -5917,7 +5970,7 @@ dependencies = [
  "packable",
  "prefix-hex",
  "primitive-types 0.12.2",
- "rand 0.8.5",
+ "rand 0.8.6",
  "regex",
  "reqwest 0.11.27",
  "rumqttc",
@@ -5956,11 +6009,11 @@ dependencies = [
  "iota-types",
  "jsonrpsee",
  "move-core-types",
- "reqwest 0.12.20",
- "rustls 0.23.28",
+ "reqwest 0.12.28",
+ "rustls 0.23.40",
  "serde",
  "serde_json",
- "serde_with 3.13.0",
+ "serde_with 3.20.0",
  "thiserror 1.0.69",
  "tokio",
  "tracing",
@@ -5979,15 +6032,15 @@ dependencies = [
  "hex",
  "itertools 0.13.0",
  "paste",
- "roaring 0.11.3",
+ "roaring 0.11.4",
  "schemars 0.8.22",
  "serde",
  "serde_json",
  "serde_repr",
- "serde_with 3.13.0",
+ "serde_with 3.20.0",
  "strum 0.27.2",
- "thiserror 2.0.12",
- "winnow 0.7.11",
+ "thiserror 2.0.18",
+ "winnow 0.7.15",
 ]
 
 [[package]]
@@ -5997,17 +6050,17 @@ source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892
 dependencies = [
  "anyhow",
  "arc-swap",
- "axum 0.8.3",
+ "axum 0.8.9",
  "axum-server",
  "ed25519 2.2.3",
  "fastcrypto",
  "pkcs8 0.10.2",
  "rcgen",
- "reqwest 0.12.20",
- "rustls 0.23.28",
+ "reqwest 0.12.28",
+ "rustls 0.23.40",
  "rustls-webpki 0.103.13",
  "tokio",
- "tokio-rustls 0.26.2",
+ "tokio-rustls 0.26.4",
  "tower-layer",
  "x509-parser",
 ]
@@ -6054,7 +6107,7 @@ dependencies = [
  "futures",
  "hex",
  "im",
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "iota-enum-compat-util",
  "iota-macros",
  "iota-network-stack",
@@ -6071,17 +6124,17 @@ dependencies = [
  "num-bigint 0.4.6",
  "num-traits",
  "once_cell",
- "parking_lot 0.12.4",
+ "parking_lot 0.12.5",
  "passkey-types",
  "prometheus",
  "prost-types",
- "rand 0.8.5",
- "roaring 0.11.3",
+ "rand 0.8.6",
+ "roaring 0.11.4",
  "schemars 0.8.22",
  "serde",
  "serde-name",
  "serde_json",
- "serde_with 3.13.0",
+ "serde_with 3.20.0",
  "signature 1.6.4",
  "starfish-config",
  "static_assertions",
@@ -6125,8 +6178,8 @@ dependencies = [
  "fastcrypto",
  "fastcrypto-zkp",
  "hex",
- "hyper 1.9.0",
- "indexmap 2.12.0",
+ "hyper 1.10.0",
+ "indexmap 2.14.0",
  "iota-sdk 1.22.0-alpha",
  "iota-sdk-types",
  "itertools 0.13.0",
@@ -6138,14 +6191,14 @@ dependencies = [
  "move-core-types",
  "nonempty",
  "primitive-types 0.12.2",
- "rand 0.8.5",
+ "rand 0.8.6",
  "ref-cast",
  "schemars 0.8.22",
  "secret-storage",
  "serde",
  "serde_json",
  "serde_repr",
- "serde_with 3.13.0",
+ "serde_with 3.20.0",
  "strum 0.25.0",
  "thiserror 1.0.69",
  "tokio",
@@ -6178,9 +6231,9 @@ dependencies = [
  "eyre",
  "fastcrypto",
  "futures",
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "getrandom 0.3.4",
- "hyper 1.9.0",
+ "hyper 1.10.0",
  "iota-sdk 1.1.5",
  "iota_interaction",
  "js-sys",
@@ -6215,21 +6268,25 @@ dependencies = [
 
 [[package]]
 name = "ipconfig"
-version = "0.3.2"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b58db92f96b720de98181bbbe63c831e87005ab460c1bf306eb2622b4707997f"
+checksum = "4d40460c0ce33d6ce4b0630ad68ff63d6661961c48b6dba35e5a4d81cfb48222"
 dependencies = [
- "socket2 0.5.10",
+ "socket2 0.6.4",
  "widestring",
- "windows-sys 0.48.0",
- "winreg",
+ "windows-registry",
+ "windows-result 0.4.1",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "ipnet"
-version = "2.11.0"
+version = "2.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+dependencies = [
+ "serde",
+]
 
 [[package]]
 name = "iref"
@@ -6242,16 +6299,6 @@ dependencies = [
  "smallvec",
 ]
 
-[[package]]
-name = "iri-string"
-version = "0.7.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbc5ebe9c3a1a7a5127f920a418f7585e9e758e911d0466ed004f393b0e380b2"
-dependencies = [
- "memchr",
- "serde",
-]
-
 [[package]]
 name = "is_empty"
 version = "0.2.0"
@@ -6274,9 +6321,9 @@ dependencies = [
 
 [[package]]
 name = "is_terminal_polyfill"
-version = "1.70.1"
+version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
 
 [[package]]
 name = "iso8601"
@@ -6346,9 +6393,9 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.15"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "jni"
@@ -6359,24 +6406,76 @@ dependencies = [
  "cesu8",
  "cfg-if",
  "combine",
- "jni-sys",
+ "jni-sys 0.3.1",
  "log",
  "thiserror 1.0.69",
  "walkdir",
  "windows-sys 0.45.0",
 ]
 
+[[package]]
+name = "jni"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
+dependencies = [
+ "cfg-if",
+ "combine",
+ "jni-macros",
+ "jni-sys 0.4.1",
+ "log",
+ "simd_cesu8",
+ "thiserror 2.0.18",
+ "walkdir",
+ "windows-link",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "simd_cesu8",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "jni-sys"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
+checksum = "41a652e1f9b6e0275df1f15b32661cf0d4b78d4d87ddec5e0c3c20f097433258"
+dependencies = [
+ "jni-sys 0.4.1",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn 2.0.117",
+]
 
 [[package]]
 name = "jobserver"
-version = "0.1.33"
+version = "0.1.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38f262f097c174adebe41eb73d66ae9c06b2844fb0da69969647bbddd9b0538a"
+checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
 dependencies = [
  "getrandom 0.3.4",
  "libc",
@@ -6523,9 +6622,9 @@ dependencies = [
 
 [[package]]
 name = "json-number"
-version = "0.4.9"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66994b2bac615128d07a1e4527ad29e98b004dd1a1769e7b8fbc1173ccf43006"
+checksum = "479dfd2ad8e4b4ae076b031f72ef2f3791f65e2a0f51e5f3408dbf716c4c2f82"
 dependencies = [
  "lexical",
  "ryu-js",
@@ -6559,7 +6658,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "704ced300295bcf404f788239794cc7c30551a4fb8e9718202268a1f495a8d4e"
 dependencies = [
  "data-encoding",
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "json-unflattening",
  "serde",
  "serde_json",
@@ -6634,9 +6733,9 @@ dependencies = [
 
 [[package]]
 name = "jsonrpsee"
-version = "0.24.9"
+version = "0.24.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37b26c20e2178756451cfeb0661fb74c47dd5988cb7e3939de7e9241fd604d42"
+checksum = "72c4b1f204b655b36b24dc4939af20366c649431d4711863bbbae5c495f3eeb4"
 dependencies = [
  "jsonrpsee-client-transport",
  "jsonrpsee-core",
@@ -6652,24 +6751,24 @@ dependencies = [
 
 [[package]]
 name = "jsonrpsee-client-transport"
-version = "0.24.9"
+version = "0.24.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bacb85abf4117092455e1573625e21b8f8ef4dec8aff13361140b2dc266cdff2"
+checksum = "b3e1420b1792cff778e2a1ebaa44115f156ee62a94dd106eaa51163f037d2023"
 dependencies = [
  "base64 0.22.1",
  "futures-channel",
  "futures-util",
  "gloo-net",
- "http 1.3.1",
+ "http 1.4.1",
  "jsonrpsee-core",
  "pin-project",
- "rustls 0.23.28",
+ "rustls 0.23.40",
  "rustls-pki-types",
  "rustls-platform-verifier 0.5.3",
  "soketto",
  "thiserror 1.0.69",
  "tokio",
- "tokio-rustls 0.26.2",
+ "tokio-rustls 0.26.4",
  "tokio-util",
  "tracing",
  "url",
@@ -6677,22 +6776,22 @@ dependencies = [
 
 [[package]]
 name = "jsonrpsee-core"
-version = "0.24.9"
+version = "0.24.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "456196007ca3a14db478346f58c7238028d55ee15c1df15115596e411ff27925"
+checksum = "f49bfa9334963e1c85866b39dff3ffcc81f1c286eb23334267c5cb97677543a4"
 dependencies = [
  "async-trait",
  "bytes",
  "futures-timer",
  "futures-util",
- "http 1.3.1",
+ "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
  "jsonrpsee-types",
- "parking_lot 0.12.4",
+ "parking_lot 0.12.5",
  "pin-project",
- "rand 0.8.5",
- "rustc-hash 2.1.1",
+ "rand 0.8.6",
+ "rustc-hash 2.1.2",
  "serde",
  "serde_json",
  "thiserror 1.0.69",
@@ -6704,19 +6803,19 @@ dependencies = [
 
 [[package]]
 name = "jsonrpsee-http-client"
-version = "0.24.9"
+version = "0.24.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c872b6c9961a4ccc543e321bb5b89f6b2d2c7fe8b61906918273a3333c95400c"
+checksum = "c215647e43482d478a6c21f021a013b50d64cf63431c1176eda9ef925dc54ec8"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
  "http-body 1.0.1",
- "hyper 1.9.0",
- "hyper-rustls 0.27.7",
+ "hyper 1.10.0",
+ "hyper-rustls 0.27.9",
  "hyper-util",
  "jsonrpsee-core",
  "jsonrpsee-types",
- "rustls 0.23.28",
+ "rustls 0.23.40",
  "rustls-platform-verifier 0.5.3",
  "serde",
  "serde_json",
@@ -6729,28 +6828,28 @@ dependencies = [
 
 [[package]]
 name = "jsonrpsee-proc-macros"
-version = "0.24.9"
+version = "0.24.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e65763c942dfc9358146571911b0cd1c361c2d63e2d2305622d40d36376ca80"
+checksum = "f5248249c016692f1465a753057ae8347681995dd490c2cb65c48b14b46215a8"
 dependencies = [
  "heck 0.5.0",
- "proc-macro-crate 3.3.0",
+ "proc-macro-crate 3.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "jsonrpsee-server"
-version = "0.24.9"
+version = "0.24.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55e363146da18e50ad2b51a0a7925fc423137a0b1371af8235b1c231a0647328"
+checksum = "c625c78b8d545478370b6e7a2a191b0d921f831a9eef38dc1e7efb57e7a5472f"
 dependencies = [
  "futures-util",
- "http 1.3.1",
+ "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.9.0",
+ "hyper 1.10.0",
  "hyper-util",
  "jsonrpsee-core",
  "jsonrpsee-types",
@@ -6769,11 +6868,11 @@ dependencies = [
 
 [[package]]
 name = "jsonrpsee-types"
-version = "0.24.9"
+version = "0.24.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08a8e70baf945b6b5752fc8eb38c918a48f1234daf11355e07106d963f860089"
+checksum = "41d86fc943f81dab0ecdd6c0240b6e0f55ad57a2ea9ad8ad7efe8456fb9cc7a4"
 dependencies = [
- "http 1.3.1",
+ "http 1.4.1",
  "serde",
  "serde_json",
  "thiserror 1.0.69",
@@ -6781,9 +6880,9 @@ dependencies = [
 
 [[package]]
 name = "jsonrpsee-wasm-client"
-version = "0.24.9"
+version = "0.24.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6558a9586cad43019dafd0b6311d0938f46efc116b34b28c74778bc11a2edf6"
+checksum = "735df2088674c87f7fecdf51c80878a7aa19a8116b32d703b000f5b1a7acf95a"
 dependencies = [
  "jsonrpsee-client-transport",
  "jsonrpsee-core",
@@ -6792,11 +6891,11 @@ dependencies = [
 
 [[package]]
 name = "jsonrpsee-ws-client"
-version = "0.24.9"
+version = "0.24.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01b3323d890aa384f12148e8d2a1fd18eb66e9e7e825f9de4fa53bcc19b93eef"
+checksum = "9df5bd5c38c0906a6e8b3a38c8c22cc8525fda25fd1a03a3fe010686aea66b70"
 dependencies = [
- "http 1.3.1",
+ "http 1.4.1",
  "jsonrpsee-client-transport",
  "jsonrpsee-core",
  "jsonrpsee-types",
@@ -6815,13 +6914,13 @@ dependencies = [
  "bytecount",
  "fancy-regex 0.13.0",
  "fraction",
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "iso8601",
  "itoa",
  "memchr",
  "num-cmp",
  "once_cell",
- "parking_lot 0.12.4",
+ "parking_lot 0.12.5",
  "percent-encoding",
  "regex",
  "serde",
@@ -6851,9 +6950,9 @@ dependencies = [
  "percent-encoding",
  "referencing",
  "regex",
- "regex-syntax 0.8.5",
- "reqwest 0.13.2",
- "rustls 0.23.28",
+ "regex-syntax",
+ "reqwest 0.13.4",
+ "rustls 0.23.40",
  "serde",
  "serde_json",
  "unicode-general-category",
@@ -6887,7 +6986,7 @@ dependencies = [
  "ring",
  "serde",
  "serde_json",
- "simple_asn1 0.6.3",
+ "simple_asn1 0.6.4",
 ]
 
 [[package]]
@@ -6907,9 +7006,9 @@ dependencies = [
 
 [[package]]
 name = "keccak"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecc2af9a1119c51f12a14607e783cb977bde58bc069ff0c3da1095e635d70654"
+checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
 dependencies = [
  "cpufeatures 0.2.17",
 ]
@@ -6942,9 +7041,24 @@ dependencies = [
  "convert_case 0.6.0",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "konst"
+version = "0.2.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "128133ed7824fcd73d6e7b17957c5eb7bacb885649bd8c69708b2331a10bcefb"
+dependencies = [
+ "konst_macro_rules",
 ]
 
+[[package]]
+name = "konst_macro_rules"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4933f3f57a8e9d9da04db23fb153356ecaf00cbd14aee46279c33dc80925c37"
+
 [[package]]
 name = "kv-log-macro"
 version = "1.0.7"
@@ -6971,9 +7085,9 @@ dependencies = [
 
 [[package]]
 name = "leb128"
-version = "0.2.5"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "884e2677b40cc8c339eaefcb701c32ef1fd2493d71118dc0ca4b6a736c93bd67"
+checksum = "6cc46bac87ef8093eed6f272babb833b6443374399985ac8ed28471ee0918545"
 
 [[package]]
 name = "leb128fmt"
@@ -6983,18 +7097,18 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "lexical"
-version = "7.0.4"
+version = "7.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ed980ff02623721dc334b9105150b66d0e1f246a92ab5a2eca0335d54c48f6"
+checksum = "1bc8a009b2ff1f419ccc62706f04fe0ca6e67b37460513964a3dfdb919bb37d6"
 dependencies = [
  "lexical-core",
 ]
 
 [[package]]
 name = "lexical-core"
-version = "1.0.5"
+version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b765c31809609075565a70b4b71402281283aeda7ecaf4818ac14a7b2ade8958"
+checksum = "7d8d125a277f807e55a77304455eb7b1cb52f2b18c143b60e766c120bd64a594"
 dependencies = [
  "lexical-parse-float",
  "lexical-parse-integer",
@@ -7005,114 +7119,108 @@ dependencies = [
 
 [[package]]
 name = "lexical-parse-float"
-version = "1.0.5"
+version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de6f9cb01fb0b08060209a057c048fcbab8717b4c1ecd2eac66ebfe39a65b0f2"
+checksum = "52a9f232fbd6f550bc0137dcb5f99ab674071ac2d690ac69704593cb4abbea56"
 dependencies = [
  "lexical-parse-integer",
  "lexical-util",
- "static_assertions",
 ]
 
 [[package]]
 name = "lexical-parse-integer"
-version = "1.0.5"
+version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72207aae22fc0a121ba7b6d479e42cbfea549af1479c3f3a4f12c70dd66df12e"
+checksum = "9a7a039f8fb9c19c996cd7b2fcce303c1b2874fe1aca544edc85c4a5f8489b34"
 dependencies = [
  "lexical-util",
- "static_assertions",
 ]
 
 [[package]]
 name = "lexical-util"
-version = "1.0.6"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a82e24bf537fd24c177ffbbdc6ebcc8d54732c35b50a3f28cc3f4e4c949a0b3"
-dependencies = [
- "static_assertions",
-]
+checksum = "2604dd126bb14f13fb5d1bd6a66155079cb9fa655b37f875b3a742c705dbed17"
 
 [[package]]
 name = "lexical-write-float"
-version = "1.0.5"
+version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5afc668a27f460fb45a81a757b6bf2f43c2d7e30cb5a2dcd3abf294c78d62bd"
+checksum = "50c438c87c013188d415fbabbb1dceb44249ab81664efbd31b14ae55dabb6361"
 dependencies = [
  "lexical-util",
  "lexical-write-integer",
- "static_assertions",
 ]
 
 [[package]]
 name = "lexical-write-integer"
-version = "1.0.5"
+version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "629ddff1a914a836fb245616a7888b62903aae58fa771e1d83943035efa0f978"
+checksum = "409851a618475d2d5796377cad353802345cba92c867d9fbcde9cf4eac4e14df"
 dependencies = [
  "lexical-util",
- "static_assertions",
 ]
 
 [[package]]
 name = "libc"
-version = "0.2.174"
+version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
 [[package]]
 name = "libflate"
-version = "2.1.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45d9dfdc14ea4ef0900c1cddbc8dcd553fbaacd8a4a282cf4018ae9dd04fb21e"
+checksum = "cd96e993e5f3368b0cb8497dae6c860c22af8ff18388c61c6c0b86c58d86b5df"
 dependencies = [
  "adler32",
- "core2",
  "crc32fast",
  "dary_heap",
  "libflate_lz77",
+ "no_std_io2",
 ]
 
 [[package]]
 name = "libflate_lz77"
-version = "2.1.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e0d73b369f386f1c44abd9c570d5318f55ccde816ff4b562fa452e5182863d"
+checksum = "ff7a10e427698aef6eef269482776debfef63384d30f13aad39a1a95e0e098fd"
 dependencies = [
- "core2",
- "hashbrown 0.14.5",
+ "hashbrown 0.16.1",
+ "no_std_io2",
  "rle-decode-fast",
 ]
 
 [[package]]
 name = "libm"
-version = "0.2.15"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9fbbcab51052fe104eb5e5d351cf728d30a5be1fe14d9be8a3b097481fb97de"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
 [[package]]
 name = "libp2p-identity"
-version = "0.2.13"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0c7892c221730ba55f7196e98b0b8ba5e04b4155651736036628e9f73ed6fc3"
+checksum = "9525f3831544f7ae497bde79adf114ef127b0fbbb97edbbf692a80408636421c"
 dependencies = [
  "bs58 0.5.1",
  "hkdf 0.12.4",
  "multihash",
  "sha2 0.10.9",
- "thiserror 2.0.12",
+ "thiserror 2.0.18",
  "tracing",
 ]
 
 [[package]]
 name = "libredox"
-version = "0.1.3"
+version = "0.1.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
+checksum = "f02ab6bace2054fb888a3c16f990117b579d14a3088e472d63c6011fa185c9d3"
 dependencies = [
- "bitflags 2.9.1",
+ "bitflags 2.11.1",
  "libc",
- "redox_syscall 0.5.13",
+ "plain",
+ "redox_syscall 0.8.0",
 ]
 
 [[package]]
@@ -7128,7 +7236,7 @@ dependencies = [
  "libsecp256k1-core",
  "libsecp256k1-gen-ecmult",
  "libsecp256k1-gen-genmult",
- "rand 0.8.5",
+ "rand 0.8.6",
  "serde",
  "sha2 0.9.9",
  "typenum",
@@ -7165,9 +7273,9 @@ dependencies = [
 
 [[package]]
 name = "libsodium-sys-stable"
-version = "1.22.3"
+version = "1.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b023d38f2afdfe36f81e15a9d7232097701d7b107e3a93ba903083985e235239"
+checksum = "72b04bf6da2c98b727af37ab62cb505f4d751b975b034a9b9ad491d333b0564e"
 dependencies = [
  "cc",
  "libc",
@@ -7192,9 +7300,9 @@ dependencies = [
 
 [[package]]
 name = "libz-sys"
-version = "1.1.22"
+version = "1.1.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b70e7a7df205e92a1a4cd9aaae7898dac0aa555503cc0a649494d0d60e7651d"
+checksum = "fc3a226e576f50782b3305c5ccf458698f92798987f551c6a02efe8276721e22"
 dependencies = [
  "cc",
  "pkg-config",
@@ -7209,23 +7317,22 @@ checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.9.4"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd945864f07fe9f5371a27ad7b52a172b4b499999f1d97574c9fa68373937e12"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
 name = "litemap"
-version = "0.8.0"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "241eaef5fd12c88705a01fc1066c48c4b36e0dd4377dcdc7ec3942cea7a69956"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
 
 [[package]]
 name = "lock_api"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96936507f153605bddfcda068dd804796c84324ed2510809e5b2a624c81da765"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
 dependencies = [
- "autocfg",
  "scopeguard",
 ]
 
@@ -7253,11 +7360,11 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.27"
+version = "0.4.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
+checksum = "616ec5685824bcc94416c6d4a7a446eea774a31efd7062c8480ba6fd06d7a6e5"
 dependencies = [
- "serde",
+ "serde_core",
  "value-bag",
 ]
 
@@ -7267,16 +7374,7 @@ version = "0.12.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "234cf4f4a04dc1f57e24b96cc0cd600cf2af460d4161ac5ecdd0af8e1f3b2a38"
 dependencies = [
- "hashbrown 0.15.4",
-]
-
-[[package]]
-name = "lru-cache"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31e24f1ad8321ca0e8a1e0ac13f23cb668e6f5466c2c57319f6a5cf1cc8e3b1c"
-dependencies = [
- "linked-hash-map",
+ "hashbrown 0.15.5",
 ]
 
 [[package]]
@@ -7307,7 +7405,7 @@ dependencies = [
  "macro_magic_core",
  "macro_magic_macros",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -7321,7 +7419,7 @@ dependencies = [
  "macro_magic_core_macros",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -7332,7 +7430,7 @@ checksum = "b02abfe41815b5bd98dbd4260173db2c116dda171dc0fe7838cb206333b83308"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -7343,16 +7441,27 @@ checksum = "73ea28ee64b88876bf45277ed9a5817c1817df061a74f2b988971a12570e5869"
 dependencies = [
  "macro_magic_core",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "match-lookup"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "757aee279b8bdbb9f9e676796fd459e4207a1f986e87886700abf589f5abf771"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "matchers"
-version = "0.1.0"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8263075bb86c5a1b1427b5ae862e8889656f126e9f77c484496e8b47cf5c5558"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
 dependencies = [
- "regex-automata 0.1.10",
+ "regex-automata",
 ]
 
 [[package]]
@@ -7385,9 +7494,9 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.7.5"
+version = "2.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
+checksum = "6b947ae49db0d222b1dbc6b113ce7248a3fc3a6ca21b696717bfc000ba4484d8"
 
 [[package]]
 name = "memoffset"
@@ -7400,12 +7509,12 @@ dependencies = [
 
 [[package]]
 name = "metrics"
-version = "0.24.2"
+version = "0.24.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25dea7ac8057892855ec285c440160265225438c3c45072613c25a4b26e98ef5"
+checksum = "89550ee9f79e88fef3119de263694973a8adb26c21d75322164fb8c493039fe2"
 dependencies = [
- "ahash 0.8.12",
  "portable-atomic",
+ "rapidhash",
 ]
 
 [[package]]
@@ -7415,26 +7524,27 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b166dea96003ee2531cf14833efedced545751d800f03535801d833313f8c15"
 dependencies = [
  "base64 0.22.1",
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "metrics",
  "metrics-util",
  "quanta",
- "thiserror 2.0.12",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
 name = "metrics-util"
-version = "0.20.0"
+version = "0.20.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe8db7a05415d0f919ffb905afa37784f71901c9a773188876984b4f769ab986"
+checksum = "96f8722f8562635f92f8ed992f26df0532266eb03d5202607c20c0d7e9745e13"
 dependencies = [
  "crossbeam-epoch",
  "crossbeam-utils",
- "hashbrown 0.15.4",
+ "hashbrown 0.16.1",
  "metrics",
  "quanta",
- "rand 0.9.1",
+ "rand 0.9.4",
  "rand_xoshiro 0.7.0",
+ "rapidhash",
  "sketches-ddsketch",
 ]
 
@@ -7462,9 +7572,9 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
 name = "minisign-verify"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e856fdd13623a2f5f2f54676a4ee49502a96a80ef4a62bcedd23d52427c44d43"
+checksum = "22f9645cb765ea72b8111f36c522475d2daa0d22c957a9826437e97534bc4e9e"
 
 [[package]]
 name = "miniz_oxide"
@@ -7473,17 +7583,35 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
 dependencies = [
  "adler2",
+ "simd-adler32",
 ]
 
 [[package]]
 name = "mio"
-version = "1.0.4"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
+checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
 dependencies = [
  "libc",
  "wasi 0.11.1+wasi-snapshot-preview1",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "moka"
+version = "0.12.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "957228ad12042ee839f93c8f257b62b4c0ab5eaae1d4fa60de53b27c9d7c5046"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+ "equivalent",
+ "parking_lot 0.12.5",
+ "portable-atomic",
+ "smallvec",
+ "tagptr",
+ "uuid",
 ]
 
 [[package]]
@@ -7496,7 +7624,7 @@ dependencies = [
  "cqrs-es 0.4.12",
  "futures",
  "log",
- "mongodb 3.2.4",
+ "mongodb 3.7.0",
  "serde",
  "serde_json",
  "tokio",
@@ -7511,12 +7639,30 @@ dependencies = [
  "cqrs-es 0.5.0",
  "futures",
  "log",
- "mongodb 3.2.4",
+ "mongodb 3.7.0",
  "serde",
  "serde_json",
  "tokio",
 ]
 
+[[package]]
+name = "mongocrypt"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8da0cd419a51a5fb44819e290fbdb0665a54f21dead8923446a799c7f4d26ad9"
+dependencies = [
+ "bson",
+ "mongocrypt-sys",
+ "once_cell",
+ "serde",
+]
+
+[[package]]
+name = "mongocrypt-sys"
+version = "0.1.5+1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224484c5d09285a7b8cb0a0c117e847ebd14cb6e4470ecf68cdb89c503b0edb9"
+
 [[package]]
 name = "mongodb"
 version = "0.1.0"
@@ -7528,84 +7674,82 @@ dependencies = [
 
 [[package]]
 name = "mongodb"
-version = "3.2.4"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0f8c69f13acf07eae386a2974f48ffd9187ea2aba8defbea9aa34e7e272c5f3"
+checksum = "276ba0cd571553d1f6936c6f180964776ece6ab7507dc8765f8a9c9c49d8cd00"
 dependencies = [
- "async-trait",
- "base64 0.13.1",
- "bitflags 1.3.2",
+ "base64 0.22.1",
+ "bitflags 2.11.1",
  "bson",
- "chrono",
  "derive-where",
- "derive_more 0.99.20",
+ "derive_more 2.1.1",
  "futures-core",
- "futures-executor",
  "futures-io",
  "futures-util",
  "hex",
+ "hickory-net",
  "hickory-proto",
  "hickory-resolver",
  "hmac 0.12.1",
  "macro_magic",
  "md-5",
+ "mongocrypt",
  "mongodb-internal-macros",
- "once_cell",
- "pbkdf2 0.11.0",
+ "pbkdf2 0.12.2",
  "percent-encoding",
- "rand 0.8.5",
+ "rand 0.9.4",
  "rustc_version_runtime",
- "rustls 0.21.12",
- "rustls-pemfile 1.0.4",
+ "rustls 0.23.40",
  "serde",
  "serde_bytes",
- "serde_with 3.13.0",
+ "serde_with 3.20.0",
  "sha1",
  "sha2 0.10.9",
- "socket2 0.5.10",
+ "socket2 0.6.4",
  "stringprep",
  "strsim 0.11.1",
  "take_mut",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
  "tokio",
- "tokio-rustls 0.24.1",
+ "tokio-rustls 0.26.4",
  "tokio-util",
  "typed-builder",
  "uuid",
- "webpki-roots 0.25.4",
+ "webpki-roots 1.0.7",
 ]
 
 [[package]]
 name = "mongodb-internal-macros"
-version = "3.2.4"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9202de265a3a8bbb43f9fe56db27c93137d4f9fb04c093f47e9c7de0c61ac7d"
+checksum = "99ceb1a9a1018e470077ec94cf3a8c2d0e6da542b2c05ea95a59a0a627147375"
 dependencies = [
  "macro_magic",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "monostate"
-version = "0.1.14"
+version = "0.1.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aafe1be9d0c75642e3e50fedc7ecadf1ef1cbce6eb66462153fc44245343fbee"
+checksum = "3341a273f6c9d5bef1908f17b7267bbab0e95c9bf69a0d4dcf8e9e1b2c76ef67"
 dependencies = [
  "monostate-impl",
  "serde",
+ "serde_core",
 ]
 
 [[package]]
 name = "monostate-impl"
-version = "0.1.14"
+version = "0.1.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c402a4092d5e204f32c9e155431046831fa712637043c58cb73bc6bc6c9663b5"
+checksum = "e4db6d5580af57bf992f59068d4ea26fd518574ff48d7639b255a36f9de6e7e9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -7629,7 +7773,7 @@ source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892
 dependencies = [
  "anyhow",
  "enum-compat-util",
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "move-core-types",
  "move-proc-macros",
  "ref-cast",
@@ -7664,7 +7808,7 @@ version = "0.1.0"
 source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "anyhow",
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "move-binary-format",
  "move-core-types",
  "petgraph",
@@ -7768,11 +7912,11 @@ dependencies = [
  "num",
  "once_cell",
  "primitive-types 0.10.1",
- "rand 0.8.5",
+ "rand 0.8.6",
  "ref-cast",
  "serde",
  "serde_bytes",
- "serde_with 3.13.0",
+ "serde_with 3.20.0",
  "thiserror 1.0.69",
  "uint",
 ]
@@ -7787,7 +7931,7 @@ dependencies = [
  "clap",
  "codespan",
  "colored",
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "move-abstract-interpreter",
  "move-binary-format",
  "move-bytecode-source-map",
@@ -7869,7 +8013,7 @@ version = "0.1.0"
 source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -8011,7 +8155,7 @@ dependencies = [
  "byteorder",
  "data-encoding",
  "libp2p-identity",
- "multibase 0.9.1",
+ "multibase 0.9.2",
  "multihash",
  "percent-encoding",
  "serde",
@@ -8033,11 +8177,12 @@ dependencies = [
 
 [[package]]
 name = "multibase"
-version = "0.9.1"
+version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b3539ec3c1f04ac9748a260728e855f261b4977f5c3406612c884564f329404"
+checksum = "8694bb4835f452b0e3bb06dbebb1d6fc5385b6ca1caf2e55fd165c042390ec77"
 dependencies = [
  "base-x",
+ "base256emoji",
  "data-encoding",
  "data-encoding-macro",
 ]
@@ -8057,11 +8202,17 @@ version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7bddcd3bf5144b6392de80e04c347cd7fab2508f6df16a85fc496ecd5cec39bc"
 dependencies = [
- "rand 0.8.5",
+ "rand 0.8.6",
 ]
 
 [[package]]
-name = "neptune"
+name = "ndk-context"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
+
+[[package]]
+name = "neptune"
 version = "13.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06626c9ac04c894e9a23d061ba1309f28506cdc5fe64156d28a15fb57fc8e438"
@@ -8099,10 +8250,10 @@ checksum = "879011babc47a1c7fdf5a935ae3cfe94f34645ca0cac1c7f6424b36fc743d1bf"
 dependencies = [
  "data-encoding",
  "ed25519 2.2.3",
- "ed25519-dalek 2.1.1",
- "getrandom 0.2.16",
+ "ed25519-dalek 2.2.0",
+ "getrandom 0.2.17",
  "log",
- "rand 0.8.5",
+ "rand 0.8.6",
  "signatory",
 ]
 
@@ -8112,6 +8263,15 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b93853da6d84c2e3c7d730d6473e8817692dd89be387eb01b94d7f108ecb5b8c"
 
+[[package]]
+name = "no_std_io2"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "418abd1b6d34fbf6cae440dc874771b0525a604428704c76e48b29a5e67b8003"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "nom"
 version = "7.1.3"
@@ -8145,21 +8305,20 @@ checksum = "38bf9645c8b145698bb0b18a4637dcacbc421ea49bef2317e4fd8065a387cf21"
 
 [[package]]
 name = "ntapi"
-version = "0.4.1"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8a3895c6391c39d7fe7ebc444a87eb2991b2a0bc718fdabd071eec617fc68e4"
+checksum = "c3b335231dfd352ffb0f8017f3b6027a4917f7df785ea2143d8af2adc66980ae"
 dependencies = [
  "winapi",
 ]
 
 [[package]]
 name = "nu-ansi-term"
-version = "0.46.0"
+version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77a8165726e8236064dbb45459242600304b42a5ea24ee2948e18e023bf7ba84"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "overload",
- "winapi",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -8168,7 +8327,7 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc895af95856f929163a0aa20c26a78d26bfdc839f51b9d5aa7a5b79e52b7e83"
 dependencies = [
- "rand 0.8.5",
+ "rand 0.8.6",
 ]
 
 [[package]]
@@ -8204,23 +8363,22 @@ checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
 dependencies = [
  "num-integer",
  "num-traits",
- "rand 0.8.5",
+ "rand 0.8.6",
  "serde",
 ]
 
 [[package]]
 name = "num-bigint-dig"
-version = "0.8.4"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc84195820f291c7697304f3cbdadd1cb7199c0efc917ff5eafd71225c136151"
+checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
 dependencies = [
- "byteorder",
  "lazy_static",
  "libm",
  "num-integer",
  "num-iter",
  "num-traits",
- "rand 0.8.5",
+ "rand 0.8.6",
  "smallvec",
  "zeroize",
 ]
@@ -8242,9 +8400,9 @@ dependencies = [
 
 [[package]]
 name = "num-conv"
-version = "0.1.0"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
 
 [[package]]
 name = "num-derive"
@@ -8265,7 +8423,7 @@ checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -8312,7 +8470,7 @@ dependencies = [
  "num-integer",
  "num-modular",
  "num-traits",
- "rand 0.8.5",
+ "rand 0.8.6",
 ]
 
 [[package]]
@@ -8366,7 +8524,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustc_version",
- "syn 2.0.104",
+ "syn 2.0.117",
  "urlencoding",
 ]
 
@@ -8386,9 +8544,9 @@ dependencies = [
 
 [[package]]
 name = "object"
-version = "0.36.7"
+version = "0.37.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
+checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe"
 dependencies = [
  "memchr",
 ]
@@ -8407,24 +8565,24 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
- "http 1.3.1",
+ "http 1.4.1",
  "http-body-util",
  "httparse",
  "humantime",
- "hyper 1.9.0",
+ "hyper 1.10.0",
  "itertools 0.14.0",
  "md-5",
- "parking_lot 0.12.4",
+ "parking_lot 0.12.5",
  "percent-encoding",
  "quick-xml",
- "rand 0.10.0",
- "reqwest 0.12.20",
+ "rand 0.10.1",
+ "reqwest 0.12.28",
  "ring",
  "rustls-pki-types",
  "serde",
  "serde_json",
  "serde_urlencoded",
- "thiserror 2.0.12",
+ "thiserror 2.0.18",
  "tokio",
  "tracing",
  "url",
@@ -8454,7 +8612,7 @@ dependencies = [
  "derive_more 0.99.20",
  "did-key",
  "did_url",
- "ed25519-dalek 2.1.1",
+ "ed25519-dalek 2.2.0",
  "getset",
  "identity_did",
  "identity_document",
@@ -8466,7 +8624,7 @@ dependencies = [
  "jsonwebtoken",
  "lazy_static",
  "nutype",
- "rand 0.8.5",
+ "rand 0.8.6",
  "serde",
  "serde_json",
  "serde_urlencoded",
@@ -8500,7 +8658,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_urlencoded",
- "serde_with 3.13.0",
+ "serde_with 3.20.0",
  "siopv2",
  "tokio",
  "tower-http 0.4.4",
@@ -8516,7 +8674,7 @@ dependencies = [
  "chrono",
  "derivative",
  "getset",
- "http 1.3.1",
+ "http 1.4.1",
  "jsonwebtoken",
  "lazy_static",
  "nutype",
@@ -8529,7 +8687,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_urlencoded",
- "serde_with 3.13.0",
+ "serde_with 3.20.0",
  "thiserror 1.0.69",
  "tokio",
  "url",
@@ -8561,7 +8719,7 @@ dependencies = [
  "reqwest-retry",
  "serde",
  "serde_json",
- "serde_with 3.13.0",
+ "serde_with 3.20.0",
  "thiserror 1.0.69",
  "tokio",
  "url",
@@ -8569,15 +8727,19 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+dependencies = [
+ "critical-section",
+ "portable-atomic",
+]
 
 [[package]]
 name = "once_cell_polyfill"
-version = "1.70.1"
+version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4895175b425cb1f87721b59f0f286c2092bd4af812243672510e1ac53e2e0ad"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 
 [[package]]
 name = "opaque-debug"
@@ -8591,6 +8753,12 @@ version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
 
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
 [[package]]
 name = "option-ext"
 version = "0.2.0"
@@ -8637,7 +8805,7 @@ dependencies = [
  "proc-macro-error",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -8646,12 +8814,6 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1a80800c0488c3a21695ea981a54918fbb37abf04f4d0720c453632255e2ff0e"
 
-[[package]]
-name = "overload"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
-
 [[package]]
 name = "p256"
 version = "0.11.1"
@@ -8799,10 +8961,10 @@ version = "3.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34b4653168b563151153c9e4c08ebed57fb8262bebfa79711552fa983c623e7a"
 dependencies = [
- "proc-macro-crate 3.3.0",
+ "proc-macro-crate 3.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -8824,12 +8986,12 @@ dependencies = [
 
 [[package]]
 name = "parking_lot"
-version = "0.12.4"
+version = "0.12.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70d58bf43669b5795d1576d0641cfb6fbb2057bf629506267a92807158584a13"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
 dependencies = [
  "lock_api",
- "parking_lot_core 0.9.11",
+ "parking_lot_core 0.9.12",
 ]
 
 [[package]]
@@ -8848,15 +9010,15 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.11"
+version = "0.9.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc838d2a56b5b1a6c25f55575dfc605fabb63bb2365f6c2353ef9159aa69e4a5"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall 0.5.13",
+ "redox_syscall 0.5.18",
  "smallvec",
- "windows-targets 0.52.6",
+ "windows-link",
 ]
 
 [[package]]
@@ -8865,14 +9027,14 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77144664f6aac5f629d7efa815f5098a054beeeca6ccafee5ec453fd2b0c53f9"
 dependencies = [
- "bitflags 2.9.1",
+ "bitflags 2.11.1",
  "ciborium",
  "coset",
  "data-encoding",
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "hmac 0.12.1",
- "indexmap 2.12.0",
- "rand 0.8.5",
+ "indexmap 2.14.0",
+ "rand 0.8.6",
  "serde",
  "serde_json",
  "sha2 0.10.9",
@@ -8892,7 +9054,7 @@ dependencies = [
  "group 0.13.0",
  "hex",
  "lazy_static",
- "rand 0.8.5",
+ "rand 0.8.6",
  "serde",
  "static_assertions",
  "subtle",
@@ -8940,12 +9102,12 @@ dependencies = [
 
 [[package]]
 name = "pem"
-version = "3.0.5"
+version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38af38e8470ac9dee3ce1bae1af9c1671fffc44ddfd8bd1d0a3445bf349a8ef3"
+checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
 dependencies = [
  "base64 0.22.1",
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -8977,9 +9139,9 @@ dependencies = [
 
 [[package]]
 name = "percent-encoding"
-version = "2.3.1"
+version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "permutohedron"
@@ -8989,20 +9151,19 @@ checksum = "b687ff7b5da449d39e418ad391e5e08da53ec334903ddbb921db208908fc372c"
 
 [[package]]
 name = "pest"
-version = "2.8.1"
+version = "2.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1db05f56d34358a8b1066f67cbb203ee3e7ed2ba674a6263a1d5ec6db2204323"
+checksum = "e0848c601009d37dfa3430c4666e147e49cdcf1b92ecd3e63657d8a5f19da662"
 dependencies = [
  "memchr",
- "thiserror 2.0.12",
  "ucd-trie",
 ]
 
 [[package]]
 name = "pest_derive"
-version = "2.8.1"
+version = "2.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb056d9e8ea77922845ec74a1c4e8fb17e7c218cc4fc11a15c5d25e189aa40bc"
+checksum = "11f486f1ea21e6c10ed15d5a7c77165d0ee443402f0780849d1768e7d9d6fe77"
 dependencies = [
  "pest",
  "pest_generator",
@@ -9010,22 +9171,22 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.8.1"
+version = "2.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87e404e638f781eb3202dc82db6760c8ae8a1eeef7fb3fa8264b2ef280504966"
+checksum = "8040c4647b13b210a963c1ed407c1ff4fdfa01c31d6d2a098218702e6664f94f"
 dependencies = [
  "pest",
  "pest_meta",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "pest_meta"
-version = "2.8.1"
+version = "2.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edd1101f170f5903fde0914f899bb503d9ff5271d7ba76bbb70bea63690cc0d5"
+checksum = "89815c69d36021a140146f26659a81d6c2afa33d216d736dd4be5381a7362220"
 dependencies = [
  "pest",
  "sha2 0.10.9",
@@ -9068,7 +9229,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
 dependencies = [
  "phf_shared",
- "rand 0.8.5",
+ "rand 0.8.6",
 ]
 
 [[package]]
@@ -9081,7 +9242,7 @@ dependencies = [
  "phf_shared",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -9095,29 +9256,29 @@ dependencies = [
 
 [[package]]
 name = "pin-project"
-version = "1.1.10"
+version = "1.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677f1add503faace112b9f1373e43e9e054bfdd22ff1a63c1bc485eaec6a6a8a"
+checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
 dependencies = [
  "pin-project-internal",
 ]
 
 [[package]]
 name = "pin-project-internal"
-version = "1.1.10"
+version = "1.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e918e4ff8c4549eb882f14b3a4bc8c8bc93de829416eacf579f1207a8fbf861"
+checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
 name = "pin-utils"
@@ -9127,9 +9288,9 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
 name = "piper"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96c8c490f422ef9a4efd2cb5b42b76c8613d7e7dfc1caf667b8a3350a5acc066"
+checksum = "c835479a4443ded371d6c535cbfd8d31ad92c5d23ae9770a61bc155e4992a3c1"
 dependencies = [
  "atomic-waker",
  "fastrand",
@@ -9143,7 +9304,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e228dbe2aebd82de09c914fe28d36d3170ed5192e8d52b9c070ee0794519c2d3"
 dependencies = [
  "base64 0.21.7",
- "rand 0.8.5",
+ "rand 0.8.6",
  "sha2 0.10.9",
 ]
 
@@ -9214,23 +9375,28 @@ dependencies = [
 
 [[package]]
 name = "pkg-config"
-version = "0.3.32"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
 [[package]]
 name = "polling"
-version = "3.8.0"
+version = "3.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b53a684391ad002dd6a596ceb6c74fd004fdce75f4be2e3f615068abbea5fd50"
+checksum = "5d0e4f59085d47d8241c88ead0f274e8a0cb551f3625263c05eb8dd897c34218"
 dependencies = [
  "cfg-if",
  "concurrent-queue",
  "hermit-abi",
  "pin-project-lite",
  "rustix",
- "tracing",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -9258,9 +9424,9 @@ dependencies = [
 
 [[package]]
 name = "portable-atomic"
-version = "1.11.1"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
 
 [[package]]
 name = "postgres-es"
@@ -9279,9 +9445,9 @@ dependencies = [
 
 [[package]]
 name = "potential_utf"
-version = "0.1.2"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5a7c30837279ca13e7c867e9e40053bc68740f988cb07f7ca6df43cc734b585"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
 dependencies = [
  "zerovec",
 ]
@@ -9312,6 +9478,17 @@ dependencies = [
  "uint",
 ]
 
+[[package]]
+name = "prefix-trie"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cf6e3177f0684016a5c209b00882e15f8bdd3f3bb48f0491df10cd102d0c6e7"
+dependencies = [
+ "either",
+ "ipnet",
+ "num-traits",
+]
+
 [[package]]
 name = "pretty_dtoa"
 version = "0.3.0"
@@ -9323,12 +9500,12 @@ dependencies = [
 
 [[package]]
 name = "prettyplease"
-version = "0.2.36"
+version = "0.2.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff24dfcda44452b9816fff4cd4227e1bb73ff5a2f1bc1105aa92fb8565ce44d2"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
 dependencies = [
  "proc-macro2",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -9386,11 +9563,11 @@ dependencies = [
 
 [[package]]
 name = "proc-macro-crate"
-version = "3.3.0"
+version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edce586971a4dfaa28950c6f18ed55e0406c1ab88bbce2c6f6293a7aaba73d35"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
 dependencies = [
- "toml_edit 0.22.27",
+ "toml_edit 0.25.12+spec-1.1.0",
 ]
 
 [[package]]
@@ -9436,14 +9613,14 @@ dependencies = [
  "proc-macro-error-attr2",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.95"
+version = "1.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
 dependencies = [
  "unicode-ident",
 ]
@@ -9480,7 +9657,7 @@ dependencies = [
  "bcs",
  "cfg-if",
  "fastcrypto",
- "hyper 1.9.0",
+ "hyper 1.10.0",
  "iota-sdk 1.22.0-alpha",
  "iota-sdk-types",
  "iota_interaction",
@@ -9488,7 +9665,7 @@ dependencies = [
  "iota_interaction_ts",
  "itertools 0.13.0",
  "phf",
- "reqwest 0.13.2",
+ "reqwest 0.13.4",
  "secret-storage",
  "serde",
  "serde_json",
@@ -9509,9 +9686,9 @@ dependencies = [
  "fnv",
  "lazy_static",
  "memchr",
- "parking_lot 0.12.4",
+ "parking_lot 0.12.5",
  "protobuf",
- "thiserror 2.0.12",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
@@ -9540,10 +9717,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
 dependencies = [
  "anyhow",
- "itertools 0.10.5",
+ "itertools 0.14.0",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -9577,10 +9754,11 @@ dependencies = [
 
 [[package]]
 name = "psm"
-version = "0.1.26"
+version = "0.1.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e944464ec8536cd1beb0bbfd96987eb5e3b72f2ecdafdc5c769a37f1fa2ae1f"
+checksum = "645dbe486e346d9b5de3ef16ede18c26e6c70ad97418f4874b8b1889d6e761ea"
 dependencies = [
+ "ar_archive_writer",
  "cc",
 ]
 
@@ -9601,9 +9779,9 @@ dependencies = [
 
 [[package]]
 name = "quick-xml"
-version = "0.39.2"
+version = "0.39.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "958f21e8e7ceb5a1aa7fa87fab28e7c75976e0bfe7e23ff069e0a260f894067d"
+checksum = "cdcc8dd4e2f670d309a5f0e83fe36dfdc05af317008fea29144da1a2ac858e5e"
 dependencies = [
  "memchr",
  "serde",
@@ -9611,9 +9789,9 @@ dependencies = [
 
 [[package]]
 name = "quinn"
-version = "0.11.8"
+version = "0.11.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "626214629cda6781b6dc1d316ba307189c85ba657213ce642d9c77670f8202c8"
+checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
 dependencies = [
  "bytes",
  "cfg_aliases",
@@ -9621,10 +9799,10 @@ dependencies = [
  "pin-project-lite",
  "quinn-proto",
  "quinn-udp",
- "rustc-hash 2.1.1",
- "rustls 0.23.28",
- "socket2 0.5.10",
- "thiserror 2.0.12",
+ "rustc-hash 2.1.2",
+ "rustls 0.23.40",
+ "socket2 0.6.4",
+ "thiserror 2.0.18",
  "tokio",
  "tracing",
  "web-time",
@@ -9632,20 +9810,20 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.12"
+version = "0.11.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49df843a9161c85bb8aae55f101bc0bac8bcafd637a620d9122fd7e0b2f7422e"
+checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
 dependencies = [
  "bytes",
  "getrandom 0.3.4",
  "lru-slab",
- "rand 0.9.1",
+ "rand 0.9.4",
  "ring",
- "rustc-hash 2.1.1",
- "rustls 0.23.28",
+ "rustc-hash 2.1.2",
+ "rustls 0.23.40",
  "rustls-pki-types",
  "slab",
- "thiserror 2.0.12",
+ "thiserror 2.0.18",
  "tinyvec",
  "tracing",
  "web-time",
@@ -9653,23 +9831,23 @@ dependencies = [
 
 [[package]]
 name = "quinn-udp"
-version = "0.5.13"
+version = "0.5.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcebb1209ee276352ef14ff8732e24cc2b02bbac986cd74a4c81bcb2f9881970"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
 dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.5.10",
+ "socket2 0.6.4",
  "tracing",
- "windows-sys 0.59.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.40"
+version = "1.0.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
 dependencies = [
  "proc-macro2",
 ]
@@ -9713,9 +9891,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
 dependencies = [
  "libc",
  "rand_chacha 0.3.1",
@@ -9724,23 +9902,23 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.1"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fbfd9d094a40bf3ae768db9361049ace4c0e04a4fd6b359518bd7b73a73dd97"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
 dependencies = [
  "rand_chacha 0.9.0",
- "rand_core 0.9.3",
+ "rand_core 0.9.5",
 ]
 
 [[package]]
 name = "rand"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc266eb313df6c5c09c1c7b1fbe2510961e5bcd3add930c1e31f7ed9da0feff8"
+checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
 dependencies = [
  "chacha20 0.10.0",
  "getrandom 0.4.2",
- "rand_core 0.10.0",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -9770,7 +9948,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
 dependencies = [
  "ppv-lite86",
- "rand_core 0.9.3",
+ "rand_core 0.9.5",
 ]
 
 [[package]]
@@ -9788,23 +9966,23 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
 ]
 
 [[package]]
 name = "rand_core"
-version = "0.9.3"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
 dependencies = [
  "getrandom 0.3.4",
 ]
 
 [[package]]
 name = "rand_core"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c8d0fd677905edcbeedbf2edb6494d676f0e98d54d5cf9bda0b061cb8fb8aba"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
 
 [[package]]
 name = "rand_hc"
@@ -9839,23 +10017,32 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f703f4665700daf5512dcca5f43afa6af89f09db47fb56be587f80636bda2d41"
 dependencies = [
- "rand_core 0.9.3",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rapidhash"
+version = "4.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e48930979c155e2f33aa36ab3119b5ee81332beb6482199a8ecd6029b80b59"
+dependencies = [
+ "rustversion",
 ]
 
 [[package]]
 name = "raw-cpuid"
-version = "11.5.0"
+version = "11.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6df7ab838ed27997ba19a4664507e6f82b41fe6e20be42929332156e5e85146"
+checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
 dependencies = [
- "bitflags 2.9.1",
+ "bitflags 2.11.1",
 ]
 
 [[package]]
 name = "rayon"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "368f01d005bf8fd9b1206fb6fa653e6c4a81ceb1466406b81792d87c5677a58f"
+checksum = "fb39b166781f92d482534ef4b4b1b2568f42613b53e5b6c160e24cfbfa30926d"
 dependencies = [
  "either",
  "rayon-core",
@@ -9905,7 +10092,7 @@ checksum = "f2a62d85ed81ca5305dc544bd42c8804c5060b78ffa5ad3c64b0fb6a8c13d062"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -9919,11 +10106,20 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.13"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags 2.11.1",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d04b7d0ee6b4a0207a0a7adb104d23ecb0b47d6beae7152d0fa34b692b29fd6"
+checksum = "7c7591fa2c6b601dfcfe5f043f65a1c39fcdf50efefcd7f1572e538c1f4b398d"
 dependencies = [
- "bitflags 2.9.1",
+ "bitflags 2.11.1",
 ]
 
 [[package]]
@@ -9932,29 +10128,29 @@ version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43"
 dependencies = [
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "libredox",
  "thiserror 1.0.69",
 ]
 
 [[package]]
 name = "ref-cast"
-version = "1.0.24"
+version = "1.0.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a0ae411dbe946a674d89546582cea4ba2bb8defac896622d6496f14c23ba5cf"
+checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
 dependencies = [
  "ref-cast-impl",
 ]
 
 [[package]]
 name = "ref-cast-impl"
-version = "1.0.24"
+version = "1.0.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1165225c21bff1f3bbce98f5a1f889949bc902d3575308cc7b0de30b4f6d27c7"
+checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -9966,55 +10162,40 @@ dependencies = [
  "ahash 0.8.12",
  "fluent-uri",
  "getrandom 0.3.4",
- "hashbrown 0.16.0",
- "parking_lot 0.12.4",
+ "hashbrown 0.16.1",
+ "parking_lot 0.12.5",
  "percent-encoding",
  "serde_json",
 ]
 
 [[package]]
 name = "regex"
-version = "1.11.1"
+version = "1.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
+checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-automata 0.4.9",
- "regex-syntax 0.8.5",
-]
-
-[[package]]
-name = "regex-automata"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
-dependencies = [
- "regex-syntax 0.6.29",
+ "regex-automata",
+ "regex-syntax",
 ]
 
 [[package]]
 name = "regex-automata"
-version = "0.4.9"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax 0.8.5",
+ "regex-syntax",
 ]
 
 [[package]]
 name = "regex-syntax"
-version = "0.6.29"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
-
-[[package]]
-name = "regex-syntax"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
 
 [[package]]
 name = "relative-path"
@@ -10033,7 +10214,7 @@ dependencies = [
  "encoding_rs",
  "futures-core",
  "futures-util",
- "h2 0.3.26",
+ "h2 0.3.27",
  "http 0.2.12",
  "http-body 0.4.6",
  "hyper 0.14.32",
@@ -10052,7 +10233,7 @@ dependencies = [
  "serde_json",
  "serde_urlencoded",
  "sync_wrapper 0.1.2",
- "system-configuration",
+ "system-configuration 0.5.1",
  "tokio",
  "tokio-rustls 0.24.1",
  "tower-service",
@@ -10066,80 +10247,80 @@ dependencies = [
 
 [[package]]
 name = "reqwest"
-version = "0.12.20"
+version = "0.12.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eabf4c97d9130e2bf606614eb937e86edac8292eaa6f422f995d7e8de1eb1813"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
  "base64 0.22.1",
  "bytes",
  "futures-channel",
  "futures-core",
  "futures-util",
- "h2 0.4.10",
- "http 1.3.1",
+ "h2 0.4.14",
+ "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.9.0",
- "hyper-rustls 0.27.7",
+ "hyper 1.10.0",
+ "hyper-rustls 0.27.9",
  "hyper-util",
  "js-sys",
  "log",
  "percent-encoding",
  "pin-project-lite",
  "quinn",
- "rustls 0.23.28",
- "rustls-native-certs 0.8.1",
+ "rustls 0.23.40",
+ "rustls-native-certs 0.8.3",
  "rustls-pki-types",
  "serde",
  "serde_json",
  "serde_urlencoded",
  "sync_wrapper 1.0.2",
  "tokio",
- "tokio-rustls 0.26.2",
+ "tokio-rustls 0.26.4",
  "tokio-util",
- "tower 0.5.2",
- "tower-http 0.6.8",
+ "tower 0.5.3",
+ "tower-http 0.6.11",
  "tower-service",
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "wasm-streams",
  "web-sys",
- "webpki-roots 1.0.1",
+ "webpki-roots 1.0.7",
 ]
 
 [[package]]
 name = "reqwest"
-version = "0.13.2"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab3f43e3283ab1488b624b44b0e988d0acea0b3214e694730a055cb6b2efa801"
+checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
 dependencies = [
  "base64 0.22.1",
  "bytes",
  "futures-channel",
  "futures-core",
  "futures-util",
- "h2 0.4.10",
- "http 1.3.1",
+ "h2 0.4.14",
+ "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.9.0",
- "hyper-rustls 0.27.7",
+ "hyper 1.10.0",
+ "hyper-rustls 0.27.9",
  "hyper-util",
  "js-sys",
  "log",
  "percent-encoding",
  "pin-project-lite",
- "rustls 0.23.28",
+ "rustls 0.23.40",
  "rustls-pki-types",
- "rustls-platform-verifier 0.6.2",
+ "rustls-platform-verifier 0.7.0",
  "serde",
  "serde_json",
  "sync_wrapper 1.0.2",
  "tokio",
- "tokio-rustls 0.26.2",
- "tower 0.5.2",
- "tower-http 0.6.8",
+ "tokio-rustls 0.26.4",
+ "tower 0.5.3",
+ "tower-http 0.6.11",
  "tower-service",
  "url",
  "wasm-bindgen",
@@ -10172,7 +10353,7 @@ dependencies = [
  "async-trait",
  "chrono",
  "futures",
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "http 0.2.12",
  "hyper 0.14.32",
  "parking_lot 0.11.2",
@@ -10187,9 +10368,9 @@ dependencies = [
 
 [[package]]
 name = "resolv-conf"
-version = "0.7.4"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95325155c684b1c89f7765e30bc1c42e4a6da51ca513615660cb8a62ef9a88e3"
+checksum = "1e061d1b48cb8d38042de4ae0a7a6401009d6143dc80d2e2d6f31f0bdd6470c7"
 
 [[package]]
 name = "retry-policies"
@@ -10199,7 +10380,7 @@ checksum = "17dd00bff1d737c40dbcd47d4375281bf4c17933f9eef0a185fc7bacca23ecbd"
 dependencies = [
  "anyhow",
  "chrono",
- "rand 0.8.5",
+ "rand 0.8.6",
 ]
 
 [[package]]
@@ -10231,7 +10412,7 @@ checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
 dependencies = [
  "cc",
  "cfg-if",
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "libc",
  "untrusted",
  "windows-sys 0.52.0",
@@ -10276,9 +10457,9 @@ dependencies = [
 
 [[package]]
 name = "roaring"
-version = "0.11.3"
+version = "0.11.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ba9ce64a8f45d7fc86358410bb1a82e8c987504c0d4900e9141d69a9f26c885"
+checksum = "1dedc5658c6ecb3bdb5ef5f3295bb9253f42dcf3fd1402c03f6b1f7659c3c4a9"
 dependencies = [
  "bytemuck",
  "byteorder",
@@ -10291,7 +10472,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b91f7eff05f748767f183df4320a63d6936e9c6107d97c9e6bdd9784f4289c94"
 dependencies = [
  "base64 0.21.7",
- "bitflags 2.9.1",
+ "bitflags 2.11.1",
  "serde",
  "serde_derive",
 ]
@@ -10354,9 +10535,9 @@ dependencies = [
 
 [[package]]
 name = "rsa"
-version = "0.9.8"
+version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78928ac1ed176a5ca1d17e578a1825f3d81ca54cf41053a592584b020cfd691b"
+checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
 dependencies = [
  "const-oid 0.9.6",
  "digest 0.10.7",
@@ -10392,13 +10573,13 @@ checksum = "c5e1711e7d14f74b12a58411c542185ef7fb7f2e7f8ee6e2940a883628522b42"
 dependencies = [
  "cfg-if",
  "glob",
- "proc-macro-crate 3.3.0",
+ "proc-macro-crate 3.5.0",
  "proc-macro2",
  "quote",
  "regex",
  "relative-path",
  "rustc_version",
- "syn 2.0.104",
+ "syn 2.0.117",
  "unicode-ident",
 ]
 
@@ -10445,12 +10626,6 @@ dependencies = [
  "ordered-multimap",
 ]
 
-[[package]]
-name = "rustc-demangle"
-version = "0.1.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "989e6739f80c4ad5b13e0fd7fe89531180375b18520cc8c82080e4dc4035b84f"
-
 [[package]]
 name = "rustc-hash"
 version = "1.1.0"
@@ -10459,9 +10634,9 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
 name = "rustc-hash"
-version = "2.1.1"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
 
 [[package]]
 name = "rustc-hex"
@@ -10499,15 +10674,15 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "1.0.7"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c71e83d6afe7ff64890ec6b71d6a69bb8a610ab78ce364b3352876bb4c801266"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
- "bitflags 2.9.1",
+ "bitflags 2.11.1",
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -10524,9 +10699,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.28"
+version = "0.23.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7160e3e10bf4535308537f3c4e1641468cd0e485175d6163087c0393c7d46643"
+checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -10544,7 +10719,7 @@ version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00"
 dependencies = [
- "openssl-probe",
+ "openssl-probe 0.1.6",
  "rustls-pemfile 1.0.4",
  "schannel",
  "security-framework 2.11.1",
@@ -10556,7 +10731,7 @@ version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5bfb394eeed242e909609f56089eecfe5fda225042e8b171791b9c95f5931e5"
 dependencies = [
- "openssl-probe",
+ "openssl-probe 0.1.6",
  "rustls-pemfile 2.2.0",
  "rustls-pki-types",
  "schannel",
@@ -10565,14 +10740,14 @@ dependencies = [
 
 [[package]]
 name = "rustls-native-certs"
-version = "0.8.1"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcff2dd52b58a8d98a70243663a0d234c4e2b79235637849d15913394a247d3"
+checksum = "612460d5f7bea540c490b2b6395d8e34a953e52b491accd6c86c8164c5932a63"
 dependencies = [
- "openssl-probe",
+ "openssl-probe 0.2.1",
  "rustls-pki-types",
  "schannel",
- "security-framework 3.5.1",
+ "security-framework 3.7.0",
 ]
 
 [[package]]
@@ -10595,9 +10770,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.12.0"
+version = "1.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "229a4a4c221013e7e1f1a043678c5cc39fe5171437c88fb47151a21e6f5b5c79"
+checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
 dependencies = [
  "web-time",
  "zeroize",
@@ -10611,14 +10786,14 @@ checksum = "19787cda76408ec5404443dc8b31795c87cd8fec49762dc75fa727740d34acc1"
 dependencies = [
  "core-foundation 0.10.1",
  "core-foundation-sys",
- "jni",
+ "jni 0.21.1",
  "log",
  "once_cell",
- "rustls 0.23.28",
- "rustls-native-certs 0.8.1",
+ "rustls 0.23.40",
+ "rustls-native-certs 0.8.3",
  "rustls-platform-verifier-android",
  "rustls-webpki 0.103.13",
- "security-framework 3.5.1",
+ "security-framework 3.7.0",
  "security-framework-sys",
  "webpki-root-certs 0.26.11",
  "windows-sys 0.59.0",
@@ -10626,22 +10801,22 @@ dependencies = [
 
 [[package]]
 name = "rustls-platform-verifier"
-version = "0.6.2"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d99feebc72bae7ab76ba994bb5e121b8d83d910ca40b36e0921f53becc41784"
+checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
 dependencies = [
  "core-foundation 0.10.1",
  "core-foundation-sys",
- "jni",
+ "jni 0.22.4",
  "log",
  "once_cell",
- "rustls 0.23.28",
- "rustls-native-certs 0.8.1",
+ "rustls 0.23.40",
+ "rustls-native-certs 0.8.3",
  "rustls-platform-verifier-android",
  "rustls-webpki 0.103.13",
- "security-framework 3.5.1",
+ "security-framework 3.7.0",
  "security-framework-sys",
- "webpki-root-certs 1.0.1",
+ "webpki-root-certs 1.0.7",
  "windows-sys 0.61.2",
 ]
 
@@ -10685,15 +10860,15 @@ dependencies = [
 
 [[package]]
 name = "rustversion"
-version = "1.0.21"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a0d197bd2c9dc6e53b84da9556a69ba4cdfab8619eb41a8bd1cc2027a0f6b1d"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
 [[package]]
 name = "ryu"
-version = "1.0.20"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
 [[package]]
 name = "ryu-js"
@@ -10727,20 +10902,20 @@ dependencies = [
 
 [[package]]
 name = "scc"
-version = "2.3.4"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22b2d775fb28f245817589471dd49c5edf64237f4a19d10ce9a92ff4651a27f4"
+checksum = "46e6f046b7fef48e2660c57ed794263155d713de679057f2d0c169bfc6e756cc"
 dependencies = [
  "sdd",
 ]
 
 [[package]]
 name = "schannel"
-version = "0.1.27"
+version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f29ebaa345f945cec9fbbc532eb307f0fdad8161f281b6369539c8d84876b3d"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -10768,6 +10943,18 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "schemars"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "schemars_derive"
 version = "0.8.22"
@@ -10777,7 +10964,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "serde_derive_internals",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -10814,12 +11001,12 @@ source = "git+https://github.com/impierce/sd-jwt-payload?rev=f28789a#f28789abfc3
 dependencies = [
  "anyhow",
  "async-trait",
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "iota-crypto",
  "itertools 0.12.1",
  "json-pointer",
- "multibase 0.9.1",
- "rand 0.8.5",
+ "multibase 0.9.2",
+ "rand 0.8.6",
  "serde",
  "serde_json",
  "strum 0.26.3",
@@ -10828,9 +11015,9 @@ dependencies = [
 
 [[package]]
 name = "sdd"
-version = "3.0.8"
+version = "3.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "584e070911c7017da6cb2eb0788d09f43d789029b5877d3e5ecc8acf86ceee21"
+checksum = "490dcfcbfef26be6800d11870ff2df8774fa6e86d047e3e8c8a76b25655e41ca"
 
 [[package]]
 name = "seahash"
@@ -10874,15 +11061,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "25996b82292a7a57ed3508f052cfff8640d38d32018784acd714758b43da9c8f"
 dependencies = [
  "bitcoin_hashes",
- "rand 0.8.5",
+ "rand 0.8.6",
  "secp256k1-sys",
 ]
 
 [[package]]
 name = "secp256k1-sys"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70a129b9e9efbfb223753b9163c4ab3b13cff7fd9c7f010fbac25ab4099fa07e"
+checksum = "4473013577ec77b4ee3668179ef1186df3146e2cf2d927bd200974c6fe60fd99"
 dependencies = [
  "cc",
 ]
@@ -10894,7 +11081,7 @@ source = "git+https://github.com/iotaledger/secret-storage.git?tag=v0.3.0#7dc13d
 dependencies = [
  "anyhow",
  "async-trait",
- "thiserror 2.0.12",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
@@ -10903,7 +11090,7 @@ version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
 dependencies = [
- "bitflags 2.9.1",
+ "bitflags 2.11.1",
  "core-foundation 0.9.4",
  "core-foundation-sys",
  "libc",
@@ -10912,11 +11099,11 @@ dependencies = [
 
 [[package]]
 name = "security-framework"
-version = "3.5.1"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3297343eaf830f66ede390ea39da1d462b6b0c1b000f420d0a83f898bbbe6ef"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
- "bitflags 2.9.1",
+ "bitflags 2.11.1",
  "core-foundation 0.10.1",
  "core-foundation-sys",
  "libc",
@@ -10925,9 +11112,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.15.0"
+version = "2.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc1f0cbffaac4852523ce30d8bd3c5cdc873501d96ff467ca09b6767bb8cd5c0"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -10935,9 +11122,9 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.26"
+version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
 
 [[package]]
 name = "send_wrapper"
@@ -11024,11 +11211,12 @@ dependencies = [
 
 [[package]]
 name = "serde_bytes"
-version = "0.11.17"
+version = "0.11.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8437fd221bde2d4ca316d61b90e337e9e702b3820b87d63caa9ba6c02bd06d96"
+checksum = "a5d440709e79d88e51ac01c4b72fc6cb7314017bb7da9eeff678aa94c10e3ea8"
 dependencies = [
  "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -11048,7 +11236,7 @@ checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -11059,7 +11247,7 @@ checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -11075,11 +11263,11 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.149"
+version = "1.0.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
 dependencies = [
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "itoa",
  "memchr",
  "serde",
@@ -11102,7 +11290,7 @@ version = "0.9.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e408f29489b5fd500fab51ff1484fc859bb655f32c671f307dcd733b72e8168c"
 dependencies = [
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "itoa",
  "ryu",
  "serde",
@@ -11111,12 +11299,13 @@ dependencies = [
 
 [[package]]
 name = "serde_path_to_error"
-version = "0.1.17"
+version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59fab13f937fa393d08645bf3a84bdfe86e296747b506ada67bb15f10f218b2a"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
 dependencies = [
  "itoa",
  "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -11127,7 +11316,7 @@ checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -11169,20 +11358,21 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.13.0"
+version = "3.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf65a400f8f66fb7b0552869ad70157166676db75ed8181f8104ea91cf9d0b42"
+checksum = "e72c1c2cb7b223fafb600a619537a871c2818583d619401b785e7c0b746ccde2"
 dependencies = [
  "base64 0.22.1",
+ "bs58 0.5.1",
  "chrono",
  "hex",
  "indexmap 1.9.3",
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "schemars 0.9.0",
- "serde",
- "serde_derive",
+ "schemars 1.2.1",
+ "serde_core",
  "serde_json",
- "serde_with_macros 3.13.0",
+ "serde_with_macros 3.20.0",
  "time",
 ]
 
@@ -11195,19 +11385,19 @@ dependencies = [
  "darling 0.20.11",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "serde_with_macros"
-version = "3.13.0"
+version = "3.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81679d9ed988d5e9a5e6531dc3f2c28efbd639cbd1dfb628df08edea6004da77"
+checksum = "b90c488738ecb4fb0262f41f43bc40efc5868d9fb744319ddf5f5317f417bfac"
 dependencies = [
- "darling 0.20.11",
+ "darling 0.23.0",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -11234,27 +11424,28 @@ dependencies = [
 
 [[package]]
 name = "serial_test"
-version = "3.2.0"
+version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b258109f244e1d6891bf1053a55d63a5cd4f8f4c30cf9a1280989f80e7a1fa9"
+checksum = "911bd979bf1070a3f3aa7b691a3b3e9968f339ceeec89e08c280a8a22207a32f"
 dependencies = [
- "futures",
+ "futures-executor",
+ "futures-util",
  "log",
  "once_cell",
- "parking_lot 0.12.4",
+ "parking_lot 0.12.5",
  "scc",
  "serial_test_derive",
 ]
 
 [[package]]
 name = "serial_test_derive"
-version = "3.2.0"
+version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d69265a08751de7844521fd15003ae0a888e035773ba05695c5c759a6f89eef"
+checksum = "0a7d91949b85b0d2fb687445e448b40d322b6b3e4af6b44a29b21d9a5f33e6d9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -11294,9 +11485,9 @@ dependencies = [
 
 [[package]]
 name = "sha3"
-version = "0.10.8"
+version = "0.10.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75872d278a8f37ef87fa0ddbda7802605cb18344497949862c0d4dcb291eba60"
+checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874"
 dependencies = [
  "digest 0.10.7",
  "keccak",
@@ -11323,7 +11514,7 @@ dependencies = [
  "iota-sdk 1.1.5",
  "iota_stronghold",
  "log",
- "rand 0.8.5",
+ "rand 0.8.6",
  "serde_json",
  "thiserror 1.0.69",
 ]
@@ -11353,10 +11544,11 @@ checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
 [[package]]
 name = "signal-hook-registry"
-version = "1.4.5"
+version = "1.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9203b8055f63a2a00e2f593bb0510367fe707d7ff1e5c872de2f537b339e5410"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
 dependencies = [
+ "errno",
  "libc",
 ]
 
@@ -11394,9 +11586,25 @@ dependencies = [
 
 [[package]]
 name = "simd-adler32"
-version = "0.3.7"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
+checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
+
+[[package]]
+name = "simd_cesu8"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94f90157bb87cddf702797c5dadfa0be7d266cdf49e22da2fcaa32eff75b2c33"
+dependencies = [
+ "rustc_version",
+ "simdutf8",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
 
 [[package]]
 name = "similar"
@@ -11424,13 +11632,13 @@ dependencies = [
 
 [[package]]
 name = "simple_asn1"
-version = "0.6.3"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "297f631f50729c8c99b84667867963997ec0b50f32b2a7dbcab828ef0541e8bb"
+checksum = "0d585997b0ac10be3c5ee635f1bab02d512760d14b7c468801ac8a01d9ae5f1d"
 dependencies = [
  "num-bigint 0.4.6",
  "num-traits",
- "thiserror 2.0.12",
+ "thiserror 2.0.18",
  "time",
 ]
 
@@ -11457,16 +11665,16 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_urlencoded",
- "serde_with 3.13.0",
+ "serde_with 3.20.0",
  "tokio",
  "url",
 ]
 
 [[package]]
 name = "siphasher"
-version = "1.0.1"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56199f7ddabf13fe5074ce809e7d3f42b42ae711800501b5b16ea82ad029c39d"
+checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
 
 [[package]]
 name = "sized-chunks"
@@ -11480,15 +11688,15 @@ dependencies = [
 
 [[package]]
 name = "sketches-ddsketch"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1e9a774a6c28142ac54bb25d25562e6bcf957493a184f15ad4eebccb23e410a"
+checksum = "0c6f73aeb92d671e0cc4dca167e59b2deb6387c375391bc99ee743f326994a2b"
 
 [[package]]
 name = "slab"
-version = "0.4.10"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04dc19736151f35336d325007ac991178d504a119863a2fcb3758cdb5e52c50d"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "slip10_ed25519"
@@ -11511,9 +11719,9 @@ dependencies = [
 
 [[package]]
 name = "smallstr"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63b1aefdf380735ff8ded0b15f31aab05daf1f70216c01c02a12926badd1df9d"
+checksum = "862077b1e764f04c251fe82a2ef562fd78d7cadaeb072ca7c2bcaf7217b1ff3b"
 dependencies = [
  "smallvec",
 ]
@@ -11542,10 +11750,10 @@ version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1c97747dbf44bb1ca44a561ece23508e99cb592e862f22222dcf42f51d1e451"
 dependencies = [
- "heck 0.4.1",
+ "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -11566,12 +11774,12 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.6.0"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "233504af464074f9d066d7b5416c5f9b894a5862a6506e306f7b816cdd6f1807"
+checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -11583,10 +11791,10 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "futures",
- "http 1.3.1",
+ "http 1.4.1",
  "httparse",
  "log",
- "rand 0.8.5",
+ "rand 0.8.6",
  "sha1",
 ]
 
@@ -11640,9 +11848,9 @@ dependencies = [
 
 [[package]]
 name = "sqlx"
-version = "0.8.3"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4410e73b3c0d8442c5f99b425d7a435b5ee0ae4167b3196771dd3f7a01be745f"
+checksum = "1fefb893899429669dcdd979aff487bd78f4064e5e7907e4269081e0ef7d97dc"
 dependencies = [
  "sqlx-core",
  "sqlx-macros",
@@ -11653,33 +11861,33 @@ dependencies = [
 
 [[package]]
 name = "sqlx-core"
-version = "0.8.3"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a007b6936676aa9ab40207cde35daab0a04b823be8ae004368c0793b96a61e0"
+checksum = "ee6798b1838b6a0f69c007c133b8df5866302197e404e8b6ee8ed3e3a5e68dc6"
 dependencies = [
+ "base64 0.22.1",
  "bytes",
  "crc",
  "crossbeam-queue",
  "either",
- "event-listener 5.4.0",
+ "event-listener 5.4.1",
  "futures-core",
  "futures-intrusive",
  "futures-io",
  "futures-util",
- "hashbrown 0.15.4",
+ "hashbrown 0.15.5",
  "hashlink 0.10.0",
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "log",
  "memchr",
  "once_cell",
  "percent-encoding",
- "rustls 0.23.28",
- "rustls-pemfile 2.2.0",
+ "rustls 0.23.40",
  "serde",
  "serde_json",
  "sha2 0.10.9",
  "smallvec",
- "thiserror 2.0.12",
+ "thiserror 2.0.18",
  "tokio",
  "tokio-stream",
  "tracing",
@@ -11689,22 +11897,22 @@ dependencies = [
 
 [[package]]
 name = "sqlx-macros"
-version = "0.8.3"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3112e2ad78643fef903618d78cf0aec1cb3134b019730edb039b69eaf531f310"
+checksum = "a2d452988ccaacfbf5e0bdbc348fb91d7c8af5bee192173ac3636b5fb6e6715d"
 dependencies = [
  "proc-macro2",
  "quote",
  "sqlx-core",
  "sqlx-macros-core",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "sqlx-macros-core"
-version = "0.8.3"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e9f90acc5ab146a99bf5061a7eb4976b573f560bc898ef3bf8435448dd5e7ad"
+checksum = "19a9c1841124ac5a61741f96e1d9e2ec77424bf323962dd894bdb93f37d5219b"
 dependencies = [
  "dotenvy",
  "either",
@@ -11720,21 +11928,20 @@ dependencies = [
  "sqlx-mysql",
  "sqlx-postgres",
  "sqlx-sqlite",
- "syn 2.0.104",
- "tempfile",
+ "syn 2.0.117",
  "tokio",
  "url",
 ]
 
 [[package]]
 name = "sqlx-mysql"
-version = "0.8.3"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4560278f0e00ce64938540546f59f590d60beee33fffbd3b9cd47851e5fff233"
+checksum = "aa003f0038df784eb8fecbbac13affe3da23b45194bd57dba231c8f48199c526"
 dependencies = [
  "atoi",
  "base64 0.22.1",
- "bitflags 2.9.1",
+ "bitflags 2.11.1",
  "byteorder",
  "bytes",
  "crc",
@@ -11755,28 +11962,28 @@ dependencies = [
  "memchr",
  "once_cell",
  "percent-encoding",
- "rand 0.8.5",
- "rsa 0.9.8",
+ "rand 0.8.6",
+ "rsa 0.9.10",
  "serde",
  "sha1",
  "sha2 0.10.9",
  "smallvec",
  "sqlx-core",
  "stringprep",
- "thiserror 2.0.12",
+ "thiserror 2.0.18",
  "tracing",
  "whoami",
 ]
 
 [[package]]
 name = "sqlx-postgres"
-version = "0.8.3"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5b98a57f363ed6764d5b3a12bfedf62f07aa16e1856a7ddc2a0bb190a959613"
+checksum = "db58fcd5a53cf07c184b154801ff91347e4c30d17a3562a635ff028ad5deda46"
 dependencies = [
  "atoi",
  "base64 0.22.1",
- "bitflags 2.9.1",
+ "bitflags 2.11.1",
  "byteorder",
  "crc",
  "dotenvy",
@@ -11793,23 +12000,23 @@ dependencies = [
  "md-5",
  "memchr",
  "once_cell",
- "rand 0.8.5",
+ "rand 0.8.6",
  "serde",
  "serde_json",
  "sha2 0.10.9",
  "smallvec",
  "sqlx-core",
  "stringprep",
- "thiserror 2.0.12",
+ "thiserror 2.0.18",
  "tracing",
  "whoami",
 ]
 
 [[package]]
 name = "sqlx-sqlite"
-version = "0.8.3"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f85ca71d3a5b24e64e1d08dd8fe36c6c95c339a896cc33068148906784620540"
+checksum = "c2d12fe70b2c1b4401038055f90f151b78208de1f9f89a7dbfd41587a10c3eea"
 dependencies = [
  "atoi",
  "flume",
@@ -11824,6 +12031,7 @@ dependencies = [
  "serde",
  "serde_urlencoded",
  "sqlx-core",
+ "thiserror 2.0.18",
  "tracing",
  "url",
 ]
@@ -12011,16 +12219,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b2d7b2b056993e04945eade2b0bbd3049f1bb65cd2fcf661ccb15b615683b384"
 dependencies = [
  "base64 0.12.3",
- "ed25519-dalek 2.1.1",
- "getrandom 0.2.16",
+ "ed25519-dalek 2.2.0",
+ "getrandom 0.2.17",
  "k256",
  "lazy_static",
- "multibase 0.9.1",
+ "multibase 0.9.2",
  "num-bigint 0.4.6",
  "num-derive 0.3.3",
  "num-traits",
  "p256 0.13.2",
- "rand 0.8.5",
+ "rand 0.8.6",
  "rsa 0.6.1",
  "serde",
  "simple_asn1 0.5.4",
@@ -12037,7 +12245,7 @@ source = "git+https://github.com/impierce/spruceid-ssi.git#ff91409b2a38188cf7126
 dependencies = [
  "base64 0.12.3",
  "lazy_static",
- "multibase 0.9.1",
+ "multibase 0.9.2",
  "num-bigint 0.4.6",
  "num-derive 0.3.3",
  "num-traits",
@@ -12051,21 +12259,21 @@ dependencies = [
 
 [[package]]
 name = "stable_deref_trait"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
 [[package]]
 name = "stacker"
-version = "0.1.21"
+version = "0.1.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cddb07e32ddb770749da91081d8d0ac3a16f1a569a18b20348cd371f5dead06b"
+checksum = "640c8cdd92b6b12f5bcb1803ca3bbf5ab96e5e6b6b96b9ab77dabe9e880b3190"
 dependencies = [
  "cc",
  "cfg-if",
  "libc",
  "psm",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -12077,7 +12285,7 @@ dependencies = [
  "fastcrypto",
  "iota-network-stack",
  "iota-sdk-types",
- "rand 0.8.5",
+ "rand 0.8.6",
  "rs_merkle",
  "serde",
  "tracing",
@@ -12132,7 +12340,7 @@ dependencies = [
  "libsodium-sys-stable",
  "log",
  "nix",
- "rand 0.8.5",
+ "rand 0.8.6",
  "serde",
  "thiserror 1.0.69",
  "windows 0.36.1",
@@ -12145,7 +12353,7 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8300214898af5e153e7f66e49dbd1c6a21585f2d592d9f24f58b969792475ed6"
 dependencies = [
- "rand 0.8.5",
+ "rand 0.8.6",
  "stronghold-derive",
 ]
 
@@ -12176,7 +12384,7 @@ dependencies = [
  "iota_stronghold",
  "k256",
  "p256 0.13.2",
- "rand 0.8.5",
+ "rand 0.8.6",
  "serde",
  "sha2 0.10.9",
  "stronghold-utils",
@@ -12249,7 +12457,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -12262,7 +12470,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -12274,7 +12482,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -12286,7 +12494,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -12314,9 +12522,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.104"
+version = "2.0.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17b6f705963418cdb9927482fa304bc562ece2fdd4f616084c50b7023b435a40"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -12346,7 +12554,7 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -12371,7 +12579,18 @@ checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
 dependencies = [
  "bitflags 1.3.2",
  "core-foundation 0.9.4",
- "system-configuration-sys",
+ "system-configuration-sys 0.5.0",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
+dependencies = [
+ "bitflags 2.11.1",
+ "core-foundation 0.9.4",
+ "system-configuration-sys 0.6.0",
 ]
 
 [[package]]
@@ -12384,6 +12603,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "tabled"
 version = "0.12.2"
@@ -12408,6 +12637,12 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "tagptr"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"
+
 [[package]]
 name = "take_mut"
 version = "0.2.2"
@@ -12422,9 +12657,9 @@ checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
 
 [[package]]
 name = "tar"
-version = "0.4.44"
+version = "0.4.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d863878d212c87a19c1a610eb53bb01fe12951c0501cf5a0d65f724914a667a"
+checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840"
 dependencies = [
  "filetime",
  "libc",
@@ -12446,20 +12681,20 @@ version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96374855068f47402c3121c6eed88d29cb1de8f3ab27090e273e420bdabcf050"
 dependencies = [
- "parking_lot 0.12.4",
+ "parking_lot 0.12.5",
 ]
 
 [[package]]
 name = "tempfile"
-version = "3.20.0"
+version = "3.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8a64e3985349f2441a1a9ef0b853f869006c3855f2cda6862a94d26ebb9d6a1"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "once_cell",
  "rustix",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -12473,12 +12708,12 @@ dependencies = [
 
 [[package]]
 name = "terminal_size"
-version = "0.4.2"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45c6481c4829e4cc63825e62c49186a34538b7b2750b73b266581ffb612fb5ed"
+checksum = "230a1b821ccbd75b185820a1f1ff7b14d21da1e442e22c0863ea5f08771a8874"
 dependencies = [
  "rustix",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -12492,11 +12727,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.12"
+version = "2.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
 dependencies = [
- "thiserror-impl 2.0.12",
+ "thiserror-impl 2.0.18",
 ]
 
 [[package]]
@@ -12507,18 +12742,18 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.12"
+version = "2.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -12541,30 +12776,30 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.41"
+version = "0.3.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a7619e19bc266e0f9c5e6686659d394bc57973859340060a69221e57dbc0c40"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
 dependencies = [
- "deranged",
+ "deranged 0.5.8",
  "itoa",
  "num-conv",
  "powerfmt",
- "serde",
+ "serde_core",
  "time-core",
  "time-macros",
 ]
 
 [[package]]
 name = "time-core"
-version = "0.1.4"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9e9a38711f559d9e3ce1cdb06dd7c5b8ea546bc90052da6d06bb76da74bb07c"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
 
 [[package]]
 name = "time-macros"
-version = "0.2.22"
+version = "0.2.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3526739392ec93fd8b359c8e98514cb3e8e021beb4e5f597b00a0221f8ed8a49"
+checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
 dependencies = [
  "num-conv",
  "time-core",
@@ -12580,7 +12815,7 @@ dependencies = [
  "hmac 0.12.1",
  "once_cell",
  "pbkdf2 0.11.0",
- "rand 0.8.5",
+ "rand 0.8.6",
  "rustc-hash 1.1.0",
  "sha2 0.10.9",
  "thiserror 1.0.69",
@@ -12600,9 +12835,9 @@ dependencies = [
 
 [[package]]
 name = "tinystr"
-version = "0.8.1"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d4f6d1145dcb577acf783d4e601bc1d76a13337bb54e6233add580b07344c8b"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
 dependencies = [
  "displaydoc",
  "zerovec",
@@ -12610,9 +12845,9 @@ dependencies = [
 
 [[package]]
 name = "tinyvec"
-version = "1.9.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09b3661f17e86524eccd4371ab0429194e0d7c008abb45f7a7495b1719463c71"
+checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
 dependencies = [
  "tinyvec_macros",
 ]
@@ -12625,30 +12860,30 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.50.0"
+version = "1.52.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27ad5e34374e03cfffefc301becb44e9dc3c17584f414349ebe29ed26661822d"
+checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
 dependencies = [
  "bytes",
  "libc",
  "mio",
- "parking_lot 0.12.4",
+ "parking_lot 0.12.5",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2 0.6.0",
+ "socket2 0.6.4",
  "tokio-macros",
  "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "tokio-macros"
-version = "2.6.1"
+version = "2.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c55a2eff8b69ce66c84f85e1da1c233edc36ceb85a2058d11b0d6a3c7e7569c"
+checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -12663,19 +12898,19 @@ dependencies = [
 
 [[package]]
 name = "tokio-rustls"
-version = "0.26.2"
+version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e727b36a1a0e8b74c376ac2211e40c2c8af09fb4013c60d910495810f008e9b"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
 dependencies = [
- "rustls 0.23.28",
+ "rustls 0.23.40",
  "tokio",
 ]
 
 [[package]]
 name = "tokio-stream"
-version = "0.1.17"
+version = "0.1.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eca58d7bba4a75707817a2c44174253f9236b2d5fbd055602e9d5c07c139a047"
+checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
 dependencies = [
  "futures-core",
  "pin-project-lite",
@@ -12685,14 +12920,14 @@ dependencies = [
 
 [[package]]
 name = "tokio-tungstenite"
-version = "0.26.2"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a9daff607c6d2bf6c16fd681ccb7eecc83e4e2cdc1ca067ffaadfca5de7f084"
+checksum = "8f72a05e828585856dacd553fba484c242c46e391fb0e58917c942ee9202915c"
 dependencies = [
  "futures-util",
  "log",
  "tokio",
- "tungstenite 0.26.2",
+ "tungstenite 0.29.0",
 ]
 
 [[package]]
@@ -12705,6 +12940,7 @@ dependencies = [
  "futures-core",
  "futures-io",
  "futures-sink",
+ "futures-util",
  "pin-project-lite",
  "tokio",
 ]
@@ -12719,13 +12955,13 @@ dependencies = [
  "bytes",
  "futures-core",
  "futures-sink",
- "http 1.3.1",
+ "http 1.4.1",
  "httparse",
- "rand 0.8.5",
+ "rand 0.8.6",
  "ring",
  "rustls-pki-types",
  "tokio",
- "tokio-rustls 0.26.2",
+ "tokio-rustls 0.26.4",
  "tokio-util",
  "webpki-roots 0.26.11",
 ]
@@ -12738,7 +12974,7 @@ checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
 dependencies = [
  "serde",
  "serde_spanned",
- "toml_datetime",
+ "toml_datetime 0.6.11",
  "toml_edit 0.22.27",
 ]
 
@@ -12751,14 +12987,23 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "toml_datetime"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+dependencies = [
+ "serde_core",
+]
+
 [[package]]
 name = "toml_edit"
 version = "0.19.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
 dependencies = [
- "indexmap 2.12.0",
- "toml_datetime",
+ "indexmap 2.14.0",
+ "toml_datetime 0.6.11",
  "winnow 0.5.40",
 ]
 
@@ -12768,12 +13013,33 @@ version = "0.22.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
 dependencies = [
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "serde",
  "serde_spanned",
- "toml_datetime",
+ "toml_datetime 0.6.11",
  "toml_write",
- "winnow 0.7.11",
+ "winnow 0.7.15",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.25.12+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2153edc6955a6c354fad8f5efd38b6a8769bdccf9fe50f8e1329f81b0baa5d7"
+dependencies = [
+ "indexmap 2.14.0",
+ "toml_datetime 1.1.1+spec-1.1.0",
+ "toml_parser",
+ "winnow 1.0.3",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
+dependencies = [
+ "winnow 1.0.3",
 ]
 
 [[package]]
@@ -12784,28 +13050,28 @@ checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
 
 [[package]]
 name = "tonic"
-version = "0.14.3"
+version = "0.14.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a286e33f82f8a1ee2df63f4fa35c0becf4a85a0cb03091a15fd7bf0b402dc94a"
+checksum = "ac2a5518c70fa84342385732db33fb3f44bc4cc748936eb5833d2df34d6445ef"
 dependencies = [
  "async-trait",
- "axum 0.8.3",
+ "axum 0.8.9",
  "base64 0.22.1",
  "bytes",
- "h2 0.4.10",
- "http 1.3.1",
+ "h2 0.4.14",
+ "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.9.0",
+ "hyper 1.10.0",
  "hyper-timeout",
  "hyper-util",
  "percent-encoding",
  "pin-project",
- "socket2 0.6.0",
+ "socket2 0.6.4",
  "sync_wrapper 1.0.2",
  "tokio",
  "tokio-stream",
- "tower 0.5.2",
+ "tower 0.5.3",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -12814,9 +13080,9 @@ dependencies = [
 
 [[package]]
 name = "tonic-health"
-version = "0.14.3"
+version = "0.14.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8dbde2c702c4be12b9b2f6f7e6c824a84a7b7be177070cada8ee575a581af359"
+checksum = "fcfab99db777fba2802f0dfa861d1628d1ae916fb199d29819941f139ae85082"
 dependencies = [
  "prost",
  "tokio",
@@ -12827,9 +13093,9 @@ dependencies = [
 
 [[package]]
 name = "tonic-prost"
-version = "0.14.3"
+version = "0.14.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6c55a2d6a14174563de34409c9f92ff981d006f56da9c6ecd40d9d4a31500b0"
+checksum = "50849f68853be452acf590cde0b146665b8d507b3b8af17261df47e02c209ea0"
 dependencies = [
  "bytes",
  "prost",
@@ -12848,7 +13114,7 @@ dependencies = [
  "indexmap 1.9.3",
  "pin-project",
  "pin-project-lite",
- "rand 0.8.5",
+ "rand 0.8.6",
  "slab",
  "tokio",
  "tokio-util",
@@ -12859,13 +13125,13 @@ dependencies = [
 
 [[package]]
 name = "tower"
-version = "0.5.2"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d039ad9159c98b70ecfd540b2573b97f7f52c3e8d9f8ad57a24b916a536975f9"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
 dependencies = [
  "futures-core",
  "futures-util",
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "pin-project-lite",
  "slab",
  "sync_wrapper 1.0.2",
@@ -12882,7 +13148,7 @@ version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "61c5bb1d698276a2443e5ecfabc1008bf15a36c12e6a7176e7bf089ea9131140"
 dependencies = [
- "bitflags 2.9.1",
+ "bitflags 2.11.1",
  "bytes",
  "futures-core",
  "futures-util",
@@ -12900,9 +13166,9 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e9cd434a998747dd2c4276bc96ee2e0c7a2eadf3cae88e52be55a05fa9053f5"
 dependencies = [
- "bitflags 2.9.1",
+ "bitflags 2.11.1",
  "bytes",
- "http 1.3.1",
+ "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
  "pin-project-lite",
@@ -12914,21 +13180,21 @@ dependencies = [
 
 [[package]]
 name = "tower-http"
-version = "0.6.8"
+version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
- "bitflags 2.9.1",
+ "bitflags 2.11.1",
  "bytes",
  "futures-util",
- "http 1.3.1",
+ "http 1.4.1",
  "http-body 1.0.1",
- "iri-string",
  "pin-project-lite",
- "tower 0.5.2",
+ "tower 0.5.3",
  "tower-layer",
  "tower-service",
  "tracing",
+ "url",
 ]
 
 [[package]]
@@ -12963,7 +13229,7 @@ checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -12999,14 +13265,14 @@ dependencies = [
 
 [[package]]
 name = "tracing-subscriber"
-version = "0.3.19"
+version = "0.3.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8189decb5ac0fa7bc8b96b7cb9b2701d60d48805aca84a238004d665fcc4008"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
 dependencies = [
  "matchers",
  "nu-ansi-term",
  "once_cell",
- "regex",
+ "regex-automata",
  "serde",
  "serde_json",
  "sharded-slab",
@@ -13020,9 +13286,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-test"
-version = "0.2.5"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "557b891436fe0d5e0e363427fc7f217abf9ccd510d5136549847bdcbcd011d68"
+checksum = "19a4c448db514d4f24c5ddb9f73f2ee71bfb24c526cf0c570ba142d1119e0051"
 dependencies = [
  "tracing-core",
  "tracing-subscriber",
@@ -13031,12 +13297,12 @@ dependencies = [
 
 [[package]]
 name = "tracing-test-macro"
-version = "0.2.5"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04659ddb06c87d233c566112c1c9c5b9e98256d9af50ec3bc9c8327f873a7568"
+checksum = "ad06847b7afb65c7866a36664b75c40b895e318cea4f71299f013fb22965329d"
 dependencies = [
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -13087,7 +13353,7 @@ dependencies = [
  "http 0.2.12",
  "httparse",
  "log",
- "rand 0.8.5",
+ "rand 0.8.6",
  "rustls 0.21.12",
  "sha1",
  "thiserror 1.0.69",
@@ -13097,32 +13363,46 @@ dependencies = [
 
 [[package]]
 name = "tungstenite"
-version = "0.26.2"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4793cb5e56680ecbb1d843515b23b6de9a75eb04b66643e256a396d43be33c13"
+checksum = "6c01152af293afb9c7c2a57e4b559c5620b421f6d133261c60dd2d0cdb38e6b8"
 dependencies = [
  "bytes",
  "data-encoding",
- "http 1.3.1",
+ "http 1.4.1",
  "httparse",
  "log",
- "rand 0.9.1",
+ "rand 0.9.4",
  "sha1",
- "thiserror 2.0.12",
- "utf-8",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
 name = "typed-builder"
-version = "0.10.0"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "398a3a3c918c96de527dc11e6e846cd549d4508030b8a33e1da12789c856b81a"
+dependencies = [
+ "typed-builder-macro",
+]
+
+[[package]]
+name = "typed-builder-macro"
+version = "0.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89851716b67b937e393b3daa8423e67ddfc4bbbf1654bcf05488e95e0828db0c"
+checksum = "0e48cea23f68d1f78eb7bc092881b6bb88d3d6b5b7e6234f6f9c911da1ffb221"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "syn 2.0.117",
 ]
 
+[[package]]
+name = "typed-path"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
+
 [[package]]
 name = "typed-store-error"
 version = "1.22.0-alpha"
@@ -13140,15 +13420,15 @@ checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
 
 [[package]]
 name = "typenum"
-version = "1.18.0"
+version = "1.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
+checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
 
 [[package]]
 name = "typeshare"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19be0f411120091e76e13e5a0186d8e2bcc3e7e244afdb70152197f1a8486ceb"
+checksum = "da1bf9fe204f358ffea7f8f779b53923a20278b3ab8e8d97962c5e1b3a54edb7"
 dependencies = [
  "chrono",
  "serde",
@@ -13158,12 +13438,12 @@ dependencies = [
 
 [[package]]
 name = "typeshare-annotation"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a615d6c2764852a2e88a4f16e9ce1ea49bb776b5872956309e170d63a042a34f"
+checksum = "621963e302416b389a1ec177397e9e62de849a78bd8205d428608553def75350"
 dependencies = [
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -13192,9 +13472,9 @@ checksum = "ccb97dac3243214f8d8507998906ca3e2e0b900bf9bf4870477f125b82e68f6e"
 
 [[package]]
 name = "unicase"
-version = "2.8.1"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75b844d17643ee918803943289730bec8aac480150456169e647ed0b576ba539"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
 
 [[package]]
 name = "unicode-bidi"
@@ -13210,30 +13490,30 @@ checksum = "0b993bddc193ae5bd0d623b49ec06ac3e9312875fdae725a975c51db1cc1677f"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.18"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
 name = "unicode-normalization"
-version = "0.1.24"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5033c97c4262335cded6d6fc3e5c18ab755e1a3dc96376350f3d8e9f009ad956"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
 dependencies = [
  "tinyvec",
 ]
 
 [[package]]
 name = "unicode-properties"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e70f2a8b45122e719eb623c01822704c4e0907e7e426a05927e1a1cfff5b75d0"
+checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.12.0"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+checksum = "9629274872b2bfaf8d66f5f15725007f635594914870f65218920345aa11aa8c"
 
 [[package]]
 name = "unicode-width"
@@ -13283,26 +13563,40 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "ureq"
-version = "2.12.1"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02d1a66277ed75f640d608235660df48c8e3c19f3b4edb6a263315626cc3c01d"
+checksum = "dea7109cdcd5864d4eeb1b58a1648dc9bf520360d7af16ec26d0a9354bafcfc0"
 dependencies = [
  "base64 0.22.1",
  "log",
- "once_cell",
- "url",
+ "percent-encoding",
+ "ureq-proto",
+ "utf8-zero",
+]
+
+[[package]]
+name = "ureq-proto"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e994ba84b0bd1b1b0cf92878b7ef898a5c1760108fe7b6010327e274917a808c"
+dependencies = [
+ "base64 0.22.1",
+ "http 1.4.1",
+ "httparse",
+ "log",
 ]
 
 [[package]]
 name = "url"
-version = "2.5.4"
+version = "2.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32f8b686cadd1473f4bd0117a5d28d36b1ade384ea9b5069a1c40aefed7fda60"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
 dependencies = [
  "form_urlencoded",
  "idna",
  "percent-encoding",
  "serde",
+ "serde_derive",
 ]
 
 [[package]]
@@ -13323,6 +13617,12 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ca61eb27fa339aa08826a29f03e87b99b4d8f0fc2255306fd266bb1b6a9de498"
 
+[[package]]
+name = "utf8-zero"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
+
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -13337,11 +13637,11 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "utoipa"
-version = "5.4.0"
+version = "5.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fcc29c80c21c31608227e0912b2d7fddba57ad76b606890627ba8ee7964e993"
+checksum = "8bde15df68e80b16c7d16b9616e80770ad158988daa56a27dccd1e55558b0160"
 dependencies = [
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "serde",
  "serde_json",
  "serde_norway",
@@ -13350,27 +13650,27 @@ dependencies = [
 
 [[package]]
 name = "utoipa-gen"
-version = "5.4.0"
+version = "5.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d79d08d92ab8af4c5e8a6da20c47ae3f61a0f1dabc1997cdf2d082b757ca08b"
+checksum = "6ba0b99ee52df3028635d93840c797102da61f8a7bb3cf751032455895b52ef8"
 dependencies = [
  "proc-macro2",
  "quote",
  "regex",
- "syn 2.0.104",
+ "syn 2.0.117",
  "url",
 ]
 
 [[package]]
 name = "uuid"
-version = "1.17.0"
+version = "1.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3cf4199d1e5d15ddd86a694e4d0dffa9c323ce759fea589f00fef9d81cc1931d"
+checksum = "ddd74a9687298c6858e9b88ec8935ec45d22e8fd5e6394fa1bd4e99a87789c76"
 dependencies = [
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "js-sys",
- "rand 0.9.1",
- "serde",
+ "rand 0.10.1",
+ "serde_core",
  "wasm-bindgen",
 ]
 
@@ -13393,9 +13693,9 @@ checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
 [[package]]
 name = "value-bag"
-version = "1.11.1"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "943ce29a8a743eb10d6082545d861b24f9d1b160b7d741e0f2cdf726bec909c5"
+checksum = "7ba6f5989077681266825251a52748b8c1d8a4ad098cc37e440103d0ea717fc0"
 
 [[package]]
 name = "variant_count"
@@ -13405,7 +13705,7 @@ checksum = "a1935e10c6f04d22688d07c0790f2fc0e1b1c5c2c55bc0cc87ed67656e587dd8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -13475,11 +13775,11 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "wasip2"
-version = "1.0.2+wasi-0.2.9"
+version = "1.0.3+wasi-0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
+checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
 dependencies = [
- "wit-bindgen",
+ "wit-bindgen 0.57.1",
 ]
 
 [[package]]
@@ -13488,7 +13788,7 @@ version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
 dependencies = [
- "wit-bindgen",
+ "wit-bindgen 0.51.0",
 ]
 
 [[package]]
@@ -13545,7 +13845,7 @@ dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
  "wasm-bindgen-shared",
 ]
 
@@ -13575,7 +13875,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
 dependencies = [
  "anyhow",
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "wasm-encoder",
  "wasmparser",
 ]
@@ -13614,9 +13914,9 @@ version = "0.244.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
 dependencies = [
- "bitflags 2.9.1",
- "hashbrown 0.15.4",
- "indexmap 2.12.0",
+ "bitflags 2.11.1",
+ "hashbrown 0.15.5",
+ "indexmap 2.14.0",
  "semver",
 ]
 
@@ -13646,14 +13946,14 @@ version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75c7f0ef91146ebfb530314f5f1d24528d7f0767efbfd31dce919275413e393e"
 dependencies = [
- "webpki-root-certs 1.0.1",
+ "webpki-root-certs 1.0.7",
 ]
 
 [[package]]
 name = "webpki-root-certs"
-version = "1.0.1"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86138b15b2b7d561bc4469e77027b8dd005a43dc502e9031d1f5afc8ce1f280e"
+checksum = "f31141ce3fc3e300ae89b78c0dd67f9708061d1d2eda54b8209346fd6be9a92c"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -13670,33 +13970,33 @@ version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
 dependencies = [
- "webpki-roots 1.0.1",
+ "webpki-roots 1.0.7",
 ]
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.1"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8782dd5a41a24eed3a4f40b606249b3e236ca61adf1f25ea4d45c73de122b502"
+checksum = "52f5ee44c96cf55f1b349600768e3ece3a8f26010c05265ab73f945bb1a2eb9d"
 dependencies = [
  "rustls-pki-types",
 ]
 
 [[package]]
 name = "whoami"
-version = "1.6.0"
+version = "1.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6994d13118ab492c3c80c1f81928718159254c53c472bf9ce36f8dae4add02a7"
+checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
 dependencies = [
- "redox_syscall 0.5.13",
+ "libredox",
  "wasite",
 ]
 
 [[package]]
 name = "widestring"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd7cf3379ca1aac9eea11fba24fd7e315d621f8dfe35c8d7d2be8b793726e07d"
+checksum = "72069c3113ab32ab29e5584db3c6ec55d416895e60715417b5b883a357c3e471"
 
 [[package]]
 name = "winapi"
@@ -13716,11 +14016,11 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.9"
+version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -13748,7 +14048,7 @@ version = "0.57.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "12342cb4d8e3b046f3d80effd474a7a02447231330ef77d71daa6fbc40681143"
 dependencies = [
- "windows-core",
+ "windows-core 0.57.0",
  "windows-targets 0.52.6",
 ]
 
@@ -13758,12 +14058,25 @@ version = "0.57.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2ed2439a290666cd67ecce2b0ffaad89c2a56b976b736e6ece670297897832d"
 dependencies = [
- "windows-implement",
- "windows-interface",
- "windows-result",
+ "windows-implement 0.57.0",
+ "windows-interface 0.57.0",
+ "windows-result 0.1.2",
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement 0.60.2",
+ "windows-interface 0.59.3",
+ "windows-link",
+ "windows-result 0.4.1",
+ "windows-strings",
+]
+
 [[package]]
 name = "windows-implement"
 version = "0.57.0"
@@ -13772,7 +14085,18 @@ checksum = "9107ddc059d5b6fbfbffdfa7a7fe3e22a226def0b2608f72e9d552763d3e1ad7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -13783,7 +14107,18 @@ checksum = "29bee4b38ea3cde66011baa44dba677c432a78593e202392d1e9070cf2a7fca7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -13792,6 +14127,17 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link",
+ "windows-result 0.4.1",
+ "windows-strings",
+]
+
 [[package]]
 name = "windows-result"
 version = "0.1.2"
@@ -13801,6 +14147,24 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.45.0"
@@ -13843,7 +14207,7 @@ version = "0.60.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
 dependencies = [
- "windows-targets 0.53.2",
+ "windows-targets 0.53.5",
 ]
 
 [[package]]
@@ -13903,18 +14267,19 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.53.2"
+version = "0.53.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c66f69fcc9ce11da9966ddb31a40968cad001c5bedeb5c2b82ede4253ab48aef"
+checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
 dependencies = [
- "windows_aarch64_gnullvm 0.53.0",
- "windows_aarch64_msvc 0.53.0",
- "windows_i686_gnu 0.53.0",
- "windows_i686_gnullvm 0.53.0",
- "windows_i686_msvc 0.53.0",
- "windows_x86_64_gnu 0.53.0",
- "windows_x86_64_gnullvm 0.53.0",
- "windows_x86_64_msvc 0.53.0",
+ "windows-link",
+ "windows_aarch64_gnullvm 0.53.1",
+ "windows_aarch64_msvc 0.53.1",
+ "windows_i686_gnu 0.53.1",
+ "windows_i686_gnullvm 0.53.1",
+ "windows_i686_msvc 0.53.1",
+ "windows_x86_64_gnu 0.53.1",
+ "windows_x86_64_gnullvm 0.53.1",
+ "windows_x86_64_msvc 0.53.1",
 ]
 
 [[package]]
@@ -13937,9 +14302,9 @@ checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86b8d5f90ddd19cb4a147a5fa63ca848db3df085e25fee3cc10b39b6eebae764"
+checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
 
 [[package]]
 name = "windows_aarch64_msvc"
@@ -13967,9 +14332,9 @@ checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7651a1f62a11b8cbd5e0d42526e55f2c99886c77e007179efff86c2b137e66c"
+checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
 
 [[package]]
 name = "windows_i686_gnu"
@@ -13997,9 +14362,9 @@ checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1dc67659d35f387f5f6c479dc4e28f1d4bb90ddd1a5d3da2e5d97b42d6272c3"
+checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
 
 [[package]]
 name = "windows_i686_gnullvm"
@@ -14009,9 +14374,9 @@ checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
 [[package]]
 name = "windows_i686_gnullvm"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ce6ccbdedbf6d6354471319e781c0dfef054c81fbc7cf83f338a4296c0cae11"
+checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
 
 [[package]]
 name = "windows_i686_msvc"
@@ -14039,9 +14404,9 @@ checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "581fee95406bb13382d2f65cd4a908ca7b1e4c2f1917f143ba16efe98a589b5d"
+checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
 
 [[package]]
 name = "windows_x86_64_gnu"
@@ -14069,9 +14434,9 @@ checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e55b5ac9ea33f2fc1716d1742db15574fd6fc8dadc51caab1c16a3d3b4190ba"
+checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
@@ -14093,9 +14458,9 @@ checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a6e035dd0599267ce1ee132e51c27dd29437f63325753051e71dd9e42406c57"
+checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
 
 [[package]]
 name = "windows_x86_64_msvc"
@@ -14123,9 +14488,9 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.53.0"
+version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486"
+checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
 
 [[package]]
 name = "winnow"
@@ -14138,9 +14503,18 @@ dependencies = [
 
 [[package]]
 name = "winnow"
-version = "0.7.11"
+version = "0.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74c7b26e3480b707944fc872477815d29a8e429d2f93a1ce000f5fa84a15cbcd"
+checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winnow"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
 dependencies = [
  "memchr",
 ]
@@ -14157,18 +14531,17 @@ dependencies = [
 
 [[package]]
 name = "wiremock"
-version = "0.6.4"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2b8b99d4cdbf36b239a9532e31fe4fb8acc38d1897c1761e161550a7dc78e6a"
+checksum = "08db1edfb05d9b3c1542e521aea074442088292f00b5f28e435c714a98f85031"
 dependencies = [
  "assert-json-diff",
- "async-trait",
  "base64 0.22.1",
  "deadpool",
  "futures",
- "http 1.3.1",
+ "http 1.4.1",
  "http-body-util",
- "hyper 1.9.0",
+ "hyper 1.10.0",
  "hyper-util",
  "log",
  "once_cell",
@@ -14188,6 +14561,12 @@ dependencies = [
  "wit-bindgen-rust-macro",
 ]
 
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
 [[package]]
 name = "wit-bindgen-core"
 version = "0.51.0"
@@ -14207,9 +14586,9 @@ checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
 dependencies = [
  "anyhow",
  "heck 0.5.0",
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "prettyplease",
- "syn 2.0.104",
+ "syn 2.0.117",
  "wasm-metadata",
  "wit-bindgen-core",
  "wit-component",
@@ -14225,7 +14604,7 @@ dependencies = [
  "prettyplease",
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
  "wit-bindgen-core",
  "wit-bindgen-rust",
 ]
@@ -14237,8 +14616,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
 dependencies = [
  "anyhow",
- "bitflags 2.9.1",
- "indexmap 2.12.0",
+ "bitflags 2.11.1",
+ "indexmap 2.14.0",
  "log",
  "serde",
  "serde_derive",
@@ -14257,7 +14636,7 @@ checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
 dependencies = [
  "anyhow",
  "id-arena",
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "log",
  "semver",
  "serde",
@@ -14269,9 +14648,9 @@ dependencies = [
 
 [[package]]
 name = "writeable"
-version = "0.6.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea2f10b9bb0928dfb1b42b65e1f9e36f7f54dbdf08457afefb38afcdec4fa2bb"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
 
 [[package]]
 name = "ws_stream_tungstenite"
@@ -14281,7 +14660,7 @@ checksum = "e283cc794a890f5bdc01e358ad7c34535025f79ba83c1b5c7e01e5d6c60b336d"
 dependencies = [
  "async-tungstenite",
  "async_io_stream",
- "bitflags 2.9.1",
+ "bitflags 2.11.1",
  "futures-core",
  "futures-io",
  "futures-sink",
@@ -14343,15 +14722,15 @@ dependencies = [
  "nom 7.1.3",
  "oid-registry",
  "rusticata-macros",
- "thiserror 2.0.12",
+ "thiserror 2.0.18",
  "time",
 ]
 
 [[package]]
 name = "xattr"
-version = "1.5.0"
+version = "1.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d65cbf2f12c15564212d48f4e3dfb87923d25d611f2aed18f4cb23f0413d89e"
+checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
 dependencies = [
  "libc",
  "rustix",
@@ -14388,11 +14767,10 @@ dependencies = [
 
 [[package]]
 name = "yoke"
-version = "0.8.0"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f41bb01b8226ef4bfd589436a297c53d118f65921786300e427be8d487695cc"
+checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
 dependencies = [
- "serde",
  "stable_deref_trait",
  "yoke-derive",
  "zerofrom",
@@ -14400,62 +14778,62 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.8.0"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38da3c9736e16c5d3c8c597a9aaa5d1fa565d0532ae05e27c24aa62fb32c0ab6"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
  "synstructure",
 ]
 
 [[package]]
 name = "zerocopy"
-version = "0.8.26"
+version = "0.8.49"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1039dd0d3c310cf05de012d8a39ff557cb0d23087fd44cad61df08fc31907a2f"
+checksum = "bce33a6288fa3f072a8c2c7d0f2fdbb90e28298f0135c1f99b96c3db2efcc60b"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.26"
+version = "0.8.49"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ecf5b4cc5364572d7f4c329661bcc82724222973f2cab6f050a4e5c22f75181"
+checksum = "8fd425244944f4ab65ccff928e7323354c5a018c75838362fdce749dfad2ee1e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "zerofrom"
-version = "0.1.6"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
 dependencies = [
  "zerofrom-derive",
 ]
 
 [[package]]
 name = "zerofrom-derive"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
  "synstructure",
 ]
 
 [[package]]
 name = "zeroize"
-version = "1.8.1"
+version = "1.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
 dependencies = [
  "serde",
  "zeroize_derive",
@@ -14463,20 +14841,20 @@ dependencies = [
 
 [[package]]
 name = "zeroize_derive"
-version = "1.4.2"
+version = "1.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
+checksum = "85a5b4158499876c763cb03bc4e49185d3cccbabb15b33c627f7884f43db852e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "zerotrie"
-version = "0.2.2"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36f0bbd478583f79edad978b407914f61b2972f5af6fa089686016be8f9af595"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
 dependencies = [
  "displaydoc",
  "yoke",
@@ -14485,9 +14863,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec"
-version = "0.11.2"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a05eb080e015ba39cc9e23bbe5e7fb04d5fb040350f99f34e338d5fdd294428"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
 dependencies = [
  "yoke",
  "zerofrom",
@@ -14496,29 +14874,26 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.1"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b96237efa0c878c64bd89c436f661be4e46b2f3eff1ebb976f7ef2321d2f58f"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.104",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "zip"
-version = "2.4.2"
+version = "8.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fabe6324e908f85a1c52063ce7aa26b68dcb7eb6dbc83a2d148403c9bc3eba50"
+checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
 dependencies = [
- "arbitrary",
  "crc32fast",
- "crossbeam-utils",
- "displaydoc",
  "flate2",
- "indexmap 2.12.0",
+ "indexmap 2.14.0",
  "memchr",
- "thiserror 2.0.12",
+ "typed-path",
  "zopfli",
 ]
 
@@ -14534,14 +14909,20 @@ dependencies = [
  "ff 0.13.1",
  "group 0.13.0",
  "hex",
- "rand 0.8.5",
+ "rand 0.8.6",
  "serde",
  "serde_json",
  "sha2 0.10.9",
  "sha3",
- "thiserror 2.0.12",
+ "thiserror 2.0.18",
 ]
 
+[[package]]
+name = "zlib-rs"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3be3d40e40a133f9c916ee3f9f4fa2d9d63435b5fbe1bfc6d9dae0aa0ada1513"
+
 [[package]]
 name = "zmij"
 version = "1.0.21"
@@ -14550,9 +14931,9 @@ checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
 
 [[package]]
 name = "zopfli"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edfc5ee405f504cd4984ecc6f14d02d55cfda60fa4b689434ef4102aae150cd7"
+checksum = "f05cd8797d63865425ff89b5c4a48804f35ba0ce8d125800027ad6017d2b5249"
 dependencies = [
  "bumpalo",
  "crc32fast",
@@ -14580,9 +14961,9 @@ dependencies = [
 
 [[package]]
 name = "zstd-sys"
-version = "2.0.15+zstd.1.5.7"
+version = "2.0.16+zstd.1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb81183ddd97d0c74cedf1d50d85c8d08c1b8b68ee863bdee9e706eedba1a237"
+checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
 dependencies = [
  "cc",
  "pkg-config",
diff --git a/README.md b/README.md
index 66dbd71b..626bd4f3 100644
--- a/README.md
+++ b/README.md
@@ -1,14 +1,15 @@
 ![banner](https://github.com/impierce/ssi-agent/raw/HEAD/.github/banner.png)
 
-[![semantic-release: angular](https://img.shields.io/badge/semantic--release-angular-e10079?logo=semantic-release)](https://github.com/angular/angular/blob/main/contributing-docs/commit-message-guidelines.md)
 [![GitHub License](https://img.shields.io/github/license/impierce/ssi-agent)](https://github.com/impierce/ssi-agent/blob/HEAD/LICENSE)
 [![Docker Pulls](https://img.shields.io/docker/pulls/impiercetechnologies/ssi-agent)](https://hub.docker.com/r/impiercetechnologies/ssi-agent)
+[![semantic-release: angular](https://img.shields.io/badge/semantic--release-angular-e10079?logo=semantic-release)](https://github.com/angular/angular/blob/main/contributing-docs/commit-message-guidelines.md)
 [![twelve-factor-app](https://img.shields.io/badge/factors-twelve-blue)](https://12factor.net)
 
-<!-- The "Twelve-Factor App" badge is a playful reference to the conventions we try to follow. -->
-
+![Check dependencies](https://github.com/impierce/ssi-agent/actions/workflows/audit.yaml/badge.svg)
 ![Check licenses](https://github.com/impierce/ssi-agent/actions/workflows/check-licenses.yaml/badge.svg)
 
+<!-- The "Twelve-Factor App" badge is a playful reference to the conventions we try to follow. -->
+
 ---
 
 ## Documentation

From 2e3171a9278a1ecb59059a321a6384d3c593f1a1 Mon Sep 17 00:00:00 2001
From: Nander Stabel <nander.stabel@impierce.com>
Date: Tue, 9 Jun 2026 10:21:25 +0200
Subject: [PATCH 09/34] feat: expose state types for external consumers (#326)

---
 Cargo.lock                   |  1 +
 agent_application/Cargo.toml |  1 +
 agent_application/src/lib.rs | 15 +++++++++++----
 deny.toml                    |  1 +
 4 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index eca0019c..37a28d34 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -134,6 +134,7 @@ dependencies = [
  "agent_holder",
  "agent_identity",
  "agent_issuance",
+ "agent_library",
  "agent_secret_manager",
  "agent_shared",
  "agent_store",
diff --git a/agent_application/Cargo.toml b/agent_application/Cargo.toml
index 5d3d6f00..dfba0af7 100644
--- a/agent_application/Cargo.toml
+++ b/agent_application/Cargo.toml
@@ -13,6 +13,7 @@ agent_event_publisher_nats = { path = "../agent_event_publisher_nats" }
 agent_holder = { path = "../agent_holder" }
 agent_identity = { path = "../agent_identity" }
 agent_issuance = { path = "../agent_issuance" }
+agent_library = { path = "../agent_library" }
 agent_secret_manager = { path = "../agent_secret_manager" }
 agent_shared = { path = "../agent_shared" }
 agent_store = { path = "../agent_store" }
diff --git a/agent_application/src/lib.rs b/agent_application/src/lib.rs
index 6946dba5..b67563f4 100644
--- a/agent_application/src/lib.rs
+++ b/agent_application/src/lib.rs
@@ -22,15 +22,22 @@ use tokio::io;
 use tower_http::cors::CorsLayer;
 use tracing::info;
 
+// Re-export states
+pub use agent_authorization::state::AuthorizationState;
+pub use agent_holder::state::HolderState;
+pub use agent_identity::state::IdentityState;
+pub use agent_issuance::state::{IssuanceState, SERVER_CONFIG_ID};
+pub use agent_library::state::LibraryState;
+pub use agent_verification::state::VerificationState;
+
 pub async fn run() -> io::Result<()> {
-    let state = state().await?;
+    let subject = Arc::new(Subject::new().await);
+    let state = state(subject).await?;
 
     serve(app(state)).await
 }
 
-pub async fn state() -> io::Result<ApplicationState> {
-    let subject = Arc::new(Subject::new().await);
-
+pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
     let identity_services = Arc::new(IdentityServices::new(subject.clone()));
     let authorization_services = Arc::new(AuthorizationServices::new(subject.clone()));
     let issuance_services = Arc::new(IssuanceServices::new(subject.clone()));
diff --git a/deny.toml b/deny.toml
index 9a8559a4..da102b93 100644
--- a/deny.toml
+++ b/deny.toml
@@ -92,6 +92,7 @@ ignore = [
 # [possible values: any SPDX 3.11 short identifier (+ optional exception)].
 allow = [
     "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
     "BSD-2-Clause",
     "BSD-3-Clause",
     "CC0-1.0",

From 297c4f3ae4951d02b9a0092fd5b89f499044cf52 Mon Sep 17 00:00:00 2001
From: Oran Dan <53859531+Oran-Dan@users.noreply.github.com>
Date: Tue, 9 Jun 2026 10:53:19 +0200
Subject: [PATCH 10/34] fix: make `authorization_details` optional, add key
 conversion helper  (#353)

---
 Cargo.lock                                    | 12 ++++----
 Cargo.toml                                    | 10 +++----
 .../authorization/authorization_server/par.rs |  4 +--
 .../authorization_server/templates.rs         |  2 +-
 agent_api_http/templates/consent.html         | 23 ++++++++++-----
 .../src/application/consent_query_service.rs  |  2 +-
 .../oauth2_authorization_request/aggregate.rs | 10 +++----
 .../oauth2_authorization_request/event.rs     |  2 +-
 agent_holder/src/credential/aggregate.rs      | 19 ++----------
 agent_identity/src/services.rs                | 29 +++++--------------
 .../access_token_validation_service.rs        | 14 +++------
 agent_shared/Cargo.toml                       |  3 +-
 agent_shared/src/credential_status_checker.rs | 17 ++++-------
 agent_shared/src/lib.rs                       | 11 +++++++
 14 files changed, 71 insertions(+), 87 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 37a28d34..17855be5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -457,6 +457,7 @@ dependencies = [
  "http-serde",
  "identity_core",
  "identity_iota",
+ "identity_jose",
  "jsonwebtoken",
  "oauth_tsl",
  "oid4vc-core",
@@ -8604,10 +8605,11 @@ dependencies = [
 [[package]]
 name = "oid4vc-core"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=e860178#e860178d46ff18cf6b08657ac4c8fa46e63ffa52"
+source = "git+https://github.com/impierce/openid4vc?rev=1db24bc#1db24bcd02659fe775666a4408a5251ce7f9e771"
 dependencies = [
  "anyhow",
  "async-trait",
+ "base64 0.22.1",
  "base64-url",
  "derivative",
  "derive_more 0.99.20",
@@ -8636,7 +8638,7 @@ dependencies = [
 [[package]]
 name = "oid4vc-manager"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=e860178#e860178d46ff18cf6b08657ac4c8fa46e63ffa52"
+source = "git+https://github.com/impierce/openid4vc?rev=1db24bc#1db24bcd02659fe775666a4408a5251ce7f9e771"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -8669,7 +8671,7 @@ dependencies = [
 [[package]]
 name = "oid4vci"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=e860178#e860178d46ff18cf6b08657ac4c8fa46e63ffa52"
+source = "git+https://github.com/impierce/openid4vc?rev=1db24bc#1db24bcd02659fe775666a4408a5251ce7f9e771"
 dependencies = [
  "anyhow",
  "chrono",
@@ -8697,7 +8699,7 @@ dependencies = [
 [[package]]
 name = "oid4vp"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=e860178#e860178d46ff18cf6b08657ac4c8fa46e63ffa52"
+source = "git+https://github.com/impierce/openid4vc?rev=1db24bc#1db24bcd02659fe775666a4408a5251ce7f9e771"
 dependencies = [
  "anyhow",
  "chrono",
@@ -11646,7 +11648,7 @@ dependencies = [
 [[package]]
 name = "siopv2"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=e860178#e860178d46ff18cf6b08657ac4c8fa46e63ffa52"
+source = "git+https://github.com/impierce/openid4vc?rev=1db24bc#1db24bcd02659fe775666a4408a5251ce7f9e771"
 dependencies = [
  "anyhow",
  "async-trait",
diff --git a/Cargo.toml b/Cargo.toml
index 72338fb1..b1fdd9d7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -35,11 +35,11 @@ publish = false
 pedantic = "warn"
 
 [workspace.dependencies]
-siopv2 = { git = "https://github.com/impierce/openid4vc", rev = "e860178" }
-oid4vci = { git = "https://github.com/impierce/openid4vc", rev = "e860178" }
-oid4vc-core = { git = "https://github.com/impierce/openid4vc", rev = "e860178" }
-oid4vc-manager = { git = "https://github.com/impierce/openid4vc", rev = "e860178" }
-oid4vp = { git = "https://github.com/impierce/openid4vc", rev = "e860178" }
+siopv2 = { git = "https://github.com/impierce/openid4vc", rev = "1db24bc" }
+oid4vci = { git = "https://github.com/impierce/openid4vc", rev = "1db24bc" }
+oid4vc-core = { git = "https://github.com/impierce/openid4vc", rev = "1db24bc" }
+oid4vc-manager = { git = "https://github.com/impierce/openid4vc", rev = "1db24bc" }
+oid4vp = { git = "https://github.com/impierce/openid4vc", rev = "1db24bc" }
 
 shared-kernel = { path = "shared-kernel" }
 
diff --git a/agent_api_http/src/v0/authorization/authorization_server/par.rs b/agent_api_http/src/v0/authorization/authorization_server/par.rs
index aa228ee2..ebc5203c 100644
--- a/agent_api_http/src/v0/authorization/authorization_server/par.rs
+++ b/agent_api_http/src/v0/authorization/authorization_server/par.rs
@@ -72,13 +72,13 @@ pub mod tests {
                             code_challenge_method: Some(CodeChallengeMethod::S256),
                             scope: Some("openid profile".to_string()),
                             issuer_state: Some(issuer_state),
-                            authorization_details: vec![AuthorizationDetailsObject {
+                            authorization_details: Some(vec![AuthorizationDetailsObject {
                                 r#type: OpenidCredential::Type,
                                 locations: None,
                                 credential_configuration_id: "configuration_id".to_string(),
                                 credential_identifiers: None,
                                 claims: None,
-                            }],
+                            }]),
                         }))
                         .unwrap(),
                     ))
diff --git a/agent_api_http/src/v0/authorization/authorization_server/templates.rs b/agent_api_http/src/v0/authorization/authorization_server/templates.rs
index 1288b064..87514932 100644
--- a/agent_api_http/src/v0/authorization/authorization_server/templates.rs
+++ b/agent_api_http/src/v0/authorization/authorization_server/templates.rs
@@ -10,7 +10,7 @@ use oid4vci::authorization_details::AuthorizationDetailsObject;
 pub struct ConsentPageTemplate {
     pub client_name: String,
     pub client_id: String,
-    pub authorization_details: Vec<AuthorizationDetailsObject>,
+    pub authorization_details: Option<Vec<AuthorizationDetailsObject>>,
     pub request_uri: String,
 }
 
diff --git a/agent_api_http/templates/consent.html b/agent_api_http/templates/consent.html
index e7047d42..f4385c21 100644
--- a/agent_api_http/templates/consent.html
+++ b/agent_api_http/templates/consent.html
@@ -134,20 +134,27 @@ <h1 style="text-align: center">Consent to Data Access</h1>
           style="height: 100%"
         />
       </div>
+{% if let Some(auth_details_list) = authorization_details %}
 <p>
   The application <strong>{{ client_id }}</strong> is requesting access to
   the following data:
 </p>
 <h2>Credentials to be Shared</h2>
+<!-- TODO: In the future, rely on either the initial credential_configuration_ids or the auth_details (as we do below) to populate the "to be shared" credentials.
+     We currently do not support using the scope parameter for this. More info here: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.html#name-identifying-credentials-bei  -->
 <ul>
-  {% for authorization_detail in authorization_details %}
-  <li>
-    <strong>{{ authorization_detail.credential_configuration_id }}</strong>
-    {% if let Some(claims) = &authorization_detail.claims %}
-    {% endif %}
-  </li>
-  {% endfor %}
+    {% for authorization_detail in auth_details_list %}
+      <li>
+        <strong>{{ authorization_detail.credential_configuration_id }}</strong>
+      </li>
+    {% endfor %}
 </ul>
+{% else %}
+<p>
+  <!-- TODO: implement displaying the credential_configurations from the credential_configuration_id's (`scope` won't be supported in the foreseeable future), as per: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#section-3.3.4 -->
+  The application <strong>{{ client_id }}</strong> is requesting access to your data.
+</p>
+{% endif %}
 <p>Do you want to allow this application to access your data?</p>
       <form
         action="/auth/consent"
@@ -172,4 +179,4 @@ <h2>Credentials to be Shared</h2>
       </form>
     </div>
   </body>
-</html>
+</html>
\ No newline at end of file
diff --git a/agent_authorization/src/application/consent_query_service.rs b/agent_authorization/src/application/consent_query_service.rs
index 3649e99b..bdb9cf37 100644
--- a/agent_authorization/src/application/consent_query_service.rs
+++ b/agent_authorization/src/application/consent_query_service.rs
@@ -9,7 +9,7 @@ use thiserror::Error;
 pub struct ConsentPageViewModel {
     pub client_id: String,
     pub client_name: String,
-    pub authorization_details: Vec<AuthorizationDetailsObject>,
+    pub authorization_details: Option<Vec<AuthorizationDetailsObject>>,
     pub request_uri: String,
 }
 
diff --git a/agent_authorization/src/domain/oauth2_authorization_request/aggregate.rs b/agent_authorization/src/domain/oauth2_authorization_request/aggregate.rs
index a4f84593..7731eef7 100644
--- a/agent_authorization/src/domain/oauth2_authorization_request/aggregate.rs
+++ b/agent_authorization/src/domain/oauth2_authorization_request/aggregate.rs
@@ -29,7 +29,7 @@ pub struct OAuth2AuthorizationRequest {
     pub issuer_state: Option<String>,
 
     // OID4VCI
-    pub authorization_details: Vec<AuthorizationDetailsObject>,
+    pub authorization_details: Option<Vec<AuthorizationDetailsObject>>,
 
     // PKCE
     #[serde(default)]
@@ -281,14 +281,14 @@ pub mod test_utils {
     }
 
     #[fixture]
-    pub fn authorization_details() -> Vec<AuthorizationDetailsObject> {
-        vec![AuthorizationDetailsObject {
+    pub fn authorization_details() -> Option<Vec<AuthorizationDetailsObject>> {
+        Some(vec![AuthorizationDetailsObject {
             r#type: OpenidCredential::Type,
             locations: None,
             credential_configuration_id: "001".to_string(),
             credential_identifiers: None,
             claims: None,
-        }]
+        }])
     }
 
     static CODE_VERIFIER: OnceLock<Vec<u8>> = OnceLock::new();
@@ -325,7 +325,7 @@ pub mod test_utils {
         redirect_uri: Option<Url>,
         scope: String,
         issuer_state: Option<String>,
-        authorization_details: Vec<AuthorizationDetailsObject>,
+        authorization_details: Option<Vec<AuthorizationDetailsObject>>,
         code_challenge: String,
         code_challenge_method: Option<CodeChallengeMethod>,
     ) -> AuthorizationRequest {
diff --git a/agent_authorization/src/domain/oauth2_authorization_request/event.rs b/agent_authorization/src/domain/oauth2_authorization_request/event.rs
index a7d4a9c4..c7b4aa9d 100644
--- a/agent_authorization/src/domain/oauth2_authorization_request/event.rs
+++ b/agent_authorization/src/domain/oauth2_authorization_request/event.rs
@@ -19,7 +19,7 @@ pub enum OAuth2AuthorizationRequestEvent {
         issuer_state: Option<String>,
 
         // OID4VCI
-        authorization_details: Vec<AuthorizationDetailsObject>,
+        authorization_details: Option<Vec<AuthorizationDetailsObject>>,
 
         // PKCE
         #[serde(default)]
diff --git a/agent_holder/src/credential/aggregate.rs b/agent_holder/src/credential/aggregate.rs
index 8c314ac1..37b52699 100644
--- a/agent_holder/src/credential/aggregate.rs
+++ b/agent_holder/src/credential/aggregate.rs
@@ -4,10 +4,10 @@ use crate::credential::event::CredentialEvent;
 use crate::services::HolderServices;
 use agent_shared::credential_status_checker::CredentialStatusChecker;
 use async_trait::async_trait;
-use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
 use cqrs_es::Aggregate;
 use identity_credential::credential::Jwt;
 use oid4vc_core::credential_status_verifier::CredentialStatusVerifier;
+use oid4vc_core::utils::jwt::get_unverified_jwt_claims;
 use serde::{Deserialize, Serialize};
 use std::sync::Arc;
 use tracing::{debug, info};
@@ -52,7 +52,8 @@ impl Aggregate for Credential {
                 received_offer_id,
                 credential,
             } => {
-                let raw = get_unverified_jwt_claims(&serde_json::json!(credential))?;
+                let raw = get_unverified_jwt_claims(&serde_json::json!(credential))
+                    .map_err(|_| CredentialError::CredentialDecodingError)?;
 
                 if let Some(status_claim) = raw.get("status") {
                     let credential_status_checker = CredentialStatusChecker {
@@ -98,20 +99,6 @@ impl Aggregate for Credential {
     }
 }
 
-// TODO: actually validate the JWT!
-/// Get the claims from a JWT without performing validation.
-pub fn get_unverified_jwt_claims(jwt: &serde_json::Value) -> Result<serde_json::Value, CredentialError> {
-    jwt.as_str()
-        .and_then(|string| string.splitn(3, '.').collect::<Vec<&str>>().get(1).cloned())
-        .and_then(|payload| {
-            URL_SAFE_NO_PAD
-                .decode(payload)
-                .ok()
-                .and_then(|payload_bytes| serde_json::from_slice::<serde_json::Value>(&payload_bytes).ok())
-        })
-        .ok_or(CredentialError::CredentialDecodingError)
-}
-
 #[cfg(test)]
 pub mod credential_tests {
     use super::test_utils::*;
diff --git a/agent_identity/src/services.rs b/agent_identity/src/services.rs
index f36c9769..30213a26 100644
--- a/agent_identity/src/services.rs
+++ b/agent_identity/src/services.rs
@@ -1,11 +1,14 @@
 use crate::connection::error::ConnectionError;
 use agent_secret_manager::subject::Subject;
-use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
 use chrono::{DateTime, Utc};
 use identity_credential::domain_linkage::{DomainLinkageConfiguration, JwtDomainLinkageValidator};
 use identity_did::DIDUrl;
 use identity_did::DID;
-use identity_iota::{core::FromJson, credential::JwtCredentialValidationOptions};
+use identity_iota::{
+    core::{FromJson, ToJson},
+    credential::JwtCredentialValidationOptions,
+};
+use oid4vc_core::utils::jwt::get_unverified_jwt_claims;
 use oid4vc_core::verifier::SignatureVerifier;
 use oid4vci::credential_issuer::credential_issuer_metadata::CredentialIssuerMetadata;
 use reqwest::Client;
@@ -70,7 +73,8 @@ impl IdentityServices {
             .linked_dids()
             .iter()
             .filter_map(|jwt| {
-                let claims = get_unverified_jwt_claims(jwt.as_str()).ok()?;
+                let jwt_value = jwt.to_json_value().ok()?;
+                let claims = get_unverified_jwt_claims(&jwt_value).ok()?;
                 let did_str = claims
                     .get("sub")
                     .or_else(|| claims.get("iss"))
@@ -149,23 +153,6 @@ impl IdentityServices {
     }
 }
 
-/// Get the claims from a jwt string without performing validation.
-fn get_unverified_jwt_claims(jwt: &str) -> Result<serde_json::Value, ConnectionError> {
-    jwt.splitn(3, '.')
-        .collect::<Vec<&str>>()
-        .get(1)
-        .cloned()
-        .and_then(|payload| {
-            URL_SAFE_NO_PAD
-                .decode(payload)
-                .ok()
-                .and_then(|payload_bytes| serde_json::from_slice::<serde_json::Value>(&payload_bytes).ok())
-        })
-        .ok_or(ConnectionError::DIDResolutionFailed(
-            "Failed to decode JWT claims".to_string(),
-        ))
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -180,7 +167,7 @@ mod tests {
     #[test]
     fn test_decode_linked_did_jwt() {
         let jwt = serde_json::json!(LINKED_DID_JWT);
-        let claims = get_unverified_jwt_claims(&jwt.to_string()).unwrap();
+        let claims = get_unverified_jwt_claims(&jwt).unwrap();
         assert_eq!(
             claims["sub"],
             "did:key:z6MkoTHsgNNrby8JzCNQ1iRLyW5QQ6R8Xuu6AA8igGrMVPUM"
diff --git a/agent_issuance/src/application/access_token_validation_service.rs b/agent_issuance/src/application/access_token_validation_service.rs
index 7c0528d6..b0a55748 100644
--- a/agent_issuance/src/application/access_token_validation_service.rs
+++ b/agent_issuance/src/application/access_token_validation_service.rs
@@ -1,7 +1,6 @@
 use crate::state::IssuanceState;
-use agent_shared::config::config;
-use identity_core::convert::{FromJson as _, ToJson as _};
-use jsonwebtoken::{decode, jwk::Jwk as JsonWebTokenJwk, DecodingKey, Validation};
+use agent_shared::{config::config, convert_iota_jwk_to_decoding_key};
+use jsonwebtoken::{decode, Validation};
 use serde::{Deserialize, Serialize};
 use serde_with::skip_serializing_none;
 use thiserror::Error;
@@ -53,13 +52,8 @@ impl AccessTokenValidationService {
             .await
             .map_err(|_err| AccessTokenValidationError::KidResolutionError)?;
 
-        // Convert the `IotaIdentityJwk` first into a `JsonWebTokenJwk` and then into a `DecodingKey`.
-        let decoding_key = public_key_jwk
-            .to_json()
-            .ok()
-            .and_then(|public_key| JsonWebTokenJwk::from_json(&public_key).ok())
-            .and_then(|jwk| DecodingKey::from_jwk(&jwk).ok())
-            .ok_or(AccessTokenValidationError::KidResolutionError)?;
+        let decoding_key =
+            convert_iota_jwk_to_decoding_key(&public_key_jwk).ok_or(AccessTokenValidationError::KidResolutionError)?;
 
         let public_url = config().public_url.to_string();
 
diff --git a/agent_shared/Cargo.toml b/agent_shared/Cargo.toml
index 8860ca20..89a33839 100644
--- a/agent_shared/Cargo.toml
+++ b/agent_shared/Cargo.toml
@@ -15,8 +15,9 @@ cqrs-es.workspace = true
 dotenvy = { version = "0.15" }
 http-serde = "2.1"
 # TODO: replace all identity_* with identity_iota?
-identity_iota.workspace = true
 identity_core.workspace = true
+identity_iota.workspace = true
+identity_jose.workspace = true
 jsonwebtoken.workspace = true
 oauth_tsl.workspace = true
 oid4vc-core.workspace = true
diff --git a/agent_shared/src/credential_status_checker.rs b/agent_shared/src/credential_status_checker.rs
index 1ed9058d..a441c87d 100644
--- a/agent_shared/src/credential_status_checker.rs
+++ b/agent_shared/src/credential_status_checker.rs
@@ -1,6 +1,5 @@
 use async_trait::async_trait;
-use identity_core::convert::{FromJson as _, ToJson as _};
-use jsonwebtoken::{decode_header, jwk::Jwk as JsonWebTokenJwk, DecodingKey};
+use jsonwebtoken::decode_header;
 use oauth_tsl::{
     relying_party::{decompress_gzip, decrypt_status_list_token, StatusListTokenResponseType},
     status_list::{StatusList, StatusType},
@@ -15,6 +14,8 @@ use thiserror::Error;
 use tracing::{info, warn};
 use url::Url;
 
+use crate::convert_iota_jwk_to_decoding_key;
+
 #[derive(Error, Debug)]
 pub enum CredentialStatusCheckerError {
     #[error("Failed to get credential status: {0}")]
@@ -110,15 +111,9 @@ impl CredentialStatusChecker {
                 .await
                 .map_err(|e| CredentialStatusCheckerError::FailedToGetCredentialStatus(e.to_string()))?;
 
-            // Convert the `IotaIdentityJwk` first into a `JsonWebTokenJwk` and then into a `DecodingKey`.
-            let decoding_key = public_key_jwk
-                .to_json()
-                .ok()
-                .and_then(|public_key| JsonWebTokenJwk::from_json(&public_key).ok())
-                .and_then(|jwk| DecodingKey::from_jwk(&jwk).ok())
-                .ok_or(CredentialStatusCheckerError::FailedToGetCredentialStatus(
-                    "Failed to create decoding key".to_string(),
-                ))?;
+            let decoding_key = convert_iota_jwk_to_decoding_key(&public_key_jwk).ok_or(
+                CredentialStatusCheckerError::FailedToGetCredentialStatus("Failed to create decoding key".to_string()),
+            )?;
 
             // TODO: move this logic to the OAuth TSL library.
             let decoded_jwt = decrypt_status_list_token(&status_list_jwt, decoding_key)
diff --git a/agent_shared/src/lib.rs b/agent_shared/src/lib.rs
index 97520268..ac627cf2 100644
--- a/agent_shared/src/lib.rs
+++ b/agent_shared/src/lib.rs
@@ -10,7 +10,9 @@ pub mod serde_json_value_ext;
 pub mod url_utils;
 
 pub use ::config::ConfigError;
+use identity_core::convert::{FromJson as _, ToJson as _};
 use identity_iota::verification::jws::JwsAlgorithm;
+use jsonwebtoken::{jwk::Jwk as JsonWebTokenJwk, DecodingKey};
 use rand::Rng;
 pub use url_utils::UrlAppendHelpers;
 
@@ -46,3 +48,12 @@ pub fn from_jsonwebtoken_algorithm_to_jwsalgorithm(algorithm: &jsonwebtoken::Alg
         jsonwebtoken::Algorithm::EdDSA => JwsAlgorithm::EdDSA,
     }
 }
+
+/// Convert the `IotaIdentityJwk` first into a `JsonWebTokenJwk` and then into a `DecodingKey`.
+pub fn convert_iota_jwk_to_decoding_key(public_key: &identity_jose::jwk::Jwk) -> Option<DecodingKey> {
+    public_key
+        .to_json()
+        .ok()
+        .and_then(|public_key| JsonWebTokenJwk::from_json(&public_key).ok())
+        .and_then(|jwk| DecodingKey::from_jwk(&jwk).ok())
+}

From 15fcc80ce5159857798e2ba0d5336a8d07bf92b9 Mon Sep 17 00:00:00 2001
From: Nander Stabel <nander.stabel@impierce.com>
Date: Tue, 16 Jun 2026 17:06:02 +0200
Subject: [PATCH 11/34] feat: support Interactive Authorization Flow (#342)

---
 Cargo.lock                                    | 111 +++++++--
 Cargo.toml                                    |  12 +-
 agent_api_http/Cargo.toml                     |   1 +
 .../authorization_server/authorize.rs         |  11 +-
 .../authorization/authorization_server/par.rs | 232 +++++++++++++++++-
 .../authorization_server/token.rs             |  11 +-
 .../issuance/credential_issuer/credential.rs  |  11 +-
 .../credential_issuer/notification.rs         |  22 +-
 .../credential_issuer/token_status_list.rs    |  11 +-
 .../v0/verification/authorization_requests.rs |   1 +
 agent_application/Cargo.toml                  |   3 +-
 agent_application/src/lib.rs                  |  52 ++--
 agent_authorization/Cargo.toml                |   3 +-
 .../interactive_authorization_service.rs      | 210 ++++++++++++++++
 agent_authorization/src/application/mod.rs    |   1 +
 .../oauth2_authorization_service.rs           |   2 +-
 .../pushed_authorization_service.rs           |   3 +
 .../domain/authorization_code/aggregate.rs    |  20 +-
 .../src/domain/authorization_code/command.rs  |   2 +-
 .../src/domain/authorization_code/event.rs    |   2 +-
 .../domain/authorization_code/views/mod.rs    |   2 +-
 .../oauth2_authorization_request/aggregate.rs |  99 ++++++--
 .../oauth2_authorization_request/command.rs   |   7 +-
 .../oauth2_authorization_request/error.rs     |   7 +-
 .../oauth2_authorization_request/event.rs     |   2 +
 .../oauth2_authorization_request/views/mod.rs |   3 +
 agent_authorization/src/services.rs           |  45 ++++
 agent_holder/src/offer/aggregate.rs           |  11 +-
 agent_issuance/src/server_config/aggregate.rs |  29 ++-
 agent_issuance/src/state.rs                   |  25 +-
 agent_shared/Cargo.toml                       |   4 +-
 agent_shared/src/config/mod.rs                |   6 +
 agent_store/src/lib.rs                        |   5 +-
 .../src/authorization_request/aggregate.rs    |   4 +-
 .../src/authorization_request/command.rs      |   2 +
 .../verification-authorization/Cargo.toml     |  19 ++
 .../verification-authorization/src/lib.rs     | 142 +++++++++++
 37 files changed, 1017 insertions(+), 116 deletions(-)
 create mode 100644 agent_authorization/src/application/interactive_authorization_service.rs
 create mode 100644 infrastructure/adapters/verification-authorization/Cargo.toml
 create mode 100644 infrastructure/adapters/verification-authorization/src/lib.rs

diff --git a/Cargo.lock b/Cargo.lock
index 17855be5..dc70dff1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -120,6 +120,7 @@ dependencies = [
  "urlencoding",
  "utoipa",
  "uuid",
+ "verification-authorization",
  "wiremock",
 ]
 
@@ -149,6 +150,7 @@ dependencies = [
  "tokio",
  "tower-http 0.6.11",
  "tracing",
+ "verification-authorization",
 ]
 
 [[package]]
@@ -167,6 +169,7 @@ dependencies = [
  "cqrs-es 0.4.12",
  "jsonwebtoken",
  "lazy_static",
+ "mockall",
  "oid4vc-core",
  "oid4vci",
  "once_cell",
@@ -1513,15 +1516,6 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
-[[package]]
-name = "base64-url"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb9fb9fb058cc3063b5fc88d9a21eefa2735871498a04e1650da76ed511c8569"
-dependencies = [
- "base64 0.21.7",
-]
-
 [[package]]
 name = "base64ct"
 version = "1.8.3"
@@ -3404,6 +3398,12 @@ version = "0.15.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
 
+[[package]]
+name = "downcast"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1435fa1053d8b2fbbe9be7e97eca7f33d37b28409959813daefc1446a14247f1"
+
 [[package]]
 name = "dunce"
 version = "1.0.5"
@@ -4031,6 +4031,15 @@ dependencies = [
  "num",
 ]
 
+[[package]]
+name = "fragile"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8878864ba14bb86e818a412bfd6f18f9eabd4ec0f008a28e8f7eb61db532fcf9"
+dependencies = [
+ "futures-core",
+]
+
 [[package]]
 name = "fs-err"
 version = "3.3.0"
@@ -7599,6 +7608,32 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "mockall"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f58d964098a5f9c6b63d0798e5372fd04708193510a7af313c22e9f29b7b620b"
+dependencies = [
+ "cfg-if",
+ "downcast",
+ "fragile",
+ "mockall_derive",
+ "predicates",
+ "predicates-tree",
+]
+
+[[package]]
+name = "mockall_derive"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca41ce716dda6a9be188b385aa78ee5260fc25cd3802cb2a8afdc6afbe6b6dbf"
+dependencies = [
+ "cfg-if",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "moka"
 version = "0.12.15"
@@ -8605,12 +8640,11 @@ dependencies = [
 [[package]]
 name = "oid4vc-core"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=1db24bc#1db24bcd02659fe775666a4408a5251ce7f9e771"
+source = "git+https://github.com/impierce/openid4vc?rev=fcb9e88#fcb9e88b0b549be9520b706e1e7d9625bfd63595"
 dependencies = [
  "anyhow",
  "async-trait",
  "base64 0.22.1",
- "base64-url",
  "derivative",
  "derive_more 0.99.20",
  "did-key",
@@ -8638,7 +8672,7 @@ dependencies = [
 [[package]]
 name = "oid4vc-manager"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=1db24bc#1db24bcd02659fe775666a4408a5251ce7f9e771"
+source = "git+https://github.com/impierce/openid4vc?rev=fcb9e88#fcb9e88b0b549be9520b706e1e7d9625bfd63595"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -8671,7 +8705,7 @@ dependencies = [
 [[package]]
 name = "oid4vci"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=1db24bc#1db24bcd02659fe775666a4408a5251ce7f9e771"
+source = "git+https://github.com/impierce/openid4vc?rev=fcb9e88#fcb9e88b0b549be9520b706e1e7d9625bfd63595"
 dependencies = [
  "anyhow",
  "chrono",
@@ -8699,7 +8733,7 @@ dependencies = [
 [[package]]
 name = "oid4vp"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=1db24bc#1db24bcd02659fe775666a4408a5251ce7f9e771"
+source = "git+https://github.com/impierce/openid4vc?rev=fcb9e88#fcb9e88b0b549be9520b706e1e7d9625bfd63595"
 dependencies = [
  "anyhow",
  "chrono",
@@ -9470,6 +9504,32 @@ dependencies = [
  "zerocopy",
 ]
 
+[[package]]
+name = "predicates"
+version = "3.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ada8f2932f28a27ee7b70dd6c1c39ea0675c55a36879ab92f3a715eaa1e63cfe"
+dependencies = [
+ "anstyle",
+ "predicates-core",
+]
+
+[[package]]
+name = "predicates-core"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cad38746f3166b4031b1a0d39ad9f954dd291e7854fcc0eed52ee41a0b50d144"
+
+[[package]]
+name = "predicates-tree"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0de1b847b39c8131db0467e9df1ff60e6d0562ab8e9a16e568ad0fdb372e2f2"
+dependencies = [
+ "predicates-core",
+ "termtree",
+]
+
 [[package]]
 name = "prefix-hex"
 version = "0.7.1"
@@ -11648,11 +11708,10 @@ dependencies = [
 [[package]]
 name = "siopv2"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=1db24bc#1db24bcd02659fe775666a4408a5251ce7f9e771"
+source = "git+https://github.com/impierce/openid4vc?rev=fcb9e88#fcb9e88b0b549be9520b706e1e7d9625bfd63595"
 dependencies = [
  "anyhow",
  "async-trait",
- "base64-url",
  "chrono",
  "derive_more 0.99.20",
  "did_url",
@@ -12719,6 +12778,12 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "termtree"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f50febec83f5ee1df3015341d8bd429f2d1cc62bcba7ea2076759d315084683"
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -13717,6 +13782,20 @@ version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
 
+[[package]]
+name = "verification-authorization"
+version = "0.1.0"
+dependencies = [
+ "agent_authorization",
+ "agent_shared",
+ "agent_verification",
+ "anyhow",
+ "async-trait",
+ "oid4vp",
+ "serde_json",
+ "shared-kernel",
+]
+
 [[package]]
 name = "version_check"
 version = "0.9.5"
diff --git a/Cargo.toml b/Cargo.toml
index b1fdd9d7..2bf57012 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -19,6 +19,7 @@ members = [
     "shared-kernel",
 
     "infrastructure/stores/mongodb",
+    "infrastructure/adapters/verification-authorization",
 ]
 
 [workspace.package]
@@ -35,11 +36,11 @@ publish = false
 pedantic = "warn"
 
 [workspace.dependencies]
-siopv2 = { git = "https://github.com/impierce/openid4vc", rev = "1db24bc" }
-oid4vci = { git = "https://github.com/impierce/openid4vc", rev = "1db24bc" }
-oid4vc-core = { git = "https://github.com/impierce/openid4vc", rev = "1db24bc" }
-oid4vc-manager = { git = "https://github.com/impierce/openid4vc", rev = "1db24bc" }
-oid4vp = { git = "https://github.com/impierce/openid4vc", rev = "1db24bc" }
+siopv2 = { git = "https://github.com/impierce/openid4vc", rev = "fcb9e88" }
+oid4vci = { git = "https://github.com/impierce/openid4vc", rev = "fcb9e88" }
+oid4vc-core = { git = "https://github.com/impierce/openid4vc", rev = "fcb9e88" }
+oid4vc-manager = { git = "https://github.com/impierce/openid4vc", rev = "fcb9e88" }
+oid4vp = { git = "https://github.com/impierce/openid4vc", rev = "fcb9e88" }
 
 shared-kernel = { path = "shared-kernel" }
 
@@ -52,6 +53,7 @@ chrono = { version = "0.4", features = ["serde"] }
 cqrs-es = "0.4.12"
 derivative = "2.2"
 futures = "0.3"
+mockall = "0.14"
 identity_core = { git = "https://github.com/iotaledger/identity", tag = "v1.9.6-beta.1" }
 identity_credential = { git = "https://github.com/iotaledger/identity", tag = "v1.9.6-beta.1", default-features = false, features = [
     "domain-linkage",
diff --git a/agent_api_http/Cargo.toml b/agent_api_http/Cargo.toml
index 5011efb5..622cb721 100644
--- a/agent_api_http/Cargo.toml
+++ b/agent_api_http/Cargo.toml
@@ -70,6 +70,7 @@ agent_store = { path = "../agent_store" }
 agent_verification = { path = "../agent_verification", features = [
     "test_utils",
 ] }
+verification-authorization = { path = "../infrastructure/adapters/verification-authorization" }
 
 futures.workspace = true
 jsonwebtoken.workspace = true
diff --git a/agent_api_http/src/v0/authorization/authorization_server/authorize.rs b/agent_api_http/src/v0/authorization/authorization_server/authorize.rs
index 5bf137e2..fc759233 100644
--- a/agent_api_http/src/v0/authorization/authorization_server/authorize.rs
+++ b/agent_api_http/src/v0/authorization/authorization_server/authorize.rs
@@ -124,8 +124,15 @@ pub mod tests {
         let AuthorizationCode { issuer_state, .. } = authorization_code.unwrap();
         let issuer_state = issuer_state.unwrap();
 
-        let authorization_state =
-            Arc::new(authorization_state(&InMemory, AuthorizationServices::default().await, Default::default()).await);
+        let authorization_state = Arc::new(
+            authorization_state(
+                &InMemory,
+                AuthorizationServices::default().await,
+                Default::default(),
+                Default::default(),
+            )
+            .await,
+        );
         agent_authorization::state::initialize(&authorization_state)
             .await
             .unwrap();
diff --git a/agent_api_http/src/v0/authorization/authorization_server/par.rs b/agent_api_http/src/v0/authorization/authorization_server/par.rs
index ebc5203c..df47982b 100644
--- a/agent_api_http/src/v0/authorization/authorization_server/par.rs
+++ b/agent_api_http/src/v0/authorization/authorization_server/par.rs
@@ -1,26 +1,89 @@
 use crate::{utils::StringifiedForm, v0::issuance::error::PublicError};
-use agent_authorization::application::pushed_authorization_service::PushedAuthorizationService;
+use agent_authorization::application::{
+    interactive_authorization_service::InteractiveAuthorizationService,
+    pushed_authorization_service::PushedAuthorizationService,
+};
 use agent_authorization::state::AuthorizationState;
 use axum::{
     extract::{Json, State},
     http::StatusCode,
     response::{IntoResponse, Response},
 };
-use oid4vci::authorization_request::AuthorizationRequest;
+use oid4vci::{authorization_request::AuthorizationRequest, InteractiveAuthorizationRequest};
+use serde::{Deserialize, Serialize};
 use std::sync::Arc;
+use tracing::info;
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+#[serde(untagged)]
+pub enum AuthorizationRequestDto {
+    InteractiveAuthorizationRequest(InteractiveAuthorizationRequest),
+    FollowUpInteractiveAuthorizationRequest {
+        auth_session: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        openid4vp_response: Option<serde_json::Value>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        code_verifier: Option<String>,
+    },
+    PushedAuthorizationRequest(AuthorizationRequest),
+}
 
+/// Handles the Pushed Authorization Request (PAR) endpoint as well as the Interactive Authorization Request flow as defined in OpenID4VCI 1.1
 #[axum_macros::debug_handler]
 pub(crate) async fn par(
     State(state): State<Arc<AuthorizationState>>,
-    StringifiedForm(pushed_authorization_request): StringifiedForm<AuthorizationRequest>,
+    StringifiedForm(authorization_request): StringifiedForm<AuthorizationRequestDto>,
 ) -> Result<Response, PublicError> {
-    let pushed_authorization_response =
-        PushedAuthorizationService::handle_pushed_authorization_request(&state, pushed_authorization_request)
-            .await
-            // TODO: implement proper error handling
-            .map_err(|_err| PublicError::InternalServerError)?;
+    match authorization_request {
+        AuthorizationRequestDto::InteractiveAuthorizationRequest(interactive_authorization_request) => {
+            info!("Received interactive authorization request");
+
+            let interactive_authorization_response =
+                InteractiveAuthorizationService::handle_interactive_authorization_request(
+                    &state,
+                    interactive_authorization_request,
+                )
+                .await
+                // TODO: implement proper error handling
+                .map_err(|_err| PublicError::InternalServerError)?;
+
+            Ok((StatusCode::OK, Json(interactive_authorization_response)).into_response())
+        }
+        AuthorizationRequestDto::FollowUpInteractiveAuthorizationRequest {
+            auth_session,
+            openid4vp_response,
+            code_verifier,
+        } => {
+            info!("Received follow-up interactive authorization request for auth session: {auth_session}");
 
-    Ok((StatusCode::CREATED, Json(pushed_authorization_response)).into_response())
+            let interactive_authorization_follow_up_response =
+                InteractiveAuthorizationService::handle_interactive_authorization_request_follow_up(
+                    &state,
+                    auth_session,
+                    openid4vp_response,
+                    code_verifier,
+                )
+                .await
+                // TODO: implement proper error handling
+                .map_err(|_err| PublicError::InternalServerError)?;
+
+            Ok((StatusCode::OK, Json(interactive_authorization_follow_up_response)).into_response())
+        }
+        AuthorizationRequestDto::PushedAuthorizationRequest(pushed_authorization_request) => {
+            info!(
+                "Received pushed authorization request with state: {:?}",
+                pushed_authorization_request.state
+            );
+
+            let authorization_response =
+                PushedAuthorizationService::handle_pushed_authorization_request(&state, pushed_authorization_request)
+                    .await
+                    // TODO: implement proper error handling
+                    .map_err(|_err| PublicError::InternalServerError)?;
+
+            Ok((StatusCode::CREATED, Json(authorization_response)).into_response())
+        }
+    }
 }
 
 #[cfg(test)]
@@ -31,12 +94,15 @@ pub mod tests {
         issuance::{self, credentials::tests::credentials, offers::tests::offers},
     };
     use agent_authorization::{
-        domain::oauth2_authorization_request::aggregate::test_utils::code_challenge, state::UNIME_REDIRECT_URI,
+        application::interactive_authorization_service::INTERACTION_TYPE_OPENID4VP,
+        domain::oauth2_authorization_request::aggregate::test_utils::code_challenge,
+        services::OAuth2AuthorizationRequestDomainServices, state::UNIME_REDIRECT_URI,
     };
     use agent_authorization::{services::AuthorizationServices, state::UNIME_CLIENT_ID};
     use agent_issuance::services::IssuanceServices;
     use agent_secret_manager::service::Service;
     use agent_store::{authorization_state, in_memory::InMemory, issuance_state};
+    use agent_verification::services::VerificationServices;
     use axum::{
         body::Body,
         http::{self, Request},
@@ -48,9 +114,11 @@ pub mod tests {
         authorization_request::CodeChallengeMethod,
         credential_offer::AuthorizationCode,
         wallet::PushedAuthorizationResponse,
+        InteractiveAuthorizationResponse, InteractiveAuthorizationStatus,
     };
     use serde_json::json;
     use tower::Service as _;
+    use verification_authorization::VerificationAuthorizationAdapter;
 
     pub async fn par(app: &mut Router, issuer_state: String) -> String {
         let response = app
@@ -97,6 +165,88 @@ pub mod tests {
         pushed_authorization_response.request_uri
     }
 
+    pub async fn interactive_authorization_request(
+        app: &mut Router,
+        issuer_state: String,
+    ) -> InteractiveAuthorizationResponse {
+        let response = app
+            .call(
+                Request::builder()
+                    .method(http::Method::POST)
+                    .uri("/auth/par")
+                    .header(
+                        http::header::CONTENT_TYPE,
+                        mime::APPLICATION_WWW_FORM_URLENCODED.as_ref(),
+                    )
+                    .body(Body::from(
+                        to_form_urlencoded_string(&json!(InteractiveAuthorizationRequest {
+                            authorization_request: AuthorizationRequest {
+                                response_type: "code".to_string(),
+                                state: Some("test_state".to_string()),
+                                client_id: UNIME_CLIENT_ID.to_string(),
+                                redirect_uri: Some(UNIME_REDIRECT_URI.parse().unwrap()),
+                                code_challenge: Some(code_challenge()),
+                                code_challenge_method: Some(CodeChallengeMethod::S256),
+                                scope: None,
+                                issuer_state: Some(issuer_state),
+                                authorization_details: Some(vec![AuthorizationDetailsObject {
+                                    r#type: OpenidCredential::Type,
+                                    locations: None,
+                                    credential_configuration_id: "configuration_id".to_string(),
+                                    credential_identifiers: None,
+                                    claims: None,
+                                }]),
+                            },
+                            interaction_types_supported: INTERACTION_TYPE_OPENID4VP.to_string(),
+                        }))
+                        .unwrap(),
+                    ))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+
+        assert_eq!(response.status(), StatusCode::OK);
+        assert_eq!(response.headers().get("Content-Type").unwrap(), "application/json");
+
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let interactive_authorization_response: InteractiveAuthorizationResponse =
+            serde_json::from_slice(&body).unwrap();
+
+        let response = app
+            .call(
+                Request::builder()
+                    .method(http::Method::POST)
+                    .uri("/auth/par")
+                    .header(
+                        http::header::CONTENT_TYPE,
+                        mime::APPLICATION_WWW_FORM_URLENCODED.as_ref(),
+                    )
+                    .body(Body::from(
+                        to_form_urlencoded_string(&json!(
+                            AuthorizationRequestDto::FollowUpInteractiveAuthorizationRequest {
+                                auth_session: interactive_authorization_response.auth_session.clone().unwrap(),
+                                openid4vp_response: Some(serde_json::json!({})),
+                                code_verifier: None,
+                            }
+                        ))
+                        .unwrap(),
+                    ))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+
+        assert_eq!(response.status(), StatusCode::OK);
+        assert_eq!(response.headers().get("Content-Type").unwrap(), "application/json");
+
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let interactive_authorization_response: InteractiveAuthorizationResponse =
+            serde_json::from_slice(&body).unwrap();
+
+        interactive_authorization_response
+    }
+
     #[serial_test::serial]
     #[tokio::test]
     async fn test_pushed_authorization_request_endpoint() {
@@ -112,8 +262,15 @@ pub mod tests {
         let AuthorizationCode { issuer_state, .. } = authorization_code.unwrap();
         let issuer_state = issuer_state.unwrap();
 
-        let authorization_state =
-            Arc::new(authorization_state(&InMemory, AuthorizationServices::default().await, Default::default()).await);
+        let authorization_state = Arc::new(
+            authorization_state(
+                &InMemory,
+                AuthorizationServices::default().await,
+                Default::default(),
+                Default::default(),
+            )
+            .await,
+        );
         agent_authorization::state::initialize(&authorization_state)
             .await
             .unwrap();
@@ -122,4 +279,55 @@ pub mod tests {
 
         let _request_uri = par(&mut app, issuer_state).await;
     }
+
+    // TODO: The holder functionality exists but is outdated and not easily integrated in this test structure. Once
+    // holder state can be instantiated and initialized here, add holder service and state creation. Consider creating
+    // a separate test module or helper that demonstrates holder functionality integration
+    #[ignore = "Holder integration requires refactoring test infrastructure to support holder state alongside authorization state"]
+    #[serial_test::serial]
+    #[tokio::test]
+    async fn test_interactive_authorization_request_flow() {
+        let issuance_state =
+            Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
+
+        agent_issuance::state::initialize(&issuance_state).await.unwrap();
+
+        let mut app = issuance::router(issuance_state.clone());
+
+        credentials(&mut app, "002").await;
+        let (authorization_code, _pre_authorized_code) = offers(&mut app, "002").await.unwrap();
+        let AuthorizationCode { issuer_state, .. } = authorization_code.unwrap();
+        let issuer_state = issuer_state.unwrap();
+
+        let verification_state = Arc::new(
+            agent_store::verification_state(&InMemory, VerificationServices::default().await, Default::default()).await,
+        );
+
+        let oauth2_authorization_request_domain_services = OAuth2AuthorizationRequestDomainServices::new(Box::new(
+            VerificationAuthorizationAdapter::new(verification_state.clone()),
+        ));
+
+        let authorization_state = Arc::new(
+            authorization_state(
+                &InMemory,
+                AuthorizationServices::default().await,
+                Default::default(),
+                oauth2_authorization_request_domain_services,
+            )
+            .await,
+        );
+        agent_authorization::state::initialize(&authorization_state)
+            .await
+            .unwrap();
+
+        let mut app = authorization::router((authorization_state, issuance_state));
+
+        let interactive_authorization_request = interactive_authorization_request(&mut app, issuer_state).await;
+
+        assert_eq!(
+            interactive_authorization_request.status,
+            InteractiveAuthorizationStatus::Ok
+        );
+        // TODO: more field checks needed on the response
+    }
 }
diff --git a/agent_api_http/src/v0/authorization/authorization_server/token.rs b/agent_api_http/src/v0/authorization/authorization_server/token.rs
index 0a0bbae0..d8fafe86 100644
--- a/agent_api_http/src/v0/authorization/authorization_server/token.rs
+++ b/agent_api_http/src/v0/authorization/authorization_server/token.rs
@@ -159,8 +159,15 @@ pub mod tests {
         credentials(&mut app, &credential_configuration_id).await;
         let grants = offers(&mut app, &credential_configuration_id).await.unwrap();
 
-        let authorization_state =
-            Arc::new(authorization_state(&InMemory, AuthorizationServices::default().await, Default::default()).await);
+        let authorization_state = Arc::new(
+            authorization_state(
+                &InMemory,
+                AuthorizationServices::default().await,
+                Default::default(),
+                Default::default(),
+            )
+            .await,
+        );
 
         agent_authorization::state::initialize(&authorization_state)
             .await
diff --git a/agent_api_http/src/v0/issuance/credential_issuer/credential.rs b/agent_api_http/src/v0/issuance/credential_issuer/credential.rs
index 9e806828..f746df0b 100644
--- a/agent_api_http/src/v0/issuance/credential_issuer/credential.rs
+++ b/agent_api_http/src/v0/issuance/credential_issuer/credential.rs
@@ -466,8 +466,15 @@ pub mod tests {
 
         let grants = offers(&mut issuance_app, &credential_configuration_id).await.unwrap();
 
-        let authorization_state =
-            Arc::new(authorization_state(&InMemory, AuthorizationServices::default().await, Default::default()).await);
+        let authorization_state = Arc::new(
+            authorization_state(
+                &InMemory,
+                AuthorizationServices::default().await,
+                Default::default(),
+                Default::default(),
+            )
+            .await,
+        );
         agent_authorization::state::initialize(&authorization_state)
             .await
             .unwrap();
diff --git a/agent_api_http/src/v0/issuance/credential_issuer/notification.rs b/agent_api_http/src/v0/issuance/credential_issuer/notification.rs
index 73bc78d2..6b206943 100644
--- a/agent_api_http/src/v0/issuance/credential_issuer/notification.rs
+++ b/agent_api_http/src/v0/issuance/credential_issuer/notification.rs
@@ -88,8 +88,15 @@ mod tests {
         credentials(&mut issuance_app, "001").await;
         let grants = offers(&mut issuance_app, "001").await.unwrap();
 
-        let authorization_state =
-            Arc::new(authorization_state(&InMemory, AuthorizationServices::default().await, Default::default()).await);
+        let authorization_state = Arc::new(
+            authorization_state(
+                &InMemory,
+                AuthorizationServices::default().await,
+                Default::default(),
+                Default::default(),
+            )
+            .await,
+        );
         agent_authorization::state::initialize(&authorization_state)
             .await
             .unwrap();
@@ -128,8 +135,15 @@ mod tests {
         credentials(&mut issuance_app, "001").await;
         let grants = offers(&mut issuance_app, "001").await.unwrap();
 
-        let authorization_state =
-            Arc::new(authorization_state(&InMemory, AuthorizationServices::default().await, Default::default()).await);
+        let authorization_state = Arc::new(
+            authorization_state(
+                &InMemory,
+                AuthorizationServices::default().await,
+                Default::default(),
+                Default::default(),
+            )
+            .await,
+        );
         agent_authorization::state::initialize(&authorization_state)
             .await
             .unwrap();
diff --git a/agent_api_http/src/v0/issuance/credential_issuer/token_status_list.rs b/agent_api_http/src/v0/issuance/credential_issuer/token_status_list.rs
index 3db2f5de..55f81fd7 100644
--- a/agent_api_http/src/v0/issuance/credential_issuer/token_status_list.rs
+++ b/agent_api_http/src/v0/issuance/credential_issuer/token_status_list.rs
@@ -157,8 +157,15 @@ pub mod tests {
 
         let grants = offers(app, &credential_configuration_id).await.unwrap();
 
-        let authorization_state =
-            Arc::new(authorization_state(&InMemory, AuthorizationServices::default().await, Default::default()).await);
+        let authorization_state = Arc::new(
+            authorization_state(
+                &InMemory,
+                AuthorizationServices::default().await,
+                Default::default(),
+                Default::default(),
+            )
+            .await,
+        );
         agent_authorization::state::initialize(&authorization_state)
             .await
             .unwrap();
diff --git a/agent_api_http/src/v0/verification/authorization_requests.rs b/agent_api_http/src/v0/verification/authorization_requests.rs
index fcec8c41..d5a9fbeb 100644
--- a/agent_api_http/src/v0/verification/authorization_requests.rs
+++ b/agent_api_http/src/v0/verification/authorization_requests.rs
@@ -63,6 +63,7 @@ pub(crate) async fn authorization_requests(
         nonce: nonce.clone(),
         state: state.clone(),
         dcql_query: dcql_query.clone(),
+        alternative_response_mode: None,
     };
 
     // Create the authorization request.
diff --git a/agent_application/Cargo.toml b/agent_application/Cargo.toml
index dfba0af7..f3d496f6 100644
--- a/agent_application/Cargo.toml
+++ b/agent_application/Cargo.toml
@@ -18,11 +18,12 @@ agent_secret_manager = { path = "../agent_secret_manager" }
 agent_shared = { path = "../agent_shared" }
 agent_store = { path = "../agent_store" }
 agent_verification = { path = "../agent_verification" }
-did_manager = { git = "https://github.com/impierce/did-manager", rev = "cbf2993" }
+verification-authorization = { path = "../infrastructure/adapters/verification-authorization" }
 
 anyhow.workspace = true
 axum.workspace = true
 chrono.workspace = true
+did_manager = { git = "https://github.com/impierce/did-manager", rev = "cbf2993" }
 serde.workspace = true
 serde_json.workspace = true
 serde_with.workspace = true
diff --git a/agent_application/src/lib.rs b/agent_application/src/lib.rs
index b67563f4..b0803947 100644
--- a/agent_application/src/lib.rs
+++ b/agent_application/src/lib.rs
@@ -3,7 +3,7 @@ mod probes;
 
 pub use agent_api_http::metrics::metrics;
 use agent_api_http::{app, metrics::track_metrics, ApplicationState};
-use agent_authorization::services::AuthorizationServices;
+use agent_authorization::services::{AuthorizationServices, OAuth2AuthorizationRequestDomainServices};
 use agent_event_publisher_http::EventPublisherHttp;
 use agent_event_publisher_nats::EventPublisherNats;
 use agent_holder::services::HolderServices;
@@ -21,6 +21,7 @@ use std::sync::Arc;
 use tokio::io;
 use tower_http::cors::CorsLayer;
 use tracing::info;
+use verification_authorization::VerificationAuthorizationAdapter;
 
 // Re-export states
 pub use agent_authorization::state::AuthorizationState;
@@ -94,6 +95,15 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
                 let issuer_metadata_synchronization_policy =
                     IssuerMetadataSynchronizationPolicy::new(issuance_state.clone());
 
+                let verification_state = Arc::new(
+                    agent_store::verification_state(&builder, verification_services, verification_event_publishers)
+                        .await,
+                );
+
+                let oauth2_authorization_request_domain_services = OAuth2AuthorizationRequestDomainServices::new(
+                    Box::new(VerificationAuthorizationAdapter::new(verification_state.clone())),
+                );
+
                 (
                     Arc::new(agent_store::identity_state(&builder, identity_services, identity_event_publishers).await),
                     Arc::new(
@@ -109,15 +119,13 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
                             &builder,
                             authorization_services,
                             authorization_event_publishers,
+                            oauth2_authorization_request_domain_services,
                         )
                         .await,
                     ),
                     issuance_state,
                     Arc::new(agent_store::holder_state(&builder, holder_services, holder_event_publishers).await),
-                    Arc::new(
-                        agent_store::verification_state(&builder, verification_services, verification_event_publishers)
-                            .await,
-                    ),
+                    verification_state,
                 )
             }
             EventStoreType::MongoDb => {
@@ -129,6 +137,15 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
                 let issuer_metadata_synchronization_policy =
                     IssuerMetadataSynchronizationPolicy::new(issuance_state.clone());
 
+                let verification_state = Arc::new(
+                    agent_store::verification_state(&builder, verification_services, verification_event_publishers)
+                        .await,
+                );
+
+                let oauth2_authorization_request_domain_services = OAuth2AuthorizationRequestDomainServices::new(
+                    Box::new(VerificationAuthorizationAdapter::new(verification_state.clone())),
+                );
+
                 (
                     Arc::new(agent_store::identity_state(&builder, identity_services, identity_event_publishers).await),
                     Arc::new(
@@ -144,15 +161,13 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
                             &builder,
                             authorization_services,
                             authorization_event_publishers,
+                            oauth2_authorization_request_domain_services,
                         )
                         .await,
                     ),
                     issuance_state,
                     Arc::new(agent_store::holder_state(&builder, holder_services, holder_event_publishers).await),
-                    Arc::new(
-                        agent_store::verification_state(&builder, verification_services, verification_event_publishers)
-                            .await,
-                    ),
+                    verification_state,
                 )
             }
             EventStoreType::InMemory => {
@@ -163,6 +178,15 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
                 let issuer_metadata_synchronization_policy =
                     IssuerMetadataSynchronizationPolicy::new(issuance_state.clone());
 
+                let verification_state = Arc::new(
+                    agent_store::verification_state(&InMemory, verification_services, verification_event_publishers)
+                        .await,
+                );
+
+                let oauth2_authorization_request_domain_services = OAuth2AuthorizationRequestDomainServices::new(
+                    Box::new(VerificationAuthorizationAdapter::new(verification_state.clone())),
+                );
+
                 (
                     Arc::new(
                         agent_store::identity_state(&InMemory, identity_services, identity_event_publishers).await,
@@ -180,19 +204,13 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
                             &InMemory,
                             authorization_services,
                             authorization_event_publishers,
+                            oauth2_authorization_request_domain_services,
                         )
                         .await,
                     ),
                     issuance_state,
                     Arc::new(agent_store::holder_state(&InMemory, holder_services, holder_event_publishers).await),
-                    Arc::new(
-                        agent_store::verification_state(
-                            &InMemory,
-                            verification_services,
-                            verification_event_publishers,
-                        )
-                        .await,
-                    ),
+                    verification_state,
                 )
             }
         };
diff --git a/agent_authorization/Cargo.toml b/agent_authorization/Cargo.toml
index 8d3f62be..6f110829 100644
--- a/agent_authorization/Cargo.toml
+++ b/agent_authorization/Cargo.toml
@@ -15,6 +15,7 @@ async-trait.workspace = true
 cqrs-es.workspace = true
 chrono.workspace = true
 jsonwebtoken.workspace = true
+mockall = { workspace = true, optional = true }
 oid4vci.workspace = true
 oid4vc-core.workspace = true
 strum.workspace = true
@@ -44,4 +45,4 @@ serial_test = "3.0"
 tracing-test.workspace = true
 
 [features]
-test_utils = ["dep:lazy_static", "dep:once_cell", "dep:rstest"]
+test_utils = ["dep:lazy_static", "dep:once_cell", "dep:rstest", "dep:mockall"]
diff --git a/agent_authorization/src/application/interactive_authorization_service.rs b/agent_authorization/src/application/interactive_authorization_service.rs
new file mode 100644
index 00000000..a22d985c
--- /dev/null
+++ b/agent_authorization/src/application/interactive_authorization_service.rs
@@ -0,0 +1,210 @@
+use agent_shared::handlers::{command_handler, query_handler};
+use oid4vci::{
+    InteractionType, InteractiveAuthorizationRequest, InteractiveAuthorizationResponse, InteractiveAuthorizationStatus,
+};
+use thiserror::Error;
+
+use crate::{
+    domain::{
+        authorization_code::command::AuthorizationCodeCommand,
+        oauth2_authorization_request::command::OAuth2AuthorizationRequestCommand,
+    },
+    state::{AuthorizationState, UNIME_CLIENT_ID},
+};
+
+/// This is the only interaction type that is currently supported by the Interactive Authorization Service. Will also stay the only type for the foreseeable future since it's the only one well-defined by OID4VCI 1.1 spec https://openid.github.io/OpenID4VCI/openid-4-verifiable-credential-issuance-1_1-wg-draft.html
+pub const INTERACTION_TYPE_OPENID4VP: &str = "urn:openid:dcp:iae:openid4vp_presentation";
+
+// TODO: improve error handling
+#[derive(Debug, Error)]
+pub enum InteractiveAuthorizationError {
+    #[error("Invalid client ID")]
+    InvalidClientIdError,
+    #[error("Invalid redirect URI")]
+    InvalidRedirectUriError,
+    #[error("Invalid response type")]
+    InvalidResponseTypeError,
+    #[error("Missing code challenge")]
+    MissingCodeChallengeError,
+    #[error("Invalid code challenge method")]
+    InvalidCodeChallengeMethodError,
+    #[error("Request not found or expired")]
+    RequestNotFound,
+    #[error("Expired authorization request")]
+    ExpiredAuthorizationRequestError,
+    #[error("Missing redirect URI")]
+    MissingRedirectUriError,
+    #[error("Missing `openid4vp_response` in the request")]
+    MissingOpenId4VPResponseError,
+    #[error("Unsupported interaction types: {0}")]
+    UnsupportedInteractionTypesError(String),
+    #[error("Internal error: {0}")]
+    Internal(String),
+}
+
+pub struct InteractiveAuthorizationService {}
+
+impl InteractiveAuthorizationService {
+    pub async fn handle_interactive_authorization_request(
+        state: &AuthorizationState,
+        interactive_authorization_request: InteractiveAuthorizationRequest,
+    ) -> Result<InteractiveAuthorizationResponse, InteractiveAuthorizationError> {
+        let InteractiveAuthorizationRequest {
+            authorization_request,
+            interaction_types_supported,
+        } = interactive_authorization_request;
+
+        if interaction_types_supported != INTERACTION_TYPE_OPENID4VP {
+            return Err(InteractiveAuthorizationError::UnsupportedInteractionTypesError(
+                interaction_types_supported,
+            ));
+        }
+
+        // TODO: Currently there is no way of validating these parameters for unknown Clients (Clients that are not
+        // registered in the Authorization Server). Therefore, as of now we can only validate the request for known
+        // Clients. See: https://github.com/openid/OpenID4VCI/issues/94
+        if authorization_request.client_id == UNIME_CLIENT_ID {
+            let client = query_handler(&authorization_request.client_id, &state.query.client)
+                .await
+                .map_err(|err| InteractiveAuthorizationError::Internal(err.to_string()))?
+                .ok_or(InteractiveAuthorizationError::InvalidClientIdError)?;
+
+            authorization_request
+                .redirect_uri
+                .as_ref()
+                .filter(|redirect_uri| client.redirect_uris.contains(redirect_uri))
+                .ok_or(InteractiveAuthorizationError::InvalidRedirectUriError)?;
+
+            if !client.response_types.contains(&authorization_request.response_type) {
+                return Err(InteractiveAuthorizationError::InvalidResponseTypeError);
+            }
+
+            // todo: add scope validation
+
+            if client.require_pkce {
+                if let Some(code_challenge_method) = authorization_request.code_challenge_method.as_ref() {
+                    if !client.code_challenge_methods_supported.contains(code_challenge_method) {
+                        return Err(InteractiveAuthorizationError::InvalidCodeChallengeMethodError);
+                    }
+                } else {
+                    return Err(InteractiveAuthorizationError::MissingCodeChallengeError);
+                }
+
+                // todo: add code_challenge validation
+            }
+        }
+
+        let oauth2_authorization_request_id = uuid::Uuid::new_v4().urn().to_string();
+
+        // TODO: Make this configurable?
+        let expires_in = 3600; // 1 hour
+        let expires_at = chrono::Utc::now().timestamp() + expires_in;
+
+        let command = OAuth2AuthorizationRequestCommand::CreateOAuth2AuthorizationRequest {
+            oauth2_authorization_request_id: oauth2_authorization_request_id.clone(),
+            pushed_authorization_request: authorization_request.clone(),
+            expires_at,
+            interaction_type: Some(InteractionType::OpenId4VpPresentation),
+        };
+
+        command_handler(
+            &oauth2_authorization_request_id,
+            &state.command.oauth2_authorization_request,
+            command,
+        )
+        .await
+        .map_err(|err| InteractiveAuthorizationError::Internal(err.to_string()))?;
+
+        let oauth2_authorization_request_view = query_handler(
+            &oauth2_authorization_request_id,
+            &state.query.oauth2_authorization_request,
+        )
+        .await
+        .map_err(|err| InteractiveAuthorizationError::Internal(err.to_string()))?
+        .ok_or(InteractiveAuthorizationError::Internal(
+            "Failed to retrieve created OAuth2 authorization request".to_string(),
+        ))?;
+
+        let openid4vp_request =
+            oauth2_authorization_request_view
+                .openid4vp_request
+                .ok_or(InteractiveAuthorizationError::Internal(
+                    "Failed to retrieve OpenID4VP request from OAuth2 authorization request".to_string(),
+                ))?;
+
+        Ok(InteractiveAuthorizationResponse {
+            status: InteractiveAuthorizationStatus::RequireInteraction,
+            code: None,
+            interaction_type: Some(InteractionType::OpenId4VpPresentation),
+            auth_session: Some(oauth2_authorization_request_id),
+            openid4vp_request: Some(openid4vp_request),
+            request_uri: None,
+            expires_in: None,
+        })
+    }
+
+    pub async fn handle_interactive_authorization_request_follow_up(
+        state: &AuthorizationState,
+        auth_session: String,
+        openid4vp_response: Option<serde_json::Value>,
+        // TODO: support PKCE?
+        _code_verifier: Option<String>,
+    ) -> Result<InteractiveAuthorizationResponse, InteractiveAuthorizationError> {
+        let oauth2_authorization_request_id = auth_session.clone();
+
+        let command = OAuth2AuthorizationRequestCommand::SubmitOpenId4VpResponse {
+            openid4vp_response: openid4vp_response
+                .clone()
+                .ok_or(InteractiveAuthorizationError::MissingOpenId4VPResponseError)?,
+        };
+
+        command_handler(
+            &oauth2_authorization_request_id,
+            &state.command.oauth2_authorization_request,
+            command,
+        )
+        .await
+        .map_err(|err| InteractiveAuthorizationError::Internal(err.to_string()))?;
+
+        // Get the OAuth2 authorization request that has been pushed via the `/auth/par` endpoint.
+        let oauth2_authorization_request = query_handler(
+            &oauth2_authorization_request_id,
+            &state.query.oauth2_authorization_request,
+        )
+        .await
+        .map_err(|err| InteractiveAuthorizationError::Internal(err.to_string()))?
+        .ok_or(InteractiveAuthorizationError::RequestNotFound)?;
+
+        if chrono::Utc::now().timestamp() > oauth2_authorization_request.expires_at {
+            return Err(InteractiveAuthorizationError::ExpiredAuthorizationRequestError);
+        }
+
+        // TODO: make this configurable?
+        let expires_in = 600; // 10 minutes
+
+        let authorization_code_id = uuid::Uuid::new_v4().to_string();
+        let command = AuthorizationCodeCommand::CreateAuthorizationCode {
+            authorization_code_id: authorization_code_id.clone(),
+            client_id: oauth2_authorization_request.client_id.clone(),
+            redirect_uri: oauth2_authorization_request.redirect_uri.clone(),
+            code_challenge: oauth2_authorization_request.code_challenge,
+            code_challenge_method: oauth2_authorization_request.code_challenge_method,
+            issuer_state: oauth2_authorization_request.issuer_state,
+            expires_in,
+        };
+
+        command_handler(&authorization_code_id, &state.command.authorization_code, command)
+            .await
+            .map_err(|err| InteractiveAuthorizationError::Internal(err.to_string()))?;
+
+        Ok(InteractiveAuthorizationResponse {
+            status: InteractiveAuthorizationStatus::Ok,
+            code: Some(authorization_code_id),
+            interaction_type: None,
+            auth_session: None,
+            openid4vp_request: None,
+            request_uri: None,
+            expires_in: Some(expires_in),
+        })
+    }
+}
diff --git a/agent_authorization/src/application/mod.rs b/agent_authorization/src/application/mod.rs
index 464f81e6..907a6a6d 100644
--- a/agent_authorization/src/application/mod.rs
+++ b/agent_authorization/src/application/mod.rs
@@ -1,5 +1,6 @@
 pub mod consent_query_service;
 pub mod consent_service;
+pub mod interactive_authorization_service;
 pub mod oauth2_authorization_service;
 pub mod pushed_authorization_service;
 pub mod token_issuance_service;
diff --git a/agent_authorization/src/application/oauth2_authorization_service.rs b/agent_authorization/src/application/oauth2_authorization_service.rs
index 06e6a163..5f066093 100644
--- a/agent_authorization/src/application/oauth2_authorization_service.rs
+++ b/agent_authorization/src/application/oauth2_authorization_service.rs
@@ -81,7 +81,7 @@ impl OAuth2AuthorizationService {
                 let command = AuthorizationCodeCommand::CreateAuthorizationCode {
                     authorization_code_id: authorization_code_id.clone(),
                     client_id,
-                    redirect_uri: redirect_uri.clone(),
+                    redirect_uri: Some(redirect_uri.clone()),
                     code_challenge: oauth2_authorization_request.code_challenge,
                     code_challenge_method: oauth2_authorization_request.code_challenge_method,
                     issuer_state: oauth2_authorization_request.issuer_state,
diff --git a/agent_authorization/src/application/pushed_authorization_service.rs b/agent_authorization/src/application/pushed_authorization_service.rs
index c9c1c30f..ce321e14 100644
--- a/agent_authorization/src/application/pushed_authorization_service.rs
+++ b/agent_authorization/src/application/pushed_authorization_service.rs
@@ -64,6 +64,8 @@ impl PushedAuthorizationService {
                 } else {
                     return Err(PushedAuthorizationError::MissingCodeChallengeError);
                 }
+
+                // todo: add code_challenge validation
             }
         }
 
@@ -78,6 +80,7 @@ impl PushedAuthorizationService {
             oauth2_authorization_request_id: oauth2_authorization_request_id.clone(),
             pushed_authorization_request: pushed_authorization_request.clone(),
             expires_at,
+            interaction_type: None,
         };
 
         command_handler(
diff --git a/agent_authorization/src/domain/authorization_code/aggregate.rs b/agent_authorization/src/domain/authorization_code/aggregate.rs
index a963df43..c606dcac 100644
--- a/agent_authorization/src/domain/authorization_code/aggregate.rs
+++ b/agent_authorization/src/domain/authorization_code/aggregate.rs
@@ -134,7 +134,7 @@ impl Aggregate for AuthorizationCode {
             } => {
                 self.authorization_code_id = authorization_code_id;
                 self.client_id = client_id;
-                self.redirect_uri.replace(redirect_uri);
+                self.redirect_uri = redirect_uri;
                 self.code_challenge = code_challenge;
                 self.code_challenge_method = code_challenge_method;
                 self.issuer_state = issuer_state;
@@ -182,7 +182,7 @@ pub mod authorization_code_tests {
             .when(AuthorizationCodeCommand::CreateAuthorizationCode {
                 authorization_code_id: authorization_code_id.clone(),
                 client_id: client_id.clone(),
-                redirect_uri: redirect_uri.clone().unwrap(),
+                redirect_uri: redirect_uri.clone(),
                 code_challenge: Some(code_challenge.clone()),
                 code_challenge_method: code_challenge_method.clone(),
                 issuer_state: issuer_state.clone(),
@@ -191,7 +191,7 @@ pub mod authorization_code_tests {
             .then_expect_events(vec![AuthorizationCodeEvent::AuthorizationCodeCreated {
                 authorization_code_id,
                 client_id,
-                redirect_uri: redirect_uri.unwrap(),
+                redirect_uri,
                 code_challenge: Some(code_challenge),
                 code_challenge_method,
                 issuer_state,
@@ -215,7 +215,7 @@ pub mod authorization_code_tests {
             .given(vec![AuthorizationCodeEvent::AuthorizationCodeCreated {
                 authorization_code_id: authorization_code_id.clone(),
                 client_id: client_id.clone(),
-                redirect_uri: redirect_uri.clone().unwrap(),
+                redirect_uri: redirect_uri.clone(),
                 code_challenge: Some(code_challenge),
                 code_challenge_method,
                 issuer_state,
@@ -249,7 +249,7 @@ pub mod authorization_code_tests {
                 AuthorizationCodeEvent::AuthorizationCodeCreated {
                     authorization_code_id: authorization_code_id.clone(),
                     client_id: client_id.clone(),
-                    redirect_uri: redirect_uri.clone().unwrap(),
+                    redirect_uri: redirect_uri.clone(),
                     code_challenge: Some(code_challenge),
                     code_challenge_method,
                     issuer_state,
@@ -284,7 +284,7 @@ pub mod authorization_code_tests {
             .given(vec![AuthorizationCodeEvent::AuthorizationCodeCreated {
                 authorization_code_id: authorization_code_id.clone(),
                 client_id: client_id.clone(),
-                redirect_uri: redirect_uri.clone().unwrap(),
+                redirect_uri: redirect_uri.clone(),
                 code_challenge: Some(code_challenge),
                 code_challenge_method,
                 issuer_state,
@@ -315,7 +315,7 @@ pub mod authorization_code_tests {
             .given(vec![AuthorizationCodeEvent::AuthorizationCodeCreated {
                 authorization_code_id: authorization_code_id.clone(),
                 client_id,
-                redirect_uri: redirect_uri.clone().unwrap(),
+                redirect_uri: redirect_uri.clone(),
                 code_challenge: Some(code_challenge),
                 code_challenge_method,
                 issuer_state,
@@ -346,7 +346,7 @@ pub mod authorization_code_tests {
             .given(vec![AuthorizationCodeEvent::AuthorizationCodeCreated {
                 authorization_code_id: authorization_code_id.clone(),
                 client_id: client_id.clone(),
-                redirect_uri: redirect_uri.unwrap(),
+                redirect_uri,
                 code_challenge: Some(code_challenge),
                 code_challenge_method,
                 issuer_state,
@@ -376,7 +376,7 @@ pub mod authorization_code_tests {
             .given(vec![AuthorizationCodeEvent::AuthorizationCodeCreated {
                 authorization_code_id: authorization_code_id.clone(),
                 client_id: client_id.clone(),
-                redirect_uri: redirect_uri.clone().unwrap(),
+                redirect_uri: redirect_uri.clone(),
                 code_challenge: Some(code_challenge),
                 code_challenge_method,
                 issuer_state,
@@ -406,7 +406,7 @@ pub mod authorization_code_tests {
             .given(vec![AuthorizationCodeEvent::AuthorizationCodeCreated {
                 authorization_code_id: authorization_code_id.clone(),
                 client_id: client_id.clone(),
-                redirect_uri: redirect_uri.clone().unwrap(),
+                redirect_uri: redirect_uri.clone(),
                 code_challenge: Some(code_challenge),
                 code_challenge_method,
                 issuer_state,
diff --git a/agent_authorization/src/domain/authorization_code/command.rs b/agent_authorization/src/domain/authorization_code/command.rs
index 2c86e6d8..47bbe882 100644
--- a/agent_authorization/src/domain/authorization_code/command.rs
+++ b/agent_authorization/src/domain/authorization_code/command.rs
@@ -8,7 +8,7 @@ pub enum AuthorizationCodeCommand {
     CreateAuthorizationCode {
         authorization_code_id: String,
         client_id: String,
-        redirect_uri: Url,
+        redirect_uri: Option<Url>,
         code_challenge: Option<String>,
         code_challenge_method: Option<CodeChallengeMethod>,
         issuer_state: Option<String>,
diff --git a/agent_authorization/src/domain/authorization_code/event.rs b/agent_authorization/src/domain/authorization_code/event.rs
index b17fc251..c4a59d52 100644
--- a/agent_authorization/src/domain/authorization_code/event.rs
+++ b/agent_authorization/src/domain/authorization_code/event.rs
@@ -9,7 +9,7 @@ pub enum AuthorizationCodeEvent {
     AuthorizationCodeCreated {
         authorization_code_id: String,
         client_id: String,
-        redirect_uri: Url,
+        redirect_uri: Option<Url>,
         code_challenge: Option<String>,
         code_challenge_method: Option<CodeChallengeMethod>,
         issuer_state: Option<String>,
diff --git a/agent_authorization/src/domain/authorization_code/views/mod.rs b/agent_authorization/src/domain/authorization_code/views/mod.rs
index 0c609e0d..4d2566c1 100644
--- a/agent_authorization/src/domain/authorization_code/views/mod.rs
+++ b/agent_authorization/src/domain/authorization_code/views/mod.rs
@@ -21,7 +21,7 @@ impl View<AuthorizationCode> for AuthorizationCode {
             } => {
                 self.authorization_code_id.clone_from(authorization_code_id);
                 self.client_id.clone_from(client_id);
-                self.redirect_uri.replace(redirect_uri.clone());
+                self.redirect_uri.clone_from(redirect_uri);
                 self.code_challenge.clone_from(code_challenge);
                 self.code_challenge_method.clone_from(code_challenge_method);
                 self.issuer_state.clone_from(issuer_state);
diff --git a/agent_authorization/src/domain/oauth2_authorization_request/aggregate.rs b/agent_authorization/src/domain/oauth2_authorization_request/aggregate.rs
index 7731eef7..a2b3d8cc 100644
--- a/agent_authorization/src/domain/oauth2_authorization_request/aggregate.rs
+++ b/agent_authorization/src/domain/oauth2_authorization_request/aggregate.rs
@@ -1,9 +1,13 @@
+use crate::services::OAuth2AuthorizationRequestDomainServices;
+
 use super::command::OAuth2AuthorizationRequestCommand;
 use super::error::OAuth2AuthorizationRequestError;
 use super::event::OAuth2AuthorizationRequestEvent;
 use async_trait::async_trait;
 use cqrs_es::Aggregate;
-use oid4vci::{authorization_details::AuthorizationDetailsObject, authorization_request::CodeChallengeMethod};
+use oid4vci::{
+    authorization_details::AuthorizationDetailsObject, authorization_request::CodeChallengeMethod, InteractionType,
+};
 use serde::{Deserialize, Serialize};
 use tracing::{debug, info};
 use url::Url;
@@ -39,6 +43,10 @@ pub struct OAuth2AuthorizationRequest {
 
     pub expires_at: i64,
     pub consent_status: ConsentStatus,
+
+    // TODO: This does not belong here, but with the current architecture for now we need it to be able to link the
+    // authorization request to the interaction session in the interactive authorization flow.
+    pub openid4vp_request: Option<serde_json::Value>,
 }
 
 #[async_trait]
@@ -46,18 +54,15 @@ impl Aggregate for OAuth2AuthorizationRequest {
     type Command = OAuth2AuthorizationRequestCommand;
     type Event = OAuth2AuthorizationRequestEvent;
     type Error = OAuth2AuthorizationRequestError;
-    type Services = ();
+    type Services = OAuth2AuthorizationRequestDomainServices;
 
     fn aggregate_type() -> String {
         "oauth2_authorization_request".to_string()
     }
 
-    async fn handle(
-        &self,
-        command: Self::Command,
-        _services: &Self::Services,
-    ) -> Result<Vec<Self::Event>, Self::Error> {
+    async fn handle(&self, command: Self::Command, services: &Self::Services) -> Result<Vec<Self::Event>, Self::Error> {
         use OAuth2AuthorizationRequestCommand::*;
+        use OAuth2AuthorizationRequestError::*;
         use OAuth2AuthorizationRequestEvent::*;
 
         info!("Handling command: {:?}", command);
@@ -67,20 +72,40 @@ impl Aggregate for OAuth2AuthorizationRequest {
                 oauth2_authorization_request_id,
                 pushed_authorization_request,
                 expires_at,
-            } => Ok(vec![OAuth2AuthorizationRequestCreated {
-                oauth2_authorization_request_id,
-                response_type: pushed_authorization_request.response_type,
-                // TODO: required or optional?
-                state: pushed_authorization_request.state.unwrap_or_default(),
-                client_id: pushed_authorization_request.client_id,
-                redirect_uri: pushed_authorization_request.redirect_uri,
-                scope: pushed_authorization_request.scope,
-                issuer_state: pushed_authorization_request.issuer_state,
-                authorization_details: pushed_authorization_request.authorization_details,
-                code_challenge: pushed_authorization_request.code_challenge,
-                code_challenge_method: pushed_authorization_request.code_challenge_method,
-                expires_at,
-            }]),
+                interaction_type,
+            } => {
+                // TODO: refactor state handling according to https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-5.3
+                // Currently the unwrap_or_default is a shortcut for the fact it's optional in the PAR but we haven't made it optional in the OID4VP request
+                let state = pushed_authorization_request.issuer_state.clone().unwrap_or_default();
+
+                let openid4vp_request = if let Some(InteractionType::OpenId4VpPresentation) = interaction_type {
+                    Some(
+                        services
+                            .openid4vp_presentation_service
+                            .create_openid4vp_presentation_request(state)
+                            .await
+                            .map_err(OpenID4VpCreationError)?,
+                    )
+                } else {
+                    None
+                };
+
+                Ok(vec![OAuth2AuthorizationRequestCreated {
+                    oauth2_authorization_request_id,
+                    response_type: pushed_authorization_request.response_type,
+                    // TODO: required or optional?
+                    state: pushed_authorization_request.state.unwrap_or_default(),
+                    client_id: pushed_authorization_request.client_id,
+                    redirect_uri: pushed_authorization_request.redirect_uri,
+                    scope: pushed_authorization_request.scope,
+                    issuer_state: pushed_authorization_request.issuer_state,
+                    authorization_details: pushed_authorization_request.authorization_details,
+                    code_challenge: pushed_authorization_request.code_challenge,
+                    code_challenge_method: pushed_authorization_request.code_challenge_method,
+                    expires_at,
+                    openid4vp_request,
+                }])
+            }
             GrantConsent => {
                 let now = chrono::Utc::now().timestamp();
                 if now > self.expires_at {
@@ -109,6 +134,27 @@ impl Aggregate for OAuth2AuthorizationRequest {
                     }])
                 }
             }
+            SubmitOpenId4VpResponse { openid4vp_response } => {
+                services
+                    .openid4vp_presentation_service()
+                    .verify_openid4vp_response(openid4vp_response)
+                    .await
+                    .map_err(OpenID4VpVerificationError)?;
+
+                // TODO: is this expiry date the only factor preventing replay? Not sure to use Nonce, state, or auth_session but one of these need to be invalidated after being used once.
+                let now = chrono::Utc::now().timestamp();
+                if now > self.expires_at {
+                    Ok(vec![OAuth2AuthorizationRequestExpired {
+                        oauth2_authorization_request_id: self.oauth2_authorization_request_id.clone(),
+                        consent_status: ConsentStatus::Expired,
+                    }])
+                } else {
+                    Ok(vec![ConsentGranted {
+                        oauth2_authorization_request_id: self.oauth2_authorization_request_id.clone(),
+                        consent_status: ConsentStatus::Granted,
+                    }])
+                }
+            }
         }
     }
 
@@ -130,6 +176,7 @@ impl Aggregate for OAuth2AuthorizationRequest {
                 code_challenge,
                 code_challenge_method,
                 expires_at,
+                openid4vp_request,
             } => {
                 self.oauth2_authorization_request_id = oauth2_authorization_request_id;
                 self.response_type = response_type;
@@ -142,6 +189,7 @@ impl Aggregate for OAuth2AuthorizationRequest {
                 self.code_challenge = code_challenge;
                 self.code_challenge_method = code_challenge_method;
                 self.expires_at = expires_at;
+                self.openid4vp_request = openid4vp_request;
             }
             OAuth2AuthorizationRequestExpired {
                 oauth2_authorization_request_id,
@@ -185,12 +233,13 @@ pub mod oauth2_authorization_request_tests {
         pushed_authorization_request: AuthorizationRequest,
         expires_at: i64,
     ) {
-        OAuth2AuthorizationRequestTestFramework::with(())
+        OAuth2AuthorizationRequestTestFramework::with(OAuth2AuthorizationRequestDomainServices::default())
             .given_no_previous_events()
             .when(OAuth2AuthorizationRequestCommand::CreateOAuth2AuthorizationRequest {
                 oauth2_authorization_request_id: oauth2_authorization_request_id.clone(),
                 pushed_authorization_request: pushed_authorization_request.clone(),
                 expires_at,
+                interaction_type: None,
             })
             .then_expect_events(vec![
                 OAuth2AuthorizationRequestEvent::OAuth2AuthorizationRequestCreated {
@@ -205,6 +254,7 @@ pub mod oauth2_authorization_request_tests {
                     code_challenge: pushed_authorization_request.code_challenge,
                     code_challenge_method: pushed_authorization_request.code_challenge_method,
                     expires_at,
+                    openid4vp_request: None,
                 },
             ]);
     }
@@ -215,7 +265,7 @@ pub mod oauth2_authorization_request_tests {
         oauth2_authorization_request_id: String,
         authorization_request_pushed_event: OAuth2AuthorizationRequestEvent,
     ) {
-        OAuth2AuthorizationRequestTestFramework::with(())
+        OAuth2AuthorizationRequestTestFramework::with(OAuth2AuthorizationRequestDomainServices::default())
             .given(vec![authorization_request_pushed_event.clone()])
             .when(OAuth2AuthorizationRequestCommand::GrantConsent)
             .then_expect_events(vec![OAuth2AuthorizationRequestEvent::ConsentGranted {
@@ -230,7 +280,7 @@ pub mod oauth2_authorization_request_tests {
         oauth2_authorization_request_id: String,
         authorization_request_pushed_event: OAuth2AuthorizationRequestEvent,
     ) {
-        OAuth2AuthorizationRequestTestFramework::with(())
+        OAuth2AuthorizationRequestTestFramework::with(OAuth2AuthorizationRequestDomainServices::default())
             .given(vec![authorization_request_pushed_event.clone()])
             .when(OAuth2AuthorizationRequestCommand::RejectConsent)
             .then_expect_events(vec![OAuth2AuthorizationRequestEvent::ConsentRejected {
@@ -360,6 +410,7 @@ pub mod test_utils {
             code_challenge: pushed_authorization_request.code_challenge,
             code_challenge_method: pushed_authorization_request.code_challenge_method,
             expires_at,
+            openid4vp_request: None,
         }
     }
 }
diff --git a/agent_authorization/src/domain/oauth2_authorization_request/command.rs b/agent_authorization/src/domain/oauth2_authorization_request/command.rs
index f842a6cd..003cc9c3 100644
--- a/agent_authorization/src/domain/oauth2_authorization_request/command.rs
+++ b/agent_authorization/src/domain/oauth2_authorization_request/command.rs
@@ -1,4 +1,4 @@
-use oid4vci::authorization_request::AuthorizationRequest;
+use oid4vci::{authorization_request::AuthorizationRequest, InteractionType};
 use serde::Deserialize;
 
 // TODO: remove this clippy allow
@@ -10,7 +10,12 @@ pub enum OAuth2AuthorizationRequestCommand {
         oauth2_authorization_request_id: String,
         pushed_authorization_request: AuthorizationRequest,
         expires_at: i64,
+        #[serde(default)]
+        interaction_type: Option<InteractionType>,
     },
     GrantConsent,
     RejectConsent,
+    SubmitOpenId4VpResponse {
+        openid4vp_response: serde_json::Value,
+    },
 }
diff --git a/agent_authorization/src/domain/oauth2_authorization_request/error.rs b/agent_authorization/src/domain/oauth2_authorization_request/error.rs
index 6f3e88ec..4ef0c6e7 100644
--- a/agent_authorization/src/domain/oauth2_authorization_request/error.rs
+++ b/agent_authorization/src/domain/oauth2_authorization_request/error.rs
@@ -1,4 +1,9 @@
 use thiserror::Error;
 
 #[derive(Error, Debug)]
-pub enum OAuth2AuthorizationRequestError {}
+pub enum OAuth2AuthorizationRequestError {
+    #[error("Failed to create OpenID4VP presentation request: {0}")]
+    OpenID4VpCreationError(anyhow::Error),
+    #[error("Failed to verify OpenID4VP presentation response: {0}")]
+    OpenID4VpVerificationError(anyhow::Error),
+}
diff --git a/agent_authorization/src/domain/oauth2_authorization_request/event.rs b/agent_authorization/src/domain/oauth2_authorization_request/event.rs
index c7b4aa9d..6c3ef97b 100644
--- a/agent_authorization/src/domain/oauth2_authorization_request/event.rs
+++ b/agent_authorization/src/domain/oauth2_authorization_request/event.rs
@@ -28,6 +28,8 @@ pub enum OAuth2AuthorizationRequestEvent {
         code_challenge_method: Option<CodeChallengeMethod>,
 
         expires_at: i64,
+
+        openid4vp_request: Option<serde_json::Value>,
     },
     OAuth2AuthorizationRequestExpired {
         oauth2_authorization_request_id: String,
diff --git a/agent_authorization/src/domain/oauth2_authorization_request/views/mod.rs b/agent_authorization/src/domain/oauth2_authorization_request/views/mod.rs
index 5cb203f8..ebf22aeb 100644
--- a/agent_authorization/src/domain/oauth2_authorization_request/views/mod.rs
+++ b/agent_authorization/src/domain/oauth2_authorization_request/views/mod.rs
@@ -23,6 +23,8 @@ impl View<OAuth2AuthorizationRequest> for OAuth2AuthorizationRequest {
                 code_challenge_method,
 
                 expires_at,
+
+                openid4vp_request,
             } => {
                 self.oauth2_authorization_request_id
                     .clone_from(oauth2_authorization_request_id);
@@ -36,6 +38,7 @@ impl View<OAuth2AuthorizationRequest> for OAuth2AuthorizationRequest {
                 self.code_challenge.clone_from(code_challenge);
                 self.code_challenge_method.clone_from(code_challenge_method);
                 self.expires_at = *expires_at;
+                self.openid4vp_request.clone_from(openid4vp_request);
             }
             OAuth2AuthorizationRequestExpired {
                 oauth2_authorization_request_id,
diff --git a/agent_authorization/src/services.rs b/agent_authorization/src/services.rs
index 4b5a27b5..3438aee8 100644
--- a/agent_authorization/src/services.rs
+++ b/agent_authorization/src/services.rs
@@ -1,4 +1,7 @@
 use agent_secret_manager::{service::Service, subject::Subject};
+use async_trait::async_trait;
+#[cfg(any(feature = "test_utils", test))]
+use mockall::automock;
 use std::sync::Arc;
 
 pub struct AuthorizationServices {
@@ -10,3 +13,45 @@ impl Service for AuthorizationServices {
         Self { signer }
     }
 }
+
+#[cfg_attr(any(feature = "test_utils", test), automock)]
+#[async_trait]
+pub trait OpenId4VpPresentationService: Send + Sync {
+    async fn create_openid4vp_presentation_request(&self, state: String) -> anyhow::Result<serde_json::Value>;
+    async fn verify_openid4vp_response(&self, openid4vp_response: serde_json::Value) -> anyhow::Result<()>;
+}
+
+/// This struct is used to hold the services required for the OAuth2AuthorizationRequest aggregate.
+/// Currently we only support the OpenId4VpPresentationService, but more services can be added in the future as needed.
+pub struct OAuth2AuthorizationRequestDomainServices {
+    pub openid4vp_presentation_service: Box<dyn OpenId4VpPresentationService>,
+}
+
+impl OAuth2AuthorizationRequestDomainServices {
+    #[must_use]
+    pub fn new(openid4vp_presentation_service: Box<dyn OpenId4VpPresentationService>) -> Self {
+        Self {
+            openid4vp_presentation_service,
+        }
+    }
+
+    #[must_use]
+    pub fn openid4vp_presentation_service(&self) -> &dyn OpenId4VpPresentationService {
+        self.openid4vp_presentation_service.as_ref()
+    }
+}
+
+#[cfg(any(feature = "test_utils", test))]
+impl Default for OAuth2AuthorizationRequestDomainServices {
+    fn default() -> Self {
+        let mut mock_openid4vp_presentation_service = MockOpenId4VpPresentationService::new();
+        mock_openid4vp_presentation_service
+            .expect_create_openid4vp_presentation_request()
+            // Returns a default JSON value for testing purposes
+            .returning(|_| Ok(serde_json::json!({})));
+
+        Self {
+            openid4vp_presentation_service: Box::new(mock_openid4vp_presentation_service),
+        }
+    }
+}
diff --git a/agent_holder/src/offer/aggregate.rs b/agent_holder/src/offer/aggregate.rs
index 3884ec18..372ce0f8 100644
--- a/agent_holder/src/offer/aggregate.rs
+++ b/agent_holder/src/offer/aggregate.rs
@@ -366,8 +366,15 @@ pub mod tests {
         agent_issuance::state::initialize(&issuance_state).await.unwrap();
         let mut credential_isser = issuance::router(issuance_state.clone());
 
-        let authorization_state =
-            Arc::new(authorization_state(&InMemory, AuthorizationServices::default().await, Default::default()).await);
+        let authorization_state = Arc::new(
+            authorization_state(
+                &InMemory,
+                AuthorizationServices::default().await,
+                Default::default(),
+                Default::default(),
+            )
+            .await,
+        );
         agent_authorization::state::initialize(&authorization_state)
             .await
             .unwrap();
diff --git a/agent_issuance/src/server_config/aggregate.rs b/agent_issuance/src/server_config/aggregate.rs
index a6d12cc2..35cc5ecd 100644
--- a/agent_issuance/src/server_config/aggregate.rs
+++ b/agent_issuance/src/server_config/aggregate.rs
@@ -107,15 +107,34 @@ impl Aggregate for ServerConfig {
             UpdateIssuerUrl { url } => {
                 let mut authorization_server_metadata = self.authorization_server_metadata.clone();
                 authorization_server_metadata.issuer = url.clone();
-                authorization_server_metadata.authorization_endpoint = Some(url.append_path_segment("auth/authorize"));
-                authorization_server_metadata.token_endpoint = Some(url.append_path_segment("auth/token"));
-                authorization_server_metadata.pushed_authorization_request_endpoint =
-                    Some(url.append_path_segment("auth/par"));
+                if authorization_server_metadata.authorization_endpoint.is_some() {
+                    authorization_server_metadata.authorization_endpoint =
+                        Some(url.append_path_segment("auth/authorize"));
+                }
+                if authorization_server_metadata.token_endpoint.is_some() {
+                    authorization_server_metadata.token_endpoint = Some(url.append_path_segment("auth/token"));
+                }
+                if authorization_server_metadata
+                    .pushed_authorization_request_endpoint
+                    .is_some()
+                {
+                    authorization_server_metadata.pushed_authorization_request_endpoint =
+                        Some(url.append_path_segment("auth/par"));
+                }
+                if authorization_server_metadata
+                    .interactive_authorization_endpoint
+                    .is_some()
+                {
+                    authorization_server_metadata.interactive_authorization_endpoint =
+                        Some(url.append_path_segment("auth/par"));
+                }
 
                 let mut credential_issuer_metadata = self.credential_issuer_metadata.clone();
                 credential_issuer_metadata.credential_issuer = url.clone();
                 credential_issuer_metadata.credential_endpoint = url.append_path_segment("openid4vci/credential");
-                credential_issuer_metadata.nonce_endpoint = Some(url.append_path_segment("openid4vci/nonce"));
+                if credential_issuer_metadata.nonce_endpoint.is_some() {
+                    credential_issuer_metadata.nonce_endpoint = Some(url.append_path_segment("openid4vci/nonce"));
+                }
 
                 Ok(vec![IssuerUrlUpdated {
                     authorization_server_metadata: Box::new(authorization_server_metadata),
diff --git a/agent_issuance/src/state.rs b/agent_issuance/src/state.rs
index 6a326617..415d5296 100644
--- a/agent_issuance/src/state.rs
+++ b/agent_issuance/src/state.rs
@@ -145,6 +145,27 @@ pub async fn load_server_metadata(state: &IssuanceState) -> anyhow::Result<()> {
         None => {
             info!("Initializing server metadata ...");
 
+            // If `enable_interactive_authorization_flow` is enabled, then the `require_pushed_authorization_requests`
+            // field will be set to `None`, and the `interactive_authorization_endpoint` and
+            // `require_interactive_authorization_request` fields will be set to the corresponding values. If
+            // `enable_interactive_authorization_flow` is disabled, then the `require_pushed_authorization_requests`
+            // field will be set to `Some(true)`, and the `interactive_authorization_endpoint` and
+            // `require_interactive_authorization_request` fields will be set to `None`.
+            // Keep in mind: the pre-authorized code flow is still supported, independent of what is enabled/required here.
+            let (
+                require_pushed_authorization_requests,
+                interactive_authorization_endpoint,
+                require_interactive_authorization_request,
+            ) = if config().enable_interactive_authorization_flow {
+                info!("Interactive authorization flow is enabled. Initializing interactive authorization endpoints in server metadata.");
+
+                (None, Some(public_url.append_path_segment("auth/par")), Some(true))
+            } else {
+                info!("Interactive authorization flow is disabled. Interactive authorization endpoints will not be included in the server metadata.");
+
+                (Some(true), None, None)
+            };
+
             let command = ServerConfigCommand::InitializeServerMetadata {
                 // TODO: Move this to `agent_authorization`.
                 authorization_server_metadata: Box::new(AuthorizationServerMetadata {
@@ -152,7 +173,9 @@ pub async fn load_server_metadata(state: &IssuanceState) -> anyhow::Result<()> {
                     authorization_endpoint: Some(public_url.append_path_segment("auth/authorize")),
                     token_endpoint: Some(public_url.append_path_segment("auth/token")),
                     pushed_authorization_request_endpoint: Some(public_url.append_path_segment("auth/par")),
-                    require_pushed_authorization_requests: Some(true),
+                    require_pushed_authorization_requests,
+                    interactive_authorization_endpoint,
+                    require_interactive_authorization_request,
                     ..Default::default()
                 }),
                 credential_issuer_metadata: Box::new(CredentialIssuerMetadata {
diff --git a/agent_shared/Cargo.toml b/agent_shared/Cargo.toml
index 89a33839..6c832fdc 100644
--- a/agent_shared/Cargo.toml
+++ b/agent_shared/Cargo.toml
@@ -39,7 +39,9 @@ url.workspace = true
 utoipa.workspace = true
 
 [dev-dependencies]
-agent_secret_manager = { path = "../agent_secret_manager", features = ["test_utils"] }
+agent_secret_manager = { path = "../agent_secret_manager", features = [
+    "test_utils",
+] }
 agent_shared = { path = ".", features = ["test_utils"] }
 serial_test = "3.0"
 tokio.workspace = true
diff --git a/agent_shared/src/config/mod.rs b/agent_shared/src/config/mod.rs
index f516acac..130d20bc 100644
--- a/agent_shared/src/config/mod.rs
+++ b/agent_shared/src/config/mod.rs
@@ -332,6 +332,11 @@ pub struct ApplicationConfiguration {
     #[config(default)]
     #[serde(serialize_with = "redact")]
     pub iota_sponsoring_service_auth: Option<String>,
+    // WARNING: When this is enabled, the authorization flow will be interactive. However, in the current form this
+    // means that the issuance flow will always include an OpenID4VP Presentation Request containing a hardcoded DCQL
+    // Query.
+    #[config(default)]
+    pub enable_interactive_authorization_flow: bool,
 }
 
 impl ApplicationConfiguration {
@@ -1171,6 +1176,7 @@ mod tests {
                   "kb-jwt_alg_values": ["ES256"]
                 },
               },
+              "enable_interactive_authorization_flow": false
             })
         );
 
diff --git a/agent_store/src/lib.rs b/agent_store/src/lib.rs
index 462859f9..acb7a27b 100644
--- a/agent_store/src/lib.rs
+++ b/agent_store/src/lib.rs
@@ -10,7 +10,7 @@ use agent_authorization::domain::client::views::ClientView;
 use agent_authorization::domain::oauth2_authorization_request::aggregate::OAuth2AuthorizationRequest;
 use agent_authorization::domain::oauth2_authorization_request::views::all_oauth2_authorization_requests::AllOAuth2AuthorizationRequestsView;
 use agent_authorization::domain::oauth2_authorization_request::views::OAuth2AuthorizationRequestView;
-use agent_authorization::services::AuthorizationServices;
+use agent_authorization::services::{AuthorizationServices, OAuth2AuthorizationRequestDomainServices};
 use agent_authorization::state::AuthorizationState;
 use agent_holder::credential::aggregate::Credential as HolderCredential;
 use agent_holder::credential::queries::all_credentials::AllHolderCredentialsView;
@@ -255,6 +255,7 @@ pub async fn authorization_state<CCB: CqrsComponentBuilder>(
     builder: &CCB,
     services: Arc<AuthorizationServices>,
     event_publishers: Vec<Box<dyn EventPublisher>>,
+    oauth2_authorization_request_domain_services: OAuth2AuthorizationRequestDomainServices,
 ) -> AuthorizationState {
     // Partition the event_publishers into the different aggregates.
     let Partitions {
@@ -282,7 +283,7 @@ pub async fn authorization_state<CCB: CqrsComponentBuilder>(
         OAuth2AuthorizationRequestView,
         OAuth2AuthorizationRequest,
         AllOAuth2AuthorizationRequestsView,
-    >((), oauth2_authorization_request_event_publishers)
+    >(oauth2_authorization_request_domain_services, oauth2_authorization_request_event_publishers)
     .await;
     let (token_command_handler, access_token, _all_access_tokens) = builder
         .commands_and_queries::<AccessTokenView, AccessToken, AllAccessTokensView>((), token_event_publishers)
diff --git a/agent_verification/src/authorization_request/aggregate.rs b/agent_verification/src/authorization_request/aggregate.rs
index bd66400f..84bbf418 100644
--- a/agent_verification/src/authorization_request/aggregate.rs
+++ b/agent_verification/src/authorization_request/aggregate.rs
@@ -52,6 +52,7 @@ impl Aggregate for AuthorizationRequest {
                 state,
                 nonce,
                 dcql_query,
+                alternative_response_mode,
             } => {
                 let default_subject_syntax_type = services.relying_party.default_subject_syntax_type().to_string();
                 let verifier = &services.verifier;
@@ -99,7 +100,7 @@ impl Aggregate for AuthorizationRequest {
                             .client_id(ClientId::from_str(&client_id).unwrap())
                             .scope(Scope::openid())
                             .response_uri(redirect_uri)
-                            .response_mode("direct_post".to_string())
+                            .response_mode(alternative_response_mode.unwrap_or_else(|| "direct_post".to_string()))
                             .client_metadata(oid4vp_client_metadata)
                             .state(state)
                             .nonce(nonce)
@@ -341,6 +342,7 @@ pub mod tests {
                 state: "state".to_string(),
                 nonce: "nonce".to_string(),
                 dcql_query: None,
+                alternative_response_mode: None,
             })
             .then_expect_events(vec![
                 AuthorizationRequestEvent::AuthorizationRequestCreated {
diff --git a/agent_verification/src/authorization_request/command.rs b/agent_verification/src/authorization_request/command.rs
index 79293d3f..751dd79f 100644
--- a/agent_verification/src/authorization_request/command.rs
+++ b/agent_verification/src/authorization_request/command.rs
@@ -10,6 +10,8 @@ pub enum AuthorizationRequestCommand {
         state: String,
         nonce: String,
         dcql_query: Option<DcqlQuery>,
+        // If set to `None`, the default response mode will be used (which is currently `direct_post`).
+        alternative_response_mode: Option<String>,
     },
     SignAuthorizationRequestObject,
     VerifyAuthorizationResponse {
diff --git a/infrastructure/adapters/verification-authorization/Cargo.toml b/infrastructure/adapters/verification-authorization/Cargo.toml
new file mode 100644
index 00000000..7bd48450
--- /dev/null
+++ b/infrastructure/adapters/verification-authorization/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "verification-authorization"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+publish.workspace = true
+
+[dependencies]
+agent_authorization = { path = "../../../agent_authorization" }
+agent_shared = { path = "../../../agent_shared" }
+agent_verification = { path = "../../../agent_verification" }
+anyhow.workspace = true
+async-trait.workspace = true
+oid4vp.workspace = true
+serde_json.workspace = true
+shared-kernel.workspace = true
+
+[lints]
+workspace = true
diff --git a/infrastructure/adapters/verification-authorization/src/lib.rs b/infrastructure/adapters/verification-authorization/src/lib.rs
new file mode 100644
index 00000000..c0feecc6
--- /dev/null
+++ b/infrastructure/adapters/verification-authorization/src/lib.rs
@@ -0,0 +1,142 @@
+use agent_authorization::services::OpenId4VpPresentationService;
+use agent_shared::{
+    generate_random_string,
+    handlers::{command_handler, query_handler},
+};
+use agent_verification::{
+    authorization_request::command::AuthorizationRequestCommand, generic_oid4vc::GenericAuthorizationResponse,
+    state::VerificationState,
+};
+use async_trait::async_trait;
+use oid4vp::dcql::dcql_query::{ClaimQuery, CredentialQuery, CredentialQueryId, DcqlQuery, Format, MetaTypes};
+use std::sync::Arc;
+
+/// This adapter bridges `agent_verification` functionality which is needed in `agent_authorization` during the interactive authorization flow, specifically for handling openID4VP presentation requests and responses.
+pub struct VerificationAuthorizationAdapter {
+    verification_state: Arc<VerificationState>,
+}
+
+impl VerificationAuthorizationAdapter {
+    #[must_use]
+    pub fn new(verification_state: Arc<VerificationState>) -> Self {
+        Self { verification_state }
+    }
+}
+
+#[async_trait]
+impl OpenId4VpPresentationService for VerificationAuthorizationAdapter {
+    async fn create_openid4vp_presentation_request(&self, state: String) -> anyhow::Result<serde_json::Value> {
+        let nonce = generate_random_string();
+
+        // TODO: Make claims and credential formats configurable by the client, rather than hardcoded.
+        // Currently only applicable when `enable_interactive_authorization_flow` is true. When false,
+        // the authorization server defaults to the Authorization Code flow.
+        // The hardcoded claims below are set to request the EduID and Entitlement credentials.
+        let eduid_claims: Vec<ClaimQuery> = serde_json::from_value(serde_json::json!([
+            {"path": ["name"]},
+            {"path": ["given_name"]},
+            {"path": ["family_name"]},
+            {"path": ["email"]},
+            {"path": ["eduperson_scoped_affiliation"]},
+            {"path": ["eduperson_assurance"]},
+            {"path": ["is_student"]},
+            {"path": ["is_faculty"]},
+            {"path": ["is_member"]},
+            {"path": ["is_staff"]},
+            {"path": ["is_alum"]},
+            {"path": ["is_affiliate"]},
+            {"path": ["is_employee"]},
+            {"path": ["is_library-walk-in"]}
+        ]))?;
+
+        let entitlement_claims: Vec<ClaimQuery> = serde_json::from_value(serde_json::json!([
+            {"path": ["entitlement"]},
+        ]))?;
+
+        let dcql_query = DcqlQuery {
+            credentials: vec![
+                CredentialQuery {
+                    id: CredentialQueryId::try_new("eduID").unwrap(),
+                    format: Format::DcSdJwt,
+                    multiple: None,
+                    meta: MetaTypes::SdJwtMeta {
+                        vct_values: vec!["https://issuer.pilots.eduid.nl/vct/eduid".to_string()],
+                    },
+                    trusted_authorities: None,
+                    require_cryptographic_holder_binding: None,
+                    claims: Some(eduid_claims),
+                    claim_sets: None,
+                },
+                CredentialQuery {
+                    id: CredentialQueryId::try_new("Entitlement").unwrap(),
+                    format: Format::DcSdJwt,
+                    multiple: None,
+                    meta: MetaTypes::SdJwtMeta {
+                        vct_values: vec!["https://issuer.pilots.eduid.nl/vct/entitlement".to_string()],
+                    },
+                    trusted_authorities: None,
+                    require_cryptographic_holder_binding: None,
+                    claims: Some(entitlement_claims),
+                    claim_sets: None,
+                },
+            ],
+            credential_sets: None,
+        };
+
+        let authorization_request_id = state.clone();
+
+        let command = AuthorizationRequestCommand::CreateAuthorizationRequest {
+            state,
+            nonce,
+            dcql_query: Some(dcql_query),
+            alternative_response_mode: None,
+        };
+
+        command_handler(
+            &authorization_request_id,
+            &self.verification_state.command.authorization_request,
+            command,
+        )
+        .await?;
+
+        let mut authorization_request = query_handler(
+            &authorization_request_id,
+            &self.verification_state.query.authorization_request,
+        )
+        .await?
+        .ok_or_else(|| anyhow::anyhow!("Authorization request not found"))?
+        .authorization_request
+        .ok_or_else(|| anyhow::anyhow!("Authorization request is missing"))?
+        .as_oid4vp_authorization_request()
+        .ok_or_else(|| anyhow::anyhow!("Failed to convert to OID4VP authorization request"))?
+        .clone();
+
+        // Normal OID4VP flows would use "direct_post" response mode, which this value is by default, but since this is an interactive authorization flow the "iae_post" response mode must be used. Spec: https://openid.github.io/OpenID4VCI/openid-4-verifiable-credential-issuance-1_1-wg-draft.html#section-6.2.1.1
+        authorization_request.body.extension.response_mode = "iae_post".to_string();
+
+        Ok(serde_json::json!(authorization_request))
+    }
+
+    async fn verify_openid4vp_response(&self, response: serde_json::Value) -> anyhow::Result<()> {
+        let authorization_response: GenericAuthorizationResponse = serde_json::from_value(response)?;
+
+        let authorization_request_id = if let Some(state) = authorization_response.state() {
+            state.clone()
+        } else {
+            return Err(anyhow::anyhow!("Authorization response is missing `state` parameter"));
+        };
+
+        // TODO: perhaps this is a good place to invalidate the `state` parameter after it's used, to prevent replay attacks? See comment under `SubmitOpenId4VpResponse` in `agent_authorization/src/domain/oauth2_authorization_request/aggregate.rs` as well.
+
+        let command = AuthorizationRequestCommand::VerifyAuthorizationResponse { authorization_response };
+
+        command_handler(
+            &authorization_request_id,
+            &self.verification_state.command.authorization_request,
+            command,
+        )
+        .await?;
+
+        Ok(())
+    }
+}

From 4eec235570d48c1acdc1f39cc159971fb2d80abd Mon Sep 17 00:00:00 2001
From: Oran Dan <53859531+Oran-Dan@users.noreply.github.com>
Date: Wed, 17 Jun 2026 11:04:13 +0200
Subject: [PATCH 12/34] build: bump `openid4vc` deps (#355)

---
 Cargo.lock | 10 +++++-----
 Cargo.toml | 10 +++++-----
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index dc70dff1..847efe5e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -8640,7 +8640,7 @@ dependencies = [
 [[package]]
 name = "oid4vc-core"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=fcb9e88#fcb9e88b0b549be9520b706e1e7d9625bfd63595"
+source = "git+https://github.com/impierce/openid4vc?rev=0a5090e#0a5090e27bc004cfea0bbe141517a8cd5c0fa520"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -8672,7 +8672,7 @@ dependencies = [
 [[package]]
 name = "oid4vc-manager"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=fcb9e88#fcb9e88b0b549be9520b706e1e7d9625bfd63595"
+source = "git+https://github.com/impierce/openid4vc?rev=0a5090e#0a5090e27bc004cfea0bbe141517a8cd5c0fa520"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -8705,7 +8705,7 @@ dependencies = [
 [[package]]
 name = "oid4vci"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=fcb9e88#fcb9e88b0b549be9520b706e1e7d9625bfd63595"
+source = "git+https://github.com/impierce/openid4vc?rev=0a5090e#0a5090e27bc004cfea0bbe141517a8cd5c0fa520"
 dependencies = [
  "anyhow",
  "chrono",
@@ -8733,7 +8733,7 @@ dependencies = [
 [[package]]
 name = "oid4vp"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=fcb9e88#fcb9e88b0b549be9520b706e1e7d9625bfd63595"
+source = "git+https://github.com/impierce/openid4vc?rev=0a5090e#0a5090e27bc004cfea0bbe141517a8cd5c0fa520"
 dependencies = [
  "anyhow",
  "chrono",
@@ -11708,7 +11708,7 @@ dependencies = [
 [[package]]
 name = "siopv2"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=fcb9e88#fcb9e88b0b549be9520b706e1e7d9625bfd63595"
+source = "git+https://github.com/impierce/openid4vc?rev=0a5090e#0a5090e27bc004cfea0bbe141517a8cd5c0fa520"
 dependencies = [
  "anyhow",
  "async-trait",
diff --git a/Cargo.toml b/Cargo.toml
index 2bf57012..c0920599 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -36,11 +36,11 @@ publish = false
 pedantic = "warn"
 
 [workspace.dependencies]
-siopv2 = { git = "https://github.com/impierce/openid4vc", rev = "fcb9e88" }
-oid4vci = { git = "https://github.com/impierce/openid4vc", rev = "fcb9e88" }
-oid4vc-core = { git = "https://github.com/impierce/openid4vc", rev = "fcb9e88" }
-oid4vc-manager = { git = "https://github.com/impierce/openid4vc", rev = "fcb9e88" }
-oid4vp = { git = "https://github.com/impierce/openid4vc", rev = "fcb9e88" }
+siopv2 = { git = "https://github.com/impierce/openid4vc", rev = "0a5090e" }
+oid4vci = { git = "https://github.com/impierce/openid4vc", rev = "0a5090e" }
+oid4vc-core = { git = "https://github.com/impierce/openid4vc", rev = "0a5090e" }
+oid4vc-manager = { git = "https://github.com/impierce/openid4vc", rev = "0a5090e" }
+oid4vp = { git = "https://github.com/impierce/openid4vc", rev = "0a5090e" }
 
 shared-kernel = { path = "shared-kernel" }
 

From c9ea4abb2e9cc46b1ad34be04d38dee86204f1bf Mon Sep 17 00:00:00 2001
From: Daniel Mader <daniel.mader@impierce.com>
Date: Wed, 17 Jun 2026 12:35:16 +0200
Subject: [PATCH 13/34] fix: serve metadata and probes routers (#356)

---
 agent_application/src/lib.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/agent_application/src/lib.rs b/agent_application/src/lib.rs
index b0803947..8c8c8552 100644
--- a/agent_application/src/lib.rs
+++ b/agent_application/src/lib.rs
@@ -35,7 +35,7 @@ pub async fn run() -> io::Result<()> {
     let subject = Arc::new(Subject::new().await);
     let state = state(subject).await?;
 
-    serve(app(state)).await
+    serve(router(state)).await
 }
 
 pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {

From 71f49b5065bfd852b4d7ea4c2dbb80011c93f383 Mon Sep 17 00:00:00 2001
From: Daniel Mader <daniel.mader@impierce.com>
Date: Wed, 17 Jun 2026 14:05:35 +0200
Subject: [PATCH 14/34] test: run test with larger stack (#357)

---
 .github/workflows/coverage.yaml         |   4 +-
 .github/workflows/format-lint-test.yaml |   8 +-
 agent_issuance/src/offer/aggregate.rs   | 161 +++++++++++++++++-------
 3 files changed, 116 insertions(+), 57 deletions(-)

diff --git a/.github/workflows/coverage.yaml b/.github/workflows/coverage.yaml
index 0e82650a..14822c18 100644
--- a/.github/workflows/coverage.yaml
+++ b/.github/workflows/coverage.yaml
@@ -30,9 +30,7 @@ jobs:
         uses: taiki-e/install-action@cargo-llvm-cov
 
       - name: Generate code coverage
-        # TODO: We set `RUST_MIN_STACK` to 32 MiB to prevent stack overflow in `test_verify_credential_response`.
-        # Investigate if this is still needed after our testing refactor.
-        run: RUST_MIN_STACK=33554432 cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info
+        run: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info
 
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v5
diff --git a/.github/workflows/format-lint-test.yaml b/.github/workflows/format-lint-test.yaml
index 4c3fa8d3..e3ffadf3 100644
--- a/.github/workflows/format-lint-test.yaml
+++ b/.github/workflows/format-lint-test.yaml
@@ -33,13 +33,7 @@ jobs:
         run: cargo clippy --all-targets --all-features -- -D warnings
 
       - name: Test
-        # TODO: do not exclude `agent_issuance` (see TODO comment below)
-        run: cargo test --workspace --exclude agent_issuance
-
-      - name: Test (Agent Issuance)
-        # TODO: We set `RUST_MIN_STACK` to 32 MiB to prevent stack overflow in `test_verify_credential_response`.
-        # Investigate removing this workaround after testing refactor.
-        run: RUST_MIN_STACK=33554432 cargo test -p agent_issuance
+        run: cargo test --workspace
 
       - name: Generated files are unchanged
         run: git diff --exit-code
diff --git a/agent_issuance/src/offer/aggregate.rs b/agent_issuance/src/offer/aggregate.rs
index 735a3f4c..d2fb0e7a 100644
--- a/agent_issuance/src/offer/aggregate.rs
+++ b/agent_issuance/src/offer/aggregate.rs
@@ -434,6 +434,21 @@ pub mod tests {
 
     type OfferTestFramework = TestFramework<Offer>;
 
+    // The test `test_verify_credential_response` requires a larger stack size (32 MiB).
+    #[expect(dead_code)]
+    fn run_with_large_stack<F>(test: F)
+    where
+        F: FnOnce() + Send + 'static,
+    {
+        std::thread::Builder::new()
+            .name("offer-aggregate-large-stack".to_string())
+            .stack_size(32 * 1024 * 1024)
+            .spawn(test)
+            .expect("failed to spawn large-stack test thread")
+            .join()
+            .expect("large-stack test thread panicked");
+    }
+
     #[rstest]
     #[serial_test::serial]
     #[allow(clippy::too_many_arguments)]
@@ -554,54 +569,106 @@ pub mod tests {
             ]);
     }
 
-    #[allow(clippy::too_many_arguments)]
-    #[rstest]
+    // Note: This test cannot use #[future(awt)] fixtures because rstest evaluates those fixtures
+    // outside the test function body, before entering run_with_large_stack. This would cause a stack
+    // overflow before the large stack is available. Instead, all fixture setup is done manually inside
+    // the large-stack wrapper using the test helper functions directly.
     #[serial_test::serial]
-    async fn test_verify_credential_response(
-        offer_id: String,
-        grant_types: Vec<GrantType>,
-        #[future(awt)] holder: Arc<dyn Subject>,
-        #[future(awt)] pre_authorized_code: String,
-        #[future(awt)] credential_offer: CredentialOffer,
-        #[future(awt)] credential_offer_uri: CredentialOffer,
-        #[future(awt)] form_url_encoded_credential_offer: String,
-        #[future(awt)] university_degree_credential_request: CredentialRequest,
-        credential_issuer_metadata: Box<CredentialIssuerMetadata>,
-        authorization_server_metadata: Box<AuthorizationServerMetadata>,
-    ) {
-        OfferTestFramework::with(IssuanceServices::default().await)
-            .given(vec![
-                OfferEvent::CredentialOfferCreated {
-                    offer_id: offer_id.clone(),
-                    grant_types,
-                    credential_offer: credential_offer.clone(),
-                    credential_offer_uri,
-                    pre_authorized_code,
-                    status: Status::Created,
-                    tx_code: None,
-                    delivery_options: None,
-                },
-                OfferEvent::CredentialsAdded {
-                    offer_id: offer_id.clone(),
-                    credential_ids: vec!["credential-id".to_string()],
-                    credential_offer: credential_offer.clone(),
-                },
-                OfferEvent::FormUrlEncodedCredentialOfferCreated {
-                    offer_id: offer_id.clone(),
-                    form_url_encoded_credential_offer,
-                    status: Status::Pending,
-                },
-            ])
-            .when(OfferCommand::VerifyCredentialRequest {
-                offer_id: offer_id.clone(),
-                credential_issuer_metadata,
-                authorization_server_metadata,
-                credential_request: university_degree_credential_request,
-            })
-            .then_expect_events(vec![OfferEvent::CredentialRequestVerified {
-                offer_id: offer_id.clone(),
-                subject_id: Some(holder.identifier("did:key", Algorithm::EdDSA).await.unwrap()),
-            }]);
+    fn test_verify_credential_response() {
+        run_with_large_stack(move || {
+            async_std::task::block_on(async move {
+                let offer_id = offer_id();
+                let grant_types = grant_types();
+                let static_issuer_url = static_issuer_url();
+                let pre_authorized_code = pre_authorized_code().await;
+                let credential_offer = CredentialOffer::CredentialOffer(Box::new(CredentialOfferParameters {
+                    credential_issuer: static_issuer_url.clone(),
+                    credential_configuration_ids: CredentialConfigurationIds::try_new(vec![
+                        "UniversityDegree".to_string()
+                    ])
+                    .expect("Credential configuration ids should not be empty in the test"),
+                    grants: Some(Grants {
+                        authorization_code: None,
+                        pre_authorized_code: Some(PreAuthorizedCode {
+                            pre_authorized_code: pre_authorized_code.clone(),
+                            ..Default::default()
+                        }),
+                    }),
+                }));
+                let credential_offer_uri =
+                    credential_offer_uri(credential_issuer_metadata(static_issuer_url.clone()), offer_id.clone()).await;
+                let form_url_encoded_credential_offer = format!(
+                        "openid-credential-offer://?credential_offer=%7B%22credential_issuer%22%3A%22https%3A%2F%2Fmy-domain.example.org%2F%22%2C%22credential_configuration_ids%22%3A%5B%22UniversityDegree%22%5D%2C%22grants%22%3A%7B%22urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Apre-authorized_code%22%3A%7B%22pre-authorized_code%22%3A%22{pre_authorized_code}%22%7D%7D%7D"
+                    );
+                let holder = holder().await;
+                let generated_proof = oid4vci::Proof::builder()
+                    .proof_type(oid4vci::proof::ProofType::Jwt)
+                    .algorithm(Algorithm::EdDSA)
+                    .signer(holder.clone())
+                    .iss(
+                        holder
+                            .identifier("did:key", Algorithm::EdDSA)
+                            .await
+                            .expect("Failed to get holder identifier"),
+                    )
+                    .aud(static_issuer_url.to_string())
+                    .iat(1571324800)
+                    .subject_syntax_type("did:key")
+                    .build()
+                    .await
+                    .expect("Failed to build proof");
+                let proof = match generated_proof {
+                    oid4vci::Proof::Jwt { jwt } => {
+                        assert!(!jwt.is_empty(), "Generated JWT should not be empty");
+                        jwt
+                    }
+                };
+                let university_degree_credential_request = CredentialRequest {
+                        credential_identifier_or_credential_configuration_id:
+                            oid4vci::credential_request::CredentialIdentifierOrCredentialConfigurationId::CredentialConfigurationId(
+                                "UniversityDegree".to_string(),
+                            ),
+                        proofs: Some(oid4vci::proofs::Proofs { jwt: vec![proof] }),
+                    };
+                let credential_issuer_metadata = credential_issuer_metadata(static_issuer_url.clone());
+                let authorization_server_metadata = authorization_server_metadata(static_issuer_url);
+                let subject_id = holder.identifier("did:key", Algorithm::EdDSA).await.unwrap();
+
+                OfferTestFramework::with(IssuanceServices::default().await)
+                    .given(vec![
+                        OfferEvent::CredentialOfferCreated {
+                            offer_id: offer_id.clone(),
+                            grant_types,
+                            credential_offer: credential_offer.clone(),
+                            credential_offer_uri,
+                            pre_authorized_code,
+                            status: Status::Created,
+                            tx_code: None,
+                            delivery_options: None,
+                        },
+                        OfferEvent::CredentialsAdded {
+                            offer_id: offer_id.clone(),
+                            credential_ids: vec!["credential-id".to_string()],
+                            credential_offer: credential_offer.clone(),
+                        },
+                        OfferEvent::FormUrlEncodedCredentialOfferCreated {
+                            offer_id: offer_id.clone(),
+                            form_url_encoded_credential_offer,
+                            status: Status::Pending,
+                        },
+                    ])
+                    .when(OfferCommand::VerifyCredentialRequest {
+                        offer_id: offer_id.clone(),
+                        credential_issuer_metadata,
+                        authorization_server_metadata,
+                        credential_request: university_degree_credential_request,
+                    })
+                    .then_expect_events(vec![OfferEvent::CredentialRequestVerified {
+                        offer_id,
+                        subject_id: Some(subject_id),
+                    }]);
+            });
+        });
     }
 
     #[rstest]

From d3b2b61297dc39a3422823ea6ef7847525bd8efc Mon Sep 17 00:00:00 2001
From: Daniel Mader <daniel.mader@impierce.com>
Date: Wed, 17 Jun 2026 14:39:15 +0200
Subject: [PATCH 15/34] docs: initialize AI context and agent skills (#358)

---
 .agents/skills/diagnose/SKILL.md              | 117 +++++++++++
 .../diagnose/scripts/hitl-loop.template.sh    |  41 ++++
 .agents/skills/find-skills/SKILL.md           | 142 +++++++++++++
 .agents/skills/grill-with-docs/ADR-FORMAT.md  |  47 +++++
 .../skills/grill-with-docs/CONTEXT-FORMAT.md  |  60 ++++++
 .agents/skills/grill-with-docs/SKILL.md       |  88 +++++++++
 .agents/skills/handoff/SKILL.md               |  15 ++
 .../DEEPENING.md                              |  37 ++++
 .../HTML-REPORT.md                            | 123 ++++++++++++
 .../INTERFACE-DESIGN.md                       |  44 +++++
 .../improve-codebase-architecture/LANGUAGE.md |  53 +++++
 .../improve-codebase-architecture/SKILL.md    |  81 ++++++++
 .agents/skills/prototype/LOGIC.md             |  79 ++++++++
 .agents/skills/prototype/SKILL.md             |  30 +++
 .agents/skills/prototype/UI.md                | 112 +++++++++++
 .agents/skills/qa/SKILL.md                    | 130 ++++++++++++
 .agents/skills/request-refactor-plan/SKILL.md |  68 +++++++
 .agents/skills/review/SKILL.md                |  78 ++++++++
 .../skills/setup-matt-pocock-skills/SKILL.md  | 121 ++++++++++++
 .../skills/setup-matt-pocock-skills/domain.md |  51 +++++
 .../issue-tracker-github.md                   |  22 +++
 .../issue-tracker-gitlab.md                   |  23 +++
 .../issue-tracker-local.md                    |  19 ++
 .../setup-matt-pocock-skills/triage-labels.md |  15 ++
 .agents/skills/tdd/SKILL.md                   | 109 ++++++++++
 .agents/skills/tdd/deep-modules.md            |  33 ++++
 .agents/skills/tdd/interface-design.md        |  31 +++
 .agents/skills/tdd/mocking.md                 |  59 ++++++
 .agents/skills/tdd/refactoring.md             |  10 +
 .agents/skills/tdd/tests.md                   |  61 ++++++
 .agents/skills/ubiquitous-language/SKILL.md   |  93 +++++++++
 .agents/skills/zoom-out/SKILL.md              |   7 +
 .github/copilot-instructions.md               | 186 ++++++++++++++++++
 dev/SETUP.md                                  |  11 ++
 docs/README.md                                |  25 ++-
 docs/glossary/CONTEXT.md                      |  81 ++++++++
 docs/glossary/README.md                       |  80 ++++++++
 docs/glossary/ubiquitous-language.md          | 182 +++++++++++++++++
 skills-lock.json                              |  83 ++++++++
 39 files changed, 2644 insertions(+), 3 deletions(-)
 create mode 100644 .agents/skills/diagnose/SKILL.md
 create mode 100644 .agents/skills/diagnose/scripts/hitl-loop.template.sh
 create mode 100644 .agents/skills/find-skills/SKILL.md
 create mode 100644 .agents/skills/grill-with-docs/ADR-FORMAT.md
 create mode 100644 .agents/skills/grill-with-docs/CONTEXT-FORMAT.md
 create mode 100644 .agents/skills/grill-with-docs/SKILL.md
 create mode 100644 .agents/skills/handoff/SKILL.md
 create mode 100644 .agents/skills/improve-codebase-architecture/DEEPENING.md
 create mode 100644 .agents/skills/improve-codebase-architecture/HTML-REPORT.md
 create mode 100644 .agents/skills/improve-codebase-architecture/INTERFACE-DESIGN.md
 create mode 100644 .agents/skills/improve-codebase-architecture/LANGUAGE.md
 create mode 100644 .agents/skills/improve-codebase-architecture/SKILL.md
 create mode 100644 .agents/skills/prototype/LOGIC.md
 create mode 100644 .agents/skills/prototype/SKILL.md
 create mode 100644 .agents/skills/prototype/UI.md
 create mode 100644 .agents/skills/qa/SKILL.md
 create mode 100644 .agents/skills/request-refactor-plan/SKILL.md
 create mode 100644 .agents/skills/review/SKILL.md
 create mode 100644 .agents/skills/setup-matt-pocock-skills/SKILL.md
 create mode 100644 .agents/skills/setup-matt-pocock-skills/domain.md
 create mode 100644 .agents/skills/setup-matt-pocock-skills/issue-tracker-github.md
 create mode 100644 .agents/skills/setup-matt-pocock-skills/issue-tracker-gitlab.md
 create mode 100644 .agents/skills/setup-matt-pocock-skills/issue-tracker-local.md
 create mode 100644 .agents/skills/setup-matt-pocock-skills/triage-labels.md
 create mode 100644 .agents/skills/tdd/SKILL.md
 create mode 100644 .agents/skills/tdd/deep-modules.md
 create mode 100644 .agents/skills/tdd/interface-design.md
 create mode 100644 .agents/skills/tdd/mocking.md
 create mode 100644 .agents/skills/tdd/refactoring.md
 create mode 100644 .agents/skills/tdd/tests.md
 create mode 100644 .agents/skills/ubiquitous-language/SKILL.md
 create mode 100644 .agents/skills/zoom-out/SKILL.md
 create mode 100644 .github/copilot-instructions.md
 create mode 100644 dev/SETUP.md
 create mode 100644 docs/glossary/CONTEXT.md
 create mode 100644 docs/glossary/README.md
 create mode 100644 docs/glossary/ubiquitous-language.md
 create mode 100644 skills-lock.json

diff --git a/.agents/skills/diagnose/SKILL.md b/.agents/skills/diagnose/SKILL.md
new file mode 100644
index 00000000..ed55bda2
--- /dev/null
+++ b/.agents/skills/diagnose/SKILL.md
@@ -0,0 +1,117 @@
+---
+name: diagnose
+description: Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says "diagnose this" / "debug this", reports a bug, says something is broken/throwing/failing, or describes a performance regression.
+---
+
+# Diagnose
+
+A discipline for hard bugs. Skip phases only when explicitly justified.
+
+When exploring the codebase, use the project's domain glossary to get a clear mental model of the relevant modules, and check ADRs in the area you're touching.
+
+## Phase 1 — Build a feedback loop
+
+**This is the skill.** Everything else is mechanical. If you have a fast, deterministic, agent-runnable pass/fail signal for the bug, you will find the cause — bisection, hypothesis-testing, and instrumentation all just consume that signal. If you don't have one, no amount of staring at code will save you.
+
+Spend disproportionate effort here. **Be aggressive. Be creative. Refuse to give up.**
+
+### Ways to construct one — try them in roughly this order
+
+1. **Failing test** at whatever seam reaches the bug — unit, integration, e2e.
+2. **Curl / HTTP script** against a running dev server.
+3. **CLI invocation** with a fixture input, diffing stdout against a known-good snapshot.
+4. **Headless browser script** (Playwright / Puppeteer) — drives the UI, asserts on DOM/console/network.
+5. **Replay a captured trace.** Save a real network request / payload / event log to disk; replay it through the code path in isolation.
+6. **Throwaway harness.** Spin up a minimal subset of the system (one service, mocked deps) that exercises the bug code path with a single function call.
+7. **Property / fuzz loop.** If the bug is "sometimes wrong output", run 1000 random inputs and look for the failure mode.
+8. **Bisection harness.** If the bug appeared between two known states (commit, dataset, version), automate "boot at state X, check, repeat" so you can `git bisect run` it.
+9. **Differential loop.** Run the same input through old-version vs new-version (or two configs) and diff outputs.
+10. **HITL bash script.** Last resort. If a human must click, drive _them_ with `scripts/hitl-loop.template.sh` so the loop is still structured. Captured output feeds back to you.
+
+Build the right feedback loop, and the bug is 90% fixed.
+
+### Iterate on the loop itself
+
+Treat the loop as a product. Once you have _a_ loop, ask:
+
+- Can I make it faster? (Cache setup, skip unrelated init, narrow the test scope.)
+- Can I make the signal sharper? (Assert on the specific symptom, not "didn't crash".)
+- Can I make it more deterministic? (Pin time, seed RNG, isolate filesystem, freeze network.)
+
+A 30-second flaky loop is barely better than no loop. A 2-second deterministic loop is a debugging superpower.
+
+### Non-deterministic bugs
+
+The goal is not a clean repro but a **higher reproduction rate**. Loop the trigger 100×, parallelise, add stress, narrow timing windows, inject sleeps. A 50%-flake bug is debuggable; 1% is not — keep raising the rate until it's debuggable.
+
+### When you genuinely cannot build a loop
+
+Stop and say so explicitly. List what you tried. Ask the user for: (a) access to whatever environment reproduces it, (b) a captured artifact (HAR file, log dump, core dump, screen recording with timestamps), or (c) permission to add temporary production instrumentation. Do **not** proceed to hypothesise without a loop.
+
+Do not proceed to Phase 2 until you have a loop you believe in.
+
+## Phase 2 — Reproduce
+
+Run the loop. Watch the bug appear.
+
+Confirm:
+
+- [ ] The loop produces the failure mode the **user** described — not a different failure that happens to be nearby. Wrong bug = wrong fix.
+- [ ] The failure is reproducible across multiple runs (or, for non-deterministic bugs, reproducible at a high enough rate to debug against).
+- [ ] You have captured the exact symptom (error message, wrong output, slow timing) so later phases can verify the fix actually addresses it.
+
+Do not proceed until you reproduce the bug.
+
+## Phase 3 — Hypothesise
+
+Generate **3–5 ranked hypotheses** before testing any of them. Single-hypothesis generation anchors on the first plausible idea.
+
+Each hypothesis must be **falsifiable**: state the prediction it makes.
+
+> Format: "If <X> is the cause, then <changing Y> will make the bug disappear / <changing Z> will make it worse."
+
+If you cannot state the prediction, the hypothesis is a vibe — discard or sharpen it.
+
+**Show the ranked list to the user before testing.** They often have domain knowledge that re-ranks instantly ("we just deployed a change to #3"), or know hypotheses they've already ruled out. Cheap checkpoint, big time saver. Don't block on it — proceed with your ranking if the user is AFK.
+
+## Phase 4 — Instrument
+
+Each probe must map to a specific prediction from Phase 3. **Change one variable at a time.**
+
+Tool preference:
+
+1. **Debugger / REPL inspection** if the env supports it. One breakpoint beats ten logs.
+2. **Targeted logs** at the boundaries that distinguish hypotheses.
+3. Never "log everything and grep".
+
+**Tag every debug log** with a unique prefix, e.g. `[DEBUG-a4f2]`. Cleanup at the end becomes a single grep. Untagged logs survive; tagged logs die.
+
+**Perf branch.** For performance regressions, logs are usually wrong. Instead: establish a baseline measurement (timing harness, `performance.now()`, profiler, query plan), then bisect. Measure first, fix second.
+
+## Phase 5 — Fix + regression test
+
+Write the regression test **before the fix** — but only if there is a **correct seam** for it.
+
+A correct seam is one where the test exercises the **real bug pattern** as it occurs at the call site. If the only available seam is too shallow (single-caller test when the bug needs multiple callers, unit test that can't replicate the chain that triggered the bug), a regression test there gives false confidence.
+
+**If no correct seam exists, that itself is the finding.** Note it. The codebase architecture is preventing the bug from being locked down. Flag this for the next phase.
+
+If a correct seam exists:
+
+1. Turn the minimised repro into a failing test at that seam.
+2. Watch it fail.
+3. Apply the fix.
+4. Watch it pass.
+5. Re-run the Phase 1 feedback loop against the original (un-minimised) scenario.
+
+## Phase 6 — Cleanup + post-mortem
+
+Required before declaring done:
+
+- [ ] Original repro no longer reproduces (re-run the Phase 1 loop)
+- [ ] Regression test passes (or absence of seam is documented)
+- [ ] All `[DEBUG-...]` instrumentation removed (`grep` the prefix)
+- [ ] Throwaway prototypes deleted (or moved to a clearly-marked debug location)
+- [ ] The hypothesis that turned out correct is stated in the commit / PR message — so the next debugger learns
+
+**Then ask: what would have prevented this bug?** If the answer involves architectural change (no good test seam, tangled callers, hidden coupling) hand off to the `/improve-codebase-architecture` skill with the specifics. Make the recommendation **after** the fix is in, not before — you have more information now than when you started.
diff --git a/.agents/skills/diagnose/scripts/hitl-loop.template.sh b/.agents/skills/diagnose/scripts/hitl-loop.template.sh
new file mode 100644
index 00000000..40afc465
--- /dev/null
+++ b/.agents/skills/diagnose/scripts/hitl-loop.template.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Human-in-the-loop reproduction loop.
+# Copy this file, edit the steps below, and run it.
+# The agent runs the script; the user follows prompts in their terminal.
+#
+# Usage:
+#   bash hitl-loop.template.sh
+#
+# Two helpers:
+#   step "<instruction>"          → show instruction, wait for Enter
+#   capture VAR "<question>"      → show question, read response into VAR
+#
+# At the end, captured values are printed as KEY=VALUE for the agent to parse.
+
+set -euo pipefail
+
+step() {
+  printf '\n>>> %s\n' "$1"
+  read -r -p "    [Enter when done] " _
+}
+
+capture() {
+  local var="$1" question="$2" answer
+  printf '\n>>> %s\n' "$question"
+  read -r -p "    > " answer
+  printf -v "$var" '%s' "$answer"
+}
+
+# --- edit below ---------------------------------------------------------
+
+step "Open the app at http://localhost:3000 and sign in."
+
+capture ERRORED "Click the 'Export' button. Did it throw an error? (y/n)"
+
+capture ERROR_MSG "Paste the error message (or 'none'):"
+
+# --- edit above ---------------------------------------------------------
+
+printf '\n--- Captured ---\n'
+printf 'ERRORED=%s\n' "$ERRORED"
+printf 'ERROR_MSG=%s\n' "$ERROR_MSG"
diff --git a/.agents/skills/find-skills/SKILL.md b/.agents/skills/find-skills/SKILL.md
new file mode 100644
index 00000000..114c6637
--- /dev/null
+++ b/.agents/skills/find-skills/SKILL.md
@@ -0,0 +1,142 @@
+---
+name: find-skills
+description: Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
+---
+
+# Find Skills
+
+This skill helps you discover and install skills from the open agent skills ecosystem.
+
+## When to Use This Skill
+
+Use this skill when the user:
+
+- Asks "how do I do X" where X might be a common task with an existing skill
+- Says "find a skill for X" or "is there a skill for X"
+- Asks "can you do X" where X is a specialized capability
+- Expresses interest in extending agent capabilities
+- Wants to search for tools, templates, or workflows
+- Mentions they wish they had help with a specific domain (design, testing, deployment, etc.)
+
+## What is the Skills CLI?
+
+The Skills CLI (`npx skills`) is the package manager for the open agent skills ecosystem. Skills are modular packages that extend agent capabilities with specialized knowledge, workflows, and tools.
+
+**Key commands:**
+
+- `npx skills find [query]` - Search for skills interactively or by keyword
+- `npx skills add <package>` - Install a skill from GitHub or other sources
+- `npx skills check` - Check for skill updates
+- `npx skills update` - Update all installed skills
+
+**Browse skills at:** https://skills.sh/
+
+## How to Help Users Find Skills
+
+### Step 1: Understand What They Need
+
+When a user asks for help with something, identify:
+
+1. The domain (e.g., React, testing, design, deployment)
+2. The specific task (e.g., writing tests, creating animations, reviewing PRs)
+3. Whether this is a common enough task that a skill likely exists
+
+### Step 2: Check the Leaderboard First
+
+Before running a CLI search, check the [skills.sh leaderboard](https://skills.sh/) to see if a well-known skill already exists for the domain. The leaderboard ranks skills by total installs, surfacing the most popular and battle-tested options.
+
+For example, top skills for web development include:
+- `vercel-labs/agent-skills` — React, Next.js, web design (100K+ installs each)
+- `anthropics/skills` — Frontend design, document processing (100K+ installs)
+
+### Step 3: Search for Skills
+
+If the leaderboard doesn't cover the user's need, run the find command:
+
+```bash
+npx skills find [query]
+```
+
+For example:
+
+- User asks "how do I make my React app faster?" → `npx skills find react performance`
+- User asks "can you help me with PR reviews?" → `npx skills find pr review`
+- User asks "I need to create a changelog" → `npx skills find changelog`
+
+### Step 4: Verify Quality Before Recommending
+
+**Do not recommend a skill based solely on search results.** Always verify:
+
+1. **Install count** — Prefer skills with 1K+ installs. Be cautious with anything under 100.
+2. **Source reputation** — Official sources (`vercel-labs`, `anthropics`, `microsoft`) are more trustworthy than unknown authors.
+3. **GitHub stars** — Check the source repository. A skill from a repo with <100 stars should be treated with skepticism.
+
+### Step 5: Present Options to the User
+
+When you find relevant skills, present them to the user with:
+
+1. The skill name and what it does
+2. The install count and source
+3. The install command they can run
+4. A link to learn more at skills.sh
+
+Example response:
+
+```
+I found a skill that might help! The "react-best-practices" skill provides
+React and Next.js performance optimization guidelines from Vercel Engineering.
+(185K installs)
+
+To install it:
+npx skills add vercel-labs/agent-skills@react-best-practices
+
+Learn more: https://skills.sh/vercel-labs/agent-skills/react-best-practices
+```
+
+### Step 6: Offer to Install
+
+If the user wants to proceed, you can install the skill for them:
+
+```bash
+npx skills add <owner/repo@skill> -g -y
+```
+
+The `-g` flag installs globally (user-level) and `-y` skips confirmation prompts.
+
+## Common Skill Categories
+
+When searching, consider these common categories:
+
+| Category        | Example Queries                          |
+| --------------- | ---------------------------------------- |
+| Web Development | react, nextjs, typescript, css, tailwind |
+| Testing         | testing, jest, playwright, e2e           |
+| DevOps          | deploy, docker, kubernetes, ci-cd        |
+| Documentation   | docs, readme, changelog, api-docs        |
+| Code Quality    | review, lint, refactor, best-practices   |
+| Design          | ui, ux, design-system, accessibility     |
+| Productivity    | workflow, automation, git                |
+
+## Tips for Effective Searches
+
+1. **Use specific keywords**: "react testing" is better than just "testing"
+2. **Try alternative terms**: If "deploy" doesn't work, try "deployment" or "ci-cd"
+3. **Check popular sources**: Many skills come from `vercel-labs/agent-skills` or `ComposioHQ/awesome-claude-skills`
+
+## When No Skills Are Found
+
+If no relevant skills exist:
+
+1. Acknowledge that no existing skill was found
+2. Offer to help with the task directly using your general capabilities
+3. Suggest the user could create their own skill with `npx skills init`
+
+Example:
+
+```
+I searched for skills related to "xyz" but didn't find any matches.
+I can still help you with this task directly! Would you like me to proceed?
+
+If this is something you do often, you could create your own skill:
+npx skills init my-xyz-skill
+```
diff --git a/.agents/skills/grill-with-docs/ADR-FORMAT.md b/.agents/skills/grill-with-docs/ADR-FORMAT.md
new file mode 100644
index 00000000..da7e78ec
--- /dev/null
+++ b/.agents/skills/grill-with-docs/ADR-FORMAT.md
@@ -0,0 +1,47 @@
+# ADR Format
+
+ADRs live in `docs/adr/` and use sequential numbering: `0001-slug.md`, `0002-slug.md`, etc.
+
+Create the `docs/adr/` directory lazily — only when the first ADR is needed.
+
+## Template
+
+```md
+# {Short title of the decision}
+
+{1-3 sentences: what's the context, what did we decide, and why.}
+```
+
+That's it. An ADR can be a single paragraph. The value is in recording *that* a decision was made and *why* — not in filling out sections.
+
+## Optional sections
+
+Only include these when they add genuine value. Most ADRs won't need them.
+
+- **Status** frontmatter (`proposed | accepted | deprecated | superseded by ADR-NNNN`) — useful when decisions are revisited
+- **Considered Options** — only when the rejected alternatives are worth remembering
+- **Consequences** — only when non-obvious downstream effects need to be called out
+
+## Numbering
+
+Scan `docs/adr/` for the highest existing number and increment by one.
+
+## When to offer an ADR
+
+All three of these must be true:
+
+1. **Hard to reverse** — the cost of changing your mind later is meaningful
+2. **Surprising without context** — a future reader will look at the code and wonder "why on earth did they do it this way?"
+3. **The result of a real trade-off** — there were genuine alternatives and you picked one for specific reasons
+
+If a decision is easy to reverse, skip it — you'll just reverse it. If it's not surprising, nobody will wonder why. If there was no real alternative, there's nothing to record beyond "we did the obvious thing."
+
+### What qualifies
+
+- **Architectural shape.** "We're using a monorepo." "The write model is event-sourced, the read model is projected into Postgres."
+- **Integration patterns between contexts.** "Ordering and Billing communicate via domain events, not synchronous HTTP."
+- **Technology choices that carry lock-in.** Database, message bus, auth provider, deployment target. Not every library — just the ones that would take a quarter to swap out.
+- **Boundary and scope decisions.** "Customer data is owned by the Customer context; other contexts reference it by ID only." The explicit no-s are as valuable as the yes-s.
+- **Deliberate deviations from the obvious path.** "We're using manual SQL instead of an ORM because X." Anything where a reasonable reader would assume the opposite. These stop the next engineer from "fixing" something that was deliberate.
+- **Constraints not visible in the code.** "We can't use AWS because of compliance requirements." "Response times must be under 200ms because of the partner API contract."
+- **Rejected alternatives when the rejection is non-obvious.** If you considered GraphQL and picked REST for subtle reasons, record it — otherwise someone will suggest GraphQL again in six months.
diff --git a/.agents/skills/grill-with-docs/CONTEXT-FORMAT.md b/.agents/skills/grill-with-docs/CONTEXT-FORMAT.md
new file mode 100644
index 00000000..eaf2a185
--- /dev/null
+++ b/.agents/skills/grill-with-docs/CONTEXT-FORMAT.md
@@ -0,0 +1,60 @@
+# CONTEXT.md Format
+
+## Structure
+
+```md
+# {Context Name}
+
+{One or two sentence description of what this context is and why it exists.}
+
+## Language
+
+**Order**:
+{A one or two sentence description of the term}
+_Avoid_: Purchase, transaction
+
+**Invoice**:
+A request for payment sent to a customer after delivery.
+_Avoid_: Bill, payment request
+
+**Customer**:
+A person or organization that places orders.
+_Avoid_: Client, buyer, account
+```
+
+## Rules
+
+- **Be opinionated.** When multiple words exist for the same concept, pick the best one and list the others under `_Avoid_`.
+- **Keep definitions tight.** One or two sentences max. Define what it IS, not what it does.
+- **Only include terms specific to this project's context.** General programming concepts (timeouts, error types, utility patterns) don't belong even if the project uses them extensively. Before adding a term, ask: is this a concept unique to this context, or a general programming concept? Only the former belongs.
+- **Group terms under subheadings** when natural clusters emerge. If all terms belong to a single cohesive area, a flat list is fine.
+
+## Single vs multi-context repos
+
+**Single context (most repos):** One `CONTEXT.md` at the repo root.
+
+**Multiple contexts:** A `CONTEXT-MAP.md` at the repo root lists the contexts, where they live, and how they relate to each other:
+
+```md
+# Context Map
+
+## Contexts
+
+- [Ordering](./src/ordering/CONTEXT.md) — receives and tracks customer orders
+- [Billing](./src/billing/CONTEXT.md) — generates invoices and processes payments
+- [Fulfillment](./src/fulfillment/CONTEXT.md) — manages warehouse picking and shipping
+
+## Relationships
+
+- **Ordering → Fulfillment**: Ordering emits `OrderPlaced` events; Fulfillment consumes them to start picking
+- **Fulfillment → Billing**: Fulfillment emits `ShipmentDispatched` events; Billing consumes them to generate invoices
+- **Ordering ↔ Billing**: Shared types for `CustomerId` and `Money`
+```
+
+The skill infers which structure applies:
+
+- If `CONTEXT-MAP.md` exists, read it to find contexts
+- If only a root `CONTEXT.md` exists, single context
+- If neither exists, create a root `CONTEXT.md` lazily when the first term is resolved
+
+When multiple contexts exist, infer which one the current topic relates to. If unclear, ask.
diff --git a/.agents/skills/grill-with-docs/SKILL.md b/.agents/skills/grill-with-docs/SKILL.md
new file mode 100644
index 00000000..5ea0aa91
--- /dev/null
+++ b/.agents/skills/grill-with-docs/SKILL.md
@@ -0,0 +1,88 @@
+---
+name: grill-with-docs
+description: Grilling session that challenges your plan against the existing domain model, sharpens terminology, and updates documentation (CONTEXT.md, ADRs) inline as decisions crystallise. Use when user wants to stress-test a plan against their project's language and documented decisions.
+---
+
+<what-to-do>
+
+Interview me relentlessly about every aspect of this plan until we reach a shared understanding. Walk down each branch of the design tree, resolving dependencies between decisions one-by-one. For each question, provide your recommended answer.
+
+Ask the questions one at a time, waiting for feedback on each question before continuing.
+
+If a question can be answered by exploring the codebase, explore the codebase instead.
+
+</what-to-do>
+
+<supporting-info>
+
+## Domain awareness
+
+During codebase exploration, also look for existing documentation:
+
+### File structure
+
+Most repos have a single context:
+
+```
+/
+├── CONTEXT.md
+├── docs/
+│   └── adr/
+│       ├── 0001-event-sourced-orders.md
+│       └── 0002-postgres-for-write-model.md
+└── src/
+```
+
+If a `CONTEXT-MAP.md` exists at the root, the repo has multiple contexts. The map points to where each one lives:
+
+```
+/
+├── CONTEXT-MAP.md
+├── docs/
+│   └── adr/                          ← system-wide decisions
+├── src/
+│   ├── ordering/
+│   │   ├── CONTEXT.md
+│   │   └── docs/adr/                 ← context-specific decisions
+│   └── billing/
+│       ├── CONTEXT.md
+│       └── docs/adr/
+```
+
+Create files lazily — only when you have something to write. If no `CONTEXT.md` exists, create one when the first term is resolved. If no `docs/adr/` exists, create it when the first ADR is needed.
+
+## During the session
+
+### Challenge against the glossary
+
+When the user uses a term that conflicts with the existing language in `CONTEXT.md`, call it out immediately. "Your glossary defines 'cancellation' as X, but you seem to mean Y — which is it?"
+
+### Sharpen fuzzy language
+
+When the user uses vague or overloaded terms, propose a precise canonical term. "You're saying 'account' — do you mean the Customer or the User? Those are different things."
+
+### Discuss concrete scenarios
+
+When domain relationships are being discussed, stress-test them with specific scenarios. Invent scenarios that probe edge cases and force the user to be precise about the boundaries between concepts.
+
+### Cross-reference with code
+
+When the user states how something works, check whether the code agrees. If you find a contradiction, surface it: "Your code cancels entire Orders, but you just said partial cancellation is possible — which is right?"
+
+### Update CONTEXT.md inline
+
+When a term is resolved, update `CONTEXT.md` right there. Don't batch these up — capture them as they happen. Use the format in [CONTEXT-FORMAT.md](./CONTEXT-FORMAT.md).
+
+`CONTEXT.md` should be totally devoid of implementation details. Do not treat `CONTEXT.md` as a spec, a scratch pad, or a repository for implementation decisions. It is a glossary and nothing else.
+
+### Offer ADRs sparingly
+
+Only offer to create an ADR when all three are true:
+
+1. **Hard to reverse** — the cost of changing your mind later is meaningful
+2. **Surprising without context** — a future reader will wonder "why did they do it this way?"
+3. **The result of a real trade-off** — there were genuine alternatives and you picked one for specific reasons
+
+If any of the three is missing, skip the ADR. Use the format in [ADR-FORMAT.md](./ADR-FORMAT.md).
+
+</supporting-info>
diff --git a/.agents/skills/handoff/SKILL.md b/.agents/skills/handoff/SKILL.md
new file mode 100644
index 00000000..0aa5b993
--- /dev/null
+++ b/.agents/skills/handoff/SKILL.md
@@ -0,0 +1,15 @@
+---
+name: handoff
+description: Compact the current conversation into a handoff document for another agent to pick up.
+argument-hint: "What will the next session be used for?"
+---
+
+Write a handoff document summarising the current conversation so a fresh agent can continue the work. Save to the temporary directory of the user's OS - not the current workspace.
+
+Include a "suggested skills" section in the document, which suggests skills that the agent should invoke.
+
+Do not duplicate content already captured in other artifacts (PRDs, plans, ADRs, issues, commits, diffs). Reference them by path or URL instead.
+
+Redact any sensitive information, such as API keys, passwords, or personally identifiable information.
+
+If the user passed arguments, treat them as a description of what the next session will focus on and tailor the doc accordingly.
diff --git a/.agents/skills/improve-codebase-architecture/DEEPENING.md b/.agents/skills/improve-codebase-architecture/DEEPENING.md
new file mode 100644
index 00000000..ecaf5d7d
--- /dev/null
+++ b/.agents/skills/improve-codebase-architecture/DEEPENING.md
@@ -0,0 +1,37 @@
+# Deepening
+
+How to deepen a cluster of shallow modules safely, given its dependencies. Assumes the vocabulary in [LANGUAGE.md](LANGUAGE.md) — **module**, **interface**, **seam**, **adapter**.
+
+## Dependency categories
+
+When assessing a candidate for deepening, classify its dependencies. The category determines how the deepened module is tested across its seam.
+
+### 1. In-process
+
+Pure computation, in-memory state, no I/O. Always deepenable — merge the modules and test through the new interface directly. No adapter needed.
+
+### 2. Local-substitutable
+
+Dependencies that have local test stand-ins (PGLite for Postgres, in-memory filesystem). Deepenable if the stand-in exists. The deepened module is tested with the stand-in running in the test suite. The seam is internal; no port at the module's external interface.
+
+### 3. Remote but owned (Ports & Adapters)
+
+Your own services across a network boundary (microservices, internal APIs). Define a **port** (interface) at the seam. The deep module owns the logic; the transport is injected as an **adapter**. Tests use an in-memory adapter. Production uses an HTTP/gRPC/queue adapter.
+
+Recommendation shape: *"Define a port at the seam, implement an HTTP adapter for production and an in-memory adapter for testing, so the logic sits in one deep module even though it's deployed across a network."*
+
+### 4. True external (Mock)
+
+Third-party services (Stripe, Twilio, etc.) you don't control. The deepened module takes the external dependency as an injected port; tests provide a mock adapter.
+
+## Seam discipline
+
+- **One adapter means a hypothetical seam. Two adapters means a real one.** Don't introduce a port unless at least two adapters are justified (typically production + test). A single-adapter seam is just indirection.
+- **Internal seams vs external seams.** A deep module can have internal seams (private to its implementation, used by its own tests) as well as the external seam at its interface. Don't expose internal seams through the interface just because tests use them.
+
+## Testing strategy: replace, don't layer
+
+- Old unit tests on shallow modules become waste once tests at the deepened module's interface exist — delete them.
+- Write new tests at the deepened module's interface. The **interface is the test surface**.
+- Tests assert on observable outcomes through the interface, not internal state.
+- Tests should survive internal refactors — they describe behaviour, not implementation. If a test has to change when the implementation changes, it's testing past the interface.
diff --git a/.agents/skills/improve-codebase-architecture/HTML-REPORT.md b/.agents/skills/improve-codebase-architecture/HTML-REPORT.md
new file mode 100644
index 00000000..8adc368f
--- /dev/null
+++ b/.agents/skills/improve-codebase-architecture/HTML-REPORT.md
@@ -0,0 +1,123 @@
+# HTML Report Format
+
+The architectural review is rendered as a single self-contained HTML file in the OS temp directory. Tailwind and Mermaid both come from CDNs. Mermaid handles graph-shaped diagrams reliably; hand-built divs and inline SVG handle the more editorial visuals (mass diagrams, cross-sections). Mix the two — don't lean on Mermaid for everything, it'll start to look generic.
+
+## Scaffold
+
+```html
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>Architecture review — {{repo name}}</title>
+    <script src="https://cdn.tailwindcss.com"></script>
+    <script type="module">
+      import mermaid from "https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs";
+      mermaid.initialize({ startOnLoad: true, theme: "neutral", securityLevel: "loose" });
+    </script>
+    <style>
+      /* small custom layer for things Tailwind doesn't cover cleanly:
+         dashed seam lines, hand-drawn-feeling arrow heads, etc. */
+      .seam { stroke-dasharray: 4 4; }
+      .leak { stroke: #dc2626; }
+      .deep { background: linear-gradient(135deg, #0f172a, #1e293b); }
+    </style>
+  </head>
+  <body class="bg-stone-50 text-slate-900 font-sans">
+    <main class="max-w-5xl mx-auto px-6 py-12 space-y-12">
+      <header>...</header>
+      <section id="candidates" class="space-y-10">...</section>
+      <section id="top-recommendation">...</section>
+    </main>
+  </body>
+</html>
+```
+
+## Header
+
+Repo name, date, and a compact legend: solid box = module, dashed line = seam, red arrow = leakage, thick dark box = deep module. No introduction paragraph — straight into the candidates.
+
+## Candidate card
+
+The diagrams carry the weight. Prose is sparse, plain, and uses the glossary terms ([LANGUAGE.md](LANGUAGE.md)) without ceremony.
+
+Each candidate is one `<article>`:
+
+- **Title** — short, names the deepening (e.g. "Collapse the Order intake pipeline").
+- **Badge row** — recommendation strength (`Strong` = emerald, `Worth exploring` = amber, `Speculative` = slate), plus a tag for the dependency category (`in-process`, `local-substitutable`, `ports & adapters`, `mock`).
+- **Files** — monospaced list, `font-mono text-sm`.
+- **Before / After diagram** — the centrepiece. Two columns, side by side. See patterns below.
+- **Problem** — one sentence. What hurts.
+- **Solution** — one sentence. What changes.
+- **Wins** — bullets, ≤6 words each. e.g. "Tests hit one interface", "Pricing logic stops leaking", "Delete 4 shallow wrappers".
+- **ADR callout** (if applicable) — one line in an amber-tinted box.
+
+No paragraphs of explanation. If the diagram needs a paragraph to be understood, redraw the diagram.
+
+## Diagram patterns
+
+Pick the pattern that fits the candidate. Mix them. Don't make every diagram look the same — variety is part of the point.
+
+### Mermaid graph (the workhorse for dependencies / call flow)
+
+Use a Mermaid `flowchart` or `graph` when the point is "X calls Y calls Z, and look at the mess." Wrap it in a Tailwind-styled card so it doesn't feel parachuted in. Style with classDef to colour leakage edges red and the deep module dark. Sequence diagrams work well for "before: 6 round-trips; after: 1."
+
+```html
+<div class="rounded-lg border border-slate-200 bg-white p-4">
+  <pre class="mermaid">
+    flowchart LR
+      A[OrderHandler] --> B[OrderValidator]
+      B --> C[OrderRepo]
+      C -.leak.-> D[PricingClient]
+      classDef leak stroke:#dc2626,stroke-width:2px;
+      class C,D leak
+  </pre>
+</div>
+```
+
+### Hand-built boxes-and-arrows (when Mermaid's layout fights you)
+
+Modules as `<div>`s with borders and labels. Arrows as inline SVG `<line>` or `<path>` elements positioned absolutely over a relative container. Reach for this when you want the "after" diagram to feel like one thick-bordered deep module with greyed-out internals — Mermaid won't render that with the right weight.
+
+### Cross-section (good for layered shallowness)
+
+Stack horizontal bands (`h-12 border-l-4`) to show layers a call passes through. Before: 6 thin layers each doing nothing. After: 1 thick band labelled with the consolidated responsibility.
+
+### Mass diagram (good for "interface as wide as implementation")
+
+Two rectangles per module — one for interface surface area, one for implementation. Before: interface rectangle is nearly as tall as the implementation rectangle (shallow). After: interface rectangle is short, implementation rectangle is tall (deep).
+
+### Call-graph collapse
+
+Before: a tree of function calls rendered as nested boxes. After: the same tree collapsed into one box, with the now-internal calls shown faded inside it.
+
+## Style guidance
+
+- Lean editorial, not corporate-dashboard. Generous whitespace. Serif optional for headings (`font-serif` works well with stone/slate).
+- Colour sparingly: one accent (emerald or indigo) plus red for leakage and amber for warnings.
+- Keep diagrams ~320px tall so before/after sits comfortably side by side without scrolling.
+- Use `text-xs uppercase tracking-wider` for module labels inside diagrams — they should read as schematic, not as UI.
+- The only scripts are the Tailwind CDN and the Mermaid ESM import. The report is otherwise static — no app code, no interactivity beyond Mermaid's own rendering.
+
+## Top recommendation section
+
+One larger card. Candidate name, one sentence on why, anchor link to its card. That's it.
+
+## Tone
+
+Plain English, concise — but the architectural nouns and verbs come straight from [LANGUAGE.md](LANGUAGE.md). Concision is not an excuse to drift.
+
+**Use exactly:** module, interface, implementation, depth, deep, shallow, seam, adapter, leverage, locality.
+
+**Never substitute:** component, service, unit (for module) · API, signature (for interface) · boundary (for seam) · layer, wrapper (for module, when you mean module).
+
+**Phrasings that fit the style:**
+
+- "Order intake module is shallow — interface nearly matches the implementation."
+- "Pricing leaks across the seam."
+- "Deepen: one interface, one place to test."
+- "Two adapters justify the seam: HTTP in prod, in-memory in tests."
+
+**Wins bullets** name the gain in glossary terms: *"locality: bugs concentrate in one module"*, *"leverage: one interface, N call sites"*, *"interface shrinks; implementation absorbs the wrappers"*. Don't write *"easier to maintain"* or *"cleaner code"* — those terms aren't in the glossary and don't earn their place.
+
+No hedging, no throat-clearing, no "it's worth noting that…". If a sentence could be a bullet, make it a bullet. If a bullet could be cut, cut it. If a term isn't in [LANGUAGE.md](LANGUAGE.md), reach for one that is before inventing a new one.
diff --git a/.agents/skills/improve-codebase-architecture/INTERFACE-DESIGN.md b/.agents/skills/improve-codebase-architecture/INTERFACE-DESIGN.md
new file mode 100644
index 00000000..3197723a
--- /dev/null
+++ b/.agents/skills/improve-codebase-architecture/INTERFACE-DESIGN.md
@@ -0,0 +1,44 @@
+# Interface Design
+
+When the user wants to explore alternative interfaces for a chosen deepening candidate, use this parallel sub-agent pattern. Based on "Design It Twice" (Ousterhout) — your first idea is unlikely to be the best.
+
+Uses the vocabulary in [LANGUAGE.md](LANGUAGE.md) — **module**, **interface**, **seam**, **adapter**, **leverage**.
+
+## Process
+
+### 1. Frame the problem space
+
+Before spawning sub-agents, write a user-facing explanation of the problem space for the chosen candidate:
+
+- The constraints any new interface would need to satisfy
+- The dependencies it would rely on, and which category they fall into (see [DEEPENING.md](DEEPENING.md))
+- A rough illustrative code sketch to ground the constraints — not a proposal, just a way to make the constraints concrete
+
+Show this to the user, then immediately proceed to Step 2. The user reads and thinks while the sub-agents work in parallel.
+
+### 2. Spawn sub-agents
+
+Spawn 3+ sub-agents in parallel using the Agent tool. Each must produce a **radically different** interface for the deepened module.
+
+Prompt each sub-agent with a separate technical brief (file paths, coupling details, dependency category from [DEEPENING.md](DEEPENING.md), what sits behind the seam). The brief is independent of the user-facing problem-space explanation in Step 1. Give each agent a different design constraint:
+
+- Agent 1: "Minimize the interface — aim for 1–3 entry points max. Maximise leverage per entry point."
+- Agent 2: "Maximise flexibility — support many use cases and extension."
+- Agent 3: "Optimise for the most common caller — make the default case trivial."
+- Agent 4 (if applicable): "Design around ports & adapters for cross-seam dependencies."
+
+Include both [LANGUAGE.md](LANGUAGE.md) vocabulary and CONTEXT.md vocabulary in the brief so each sub-agent names things consistently with the architecture language and the project's domain language.
+
+Each sub-agent outputs:
+
+1. Interface (types, methods, params — plus invariants, ordering, error modes)
+2. Usage example showing how callers use it
+3. What the implementation hides behind the seam
+4. Dependency strategy and adapters (see [DEEPENING.md](DEEPENING.md))
+5. Trade-offs — where leverage is high, where it's thin
+
+### 3. Present and compare
+
+Present designs sequentially so the user can absorb each one, then compare them in prose. Contrast by **depth** (leverage at the interface), **locality** (where change concentrates), and **seam placement**.
+
+After comparing, give your own recommendation: which design you think is strongest and why. If elements from different designs would combine well, propose a hybrid. Be opinionated — the user wants a strong read, not a menu.
diff --git a/.agents/skills/improve-codebase-architecture/LANGUAGE.md b/.agents/skills/improve-codebase-architecture/LANGUAGE.md
new file mode 100644
index 00000000..530c2763
--- /dev/null
+++ b/.agents/skills/improve-codebase-architecture/LANGUAGE.md
@@ -0,0 +1,53 @@
+# Language
+
+Shared vocabulary for every suggestion this skill makes. Use these terms exactly — don't substitute "component," "service," "API," or "boundary." Consistent language is the whole point.
+
+## Terms
+
+**Module**
+Anything with an interface and an implementation. Deliberately scale-agnostic — applies equally to a function, class, package, or tier-spanning slice.
+_Avoid_: unit, component, service.
+
+**Interface**
+Everything a caller must know to use the module correctly. Includes the type signature, but also invariants, ordering constraints, error modes, required configuration, and performance characteristics.
+_Avoid_: API, signature (too narrow — those refer only to the type-level surface).
+
+**Implementation**
+What's inside a module — its body of code. Distinct from **Adapter**: a thing can be a small adapter with a large implementation (a Postgres repo) or a large adapter with a small implementation (an in-memory fake). Reach for "adapter" when the seam is the topic; "implementation" otherwise.
+
+**Depth**
+Leverage at the interface — the amount of behaviour a caller (or test) can exercise per unit of interface they have to learn. A module is **deep** when a large amount of behaviour sits behind a small interface. A module is **shallow** when the interface is nearly as complex as the implementation.
+
+**Seam** _(from Michael Feathers)_
+A place where you can alter behaviour without editing in that place. The *location* at which a module's interface lives. Choosing where to put the seam is its own design decision, distinct from what goes behind it.
+_Avoid_: boundary (overloaded with DDD's bounded context).
+
+**Adapter**
+A concrete thing that satisfies an interface at a seam. Describes *role* (what slot it fills), not substance (what's inside).
+
+**Leverage**
+What callers get from depth. More capability per unit of interface they have to learn. One implementation pays back across N call sites and M tests.
+
+**Locality**
+What maintainers get from depth. Change, bugs, knowledge, and verification concentrate at one place rather than spreading across callers. Fix once, fixed everywhere.
+
+## Principles
+
+- **Depth is a property of the interface, not the implementation.** A deep module can be internally composed of small, mockable, swappable parts — they just aren't part of the interface. A module can have **internal seams** (private to its implementation, used by its own tests) as well as the **external seam** at its interface.
+- **The deletion test.** Imagine deleting the module. If complexity vanishes, the module wasn't hiding anything (it was a pass-through). If complexity reappears across N callers, the module was earning its keep.
+- **The interface is the test surface.** Callers and tests cross the same seam. If you want to test *past* the interface, the module is probably the wrong shape.
+- **One adapter means a hypothetical seam. Two adapters means a real one.** Don't introduce a seam unless something actually varies across it.
+
+## Relationships
+
+- A **Module** has exactly one **Interface** (the surface it presents to callers and tests).
+- **Depth** is a property of a **Module**, measured against its **Interface**.
+- A **Seam** is where a **Module**'s **Interface** lives.
+- An **Adapter** sits at a **Seam** and satisfies the **Interface**.
+- **Depth** produces **Leverage** for callers and **Locality** for maintainers.
+
+## Rejected framings
+
+- **Depth as ratio of implementation-lines to interface-lines** (Ousterhout): rewards padding the implementation. We use depth-as-leverage instead.
+- **"Interface" as the TypeScript `interface` keyword or a class's public methods**: too narrow — interface here includes every fact a caller must know.
+- **"Boundary"**: overloaded with DDD's bounded context. Say **seam** or **interface**.
diff --git a/.agents/skills/improve-codebase-architecture/SKILL.md b/.agents/skills/improve-codebase-architecture/SKILL.md
new file mode 100644
index 00000000..c12b263b
--- /dev/null
+++ b/.agents/skills/improve-codebase-architecture/SKILL.md
@@ -0,0 +1,81 @@
+---
+name: improve-codebase-architecture
+description: Find deepening opportunities in a codebase, informed by the domain language in CONTEXT.md and the decisions in docs/adr/. Use when the user wants to improve architecture, find refactoring opportunities, consolidate tightly-coupled modules, or make a codebase more testable and AI-navigable.
+---
+
+# Improve Codebase Architecture
+
+Surface architectural friction and propose **deepening opportunities** — refactors that turn shallow modules into deep ones. The aim is testability and AI-navigability.
+
+## Glossary
+
+Use these terms exactly in every suggestion. Consistent language is the point — don't drift into "component," "service," "API," or "boundary." Full definitions in [LANGUAGE.md](LANGUAGE.md).
+
+- **Module** — anything with an interface and an implementation (function, class, package, slice).
+- **Interface** — everything a caller must know to use the module: types, invariants, error modes, ordering, config. Not just the type signature.
+- **Implementation** — the code inside.
+- **Depth** — leverage at the interface: a lot of behaviour behind a small interface. **Deep** = high leverage. **Shallow** = interface nearly as complex as the implementation.
+- **Seam** — where an interface lives; a place behaviour can be altered without editing in place. (Use this, not "boundary.")
+- **Adapter** — a concrete thing satisfying an interface at a seam.
+- **Leverage** — what callers get from depth.
+- **Locality** — what maintainers get from depth: change, bugs, knowledge concentrated in one place.
+
+Key principles (see [LANGUAGE.md](LANGUAGE.md) for the full list):
+
+- **Deletion test**: imagine deleting the module. If complexity vanishes, it was a pass-through. If complexity reappears across N callers, it was earning its keep.
+- **The interface is the test surface.**
+- **One adapter = hypothetical seam. Two adapters = real seam.**
+
+This skill is _informed_ by the project's domain model. The domain language gives names to good seams; ADRs record decisions the skill should not re-litigate.
+
+## Process
+
+### 1. Explore
+
+Read the project's domain glossary and any ADRs in the area you're touching first.
+
+Then use the Agent tool with `subagent_type=Explore` to walk the codebase. Don't follow rigid heuristics — explore organically and note where you experience friction:
+
+- Where does understanding one concept require bouncing between many small modules?
+- Where are modules **shallow** — interface nearly as complex as the implementation?
+- Where have pure functions been extracted just for testability, but the real bugs hide in how they're called (no **locality**)?
+- Where do tightly-coupled modules leak across their seams?
+- Which parts of the codebase are untested, or hard to test through their current interface?
+
+Apply the **deletion test** to anything you suspect is shallow: would deleting it concentrate complexity, or just move it? A "yes, concentrates" is the signal you want.
+
+### 2. Present candidates as an HTML report
+
+Write a self-contained HTML file to the OS temp directory so nothing lands in the repo. Resolve the temp dir from `$TMPDIR`, falling back to `/tmp` (or `%TEMP%` on Windows), and write to `<tmpdir>/architecture-review-<timestamp>.html` so each run gets a fresh file. Open it for the user — `xdg-open <path>` on Linux, `open <path>` on macOS, `start <path>` on Windows — and tell them the absolute path.
+
+The report uses **Tailwind via CDN** for layout and styling, and **Mermaid via CDN** for diagrams where a graph/flow/sequence reliably communicates the structure. Mix Mermaid with hand-crafted CSS/SVG visuals — use Mermaid when relationships are graph-shaped (call graphs, dependencies, sequences), and hand-built divs/SVG when you want something more editorial (mass diagrams, cross-sections, collapse animations). Each candidate gets a **before/after visualisation**. Be visual.
+
+For each candidate, the same template as before, but rendered as a card:
+
+- **Files** — which files/modules are involved
+- **Problem** — why the current architecture is causing friction
+- **Solution** — plain English description of what would change
+- **Benefits** — explained in terms of locality and leverage, and how tests would improve
+- **Before / After diagram** — side-by-side, custom-drawn, illustrating the shallowness and the deepening
+- **Recommendation strength** — one of `Strong`, `Worth exploring`, `Speculative`, rendered as a badge
+
+End the report with a **Top recommendation** section: which candidate you'd tackle first and why.
+
+**Use CONTEXT.md vocabulary for the domain, and [LANGUAGE.md](LANGUAGE.md) vocabulary for the architecture.** If `CONTEXT.md` defines "Order," talk about "the Order intake module" — not "the FooBarHandler," and not "the Order service."
+
+**ADR conflicts**: if a candidate contradicts an existing ADR, only surface it when the friction is real enough to warrant revisiting the ADR. Mark it clearly in the card (e.g. a warning callout: _"contradicts ADR-0007 — but worth reopening because…"_). Don't list every theoretical refactor an ADR forbids.
+
+See [HTML-REPORT.md](HTML-REPORT.md) for the full HTML scaffold, diagram patterns, and styling guidance.
+
+Do NOT propose interfaces yet. After the file is written, ask the user: "Which of these would you like to explore?"
+
+### 3. Grilling loop
+
+Once the user picks a candidate, drop into a grilling conversation. Walk the design tree with them — constraints, dependencies, the shape of the deepened module, what sits behind the seam, what tests survive.
+
+Side effects happen inline as decisions crystallize:
+
+- **Naming a deepened module after a concept not in `CONTEXT.md`?** Add the term to `CONTEXT.md` — same discipline as `/grill-with-docs` (see [CONTEXT-FORMAT.md](../grill-with-docs/CONTEXT-FORMAT.md)). Create the file lazily if it doesn't exist.
+- **Sharpening a fuzzy term during the conversation?** Update `CONTEXT.md` right there.
+- **User rejects the candidate with a load-bearing reason?** Offer an ADR, framed as: _"Want me to record this as an ADR so future architecture reviews don't re-suggest it?"_ Only offer when the reason would actually be needed by a future explorer to avoid re-suggesting the same thing — skip ephemeral reasons ("not worth it right now") and self-evident ones. See [ADR-FORMAT.md](../grill-with-docs/ADR-FORMAT.md).
+- **Want to explore alternative interfaces for the deepened module?** See [INTERFACE-DESIGN.md](INTERFACE-DESIGN.md).
diff --git a/.agents/skills/prototype/LOGIC.md b/.agents/skills/prototype/LOGIC.md
new file mode 100644
index 00000000..526ecb18
--- /dev/null
+++ b/.agents/skills/prototype/LOGIC.md
@@ -0,0 +1,79 @@
+# Logic Prototype
+
+A tiny interactive terminal app that lets the user drive a state model by hand. Use this when the question is about **business logic, state transitions, or data shape** — the kind of thing that looks reasonable on paper but only feels wrong once you push it through real cases.
+
+## When this is the right shape
+
+- "I'm not sure if this state machine handles the edge case where X then Y."
+- "Does this data model actually let me represent the case where..."
+- "I want to feel out what the API should look like before writing it."
+- Anything where the user wants to **press buttons and watch state change**.
+
+If the question is "what should this look like" — wrong branch. Use [UI.md](UI.md).
+
+## Process
+
+### 1. State the question
+
+Before writing code, write down what state model and what question you're prototyping. One paragraph, in the prototype's README or a comment at the top of the file. A logic prototype that answers the wrong question is pure waste — make the question explicit so it can be checked later, whether the user is watching now or returning to it AFK.
+
+### 2. Pick the language
+
+Use whatever the host project uses. If the project has no obvious runtime (e.g. a docs repo), ask.
+
+Match the project's existing conventions for tooling — don't add a new package manager or runtime just for the prototype.
+
+### 3. Isolate the logic in a portable module
+
+Put the actual logic — the bit that's answering the question — behind a small, pure interface that could be lifted out and dropped into the real codebase later. The TUI around it is throwaway; the logic module shouldn't be.
+
+The right shape depends on the question:
+
+- **A pure reducer** — `(state, action) => state`. Good when actions are discrete events and state is a single value.
+- **A state machine** — explicit states and transitions. Good when "which actions are even legal right now" is part of the question.
+- **A small set of pure functions** over a plain data type. Good when there's no implicit current state — just transformations.
+- **A class or module with a clear method surface** when the logic genuinely owns ongoing internal state.
+
+Pick whichever shape best fits the question being asked, *not* whichever is easiest to wire to a TUI. Keep it pure: no I/O, no terminal code, no `console.log` for control flow. The TUI imports it and calls into it; nothing flows the other direction.
+
+This is what makes the prototype useful past its own lifetime. When the question's been answered, the validated reducer / machine / function set can be lifted into the real module — the TUI shell gets deleted.
+
+### 4. Build the smallest TUI that exposes the state
+
+Build it as a **lightweight TUI** — on every tick, clear the screen (`console.clear()` / `print("\033[2J\033[H")` / equivalent) and re-render the whole frame. The user should always see one stable view, not an ever-growing scrollback.
+
+Each frame has two parts, in this order:
+
+1. **Current state**, pretty-printed and diff-friendly (one field per line, or formatted JSON). Use **bold** for field names or section headers and **dim** for less important context (timestamps, IDs, derived values). Native ANSI escape codes are fine — `\x1b[1m` bold, `\x1b[2m` dim, `\x1b[0m` reset. No need to pull in a styling library unless one is already in the project.
+2. **Keyboard shortcuts**, listed at the bottom: `[a] add user  [d] delete user  [t] tick clock  [q] quit`. Bold the key, dim the description, or vice-versa — whatever reads cleanly.
+
+Behaviour:
+
+1. **Initialise state** — a single in-memory object/struct. Render the first frame on start.
+2. **Read one keystroke (or one line)** at a time, dispatch to a handler that mutates state.
+3. **Re-render** the full frame after every action — don't append, replace.
+4. **Loop until quit.**
+
+The whole frame should fit on one screen.
+
+### 5. Make it runnable in one command
+
+Add a script to the project's existing task runner (`package.json` scripts, `Makefile`, `justfile`, `pyproject.toml`). The user should run `pnpm run <prototype-name>` or equivalent — never need to remember a path.
+
+If the host project has no task runner, just put the command at the top of the prototype's README.
+
+### 6. Hand it over
+
+Give the user the run command. They'll drive it themselves; the interesting moments are when they say "wait, that shouldn't be possible" or "huh, I assumed X would be different" — those are the bugs in the _idea_, which is the whole point. If they want new actions added, add them. Prototypes evolve.
+
+### 7. Capture the answer
+
+When the prototype has done its job, the answer to the question is the only thing worth keeping. If the user is around, ask what it taught them. If not, leave a `NOTES.md` next to the prototype so the answer can be filled in (or filled in by you, if you've watched the session) before the prototype gets deleted.
+
+## Anti-patterns
+
+- **Don't add tests.** A prototype that needs tests is no longer a prototype.
+- **Don't wire it to the real database.** Use an in-memory store unless the question is specifically about persistence.
+- **Don't generalise.** No "what if we wanted to support X later." The prototype answers one question.
+- **Don't blur the logic and the TUI together.** If the reducer / state machine references `console.log`, prompts, or terminal escape codes, it's no longer portable. Keep the TUI as a thin shell over a pure module.
+- **Don't ship the TUI shell into production.** The shell is optimised for being driven by hand from a terminal. The logic module behind it is the bit worth keeping.
diff --git a/.agents/skills/prototype/SKILL.md b/.agents/skills/prototype/SKILL.md
new file mode 100644
index 00000000..64f3e611
--- /dev/null
+++ b/.agents/skills/prototype/SKILL.md
@@ -0,0 +1,30 @@
+---
+name: prototype
+description: Build a throwaway prototype to flesh out a design before committing to it. Routes between two branches — a runnable terminal app for state/business-logic questions, or several radically different UI variations toggleable from one route. Use when the user wants to prototype, sanity-check a data model or state machine, mock up a UI, explore design options, or says "prototype this", "let me play with it", "try a few designs".
+---
+
+# Prototype
+
+A prototype is **throwaway code that answers a question**. The question decides the shape.
+
+## Pick a branch
+
+Identify which question is being answered — from the user's prompt, the surrounding code, or by asking if the user is around:
+
+- **"Does this logic / state model feel right?"** → [LOGIC.md](LOGIC.md). Build a tiny interactive terminal app that pushes the state machine through cases that are hard to reason about on paper.
+- **"What should this look like?"** → [UI.md](UI.md). Generate several radically different UI variations on a single route, switchable via a URL search param and a floating bottom bar.
+
+The two branches produce very different artifacts — getting this wrong wastes the whole prototype. If the question is genuinely ambiguous and the user isn't reachable, default to whichever branch better matches the surrounding code (a backend module → logic; a page or component → UI) and state the assumption at the top of the prototype.
+
+## Rules that apply to both
+
+1. **Throwaway from day one, and clearly marked as such.** Locate the prototype code close to where it will actually be used (next to the module or page it's prototyping for) so context is obvious — but name it so a casual reader can see it's a prototype, not production. For throwaway UI routes, obey whatever routing convention the project already uses; don't invent a new top-level structure.
+2. **One command to run.** Whatever the project's existing task runner supports — `pnpm <name>`, `python <path>`, `bun <path>`, etc. The user must be able to start it without thinking.
+3. **No persistence by default.** State lives in memory. Persistence is the thing the prototype is _checking_, not something it should depend on. If the question explicitly involves a database, hit a scratch DB or a local file with a clear "PROTOTYPE — wipe me" name.
+4. **Skip the polish.** No tests, no error handling beyond what makes the prototype _runnable_, no abstractions. The point is to learn something fast and then delete it.
+5. **Surface the state.** After every action (logic) or on every variant switch (UI), print or render the full relevant state so the user can see what changed.
+6. **Delete or absorb when done.** When the prototype has answered its question, either delete it or fold the validated decision into the real code — don't leave it rotting in the repo.
+
+## When done
+
+The _answer_ is the only thing worth keeping from a prototype. Capture it somewhere durable (commit message, ADR, issue, or a `NOTES.md` next to the prototype) along with the question it was answering. If the user is around, that capture is a quick conversation; if not, leave the placeholder so they (or you, on the next pass) can fill in the verdict before deleting the prototype.
diff --git a/.agents/skills/prototype/UI.md b/.agents/skills/prototype/UI.md
new file mode 100644
index 00000000..f3b6e640
--- /dev/null
+++ b/.agents/skills/prototype/UI.md
@@ -0,0 +1,112 @@
+# UI Prototype
+
+Generate **several radically different UI variations** on a single route, switchable from a floating bottom bar. The user flips between variants in the browser, picks one (or steals bits from each), then throws the rest away.
+
+If the question is about logic/state rather than what something looks like — wrong branch. Use [LOGIC.md](LOGIC.md).
+
+## When this is the right shape
+
+- "What should this page look like?"
+- "I want to see a few options for this dashboard before committing."
+- "Try a different layout for the settings screen."
+- Any time the user would otherwise spend a day picking between three vague mockups in their head.
+
+## Two sub-shapes — strongly prefer sub-shape A
+
+A UI prototype is much easier to judge when it's **butting up against the rest of the app** — real header, real sidebar, real data, real density. A throwaway route on its own is a vacuum: every variant looks fine in isolation. Default to sub-shape A whenever there's a plausible existing page to host the variants. Only reach for sub-shape B if the prototype genuinely has no nearby home.
+
+### Sub-shape A — adjustment to an existing page (preferred)
+
+The route already exists. Variants are rendered **on the same route**, gated by a `?variant=` URL search param. The existing data fetching, params, and auth all stay — only the rendering swaps. This is the default; pick it unless there's a specific reason not to.
+
+If the prototype is for something that doesn't yet have a page but *would naturally live inside one* (a new section of the dashboard, a new card on the settings screen, a new step in an existing flow) — that's still sub-shape A. Mount the variants inside the host page.
+
+### Sub-shape B — a new page (last resort)
+
+Only use this when the thing being prototyped genuinely has no existing page to live inside — e.g. an entirely new top-level surface, or a flow that can't be embedded anywhere sensible.
+
+Create a **throwaway route** following whatever routing convention the project already uses — don't invent a new top-level structure. Name it so it's obviously a prototype (e.g. include the word `prototype` in the path or filename). Same `?variant=` pattern.
+
+Before committing to sub-shape B, sanity-check: is there really no existing page this could be embedded in? An empty route hides design problems that a populated one would expose.
+
+In both sub-shapes the floating bottom bar is identical.
+
+## Process
+
+### 1. State the question and pick N
+
+Default to **3 variants**. More than 5 stops being radically different and starts being noise — cap there.
+
+Write down the plan in one line, in the prototype's location or a top-of-file comment:
+
+> "Three variants of the settings page, switchable via `?variant=`, on the existing `/settings` route."
+
+This works whether the user is here to push back or not.
+
+### 2. Generate radically different variants
+
+Draft each variant. Hold each one to:
+
+- The page's purpose and the data it has access to.
+- The project's component library / styling system (TailwindCSS, shadcn, MUI, plain CSS, whatever).
+- A clear exported component name, e.g. `VariantA`, `VariantB`, `VariantC`.
+
+Variants must be **structurally different** — different layout, different information hierarchy, different primary affordance, not just different colours. Three slightly-tweaked card grids isn't a UI prototype, it's wallpaper. If two drafts come out too similar, redo one with explicit "do not use a card grid" guidance.
+
+### 3. Wire them together
+
+Create a single switcher component on the route:
+
+```tsx
+// pseudo-code — adapt to the project's framework
+const variant = searchParams.get('variant') ?? 'A';
+return (
+  <>
+    {variant === 'A' && <VariantA {...data} />}
+    {variant === 'B' && <VariantB {...data} />}
+    {variant === 'C' && <VariantC {...data} />}
+    <PrototypeSwitcher variants={['A','B','C']} current={variant} />
+  </>
+);
+```
+
+For sub-shape A (existing page): keep all the existing data fetching above the switcher; only the rendered subtree changes per variant.
+
+For sub-shape B (new page): the throwaway route under `/prototype/<name>` mounts the same switcher.
+
+### 4. Build the floating switcher
+
+A small fixed-position bar at the bottom-centre of the screen with three pieces:
+
+- **Left arrow** — cycles to the previous variant (wraps around).
+- **Variant label** — shows the current variant key and, if the variant exports a name, that name too. e.g. `B — Sidebar layout`.
+- **Right arrow** — cycles forward (wraps around).
+
+Behaviour:
+
+- Clicking an arrow updates the URL search param (use the framework's router — `router.replace` on Next, `navigate` on React Router, etc) so the variant is shareable and reload-stable.
+- Keyboard: `←` and `→` arrow keys also cycle. Don't intercept arrow keys when an `<input>`, `<textarea>`, or `[contenteditable]` is focused.
+- Visually distinct from the page (e.g. high-contrast pill, subtle shadow) so it's obviously not part of the design being evaluated.
+- Hidden in production builds — gate on `process.env.NODE_ENV !== 'production'` or an equivalent check, so a stray prototype merge can't ship the bar to users.
+
+Put the switcher in a single shared component so both sub-shapes can reuse it. Locate it wherever shared UI lives in the project.
+
+### 5. Hand it over
+
+Surface the URL (and the `?variant=` keys). The user will flip through whenever they get to it. The interesting feedback is usually **"I want the header from B with the sidebar from C"** — that's the actual design they want.
+
+### 6. Capture the answer and clean up
+
+Once a variant has won, write down which one and why (commit message, ADR, issue, or a `NOTES.md` next to the prototype if running AFK and the user hasn't responded yet). Then:
+
+- **Sub-shape A** — delete the losing variants and the switcher; fold the winner into the existing page.
+- **Sub-shape B** — promote the winning variant to a real route, delete the throwaway route and the switcher.
+
+Don't leave variant components or the switcher lying around. They rot fast and confuse the next reader.
+
+## Anti-patterns
+
+- **Variants that differ only in colour or copy.** That's a tweak, not a prototype. Real variants disagree about structure.
+- **Sharing too much code between variants.** A shared `<Header>` is fine; a shared `<Layout>` defeats the point. Each variant should be free to throw out the layout.
+- **Wiring variants to real mutations.** Read-only prototypes are fine. If a variant needs to mutate, point it at a stub — the question is "what should this look like", not "does the backend work".
+- **Promoting the prototype directly to production.** The variant code was written under prototype constraints (no tests, minimal error handling). Rewrite it properly when you fold it in.
diff --git a/.agents/skills/qa/SKILL.md b/.agents/skills/qa/SKILL.md
new file mode 100644
index 00000000..305e43fb
--- /dev/null
+++ b/.agents/skills/qa/SKILL.md
@@ -0,0 +1,130 @@
+---
+name: qa
+description: Interactive QA session where user reports bugs or issues conversationally, and the agent files GitHub issues. Explores the codebase in the background for context and domain language. Use when user wants to report bugs, do QA, file issues conversationally, or mentions "QA session".
+---
+
+# QA Session
+
+Run an interactive QA session. The user describes problems they're encountering. You clarify, explore the codebase for context, and file GitHub issues that are durable, user-focused, and use the project's domain language.
+
+## For each issue the user raises
+
+### 1. Listen and lightly clarify
+
+Let the user describe the problem in their own words. Ask **at most 2-3 short clarifying questions** focused on:
+
+- What they expected vs what actually happened
+- Steps to reproduce (if not obvious)
+- Whether it's consistent or intermittent
+
+Do NOT over-interview. If the description is clear enough to file, move on.
+
+### 2. Explore the codebase in the background
+
+While talking to the user, kick off an Agent (subagent_type=Explore) in the background to understand the relevant area. The goal is NOT to find a fix — it's to:
+
+- Learn the domain language used in that area (check UBIQUITOUS_LANGUAGE.md)
+- Understand what the feature is supposed to do
+- Identify the user-facing behavior boundary
+
+This context helps you write a better issue — but the issue itself should NOT reference specific files, line numbers, or internal implementation details.
+
+### 3. Assess scope: single issue or breakdown?
+
+Before filing, decide whether this is a **single issue** or needs to be **broken down** into multiple issues.
+
+Break down when:
+
+- The fix spans multiple independent areas (e.g. "the form validation is wrong AND the success message is missing AND the redirect is broken")
+- There are clearly separable concerns that different people could work on in parallel
+- The user describes something that has multiple distinct failure modes or symptoms
+
+Keep as a single issue when:
+
+- It's one behavior that's wrong in one place
+- The symptoms are all caused by the same root behavior
+
+### 4. File the GitHub issue(s)
+
+Create issues with `gh issue create`. Do NOT ask the user to review first — just file and share URLs.
+
+Issues must be **durable** — they should still make sense after major refactors. Write from the user's perspective.
+
+#### For a single issue
+
+Use this template:
+
+```
+## What happened
+
+[Describe the actual behavior the user experienced, in plain language]
+
+## What I expected
+
+[Describe the expected behavior]
+
+## Steps to reproduce
+
+1. [Concrete, numbered steps a developer can follow]
+2. [Use domain terms from the codebase, not internal module names]
+3. [Include relevant inputs, flags, or configuration]
+
+## Additional context
+
+[Any extra observations from the user or from codebase exploration that help frame the issue — e.g. "this only happens when using the Docker layer, not the filesystem layer" — use domain language but don't cite files]
+```
+
+#### For a breakdown (multiple issues)
+
+Create issues in dependency order (blockers first) so you can reference real issue numbers.
+
+Use this template for each sub-issue:
+
+```
+## Parent issue
+
+#<parent-issue-number> (if you created a tracking issue) or "Reported during QA session"
+
+## What's wrong
+
+[Describe this specific behavior problem — just this slice, not the whole report]
+
+## What I expected
+
+[Expected behavior for this specific slice]
+
+## Steps to reproduce
+
+1. [Steps specific to THIS issue]
+
+## Blocked by
+
+- #<issue-number> (if this issue can't be fixed until another is resolved)
+
+Or "None — can start immediately" if no blockers.
+
+## Additional context
+
+[Any extra observations relevant to this slice]
+```
+
+When creating a breakdown:
+
+- **Prefer many thin issues over few thick ones** — each should be independently fixable and verifiable
+- **Mark blocking relationships honestly** — if issue B genuinely can't be tested until issue A is fixed, say so. If they're independent, mark both as "None — can start immediately"
+- **Create issues in dependency order** so you can reference real issue numbers in "Blocked by"
+- **Maximize parallelism** — the goal is that multiple people (or agents) can grab different issues simultaneously
+
+#### Rules for all issue bodies
+
+- **No file paths or line numbers** — these go stale
+- **Use the project's domain language** (check UBIQUITOUS_LANGUAGE.md if it exists)
+- **Describe behaviors, not code** — "the sync service fails to apply the patch" not "applyPatch() throws on line 42"
+- **Reproduction steps are mandatory** — if you can't determine them, ask the user
+- **Keep it concise** — a developer should be able to read the issue in 30 seconds
+
+After filing, print all issue URLs (with blocking relationships summarized) and ask: "Next issue, or are we done?"
+
+### 5. Continue the session
+
+Keep going until the user says they're done. Each issue is independent — don't batch them.
diff --git a/.agents/skills/request-refactor-plan/SKILL.md b/.agents/skills/request-refactor-plan/SKILL.md
new file mode 100644
index 00000000..7e8b2e41
--- /dev/null
+++ b/.agents/skills/request-refactor-plan/SKILL.md
@@ -0,0 +1,68 @@
+---
+name: request-refactor-plan
+description: Create a detailed refactor plan with tiny commits via user interview, then file it as a GitHub issue. Use when user wants to plan a refactor, create a refactoring RFC, or break a refactor into safe incremental steps.
+---
+
+This skill will be invoked when the user wants to create a refactor request. You should go through the steps below. You may skip steps if you don't consider them necessary.
+
+1. Ask the user for a long, detailed description of the problem they want to solve and any potential ideas for solutions.
+
+2. Explore the repo to verify their assertions and understand the current state of the codebase.
+
+3. Ask whether they have considered other options, and present other options to them.
+
+4. Interview the user about the implementation. Be extremely detailed and thorough.
+
+5. Hammer out the exact scope of the implementation. Work out what you plan to change and what you plan not to change.
+
+6. Look in the codebase to check for test coverage of this area of the codebase. If there is insufficient test coverage, ask the user what their plans for testing are.
+
+7. Break the implementation into a plan of tiny commits. Remember Martin Fowler's advice to "make each refactoring step as small as possible, so that you can always see the program working."
+
+8. Create a GitHub issue with the refactor plan. Use the following template for the issue description:
+
+<refactor-plan-template>
+
+## Problem Statement
+
+The problem that the developer is facing, from the developer's perspective.
+
+## Solution
+
+The solution to the problem, from the developer's perspective.
+
+## Commits
+
+A LONG, detailed implementation plan. Write the plan in plain English, breaking down the implementation into the tiniest commits possible. Each commit should leave the codebase in a working state.
+
+## Decision Document
+
+A list of implementation decisions that were made. This can include:
+
+- The modules that will be built/modified
+- The interfaces of those modules that will be modified
+- Technical clarifications from the developer
+- Architectural decisions
+- Schema changes
+- API contracts
+- Specific interactions
+
+Do NOT include specific file paths or code snippets. They may end up being outdated very quickly.
+
+## Testing Decisions
+
+A list of testing decisions that were made. Include:
+
+- A description of what makes a good test (only test external behavior, not implementation details)
+- Which modules will be tested
+- Prior art for the tests (i.e. similar types of tests in the codebase)
+
+## Out of Scope
+
+A description of the things that are out of scope for this refactor.
+
+## Further Notes (optional)
+
+Any further notes about the refactor.
+
+</refactor-plan-template>
diff --git a/.agents/skills/review/SKILL.md b/.agents/skills/review/SKILL.md
new file mode 100644
index 00000000..7507a362
--- /dev/null
+++ b/.agents/skills/review/SKILL.md
@@ -0,0 +1,78 @@
+---
+name: review
+description: Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/PRD asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to "review since X".
+---
+
+# Review
+
+Two-axis review of the diff between `HEAD` and a fixed point the user supplies:
+
+- **Standards** — does the code conform to this repo's documented coding standards?
+- **Spec** — does the code faithfully implement the originating issue / PRD / spec?
+
+Both axes run as **parallel sub-agents** so they don't pollute each other's context, then this skill aggregates their findings.
+
+The issue tracker should have been provided to you — run `/setup-matt-pocock-skills` if `docs/agents/issue-tracker.md` is missing.
+
+## Process
+
+### 1. Pin the fixed point
+
+Whatever the user said is the fixed point — a commit SHA, branch name, tag, `main`, `HEAD~5`, etc. Don't be opinionated; pass it through. If they didn't specify one, ask: "Review against what — a branch, a commit, or `main`?" Don't proceed until you have it.
+
+Capture the diff command once: `git diff <fixed-point>...HEAD` (three-dot, so the comparison is against the merge-base). Also note the list of commits via `git log <fixed-point>..HEAD --oneline`.
+
+### 2. Identify the spec source
+
+Look for the originating spec, in this order:
+
+1. Issue references in the commit messages (`#123`, `Closes #45`, GitLab `!67`, etc.) — fetch via the workflow in `docs/agents/issue-tracker.md`.
+2. A path the user passed as an argument.
+3. A PRD/spec file under `docs/`, `specs/`, or `.scratch/` matching the branch name or feature.
+4. If nothing is found, ask the user where the spec is. If they say there isn't one, the **Spec** sub-agent will skip and report "no spec available".
+
+### 3. Identify the standards sources
+
+Anything in the repo that documents how code should be written. Common locations:
+
+- `CLAUDE.md`, `AGENTS.md`
+- `CONTRIBUTING.md`
+- `CONTEXT.md`, `CONTEXT-MAP.md`, per-context `CONTEXT.md` files
+- `docs/adr/` (architectural decisions are standards)
+- `.editorconfig`, `eslint.config.*`, `biome.json`, `prettier.config.*`, `tsconfig.json` (machine-enforced standards — note them but don't re-check what tooling already checks)
+- Any `STYLE.md`, `STANDARDS.md`, `STYLEGUIDE.md`, or similar at the repo root or under `docs/`
+
+Collect the list of files. The **Standards** sub-agent will read them.
+
+### 4. Spawn both sub-agents in parallel
+
+Send a single message with two `Agent` tool calls. Use the `general-purpose` subagent for both.
+
+**Standards sub-agent prompt** — include:
+
+- The full diff command and commit list.
+- The list of standards-source files you found in step 3.
+- The brief: "Read the standards docs. Then read the diff. Report — per file/hunk where relevant — every place the diff violates a documented standard. Cite the standard (file + the rule). Distinguish hard violations from judgement calls. Skip anything tooling enforces. Under 400 words."
+
+**Spec sub-agent prompt** — include:
+
+- The diff command and commit list.
+- The path or fetched contents of the spec.
+- The brief: "Read the spec. Then read the diff. Report: (a) requirements the spec asked for that are missing or partial; (b) behaviour in the diff that wasn't asked for (scope creep); (c) requirements that look implemented but where the implementation looks wrong. Quote the spec line for each finding. Under 400 words."
+
+If the spec is missing, skip the Spec sub-agent and note this in the final report.
+
+### 5. Aggregate
+
+Present the two reports under `## Standards` and `## Spec` headings, verbatim or lightly cleaned. Do **not** merge or rerank findings — the two axes are deliberately separate so the user can see them independently.
+
+End with a one-line summary: total findings per axis, and the worst single issue (if any) flagged.
+
+## Why two axes
+
+A change can pass one axis and fail the other:
+
+- Code that follows every standard but implements the wrong thing → **Standards pass, Spec fail.**
+- Code that does exactly what the issue asked but breaks the project's conventions → **Spec pass, Standards fail.**
+
+Reporting them separately stops one axis from masking the other.
diff --git a/.agents/skills/setup-matt-pocock-skills/SKILL.md b/.agents/skills/setup-matt-pocock-skills/SKILL.md
new file mode 100644
index 00000000..1ebc6e14
--- /dev/null
+++ b/.agents/skills/setup-matt-pocock-skills/SKILL.md
@@ -0,0 +1,121 @@
+---
+name: setup-matt-pocock-skills
+description: Sets up an `## Agent skills` block in AGENTS.md/CLAUDE.md and `docs/agents/` so the engineering skills know this repo's issue tracker (GitHub or local markdown), triage label vocabulary, and domain doc layout. Run before first use of `to-issues`, `to-prd`, `triage`, `diagnose`, `tdd`, `improve-codebase-architecture`, or `zoom-out` — or if those skills appear to be missing context about the issue tracker, triage labels, or domain docs.
+disable-model-invocation: true
+---
+
+# Setup Matt Pocock's Skills
+
+Scaffold the per-repo configuration that the engineering skills assume:
+
+- **Issue tracker** — where issues live (GitHub by default; local markdown is also supported out of the box)
+- **Triage labels** — the strings used for the five canonical triage roles
+- **Domain docs** — where `CONTEXT.md` and ADRs live, and the consumer rules for reading them
+
+This is a prompt-driven skill, not a deterministic script. Explore, present what you found, confirm with the user, then write.
+
+## Process
+
+### 1. Explore
+
+Look at the current repo to understand its starting state. Read whatever exists; don't assume:
+
+- `git remote -v` and `.git/config` — is this a GitHub repo? Which one?
+- `AGENTS.md` and `CLAUDE.md` at the repo root — does either exist? Is there already an `## Agent skills` section in either?
+- `CONTEXT.md` and `CONTEXT-MAP.md` at the repo root
+- `docs/adr/` and any `src/*/docs/adr/` directories
+- `docs/agents/` — does this skill's prior output already exist?
+- `.scratch/` — sign that a local-markdown issue tracker convention is already in use
+
+### 2. Present findings and ask
+
+Summarise what's present and what's missing. Then walk the user through the three decisions **one at a time** — present a section, get the user's answer, then move to the next. Don't dump all three at once.
+
+Assume the user does not know what these terms mean. Each section starts with a short explainer (what it is, why these skills need it, what changes if they pick differently). Then show the choices and the default.
+
+**Section A — Issue tracker.**
+
+> Explainer: The "issue tracker" is where issues live for this repo. Skills like `to-issues`, `triage`, `to-prd`, and `qa` read from and write to it — they need to know whether to call `gh issue create`, write a markdown file under `.scratch/`, or follow some other workflow you describe. Pick the place you actually track work for this repo.
+
+Default posture: these skills were designed for GitHub. If a `git remote` points at GitHub, propose that. If a `git remote` points at GitLab (`gitlab.com` or a self-hosted host), propose GitLab. Otherwise (or if the user prefers), offer:
+
+- **GitHub** — issues live in the repo's GitHub Issues (uses the `gh` CLI)
+- **GitLab** — issues live in the repo's GitLab Issues (uses the [`glab`](https://gitlab.com/gitlab-org/cli) CLI)
+- **Local markdown** — issues live as files under `.scratch/<feature>/` in this repo (good for solo projects or repos without a remote)
+- **Other** (Jira, Linear, etc.) — ask the user to describe the workflow in one paragraph; the skill will record it as freeform prose
+
+**Section B — Triage label vocabulary.**
+
+> Explainer: When the `triage` skill processes an incoming issue, it moves it through a state machine — needs evaluation, waiting on reporter, ready for an AFK agent to pick up, ready for a human, or won't fix. To do that, it needs to apply labels (or the equivalent in your issue tracker) that match strings *you've actually configured*. If your repo already uses different label names (e.g. `bug:triage` instead of `needs-triage`), map them here so the skill applies the right ones instead of creating duplicates.
+
+The five canonical roles:
+
+- `needs-triage` — maintainer needs to evaluate
+- `needs-info` — waiting on reporter
+- `ready-for-agent` — fully specified, AFK-ready (an agent can pick it up with no human context)
+- `ready-for-human` — needs human implementation
+- `wontfix` — will not be actioned
+
+Default: each role's string equals its name. Ask the user if they want to override any. If their issue tracker has no existing labels, the defaults are fine.
+
+**Section C — Domain docs.**
+
+> Explainer: Some skills (`improve-codebase-architecture`, `diagnose`, `tdd`) read a `CONTEXT.md` file to learn the project's domain language, and `docs/adr/` for past architectural decisions. They need to know whether the repo has one global context or multiple (e.g. a monorepo with separate frontend/backend contexts) so they look in the right place.
+
+Confirm the layout:
+
+- **Single-context** — one `CONTEXT.md` + `docs/adr/` at the repo root. Most repos are this.
+- **Multi-context** — `CONTEXT-MAP.md` at the root pointing to per-context `CONTEXT.md` files (typically a monorepo).
+
+### 3. Confirm and edit
+
+Show the user a draft of:
+
+- The `## Agent skills` block to add to whichever of `CLAUDE.md` / `AGENTS.md` is being edited (see step 4 for selection rules)
+- The contents of `docs/agents/issue-tracker.md`, `docs/agents/triage-labels.md`, `docs/agents/domain.md`
+
+Let them edit before writing.
+
+### 4. Write
+
+**Pick the file to edit:**
+
+- If `CLAUDE.md` exists, edit it.
+- Else if `AGENTS.md` exists, edit it.
+- If neither exists, ask the user which one to create — don't pick for them.
+
+Never create `AGENTS.md` when `CLAUDE.md` already exists (or vice versa) — always edit the one that's already there.
+
+If an `## Agent skills` block already exists in the chosen file, update its contents in-place rather than appending a duplicate. Don't overwrite user edits to the surrounding sections.
+
+The block:
+
+```markdown
+## Agent skills
+
+### Issue tracker
+
+[one-line summary of where issues are tracked]. See `docs/agents/issue-tracker.md`.
+
+### Triage labels
+
+[one-line summary of the label vocabulary]. See `docs/agents/triage-labels.md`.
+
+### Domain docs
+
+[one-line summary of layout — "single-context" or "multi-context"]. See `docs/agents/domain.md`.
+```
+
+Then write the three docs files using the seed templates in this skill folder as a starting point:
+
+- [issue-tracker-github.md](./issue-tracker-github.md) — GitHub issue tracker
+- [issue-tracker-gitlab.md](./issue-tracker-gitlab.md) — GitLab issue tracker
+- [issue-tracker-local.md](./issue-tracker-local.md) — local-markdown issue tracker
+- [triage-labels.md](./triage-labels.md) — label mapping
+- [domain.md](./domain.md) — domain doc consumer rules + layout
+
+For "other" issue trackers, write `docs/agents/issue-tracker.md` from scratch using the user's description.
+
+### 5. Done
+
+Tell the user the setup is complete and which engineering skills will now read from these files. Mention they can edit `docs/agents/*.md` directly later — re-running this skill is only necessary if they want to switch issue trackers or restart from scratch.
diff --git a/.agents/skills/setup-matt-pocock-skills/domain.md b/.agents/skills/setup-matt-pocock-skills/domain.md
new file mode 100644
index 00000000..c97d6a6d
--- /dev/null
+++ b/.agents/skills/setup-matt-pocock-skills/domain.md
@@ -0,0 +1,51 @@
+# Domain Docs
+
+How the engineering skills should consume this repo's domain documentation when exploring the codebase.
+
+## Before exploring, read these
+
+- **`CONTEXT.md`** at the repo root, or
+- **`CONTEXT-MAP.md`** at the repo root if it exists — it points at one `CONTEXT.md` per context. Read each one relevant to the topic.
+- **`docs/adr/`** — read ADRs that touch the area you're about to work in. In multi-context repos, also check `src/<context>/docs/adr/` for context-scoped decisions.
+
+If any of these files don't exist, **proceed silently**. Don't flag their absence; don't suggest creating them upfront. The producer skill (`/grill-with-docs`) creates them lazily when terms or decisions actually get resolved.
+
+## File structure
+
+Single-context repo (most repos):
+
+```
+/
+├── CONTEXT.md
+├── docs/adr/
+│   ├── 0001-event-sourced-orders.md
+│   └── 0002-postgres-for-write-model.md
+└── src/
+```
+
+Multi-context repo (presence of `CONTEXT-MAP.md` at the root):
+
+```
+/
+├── CONTEXT-MAP.md
+├── docs/adr/                          ← system-wide decisions
+└── src/
+    ├── ordering/
+    │   ├── CONTEXT.md
+    │   └── docs/adr/                  ← context-specific decisions
+    └── billing/
+        ├── CONTEXT.md
+        └── docs/adr/
+```
+
+## Use the glossary's vocabulary
+
+When your output names a domain concept (in an issue title, a refactor proposal, a hypothesis, a test name), use the term as defined in `CONTEXT.md`. Don't drift to synonyms the glossary explicitly avoids.
+
+If the concept you need isn't in the glossary yet, that's a signal — either you're inventing language the project doesn't use (reconsider) or there's a real gap (note it for `/grill-with-docs`).
+
+## Flag ADR conflicts
+
+If your output contradicts an existing ADR, surface it explicitly rather than silently overriding:
+
+> _Contradicts ADR-0007 (event-sourced orders) — but worth reopening because…_
diff --git a/.agents/skills/setup-matt-pocock-skills/issue-tracker-github.md b/.agents/skills/setup-matt-pocock-skills/issue-tracker-github.md
new file mode 100644
index 00000000..cce77ecb
--- /dev/null
+++ b/.agents/skills/setup-matt-pocock-skills/issue-tracker-github.md
@@ -0,0 +1,22 @@
+# Issue tracker: GitHub
+
+Issues and PRDs for this repo live as GitHub issues. Use the `gh` CLI for all operations.
+
+## Conventions
+
+- **Create an issue**: `gh issue create --title "..." --body "..."`. Use a heredoc for multi-line bodies.
+- **Read an issue**: `gh issue view <number> --comments`, filtering comments by `jq` and also fetching labels.
+- **List issues**: `gh issue list --state open --json number,title,body,labels,comments --jq '[.[] | {number, title, body, labels: [.labels[].name], comments: [.comments[].body]}]'` with appropriate `--label` and `--state` filters.
+- **Comment on an issue**: `gh issue comment <number> --body "..."`
+- **Apply / remove labels**: `gh issue edit <number> --add-label "..."` / `--remove-label "..."`
+- **Close**: `gh issue close <number> --comment "..."`
+
+Infer the repo from `git remote -v` — `gh` does this automatically when run inside a clone.
+
+## When a skill says "publish to the issue tracker"
+
+Create a GitHub issue.
+
+## When a skill says "fetch the relevant ticket"
+
+Run `gh issue view <number> --comments`.
diff --git a/.agents/skills/setup-matt-pocock-skills/issue-tracker-gitlab.md b/.agents/skills/setup-matt-pocock-skills/issue-tracker-gitlab.md
new file mode 100644
index 00000000..f54da955
--- /dev/null
+++ b/.agents/skills/setup-matt-pocock-skills/issue-tracker-gitlab.md
@@ -0,0 +1,23 @@
+# Issue tracker: GitLab
+
+Issues and PRDs for this repo live as GitLab issues. Use the [`glab`](https://gitlab.com/gitlab-org/cli) CLI for all operations.
+
+## Conventions
+
+- **Create an issue**: `glab issue create --title "..." --description "..."`. Use a heredoc for multi-line descriptions. Pass `--description -` to open an editor.
+- **Read an issue**: `glab issue view <number> --comments`. Use `-F json` for machine-readable output.
+- **List issues**: `glab issue list -F json` with appropriate `--label` filters.
+- **Comment on an issue**: `glab issue note <number> --message "..."`. GitLab calls comments "notes".
+- **Apply / remove labels**: `glab issue update <number> --label "..."` / `--unlabel "..."`. Multiple labels can be comma-separated or by repeating the flag.
+- **Close**: `glab issue close <number>`. `glab issue close` does not accept a closing comment, so post the explanation first with `glab issue note <number> --message "..."`, then close.
+- **Merge requests**: GitLab calls PRs "merge requests". Use `glab mr create`, `glab mr view`, `glab mr note`, etc. — the same shape as `gh pr ...` with `mr` in place of `pr` and `note`/`--message` in place of `comment`/`--body`.
+
+Infer the repo from `git remote -v` — `glab` does this automatically when run inside a clone.
+
+## When a skill says "publish to the issue tracker"
+
+Create a GitLab issue.
+
+## When a skill says "fetch the relevant ticket"
+
+Run `glab issue view <number> --comments`.
diff --git a/.agents/skills/setup-matt-pocock-skills/issue-tracker-local.md b/.agents/skills/setup-matt-pocock-skills/issue-tracker-local.md
new file mode 100644
index 00000000..a2f08fb0
--- /dev/null
+++ b/.agents/skills/setup-matt-pocock-skills/issue-tracker-local.md
@@ -0,0 +1,19 @@
+# Issue tracker: Local Markdown
+
+Issues and PRDs for this repo live as markdown files in `.scratch/`.
+
+## Conventions
+
+- One feature per directory: `.scratch/<feature-slug>/`
+- The PRD is `.scratch/<feature-slug>/PRD.md`
+- Implementation issues are `.scratch/<feature-slug>/issues/<NN>-<slug>.md`, numbered from `01`
+- Triage state is recorded as a `Status:` line near the top of each issue file (see `triage-labels.md` for the role strings)
+- Comments and conversation history append to the bottom of the file under a `## Comments` heading
+
+## When a skill says "publish to the issue tracker"
+
+Create a new file under `.scratch/<feature-slug>/` (creating the directory if needed).
+
+## When a skill says "fetch the relevant ticket"
+
+Read the file at the referenced path. The user will normally pass the path or the issue number directly.
diff --git a/.agents/skills/setup-matt-pocock-skills/triage-labels.md b/.agents/skills/setup-matt-pocock-skills/triage-labels.md
new file mode 100644
index 00000000..b716855d
--- /dev/null
+++ b/.agents/skills/setup-matt-pocock-skills/triage-labels.md
@@ -0,0 +1,15 @@
+# Triage Labels
+
+The skills speak in terms of five canonical triage roles. This file maps those roles to the actual label strings used in this repo's issue tracker.
+
+| Label in mattpocock/skills | Label in our tracker | Meaning                                  |
+| -------------------------- | -------------------- | ---------------------------------------- |
+| `needs-triage`             | `needs-triage`       | Maintainer needs to evaluate this issue  |
+| `needs-info`               | `needs-info`         | Waiting on reporter for more information |
+| `ready-for-agent`          | `ready-for-agent`    | Fully specified, ready for an AFK agent  |
+| `ready-for-human`          | `ready-for-human`    | Requires human implementation            |
+| `wontfix`                  | `wontfix`            | Will not be actioned                     |
+
+When a skill mentions a role (e.g. "apply the AFK-ready triage label"), use the corresponding label string from this table.
+
+Edit the right-hand column to match whatever vocabulary you actually use.
diff --git a/.agents/skills/tdd/SKILL.md b/.agents/skills/tdd/SKILL.md
new file mode 100644
index 00000000..7a989411
--- /dev/null
+++ b/.agents/skills/tdd/SKILL.md
@@ -0,0 +1,109 @@
+---
+name: tdd
+description: Test-driven development with red-green-refactor loop. Use when user wants to build features or fix bugs using TDD, mentions "red-green-refactor", wants integration tests, or asks for test-first development.
+---
+
+# Test-Driven Development
+
+## Philosophy
+
+**Core principle**: Tests should verify behavior through public interfaces, not implementation details. Code can change entirely; tests shouldn't.
+
+**Good tests** are integration-style: they exercise real code paths through public APIs. They describe _what_ the system does, not _how_ it does it. A good test reads like a specification - "user can checkout with valid cart" tells you exactly what capability exists. These tests survive refactors because they don't care about internal structure.
+
+**Bad tests** are coupled to implementation. They mock internal collaborators, test private methods, or verify through external means (like querying a database directly instead of using the interface). The warning sign: your test breaks when you refactor, but behavior hasn't changed. If you rename an internal function and tests fail, those tests were testing implementation, not behavior.
+
+See [tests.md](tests.md) for examples and [mocking.md](mocking.md) for mocking guidelines.
+
+## Anti-Pattern: Horizontal Slices
+
+**DO NOT write all tests first, then all implementation.** This is "horizontal slicing" - treating RED as "write all tests" and GREEN as "write all code."
+
+This produces **crap tests**:
+
+- Tests written in bulk test _imagined_ behavior, not _actual_ behavior
+- You end up testing the _shape_ of things (data structures, function signatures) rather than user-facing behavior
+- Tests become insensitive to real changes - they pass when behavior breaks, fail when behavior is fine
+- You outrun your headlights, committing to test structure before understanding the implementation
+
+**Correct approach**: Vertical slices via tracer bullets. One test → one implementation → repeat. Each test responds to what you learned from the previous cycle. Because you just wrote the code, you know exactly what behavior matters and how to verify it.
+
+```
+WRONG (horizontal):
+  RED:   test1, test2, test3, test4, test5
+  GREEN: impl1, impl2, impl3, impl4, impl5
+
+RIGHT (vertical):
+  RED→GREEN: test1→impl1
+  RED→GREEN: test2→impl2
+  RED→GREEN: test3→impl3
+  ...
+```
+
+## Workflow
+
+### 1. Planning
+
+When exploring the codebase, use the project's domain glossary so that test names and interface vocabulary match the project's language, and respect ADRs in the area you're touching.
+
+Before writing any code:
+
+- [ ] Confirm with user what interface changes are needed
+- [ ] Confirm with user which behaviors to test (prioritize)
+- [ ] Identify opportunities for [deep modules](deep-modules.md) (small interface, deep implementation)
+- [ ] Design interfaces for [testability](interface-design.md)
+- [ ] List the behaviors to test (not implementation steps)
+- [ ] Get user approval on the plan
+
+Ask: "What should the public interface look like? Which behaviors are most important to test?"
+
+**You can't test everything.** Confirm with the user exactly which behaviors matter most. Focus testing effort on critical paths and complex logic, not every possible edge case.
+
+### 2. Tracer Bullet
+
+Write ONE test that confirms ONE thing about the system:
+
+```
+RED:   Write test for first behavior → test fails
+GREEN: Write minimal code to pass → test passes
+```
+
+This is your tracer bullet - proves the path works end-to-end.
+
+### 3. Incremental Loop
+
+For each remaining behavior:
+
+```
+RED:   Write next test → fails
+GREEN: Minimal code to pass → passes
+```
+
+Rules:
+
+- One test at a time
+- Only enough code to pass current test
+- Don't anticipate future tests
+- Keep tests focused on observable behavior
+
+### 4. Refactor
+
+After all tests pass, look for [refactor candidates](refactoring.md):
+
+- [ ] Extract duplication
+- [ ] Deepen modules (move complexity behind simple interfaces)
+- [ ] Apply SOLID principles where natural
+- [ ] Consider what new code reveals about existing code
+- [ ] Run tests after each refactor step
+
+**Never refactor while RED.** Get to GREEN first.
+
+## Checklist Per Cycle
+
+```
+[ ] Test describes behavior, not implementation
+[ ] Test uses public interface only
+[ ] Test would survive internal refactor
+[ ] Code is minimal for this test
+[ ] No speculative features added
+```
diff --git a/.agents/skills/tdd/deep-modules.md b/.agents/skills/tdd/deep-modules.md
new file mode 100644
index 00000000..0d9720cf
--- /dev/null
+++ b/.agents/skills/tdd/deep-modules.md
@@ -0,0 +1,33 @@
+# Deep Modules
+
+From "A Philosophy of Software Design":
+
+**Deep module** = small interface + lots of implementation
+
+```
+┌─────────────────────┐
+│   Small Interface   │  ← Few methods, simple params
+├─────────────────────┤
+│                     │
+│                     │
+│  Deep Implementation│  ← Complex logic hidden
+│                     │
+│                     │
+└─────────────────────┘
+```
+
+**Shallow module** = large interface + little implementation (avoid)
+
+```
+┌─────────────────────────────────┐
+│       Large Interface           │  ← Many methods, complex params
+├─────────────────────────────────┤
+│  Thin Implementation            │  ← Just passes through
+└─────────────────────────────────┘
+```
+
+When designing interfaces, ask:
+
+- Can I reduce the number of methods?
+- Can I simplify the parameters?
+- Can I hide more complexity inside?
diff --git a/.agents/skills/tdd/interface-design.md b/.agents/skills/tdd/interface-design.md
new file mode 100644
index 00000000..a0a20ca4
--- /dev/null
+++ b/.agents/skills/tdd/interface-design.md
@@ -0,0 +1,31 @@
+# Interface Design for Testability
+
+Good interfaces make testing natural:
+
+1. **Accept dependencies, don't create them**
+
+   ```typescript
+   // Testable
+   function processOrder(order, paymentGateway) {}
+
+   // Hard to test
+   function processOrder(order) {
+     const gateway = new StripeGateway();
+   }
+   ```
+
+2. **Return results, don't produce side effects**
+
+   ```typescript
+   // Testable
+   function calculateDiscount(cart): Discount {}
+
+   // Hard to test
+   function applyDiscount(cart): void {
+     cart.total -= discount;
+   }
+   ```
+
+3. **Small surface area**
+   - Fewer methods = fewer tests needed
+   - Fewer params = simpler test setup
diff --git a/.agents/skills/tdd/mocking.md b/.agents/skills/tdd/mocking.md
new file mode 100644
index 00000000..71cbfee6
--- /dev/null
+++ b/.agents/skills/tdd/mocking.md
@@ -0,0 +1,59 @@
+# When to Mock
+
+Mock at **system boundaries** only:
+
+- External APIs (payment, email, etc.)
+- Databases (sometimes - prefer test DB)
+- Time/randomness
+- File system (sometimes)
+
+Don't mock:
+
+- Your own classes/modules
+- Internal collaborators
+- Anything you control
+
+## Designing for Mockability
+
+At system boundaries, design interfaces that are easy to mock:
+
+**1. Use dependency injection**
+
+Pass external dependencies in rather than creating them internally:
+
+```typescript
+// Easy to mock
+function processPayment(order, paymentClient) {
+  return paymentClient.charge(order.total);
+}
+
+// Hard to mock
+function processPayment(order) {
+  const client = new StripeClient(process.env.STRIPE_KEY);
+  return client.charge(order.total);
+}
+```
+
+**2. Prefer SDK-style interfaces over generic fetchers**
+
+Create specific functions for each external operation instead of one generic function with conditional logic:
+
+```typescript
+// GOOD: Each function is independently mockable
+const api = {
+  getUser: (id) => fetch(`/users/${id}`),
+  getOrders: (userId) => fetch(`/users/${userId}/orders`),
+  createOrder: (data) => fetch('/orders', { method: 'POST', body: data }),
+};
+
+// BAD: Mocking requires conditional logic inside the mock
+const api = {
+  fetch: (endpoint, options) => fetch(endpoint, options),
+};
+```
+
+The SDK approach means:
+- Each mock returns one specific shape
+- No conditional logic in test setup
+- Easier to see which endpoints a test exercises
+- Type safety per endpoint
diff --git a/.agents/skills/tdd/refactoring.md b/.agents/skills/tdd/refactoring.md
new file mode 100644
index 00000000..8a444392
--- /dev/null
+++ b/.agents/skills/tdd/refactoring.md
@@ -0,0 +1,10 @@
+# Refactor Candidates
+
+After TDD cycle, look for:
+
+- **Duplication** → Extract function/class
+- **Long methods** → Break into private helpers (keep tests on public interface)
+- **Shallow modules** → Combine or deepen
+- **Feature envy** → Move logic to where data lives
+- **Primitive obsession** → Introduce value objects
+- **Existing code** the new code reveals as problematic
diff --git a/.agents/skills/tdd/tests.md b/.agents/skills/tdd/tests.md
new file mode 100644
index 00000000..ff22f809
--- /dev/null
+++ b/.agents/skills/tdd/tests.md
@@ -0,0 +1,61 @@
+# Good and Bad Tests
+
+## Good Tests
+
+**Integration-style**: Test through real interfaces, not mocks of internal parts.
+
+```typescript
+// GOOD: Tests observable behavior
+test("user can checkout with valid cart", async () => {
+  const cart = createCart();
+  cart.add(product);
+  const result = await checkout(cart, paymentMethod);
+  expect(result.status).toBe("confirmed");
+});
+```
+
+Characteristics:
+
+- Tests behavior users/callers care about
+- Uses public API only
+- Survives internal refactors
+- Describes WHAT, not HOW
+- One logical assertion per test
+
+## Bad Tests
+
+**Implementation-detail tests**: Coupled to internal structure.
+
+```typescript
+// BAD: Tests implementation details
+test("checkout calls paymentService.process", async () => {
+  const mockPayment = jest.mock(paymentService);
+  await checkout(cart, payment);
+  expect(mockPayment.process).toHaveBeenCalledWith(cart.total);
+});
+```
+
+Red flags:
+
+- Mocking internal collaborators
+- Testing private methods
+- Asserting on call counts/order
+- Test breaks when refactoring without behavior change
+- Test name describes HOW not WHAT
+- Verifying through external means instead of interface
+
+```typescript
+// BAD: Bypasses interface to verify
+test("createUser saves to database", async () => {
+  await createUser({ name: "Alice" });
+  const row = await db.query("SELECT * FROM users WHERE name = ?", ["Alice"]);
+  expect(row).toBeDefined();
+});
+
+// GOOD: Verifies through interface
+test("createUser makes user retrievable", async () => {
+  const user = await createUser({ name: "Alice" });
+  const retrieved = await getUser(user.id);
+  expect(retrieved.name).toBe("Alice");
+});
+```
diff --git a/.agents/skills/ubiquitous-language/SKILL.md b/.agents/skills/ubiquitous-language/SKILL.md
new file mode 100644
index 00000000..35b649dd
--- /dev/null
+++ b/.agents/skills/ubiquitous-language/SKILL.md
@@ -0,0 +1,93 @@
+---
+name: ubiquitous-language
+description: Extract a DDD-style ubiquitous language glossary from the current conversation, flagging ambiguities and proposing canonical terms. Saves to UBIQUITOUS_LANGUAGE.md. Use when user wants to define domain terms, build a glossary, harden terminology, create a ubiquitous language, or mentions "domain model" or "DDD".
+disable-model-invocation: true
+---
+
+# Ubiquitous Language
+
+Extract and formalize domain terminology from the current conversation into a consistent glossary, saved to a local file.
+
+## Process
+
+1. **Scan the conversation** for domain-relevant nouns, verbs, and concepts
+2. **Identify problems**:
+   - Same word used for different concepts (ambiguity)
+   - Different words used for the same concept (synonyms)
+   - Vague or overloaded terms
+3. **Propose a canonical glossary** with opinionated term choices
+4. **Write to `UBIQUITOUS_LANGUAGE.md`** in the working directory using the format below
+5. **Output a summary** inline in the conversation
+
+## Output Format
+
+Write a `UBIQUITOUS_LANGUAGE.md` file with this structure:
+
+```md
+# Ubiquitous Language
+
+## Order lifecycle
+
+| Term        | Definition                                              | Aliases to avoid      |
+| ----------- | ------------------------------------------------------- | --------------------- |
+| **Order**   | A customer's request to purchase one or more items      | Purchase, transaction |
+| **Invoice** | A request for payment sent to a customer after delivery | Bill, payment request |
+
+## People
+
+| Term         | Definition                                  | Aliases to avoid       |
+| ------------ | ------------------------------------------- | ---------------------- |
+| **Customer** | A person or organization that places orders | Client, buyer, account |
+| **User**     | An authentication identity in the system    | Login, account         |
+
+## Relationships
+
+- An **Invoice** belongs to exactly one **Customer**
+- An **Order** produces one or more **Invoices**
+
+## Example dialogue
+
+> **Dev:** "When a **Customer** places an **Order**, do we create the **Invoice** immediately?"
+> **Domain expert:** "No — an **Invoice** is only generated once a **Fulfillment** is confirmed. A single **Order** can produce multiple **Invoices** if items ship in separate **Shipments**."
+> **Dev:** "So if a **Shipment** is cancelled before dispatch, no **Invoice** exists for it?"
+> **Domain expert:** "Exactly. The **Invoice** lifecycle is tied to the **Fulfillment**, not the **Order**."
+
+## Flagged ambiguities
+
+- "account" was used to mean both **Customer** and **User** — these are distinct concepts: a **Customer** places orders, while a **User** is an authentication identity that may or may not represent a **Customer**.
+```
+
+## Rules
+
+- **Be opinionated.** When multiple words exist for the same concept, pick the best one and list the others as aliases to avoid.
+- **Flag conflicts explicitly.** If a term is used ambiguously in the conversation, call it out in the "Flagged ambiguities" section with a clear recommendation.
+- **Only include terms relevant for domain experts.** Skip the names of modules or classes unless they have meaning in the domain language.
+- **Keep definitions tight.** One sentence max. Define what it IS, not what it does.
+- **Show relationships.** Use bold term names and express cardinality where obvious.
+- **Only include domain terms.** Skip generic programming concepts (array, function, endpoint) unless they have domain-specific meaning.
+- **Group terms into multiple tables** when natural clusters emerge (e.g. by subdomain, lifecycle, or actor). Each group gets its own heading and table. If all terms belong to a single cohesive domain, one table is fine — don't force groupings.
+- **Write an example dialogue.** A short conversation (3-5 exchanges) between a dev and a domain expert that demonstrates how the terms interact naturally. The dialogue should clarify boundaries between related concepts and show terms being used precisely.
+
+<example>
+
+## Example dialogue
+
+> **Dev:** "How do I test the **sync service** without Docker?"
+
+> **Domain expert:** "Provide the **filesystem layer** instead of the **Docker layer**. It implements the same **Sandbox service** interface but uses a local directory as the **sandbox**."
+
+> **Dev:** "So **sync-in** still creates a **bundle** and unpacks it?"
+
+> **Domain expert:** "Exactly. The **sync service** doesn't know which layer it's talking to. It calls `exec` and `copyIn` — the **filesystem layer** just runs those as local shell commands."
+
+</example>
+
+## Re-running
+
+When invoked again in the same conversation:
+
+1. Read the existing `UBIQUITOUS_LANGUAGE.md`
+2. Incorporate any new terms from subsequent discussion
+3. Update definitions if understanding has evolved
+4. Re-flag any new ambiguities
+5. Rewrite the example dialogue to incorporate new terms
diff --git a/.agents/skills/zoom-out/SKILL.md b/.agents/skills/zoom-out/SKILL.md
new file mode 100644
index 00000000..1e7a5dc7
--- /dev/null
+++ b/.agents/skills/zoom-out/SKILL.md
@@ -0,0 +1,7 @@
+---
+name: zoom-out
+description: Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.
+disable-model-invocation: true
+---
+
+I don't know this area of code well. Go up a layer of abstraction. Give me a map of all the relevant modules and callers, using the project's domain glossary vocabulary.
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
new file mode 100644
index 00000000..fa963838
--- /dev/null
+++ b/.github/copilot-instructions.md
@@ -0,0 +1,186 @@
+# Copilot Cloud Agent Onboarding
+
+## Repository Overview
+
+**ssi-agent** is a Self-Sovereign Identity (SSI) agent implementing OpenID4VCI (issuance) and OpenID4VP (verification) protocols. It's a Rust Tokio-based service that manages identity credentials, digital wallets, and credential verification flows.
+
+- **Language**: Rust 1.76.0+ (enforced in Cargo.toml `rust-version`)
+- **Build System**: Cargo workspace with 18 crates
+- **HTTP Framework**: Axum 0.8 with Tokio async runtime
+- **Persistence**: PostgreSQL with CQRS-ES event sourcing pattern
+- **Code Size**: ~15K LOC across distributed domain-driven crates
+- **Architecture**: Domain-driven design with bounded contexts (issuance, holder, verification, authorization, identity)
+
+## Build & Test Instructions
+
+All commands run from repository root. **Always use `cargo` commands; do not use shell scripts for building.**
+
+### Bootstrap (one-time setup)
+
+```bash
+# Install Rust 1.76.0+ (use dtolnay/rust-toolchain@stable for CI version)
+curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
+rustup component add rustfmt clippy
+
+# Verify installation
+cargo --version  # Should show 1.76.0+
+```
+
+### Build
+
+```bash
+# Full workspace build (includes all 18 crates)
+cargo build --workspace
+
+# Build specific crate
+cargo build -p agent_api_http
+
+# Build with optimizations
+cargo build --release
+```
+
+**Expected time**: ~45 seconds for clean full build (first time may be 2+ minutes with git dependency downloads).
+
+### Format Check
+
+```bash
+# Check code formatting (max width 120 chars per rustfmt.toml)
+cargo fmt --all -- --check
+
+# Auto-fix formatting
+cargo fmt --all
+```
+
+### Lint
+
+```bash
+# Run clippy with pedantic warnings as errors
+cargo clippy --all-targets --all-features -- -D warnings
+```
+
+### Test
+
+```bash
+# Run all tests (serial_test synchronizes certain tests to prevent race conditions)
+cargo test --workspace
+
+# Run tests for single crate
+cargo test -p agent_issuance
+
+# Run specific test with output
+cargo test -p agent_issuance test_verify_credential_response -- --nocapture
+```
+
+**Critical constraint**: Test `test_verify_credential_response` in `agent_issuance` requires 32 MiB stack. It's already wrapped with `run_with_large_stack` helper; do NOT remove or modify this wrapper. The test cannot use `#[future(awt)]` rstest fixtures because rstest evaluates fixtures on the normal stack before the large-stack wrapper executes.
+
+### Dependency & Security Checks
+
+```bash
+# Audit dependencies for vulnerabilities
+cargo install cargo-audit
+cargo audit
+
+# Check license compliance (runs weekly in CI)
+cargo install cargo-deny
+cargo deny check licenses --hide-inclusion-graph
+```
+
+### Code Coverage (local)
+
+```bash
+# Generate LCOV coverage report
+cargo install cargo-llvm-cov
+cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info
+```
+
+## Project Layout
+
+### Root Directory Structure
+
+- **agent\_\*** crates: 14 bounded contexts (api_http, application, holder, issuance, verification, etc.)
+- **shared-kernel/**: Core DDD abstractions (ApplicationService, CommandHandlerFactory, ViewRepository)
+- **infrastructure/**: Persistence adapters (MongoDB, PostgreSQL) and authorization adapters
+- **.github/workflows/**: CI/CD pipelines (format-lint-test, audit, coverage, docker, release)
+- **agent_application/**: Entry point (main.rs runs the Tokio async runtime)
+- **agent_application/docker/**: Docker Compose setup with PostgreSQL + pgAdmin + optional Prometheus/Grafana
+
+### Key Configuration Files
+
+| File                                    | Purpose                                                                                                        |
+| --------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
+| `Cargo.toml`                            | Workspace definition, workspace dependencies, Clippy pedantic lints, patch.crates-io (sd-jwt hasher trait fix) |
+| `rustfmt.toml`                          | max_width = 120                                                                                                |
+| `deny.toml`                             | Dependency graph and license checks                                                                            |
+| `.releaserc.yaml`                       | Semantic-release config (squash-merge PRs, conventional commits)                                               |
+| `commitlint.config.mjs`                 | PR title validation enforces conventional commit style                                                         |
+| `agent_application/docker/compose.yaml` | PostgreSQL 15, pgAdmin, Prometheus/Grafana (optional)                                                          |
+
+### Critical Workflow Files
+
+- **.github/workflows/format-lint-test.yaml**: Runs `cargo fmt --check`, `cargo clippy`, `cargo test --workspace` on all PRs
+- **.github/workflows/audit.yaml**: Daily dependency audit via cargo-audit
+- **.github/workflows/check-licenses.yaml**: Weekly license check via cargo-deny
+- **.github/workflows/coverage.yaml**: Generates LCOV coverage, uploads to Codecov on main/next/beta/alpha
+- **.github/workflows/build-push-docker.yaml**: Multi-platform Docker builds (amd64/arm64)
+
+## Architecture & Key Constraints
+
+### Domain-Driven Design Bounded Contexts
+
+- **agent_issuance**: OpenID4VCI credential issuance flows
+- **agent_holder**: Credential storage and management
+- **agent_verification**: Credential verification via OpenID4VP
+- **agent_authorization**: OAuth 2.0 authorization flows
+- **agent_identity**: DID document management and resolution
+- **agent_api_http**: Axum HTTP API handlers (all endpoints routed through this crate)
+- **shared-kernel**: Command/Query service, CQRS patterns, dependency injection
+
+### Testing Patterns
+
+- **Test Framework**: rstest with `#[rstest]` and `#[future(awt)]` fixtures for async tests
+- **Test Synchronization**: Tests marked with `#[serial_test::serial]` when they share HTTP event-publisher state
+- **Stack-Intensive Tests**: Tests requiring 32 MiB stack are wrapped with `run_with_large_stack<F>` helper thread spawning
+- **Fixture Setup**: Manual fixture helpers (not rstest parameters) must be called inside large-stack wrappers to avoid premature stack overflow
+
+### External Dependencies (Git Pinned)
+
+```
+siopv2, oid4vci, oid4vc-core, oid4vc-manager, oid4vp → https://github.com/impierce/openid4vc (rev 0a5090e)
+identity_* crates → https://github.com/iotaledger/identity (v1.9.6-beta.1)
+iota-sdk → https://github.com/iotaledger/iota (specific rev)
+oauth_tsl → https://github.com/impierce/oauth-token-status-list (rev 0aa0228)
+sd-jwt (patched) → https://github.com/impierce/sd-jwt-payload (rev f28789a, Hasher trait Send+Sync fix)
+```
+
+### Configuration & Environment
+
+- **Config file**: `agent_application/example.config.yaml` (copied to required locations)
+- **Environment vars**: Prefixed with `UNICORE__` (e.g., `UNICORE__APPLICATION_URL`, `UNICORE__LOG_FORMAT`)
+- **Required for testing**: `.env` file optional; Docker Compose auto-manages Postgres credentials (demo_user/demo_pass)
+- **Stronghold secret manager**: Generates `stronghold.dat` at runtime; controlled via `UNICORE__SECRET_MANAGER__STRONGHOLD_PATH`
+
+## Pre-commit Validation (Always Trust CI, Validate Locally First)
+
+Run locally before pushing to avoid PR rejection:
+
+```bash
+# Full CI validation sequence (runs in format-lint-test.yaml)
+cargo fmt --all -- --check && \
+  cargo clippy --all-targets --all-features -- -D warnings && \
+  cargo test --workspace && \
+  git diff --exit-code
+
+# If git diff fails, code generation files changed (check agent_api_http openapi-generated.yaml)
+```
+
+**If tests timeout or panic**: Check for stack-related issues in test output (search for "stack" or "overflow"). All known stack-intensive tests are already wrapped; report new cases.
+
+## Trust This Document
+
+Cloud agents should use these instructions as the authoritative source for building and testing this repository. Only perform additional file searches if:
+
+1. Build/test steps documented here fail with clear error messages not addressed above
+2. Changes are needed to crate-specific logic (then search agent\_\*/src/ for relevant modules)
+3. New CI validations are added to .github/workflows/ (then update this document)
+
+All other exploration wastes cycles. Use this guide to complete tasks efficiently.
diff --git a/dev/SETUP.md b/dev/SETUP.md
new file mode 100644
index 00000000..58fdb02b
--- /dev/null
+++ b/dev/SETUP.md
@@ -0,0 +1,11 @@
+# Developer Setup
+
+## AI Skills
+
+AI skills were set up on June 17, 2026 with the following command:
+
+```bash
+npx skills@latest add mattpocock/skills
+```
+
+The installed skills can be found in the `.agent/skills` directory. Versions are in the `skills-lock.json` file.
diff --git a/docs/README.md b/docs/README.md
index 3d18ebfb..fab80dd2 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -3,8 +3,27 @@
 Welcome to the source repository for the official documentation of **UniCore**, our self-sovereign digital identity agent.
 
 ## About
-All the markdown (`.md`) files in this folder serve as the **source files** for the official UniCore documentation, which is hosted at:
 
-👉 [UniCore Official Documentation (Beta)](https://beta.docs.impierce.com/unicore/)
+All the markdown (`.md`) files in this folder serve as:
 
-These markdown files are used as input for generating the official documentation site. Any changes to these files will reflect on the site after they are processed and deployed.
+1. **Source files** for the official UniCore documentation, hosted at: 👉 [UniCore Official Documentation (Beta)](https://beta.docs.impierce.com/unicore/)
+2. **AI Context** for cloud agents and developers working on the codebase
+
+These markdown files are used as input for generating the official documentation site. Changes to these files will reflect on the site after they are processed and deployed.
+
+## Quick Navigation
+
+### For External Stakeholders & API Consumers
+
+- **[Ubiquitous Language](./glossary/ubiquitous-language.md)** - Shared domain terminology (implementation-free, publishable)
+- **[Introduction](./introduction/)** - Quick start and feature overview
+- **[Configuration](./configuration/)** - Setup and environment variables
+- **[API Documentation](https://beta.docs.impierce.com/unicore/)** - OpenAPI specification
+
+### For Developers & AI Agents
+
+- **[AI Context & Code Navigation](./glossary/CONTEXT.md)** - Architecture patterns and bounded context mapping
+- **[Glossary Overview](./glossary/)** - How to use ubiquitous language and AI context
+- **[Architecture Decision Records](./adr/)** - Why certain design choices were made
+- **[Deployment](./deployment/)** - Production deployment guides
+- **[Problem Details](./problem-details/)** - Troubleshooting and error handling
diff --git a/docs/glossary/CONTEXT.md b/docs/glossary/CONTEXT.md
new file mode 100644
index 00000000..4fe3a119
--- /dev/null
+++ b/docs/glossary/CONTEXT.md
@@ -0,0 +1,81 @@
+# AI Context & Code Navigation
+
+This guide helps AI agents and developers navigate the ssi-agent codebase by mapping domain concepts to implementation patterns and code locations.
+
+## Architecture Overview
+
+UniCore uses **domain-driven design (DDD)** with the **CQRS-ES pattern** (Command Query Responsibility Segregation + Event Sourcing):
+
+- **Bounded Contexts**: Organized as separate crates (e.g., `agent_issuance`, `agent_holder`). Each context owns its domain model, commands, queries, and events.
+- **CQRS**: Commands modify state, queries read state. Separated for clarity and independent optimization.
+- **Event Sourcing**: All state changes are captured as immutable events. State is reconstructed by replaying events. Enables audit trails, temporal queries, and event-driven integration.
+- **Aggregates**: Domain-driven design root entities that group related data and enforce business invariants.
+
+## Bounded Context Mapping
+
+Find where domain concepts live in code:
+
+| Context               | Domain Focus                        | Primary Aggregates                    | Key Files                                               |
+| --------------------- | ----------------------------------- | ------------------------------------- | ------------------------------------------------------- |
+| `agent_issuance`      | Issuance Flow, Credential Offer     | `Offer`, `Credential`                 | `src/offer/aggregate.rs`, `src/credential/aggregate.rs` |
+| `agent_holder`        | Holder, Wallet, Credential Storage  | `Holder`, `CredentialContainer`       | `src/holder/aggregate.rs`                               |
+| `agent_verification`  | Verification, Presentation          | `Presentation`, `VerificationRequest` | `src/presentation/aggregate.rs`                         |
+| `agent_authorization` | OAuth2, SIOP v2                     | `OAuth2AuthorizationRequest`          | `src/domain/oauth2_authorization_request/`              |
+| `agent_identity`      | DID, Profile, Service               | `IdentityProfile`, `DIDDocument`      | `src/document/aggregate.rs`, `src/profile/aggregate.rs` |
+| `agent_api_http`      | HTTP API, Handlers, Routing         | N/A (presentation layer)              | `src/handlers.rs`, `src/v0/`                            |
+| `shared-kernel`       | CQRS Patterns, Dependency Injection | N/A (infrastructure)                  | `src/application_service.rs`, `src/command_handler.rs`  |
+
+## Key Architectural Patterns
+
+### Events
+
+Events represent domain facts (e.g., `CredentialIssued`, `PresentationVerified`). Named in past tense. Each event is immutable and belongs to an aggregate.
+
+**Location**: `src/domain/*/events.rs` or inline in aggregate files.
+
+### Commands
+
+Commands request a state change (e.g., `IssueCredential`, `VerifyPresentation`). Handled by an aggregate which either succeeds or fails atomically.
+
+**Pattern**: Agent receives command → applies to aggregate → emits events → persists.
+
+### Queries
+
+Queries read state via projections (read models). CQRS separates reads from writes for independent optimization.
+
+**Location**: Usually in `src/queries/` or service layer files.
+
+### Aggregate Pattern
+
+Aggregates group related entities under a root entity. The root enforces business rules and only the root is directly mutable from outside.
+
+**Example**: `Offer` aggregate (in `agent_issuance`) contains offer metadata, credential templates, and issue state.
+
+## Persistence Layer
+
+- **Write Model**: Event store (PostgreSQL via `cqrs-es` crate)
+- **Read Model**: Projections that materialize events into queryable views
+- Both live in `infrastructure/stores/` (Postgres adapter)
+
+## Cross-Context Integration
+
+Contexts communicate via:
+
+1. **HTTP (API boundary)** — External consumers call REST endpoints
+2. **Events** — Published via event publisher (HTTP or NATS)
+3. **Queries** — Read-only access to specific data
+
+No direct database access between contexts; all coupling is intentional and explicit.
+
+## When to Update This Guide
+
+Update when:
+
+- Adding or renaming a bounded context
+- Introducing new architectural patterns
+- Clarifying how concepts map to code
+- Adding new aggregates or command types
+
+---
+
+**Last updated**: 2026-06-17
diff --git a/docs/glossary/README.md b/docs/glossary/README.md
new file mode 100644
index 00000000..6cc2c947
--- /dev/null
+++ b/docs/glossary/README.md
@@ -0,0 +1,80 @@
+# Glossary
+
+This glossary is organized into two complementary documents:
+
+## 📚 [Ubiquitous Language](./ubiquitous-language.md)
+
+**Audience**: Domain experts, product stakeholders, API consumers, external developers
+
+The shared language of UniCore. Pure domain concepts with no implementation details. This file is **publishable to external documentation** as-is.
+
+Contains:
+
+- **Core Identity Concepts**: DID, Credential, Holder, Issuer, Verifier, Wallet, Claim, Proof, Signature
+- **OpenID4 Protocols**: OpenID4VCI, OpenID4VP, SIOP v2, Credential Offer, Pre-authorized Code, Challenge
+- **Credential Lifecycle**: Issuance Flow, Presentation Flow, Verification, Selective Disclosure, Credential Status
+
+### Using the Ubiquitous Language
+
+When reading or writing about UniCore:
+
+1. Use terms from this glossary for consistency
+2. Challenge fuzzy language — if you're using multiple terms for the same concept, align on one
+3. Reference this glossary when onboarding new stakeholders
+
+---
+
+## 🔧 [AI Context & Code Navigation](./CONTEXT.md)
+
+**Audience**: AI agents, developers, architects
+
+How domain concepts map to code. Explains architecture patterns (DDD, CQRS-ES, Aggregates, Events) and guides navigation from domain terms to implementation.
+
+Contains:
+
+- **Architecture Overview**: DDD, CQRS-ES, Aggregates, Events, Commands, Queries
+- **Bounded Context Mapping**: Which contexts implement which domain concepts
+- **Persistence Layer**: Write model (Event Store), Read model (Projections)
+- **Cross-Context Integration**: How bounded contexts communicate
+
+### Using AI Context
+
+When navigating the codebase:
+
+1. Start with a domain concept from [Ubiquitous Language](./ubiquitous-language.md)
+2. Find where it lives using the [Bounded Context Mapping](./CONTEXT.md#bounded-context-mapping)
+3. Understand the architectural pattern (Aggregate, Event, Command) from [Key Architectural Patterns](./CONTEXT.md#key-architectural-patterns)
+4. Locate the specific code files
+
+---
+
+## Adding New Terms
+
+Follow this process:
+
+### 1. New Domain Concept
+
+Add to [ubiquitous-language.md](./ubiquitous-language.md):
+
+- Clear definition in plain language
+- Related concepts
+- No code references
+
+### 2. New Implementation Pattern
+
+Update [CONTEXT.md](./CONTEXT.md):
+
+- Describe the architectural pattern or aggregate
+- Map to relevant codebase locations
+- Explain how it relates to domain concepts
+
+### 3. New Bounded Context
+
+Update [AI Context Mapping table](./CONTEXT.md#bounded-context-mapping):
+
+- Add context name, domain focus, primary aggregates
+- List key file locations
+
+---
+
+**Last updated**: 2026-06-17
diff --git a/docs/glossary/ubiquitous-language.md b/docs/glossary/ubiquitous-language.md
new file mode 100644
index 00000000..84b3ab9a
--- /dev/null
+++ b/docs/glossary/ubiquitous-language.md
@@ -0,0 +1,182 @@
+# Ubiquitous Language
+
+This file defines the core domain concepts and terminology used in UniCore. It is the shared language between domain experts, product stakeholders, API consumers, and developers.
+
+This glossary is **implementation-agnostic** and can be published to external documentation as-is.
+
+---
+
+## Core Identity Concepts
+
+### Decentralized Identifier (DID)
+
+A globally unique, persistent identifier that does not require a centralized registry. DIDs are self-issued, cryptographically verifiable, and enable self-sovereign identity.
+
+**Related**: Credential, Holder, Issuer, Verifier
+
+### Credential
+
+A digitally signed assertion of one or more claims about a subject. Credentials support multiple formats and can contain selective disclosure—the ability for a holder to omit certain fields when presenting.
+
+**Related**: Credential Subject, Claim, Proof, Verification
+
+### Credential Subject
+
+The entity about whom a credential makes claims. In many cases, the credential subject is also the holder (the entity possessing the credential).
+
+**Related**: Credential, Holder, Claim
+
+### Holder
+
+The entity that receives, stores, and presents credentials. The holder controls the credentials in their digital wallet and decides when and to whom to present them.
+
+**Related**: Wallet, Credential, Presentation
+
+### Issuer
+
+A trusted entity that creates, signs, and issues credentials to holders. The issuer defines credential types, validates credential requests, and manages credential metadata.
+
+**Related**: Credential, Issuance, Signature
+
+### Verifier
+
+An entity that requests and verifies credentials from a holder. The verifier checks the credential's authenticity, validity, and whether it meets their authorization requirements.
+
+**Related**: Verification, Presentation, Credential
+
+### Wallet
+
+A digital container that holds credentials on behalf of a holder. The wallet manages credential storage, retrieval, and presentation to verifiers.
+
+**Related**: Holder, Credential, Presentation
+
+### Claim
+
+A statement or assertion made about a credential subject. Claims form the substance of a credential and typically include attributes like name, age, or professional qualifications.
+
+**Related**: Credential, Credential Subject
+
+### Proof
+
+Cryptographic evidence (typically a signature or zero-knowledge proof) that validates:
+
+- The credential was issued by the claimed issuer
+- The holder possesses the credential
+- The credential has not been tampered with
+
+**Related**: Signature, Verification, Credential
+
+### Signature
+
+A cryptographic operation that binds a credential to its issuer, providing authenticity and non-repudiation. Signatures are verified by decoding and validating against the issuer's public key.
+
+**Related**: Proof, Issuer, Verification
+
+---
+
+## OpenID4 Protocols
+
+### OpenID4VCI (OpenID for Verifiable Credential Issuance)
+
+Protocol specification defining how an issuer communicates with a wallet to issue credentials. Supports both direct issuance flows (pre-authorized codes) and interactive authorization code flows.
+
+**Related**: Issuance Flow, Credential Offer, Pre-authorized Code
+
+### OpenID4VP (OpenID for Verifiable Presentations)
+
+Protocol specification defining how a verifier requests and receives credential presentations from a holder. Enables selective disclosure and support for multiple credential formats.
+
+**Related**: Verification Flow, Presentation, Challenge
+
+### SIOP v2 (Self-Issued OpenID Provider v2)
+
+Self-issued OpenID Provider specification allowing a user to act as their own identity provider. Enables direct authentication without requiring a centralized identity provider.
+
+**Related**: Authorization, Self-Issued Credentials
+
+### Credential Offer
+
+A message from an issuer to a holder inviting them to receive credentials. Contains credential type information and issuer metadata, providing the holder with details about what credentials are available.
+
+**Related**: Pre-authorized Code, Issuance Flow, OpenID4VCI
+
+### Pre-authorized Code
+
+A short-lived code generated by the issuer that allows a holder to obtain credentials directly without completing an interactive authorization flow. Used in scenarios where the issuer can pre-authorize the credential request.
+
+**Related**: Credential Offer, OpenID4VCI, Issuance Flow
+
+### Challenge
+
+A nonce or random value issued by a verifier that prevents replay attacks. The holder includes the challenge in their credential presentation proof to demonstrate freshness.
+
+**Related**: Proof, Presentation, Verification
+
+---
+
+## Credential Lifecycle
+
+### Issuance Flow
+
+The end-to-end process of issuing a credential from an issuer to a holder. Typically includes credential offer, credential request, proof of possession, and credential delivery.
+
+**Related**: Credential Offer, Pre-authorized Code, OpenID4VCI
+
+### Issuance Request
+
+A request from a holder (or their wallet) asking an issuer for specific credentials. The request includes proof of key possession and any required claims that the issuer needs from the holder.
+
+**Related**: Proof, Issuance Flow, Issuer
+
+### Presentation Flow
+
+The end-to-end process of a holder presenting credentials to a verifier. The verifier specifies which credentials and claims are needed, the holder selects and presents them, and the verifier validates.
+
+**Related**: Presentation Request, Challenge, Proof, OpenID4VP
+
+### Presentation Request
+
+A request from a verifier asking a holder to present specific credentials or claims. The request specifies what is needed, any constraints (like credential issuers or formats), and a challenge for freshness.
+
+**Related**: Verifier, Presentation, Challenge
+
+### Verification
+
+The process of validating that a presented credential is:
+
+- Authentically issued by the claimed issuer
+- Not expired or revoked
+- Meets the verifier's authorization requirements
+
+**Related**: Verifier, Presentation, Proof
+
+### Selective Disclosure
+
+The capability for a holder to omit certain claims from a credential when presenting it to a verifier, revealing only the minimum information necessary. This enhances privacy by default.
+
+**Related**: Credential, Presentation, Holder
+
+### Credential Status
+
+The current state of a credential: valid, expired, revoked, or suspended. Verifiers check credential status during verification to ensure the credential is current and not revoked by the issuer.
+
+**Related**: Credential, Verification, Issuer
+
+### Credential Template
+
+A blueprint that defines what a verifiable credential should look like. A template specifies what fields the credential contains, how long it's valid, which fields can be selectively disclosed, and what credential standard it follows (e.g., Open Badges 3.0).
+
+Issuers set up a template once and reuse it for every instance of that credential type (e.g., diplomas, membership cards, professional certifications). Templates move through states: `Draft` (being set up) → `Published` (active) → `Archived` (retired) → `Deleted` (no longer needed).
+
+**Related**: Credential, Issuer, Selective Disclosure, Credential Lifecycle
+
+---
+
+## See Also
+
+- [API Documentation](https://beta.docs.impierce.com/unicore/) - OpenAPI specification for UniCore
+- [Configuration Reference](../configuration/) - Environment variables and settings
+
+---
+
+**Last updated**: 2026-06-17
diff --git a/skills-lock.json b/skills-lock.json
new file mode 100644
index 00000000..63251484
--- /dev/null
+++ b/skills-lock.json
@@ -0,0 +1,83 @@
+{
+  "version": 1,
+  "skills": {
+    "diagnose": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/engineering/diagnose/SKILL.md",
+      "computedHash": "15939a26f86edec2d4862042b8564e5a062cb81d04e047a0cea6305c8830b5f5"
+    },
+    "find-skills": {
+      "source": "vercel-labs/skills",
+      "sourceType": "github",
+      "skillPath": "skills/find-skills/SKILL.md",
+      "computedHash": "9e1c8b3103f92fa8092568a44fe64858de7c5c9dc65ce4bea8f168080e889cfd"
+    },
+    "grill-with-docs": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/engineering/grill-with-docs/SKILL.md",
+      "computedHash": "eb0e91e84277283dc2b23ed544399e53afd6b5287e5b6929f25fe8aa608e164b"
+    },
+    "handoff": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/productivity/handoff/SKILL.md",
+      "computedHash": "1a78d774f8a59db5daa6e65e20a6596872fa8cde769f9a6e3a09b678dd5ae8cc"
+    },
+    "improve-codebase-architecture": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/engineering/improve-codebase-architecture/SKILL.md",
+      "computedHash": "ef32aea0a8fab9b365ff9e08a95f8d353e20ca21ea46ec2e73587c86dd341351"
+    },
+    "prototype": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/engineering/prototype/SKILL.md",
+      "computedHash": "e4d0c8f8cb3fc096ee99405a15491da466545cf4a3694bee5a0c9db2fa621a43"
+    },
+    "qa": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/deprecated/qa/SKILL.md",
+      "computedHash": "20c63e29b268b1f0762cff524b5e321d5e1a773b4f61b90d84811b755948a66c"
+    },
+    "request-refactor-plan": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/deprecated/request-refactor-plan/SKILL.md",
+      "computedHash": "176cf1d0c4dc4fc4d958c4bc4ed67f222f2656bda2f3f15e3a3e98b2e5edaf2f"
+    },
+    "review": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/in-progress/review/SKILL.md",
+      "computedHash": "4a2b10bb81e568516c52018e73b8255a02066024257d7c907fa65826d62bc8dd"
+    },
+    "setup-matt-pocock-skills": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/engineering/setup-matt-pocock-skills/SKILL.md",
+      "computedHash": "0164a8b1ef998abca426056c6ed8a7716a9d4692fc6daa5378f68381a6dafd24"
+    },
+    "tdd": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/engineering/tdd/SKILL.md",
+      "computedHash": "15a7b5e36383ebadb2dec5e586679e55e9663d292da418926b8da6fc0ef27d84"
+    },
+    "ubiquitous-language": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/deprecated/ubiquitous-language/SKILL.md",
+      "computedHash": "c8968b02b83c365bc81d85cc17fb4c8854b80f5b6dece322164fff5b00142231"
+    },
+    "zoom-out": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/engineering/zoom-out/SKILL.md",
+      "computedHash": "8357aeaece3b709c442eab67e64b86844e05e2f1ea95b109565eba50b6def36e"
+    }
+  }
+}

From d93ec81307d30114c0404f660c21270c9ae014c7 Mon Sep 17 00:00:00 2001
From: Oran Dan <53859531+Oran-Dan@users.noreply.github.com>
Date: Wed, 17 Jun 2026 14:43:40 +0200
Subject: [PATCH 16/34] docs: update example config (#359)

---
 agent_application/example.config.yaml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/agent_application/example.config.yaml b/agent_application/example.config.yaml
index 73eeb923..df436efb 100644
--- a/agent_application/example.config.yaml
+++ b/agent_application/example.config.yaml
@@ -15,6 +15,7 @@ did_methods:
     enabled: false
 
 domain_linkage_enabled: false
+enable_interactive_authorization_flow: true
 
 signing_algorithms_supported:
   es256:
@@ -25,8 +26,8 @@ signing_algorithms_supported:
 
 # agent_event_publisher_http
 # Configure here to which events will be dispatched to a specific `target_url`. In the example below, the
-# `EventPublisherHttp` will listen for the `SIOPv2AuthorizationResponseVerified` event which is part of the `connection`
-# aggregate. The events will be dispatched to the `https://my-domain.example.org/event-subscriber` endpoint.
+# `EventPublisherHttp` will listen for the `UnsignedCredentialCreated` and `CredentialSigned` events.
+# The events will be dispatched to the `https://my-domain.example.org/event-subscriber` endpoint.
 event_publishers:
   http:
     - enabled: false
@@ -36,6 +37,10 @@ event_publishers:
       events:
         server_config: []
         credential: [UnsignedCredentialCreated, CredentialSigned]
+        # To enable the interactive authorization flow for OID4VCIm, the event below needs to be listened to.
+        # authorization_request: [OID4VPAuthorizationResponseVerified]
+
+
   nats:
     enabled: true
     nats_url: "nats://localhost:4222"

From f9afa80d5ced980b38b9b9d4fa3d10bbbf9a1406 Mon Sep 17 00:00:00 2001
From: Daniel Mader <daniel.mader@impierce.com>
Date: Thu, 18 Jun 2026 13:38:24 +0200
Subject: [PATCH 17/34] docs: add `caveman` and `teach` skills (#360)

---
 .agents/skills/caveman/SKILL.md               |  49 +++++++
 .agents/skills/teach/GLOSSARY-FORMAT.md       |  35 +++++
 .../skills/teach/LEARNING-RECORD-FORMAT.md    |  46 ++++++
 .agents/skills/teach/MISSION-FORMAT.md        |  31 +++++
 .agents/skills/teach/RESOURCES-FORMAT.md      |  32 +++++
 .agents/skills/teach/SKILL.md                 | 131 ++++++++++++++++++
 skills-lock.json                              |  12 ++
 7 files changed, 336 insertions(+)
 create mode 100644 .agents/skills/caveman/SKILL.md
 create mode 100644 .agents/skills/teach/GLOSSARY-FORMAT.md
 create mode 100644 .agents/skills/teach/LEARNING-RECORD-FORMAT.md
 create mode 100644 .agents/skills/teach/MISSION-FORMAT.md
 create mode 100644 .agents/skills/teach/RESOURCES-FORMAT.md
 create mode 100644 .agents/skills/teach/SKILL.md

diff --git a/.agents/skills/caveman/SKILL.md b/.agents/skills/caveman/SKILL.md
new file mode 100644
index 00000000..85770a38
--- /dev/null
+++ b/.agents/skills/caveman/SKILL.md
@@ -0,0 +1,49 @@
+---
+name: caveman
+description: >
+  Ultra-compressed communication mode. Cuts token usage ~75% by dropping
+  filler, articles, and pleasantries while keeping full technical accuracy.
+  Use when user says "caveman mode", "talk like caveman", "use caveman",
+  "less tokens", "be brief", or invokes /caveman.
+---
+
+Respond terse like smart caveman. All technical substance stay. Only fluff die.
+
+## Persistence
+
+ACTIVE EVERY RESPONSE once triggered. No revert after many turns. No filler drift. Still active if unsure. Off only when user says "stop caveman" or "normal mode".
+
+## Rules
+
+Drop: articles (a/an/the), filler (just/really/basically/actually/simply), pleasantries (sure/certainly/of course/happy to), hedging. Fragments OK. Short synonyms (big not extensive, fix not "implement a solution for"). Abbreviate common terms (DB/auth/config/req/res/fn/impl). Strip conjunctions. Use arrows for causality (X -> Y). One word when one word enough.
+
+Technical terms stay exact. Code blocks unchanged. Errors quoted exact.
+
+Pattern: `[thing] [action] [reason]. [next step].`
+
+Not: "Sure! I'd be happy to help you with that. The issue you're experiencing is likely caused by..."
+Yes: "Bug in auth middleware. Token expiry check use `<` not `<=`. Fix:"
+
+### Examples
+
+**"Why React component re-render?"**
+
+> Inline obj prop -> new ref -> re-render. `useMemo`.
+
+**"Explain database connection pooling."**
+
+> Pool = reuse DB conn. Skip handshake -> fast under load.
+
+## Auto-Clarity Exception
+
+Drop caveman temporarily for: security warnings, irreversible action confirmations, multi-step sequences where fragment order risks misread, user asks to clarify or repeats question. Resume caveman after clear part done.
+
+Example -- destructive op:
+
+> **Warning:** This will permanently delete all rows in the `users` table and cannot be undone.
+>
+> ```sql
+> DROP TABLE users;
+> ```
+>
+> Caveman resume. Verify backup exist first.
diff --git a/.agents/skills/teach/GLOSSARY-FORMAT.md b/.agents/skills/teach/GLOSSARY-FORMAT.md
new file mode 100644
index 00000000..9cae84c4
--- /dev/null
+++ b/.agents/skills/teach/GLOSSARY-FORMAT.md
@@ -0,0 +1,35 @@
+# GLOSSARY.md Format
+
+`GLOSSARY.md` is the canonical language for this teaching workspace. All explainers, exercises, and learning records should adhere to its terminology. Building it is itself part of learning: compressing a concept into a tight definition is evidence the user understands it.
+
+## Structure
+
+```md
+# {Topic} Glossary
+
+{One or two sentence description of the topic this glossary covers.}
+
+## Terms
+
+**Hypertrophy**:
+Muscle growth driven by mechanical tension and metabolic stress over repeated training sessions.
+_Avoid_: Bulking, getting big
+
+**Progressive overload**:
+Systematically increasing the demand on a muscle over time — via load, volume, or intensity.
+_Avoid_: Pushing harder, levelling up
+
+**RPE (Rate of Perceived Exertion)**:
+A 1–10 self-rating of how hard a set felt, where 10 is failure and 8 means two reps left in the tank.
+_Avoid_: Effort score, intensity rating
+```
+
+## Rules
+
+- **Add a term only when the user understands it.** The glossary is a record of compressed knowledge, not a dictionary the user reads to learn. If the user has just been introduced to a concept, wait until they can use it correctly before promoting it here.
+- **Be opinionated.** When several words exist for the same concept, pick the best one and list the rest as aliases to avoid. This is how language compresses.
+- **Keep definitions tight.** One or two sentences. Define what the term IS, not what it does or how to do it.
+- **Use the glossary's own terms inside definitions.** Once a term is in the glossary, prefer it everywhere — including inside other definitions. This is what makes complex terms easier to grasp later.
+- **Group under subheadings** when natural clusters emerge (e.g. `## Anatomy`, `## Programming`). A flat list is fine when terms cohere.
+- **Flag ambiguities explicitly.** If a term is used loosely in the wider field, note the resolution: "In this workspace, 'set' always means a working set — warm-ups are tracked separately."
+- **Revise as understanding deepens.** A definition the user wrote in week one may be wrong by week six. Update in place; do not leave stale entries.
diff --git a/.agents/skills/teach/LEARNING-RECORD-FORMAT.md b/.agents/skills/teach/LEARNING-RECORD-FORMAT.md
new file mode 100644
index 00000000..2faa7c98
--- /dev/null
+++ b/.agents/skills/teach/LEARNING-RECORD-FORMAT.md
@@ -0,0 +1,46 @@
+# Learning Record Format
+
+Learning records live in `./learning-records/` and use sequential numbering: `0001-slug.md`, `0002-slug.md`, etc. Create the directory lazily — only when the first record is written.
+
+They are the teaching equivalent of ADRs: they capture non-obvious lessons, key insights, and stated prior knowledge that will steer future sessions. They are used to calculate the zone of proximal development.
+
+## Template
+
+```md
+# {Short title of what was learned or established}
+
+{1-3 sentences: what was learned (or what prior knowledge was established), and why it matters for future sessions.}
+```
+
+That is the whole format. A learning record can be a single paragraph. The value is recording _that_ this is now known and _why_ it changes what to teach next — not in filling out sections.
+
+## Optional sections
+
+Only include these when they add genuine value. Most records won't need them.
+
+- **Status** frontmatter (`active | superseded by LR-NNNN`) — useful when an earlier understanding turns out to be wrong and is replaced.
+- **Evidence** — how the user demonstrated the understanding (a question answered, an exercise completed, prior experience cited). Useful when the claim might be revisited.
+- **Implications** — what this unlocks or rules out for future sessions. Worth recording when non-obvious.
+
+## Numbering
+
+Scan `./learning-records/` for the highest existing number and increment by one.
+
+## When to write a learning record
+
+Write one when any of these is true:
+
+1. **The user demonstrated genuine understanding of something non-trivial** — not just exposure, but evidence they can use the concept correctly. This sets a new floor for what to teach next.
+2. **The user disclosed prior knowledge** — "I already know X." Record it so future sessions don't re-teach it. Also record the _depth_ claimed.
+3. **A misconception was corrected** — the user previously believed something wrong and now sees why. These are high-value: they predict future stumbling blocks for related topics.
+4. **The mission shifted in response to learning** — the user discovered they cared about something different than they thought. Cross-link to [[MISSION.md]] and update it.
+
+### What does _not_ qualify
+
+- Material that was merely covered. Coverage is not learning. Wait for evidence.
+- Anything already captured tersely in [[GLOSSARY.md]] as a term definition. Don't duplicate.
+- Session-by-session activity logs. Learning records are not a journal — they are decision-grade insights.
+
+## Supersession
+
+When a later record contradicts an earlier one (the user's understanding deepened or corrected), mark the old record `Status: superseded by LR-NNNN` rather than deleting it. The history of how understanding evolved is itself useful signal.
diff --git a/.agents/skills/teach/MISSION-FORMAT.md b/.agents/skills/teach/MISSION-FORMAT.md
new file mode 100644
index 00000000..5dac184a
--- /dev/null
+++ b/.agents/skills/teach/MISSION-FORMAT.md
@@ -0,0 +1,31 @@
+# MISSION.md Format
+
+`MISSION.md` lives at the workspace root. It captures the _reason_ the user is learning this topic. Every teaching decision — what to teach next, which resources to surface, which exercises to design — should trace back to this document.
+
+## Template
+
+```md
+# Mission: {Topic}
+
+## Why
+{1-3 sentences. The concrete real-world goal the user is chasing. What changes in their life or work when they have this skill? Avoid abstract framings like "to understand X" — push for the underlying outcome.}
+
+## Success looks like
+- {A specific, observable thing the user will be able to do}
+- {Another specific thing}
+- {…}
+
+## Constraints
+- {Time, budget, prior commitments, learning preferences, anything that bounds the approach}
+
+## Out of scope
+- {Adjacent topics the user explicitly does not want to chase right now — protects the zone of proximal development}
+```
+
+## Rules
+
+- **One mission per workspace.** If the user wants to learn two unrelated things, that is two workspaces.
+- **Concrete over abstract.** "Run a half marathon by October" beats "get fitter." "Ship a Rust CLI to my team" beats "learn Rust."
+- **Push back on vagueness.** If the user cannot articulate why, interview them before writing anything. A bad mission is worse than no mission.
+- **Revise when reality shifts.** Missions change. When the user's goal moves, update this file — don't leave a stale mission steering future sessions.
+- **Keep it short.** If `MISSION.md` runs past a screen, it has stopped being a compass and started being a plan.
diff --git a/.agents/skills/teach/RESOURCES-FORMAT.md b/.agents/skills/teach/RESOURCES-FORMAT.md
new file mode 100644
index 00000000..c94aac6a
--- /dev/null
+++ b/.agents/skills/teach/RESOURCES-FORMAT.md
@@ -0,0 +1,32 @@
+# RESOURCES.md Format
+
+`RESOURCES.md` is the curated set of trusted sources for this topic. Knowledge for explainers should be drawn from here, not from parametric guesses. Wisdom comes from the communities listed here.
+
+## Structure
+
+```md
+# {Topic} Resources
+
+## Knowledge
+
+- [Book: _The Science and Practice of Strength Training_ — Zatsiorsky & Kraemer](https://example.com)
+  Foundational text on programming and adaptation. Use for: anything to do with periodisation, recovery, intensity zones.
+- [Article: "How Much Should I Train?" — Greg Nuckols (Stronger By Science)](https://example.com)
+  Evidence-based review of volume landmarks. Use for: weekly set targets per muscle group.
+
+## Wisdom (Communities)
+
+- [r/weightroom](https://reddit.com/r/weightroom)
+  High-signal subreddit, moderated against bro-science. Use for: programme critique, plateau troubleshooting.
+- Local: Tuesday strength class at {gym name}
+  Use for: real-time coaching feedback on lifts.
+```
+
+## Rules
+
+- **High-trust only.** Prefer primary sources, recognised experts, peer-reviewed work, and communities with strong moderation. If a resource is marketing dressed as education, leave it out.
+- **Annotate every entry.** A bare link is useless in three months. Add one line: what it covers and when to reach for it.
+- **Group by Knowledge / Wisdom.** Mirrors the philosophy in [SKILL.md](./SKILL.md). It is fine for a resource to appear in only one group.
+- **Surface gaps explicitly.** If no good resource exists for an area the mission needs, write a `## Gaps` section listing what is missing. This drives future search.
+- **Prune ruthlessly.** A resource that turned out to be wrong, shallow, or off-mission should be removed, not buried. Better five sharp sources than thirty mediocre ones.
+- **Record community preferences.** If the user has opted out of joining communities, note it here so future sessions don't keep proposing them.
diff --git a/.agents/skills/teach/SKILL.md b/.agents/skills/teach/SKILL.md
new file mode 100644
index 00000000..2fad9a36
--- /dev/null
+++ b/.agents/skills/teach/SKILL.md
@@ -0,0 +1,131 @@
+---
+name: teach
+description: Teach the user a new skill or concept, within this workspace.
+disable-model-invocation: true
+argument-hint: "What would you like to learn about?"
+---
+
+The user has asked you to teach them something. This is a stateful request - they intend to learn the topic over multiple sessions.
+
+## Teaching Workspace
+
+Treat the current directory as a teaching workspace. The state of their learning is captured in this directory in several files:
+
+- `MISSION.md`: A document capturing the _reason_ the user is interested in the topic. This should be used to ground all teaching. Use the format in [MISSION-FORMAT.md](./MISSION-FORMAT.md).
+- `./reference/*.html`: A directory of reference materials. These are the compressed learnings from the lessons - cheat sheets, reference algorithms, syntax, yoga poses, glossaries. They are the raw units of learning. They should be beautiful documents which print out well, and are designed for quick reference.
+- `RESOURCES.md`: A list of resources which can be explored to ground your teaching in contextual knowledge, or to acquire knowledge and wisdom. Use the format in [RESOURCES-FORMAT.md](./RESOURCES-FORMAT.md).
+- `./learning-records/*.md`: A directory of learning records, which capture what the user has learned. These are loosely equivalent to architectural decision records in software development - they capture non-obvious lessons and key insights that may need to be revised later, or drive future sessions. These should be used to calculate the zone of proximal development. They are titled `0001-<dash-case-name>.md`, where the number increments each time. Use the format in [LEARNING-RECORD-FORMAT.md](./LEARNING-RECORD-FORMAT.md).
+- `./lessons/*.html`: A directory of lessons. A **lesson** is a single, self-contained HTML output that teaches one tightly-scoped thing tied to the mission. This is the primary unit of teaching in this workspace.
+- `NOTES.md`: A scratchpad for you to jot down user preferences, or working notes.
+
+## Philosophy
+
+To learn at a deep level, the user needs three things:
+
+- **Knowledge**, captured from high-quality, high-trust resources
+- **Skills**, acquired through highly-relevant interactive lessons devised by you, based on the knowledge
+- **Wisdom**, which comes from interacting with other learners and practitioners
+
+Before the `RESOURCES.md` is well-populated, your focus should be to find high-quality resources which will help the user acquire knowledge. Never trust your parametric knowledge.
+
+Some topics may require more skills than knowledge. Learning more about theoretical physics might be more knowledge-based. For yoga, more skills-based.
+
+### Fluency vs Storage Strength
+
+You should be careful to split between two types of learning:
+
+- **Fluency strength**: in-the-moment retrieval of knowledge
+- **Storage strength**: long-term retention of knowledge
+
+Fluency can give the user an illusory sense of mastery, but storage strength is the real goal. Try to design lessons which build long-term retention by desirable difficulty:
+
+- Using retrieval practice (recall from memory)
+- Spacing (distributing practice over time)
+- Interleaving (mixing up different but related topics in practice - for skills practice only)
+
+## Lessons
+
+A lesson is the main thing you produce — the unit in which knowledge and skills reach the user. Each lesson is one self-contained HTML file, saved to `./lessons/` and titled `0001-<dash-case-name>.html` where the number increments each time.
+
+A lesson should be **beautiful** — clean, readable typography and layout — since the user will return to these later to review. Think Tufte.
+
+The lesson should be short, and completable very quickly. Learners' working memory is very small, and we need to stay within it. But each lesson should give the user a single tangible win that they can build on. It should be directly tied to the mission, and should be in the user's zone of proximal development.
+
+If possible, open the lesson file for the user by running a CLI command.
+
+Each lesson should link via HTML anchors to other lessons and reference documents.
+
+Each lesson should recommend a primary source for the user to read or watch. This should be the most high-quality, high-trust resource you found on the topic.
+
+Each lesson should contain a reminder to ask followup questions to the agent. The agent is their teacher, and can assist with anything that's unclear.
+
+## The Mission
+
+Every lesson should be tied into the mission - the reason that the user is interested in learning about the topic.
+
+If the user is unclear about the mission, or the `MISSION.md` is not populated, your first job should be to question the user on why they want to learn this.
+
+Failing to understand the mission will mean knowledge acquisition is not grounded in real-world goals. Lessons will feel too abstract. You will have no way of judging what the user should do next.
+
+Missions may change as the user develops more skills and knowledge. This is normal - make sure to update the `MISSION.md` and add a learning record to capture the change. Confirm with the user before changing the mission.
+
+## Zone Of Proximal Development
+
+Each lesson, the user should always feel as if they are being challenged 'just enough'.
+
+The user may specify an exact thing they want to learn. If they don't, figure out their zone of proximal development by:
+
+- Reading their `learning-records`
+- Figuring out the right thing to teach them based on their mission
+- Teach the most relevant thing that fits in their zone of proximal development
+
+## Knowledge
+
+Lessons should be designed around a skill the user is going to learn. The knowledge in the lesson should be only what's required to acquire that skill. You teach the knowledge first, then get the user to practice the skills via an interactive feedback loop.
+
+Knowledge should first be gathered from trusted resources. Use `RESOURCES.md` to keep track of them. Lessons should be littered with citations - links to external resources to back up any claim made. This increases the trustworthiness of the lesson.
+
+For acquiring knowledge, difficulty is the enemy. It eats working memory you need for understanding.
+
+## Skills
+
+If knowledge is all about acquisition, skills are about durability and flexibility. Make the knowledge stick.
+
+For skill acquisition, difficulty is the tool. Effortful retrieval is what builds storage strength. Skills should be taught through interactive lessons. There are several tools at your disposal:
+
+- Interactive lessons, using quizzes and light in-browser tasks
+- Lessons which guide the user through a list of real-world steps to take (for instance, yoga poses)
+
+Each of these should be based on a **feedback loop**, where the user receives feedback on their performance. This feedback loop should be as tight as possible, giving feedback immediately - and ideally automatically.
+
+For quizzes, each answer should be exactly the same number of words (and characters, if possible). Don't give the user any clues about the answer through formatting.
+
+## Acquiring Wisdom
+
+Wisdom comes from true real-world interaction - testing your skills outside the learning environment.
+
+When the user asks a question that appears to require wisdom, your default posture should be to attempt to answer - but to ultimately delegate to a **community**.
+
+A community is a place (online or offline) where the user can test their skills in the real world. This might be a forum, a subreddit, a real-world class (budget permitting) or a local interest group.
+
+You should attempt to find high-reputation communities the user can join. If the user expresses a preference that they don't want to join a community, respect it.
+
+## Reference Documents
+
+While creating lessons, you should also create reference documents. Lessons can reference these documents - they are useful for tracking raw units of knowledge useful across lessons.
+
+Lessons will rarely be revisited later - reference documents will be. They should be the compressed essence of the lesson, in a format designed for quick reference.
+
+Some learning topics lend themselves to reference:
+
+- Syntax and code snippets for programming
+- Algorithms and flowcharts for processes
+- Yoga poses and sequences for yoga
+- Exercises and routines for fitness
+- Glossaries for any topic with its own nomenclature
+
+Glossaries, in particular, are an essential reference. Once one is created, it should be adhered to in every lesson.
+
+## `NOTES.md`
+
+The user will sometimes express preferences of how they want to be taught, or things you should keep in mind. This is the place to record those preferences, so you can refer back to them when designing lessons or working with the user.
diff --git a/skills-lock.json b/skills-lock.json
index 63251484..2eafa0f6 100644
--- a/skills-lock.json
+++ b/skills-lock.json
@@ -1,6 +1,12 @@
 {
   "version": 1,
   "skills": {
+    "caveman": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/productivity/caveman/SKILL.md",
+      "computedHash": "934433479903febc585bf6deb5f0cebc63137e3f86b7babe0aab1ecb94d6d7a4"
+    },
     "diagnose": {
       "source": "mattpocock/skills",
       "sourceType": "github",
@@ -67,6 +73,12 @@
       "skillPath": "skills/engineering/tdd/SKILL.md",
       "computedHash": "15a7b5e36383ebadb2dec5e586679e55e9663d292da418926b8da6fc0ef27d84"
     },
+    "teach": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/productivity/teach/SKILL.md",
+      "computedHash": "9bbda5627df9d1d46082c7d839f53a04b2a884451f7f7c45fc9860d852b19453"
+    },
     "ubiquitous-language": {
       "source": "mattpocock/skills",
       "sourceType": "github",

From d47858a186867f28c2307e17ac9241e2be6f5453 Mon Sep 17 00:00:00 2001
From: Daniel Mader <daniel.mader@impierce.com>
Date: Thu, 18 Jun 2026 20:49:04 +0200
Subject: [PATCH 18/34] feat: create public offers for static credentials
 (#354)

---
 agent_api_http/openapi-generated.yaml         | 143 ++++
 agent_api_http/src/lib.rs                     |   8 +-
 .../authorization_server/token.rs             | 170 +++++
 agent_api_http/src/v0/authorization/error.rs  |   1 +
 .../credential_issuer/credential_offer.rs     |   5 +
 agent_api_http/src/v0/issuance/error.rs       |  29 +-
 agent_api_http/src/v0/issuance/mod.rs         |  28 +-
 agent_api_http/src/v0/issuance/openapi.rs     |  20 +-
 .../src/v0/issuance/public_offers.rs          | 657 ++++++++++++++++++
 .../src/application/token_issuance_service.rs |  25 +
 agent_event_publisher_http/src/lib.rs         |   4 +
 agent_event_publisher_nats/src/lib.rs         |   4 +
 agent_issuance/src/lib.rs                     |   1 +
 agent_issuance/src/offer/aggregate.rs         |   8 +-
 agent_issuance/src/offer/views/mod.rs         |   1 +
 agent_issuance/src/public_offer/aggregate.rs  | 378 ++++++++++
 agent_issuance/src/public_offer/command.rs    |  11 +
 agent_issuance/src/public_offer/error.rs      |  13 +
 agent_issuance/src/public_offer/event.rs      |  33 +
 agent_issuance/src/public_offer/mod.rs        |  13 +
 agent_issuance/src/public_offer/state.rs      |  17 +
 agent_issuance/src/public_offer/views/mod.rs  | 276 ++++++++
 agent_issuance/src/state.rs                   |  13 +-
 agent_store/src/lib.rs                        |  31 +-
 features/public-credential-offers/README.md   |  47 ++
 25 files changed, 1926 insertions(+), 10 deletions(-)
 create mode 100644 agent_api_http/src/v0/issuance/public_offers.rs
 create mode 100644 agent_issuance/src/public_offer/aggregate.rs
 create mode 100644 agent_issuance/src/public_offer/command.rs
 create mode 100644 agent_issuance/src/public_offer/error.rs
 create mode 100644 agent_issuance/src/public_offer/event.rs
 create mode 100644 agent_issuance/src/public_offer/mod.rs
 create mode 100644 agent_issuance/src/public_offer/state.rs
 create mode 100644 agent_issuance/src/public_offer/views/mod.rs
 create mode 100644 features/public-credential-offers/README.md

diff --git a/agent_api_http/openapi-generated.yaml b/agent_api_http/openapi-generated.yaml
index 5c508cf4..a63c4aab 100644
--- a/agent_api_http/openapi-generated.yaml
+++ b/agent_api_http/openapi-generated.yaml
@@ -123,6 +123,25 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/Connection'
+  /v0/create-public-offer:
+    post:
+      tags:
+      - Issuance
+      summary: Create a public offer mapping
+      operationId: create_public_offer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CreatePublicOfferRequest'
+        required: true
+      responses:
+        '201':
+          description: Public offer created successfully
+        '400':
+          description: Template schema invalid for public offers
+        '404':
+          description: Template or offer not found
   /v0/credential-configurations:
     post:
       tags:
@@ -196,6 +215,23 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/Credential'
+  /v0/delete-public-offer:
+    post:
+      tags:
+      - Issuance
+      summary: Delete a public offer
+      operationId: delete_public_offer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/DeletePublicOfferRequest'
+        required: true
+      responses:
+        '204':
+          description: Public offer deleted successfully
+        '404':
+          description: Public offer not found
   /v0/documents:
     get:
       tags:
@@ -242,6 +278,21 @@ paths:
                 $ref: '#/components/schemas/Document'
         '404':
           description: Document not found
+  /v0/get-all-public-offers:
+    get:
+      tags:
+      - Issuance
+      summary: Get all public offers
+      operationId: all_public_offers
+      responses:
+        '200':
+          description: Public offers retrieved successfully
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/PublicOfferStatusDto'
   /v0/holder/credentials:
     get:
       tags:
@@ -465,6 +516,40 @@ paths:
       responses:
         '200':
           description: Profile updated successfully
+  /v0/take-public-offer-offline:
+    post:
+      tags:
+      - Issuance
+      summary: Take a public offer offline
+      operationId: take_public_offer_offline
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/TakePublicOfferOfflineRequest'
+        required: true
+      responses:
+        '204':
+          description: Public offer taken offline successfully
+        '404':
+          description: Public offer not found
+  /v0/take-public-offer-online:
+    post:
+      tags:
+      - Issuance
+      summary: Take a public offer online
+      operationId: take_public_offer_online
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/TakePublicOfferOnlineRequest'
+        required: true
+      responses:
+        '204':
+          description: Public offer taken online successfully
+        '404':
+          description: Public offer not found
   /v0/templates/create-template:
     post:
       tags:
@@ -670,6 +755,16 @@ components:
           type:
           - string
           - 'null'
+    CreatePublicOfferRequest:
+      type: object
+      required:
+      - offerId
+      - templateId
+      properties:
+        offerId:
+          type: string
+        templateId:
+          type: string
     CreateTemplateEndpointRequest:
       type: object
       properties:
@@ -950,6 +1045,13 @@ components:
       - w3c_vc_data_model_v2-0
       - open_badges_3-0
       - european_learning_model_v3-3
+    DeletePublicOfferRequest:
+      type: object
+      required:
+      - offerId
+      properties:
+        offerId:
+          type: string
     DeleteTemplateEndpointRequest:
       type: object
       required:
@@ -1178,6 +1280,10 @@ components:
           type:
           - string
           - 'null'
+        successful_issuances:
+          type: integer
+          format: int32
+          minimum: 0
         tx_code:
           type:
           - string
@@ -1281,6 +1387,29 @@ components:
       properties:
         selectivelyDisclosable:
           type: boolean
+    PublicOfferStatus:
+      type: string
+      enum:
+      - Active
+      - Inactive
+    PublicOfferStatusDto:
+      type: object
+      required:
+      - id
+      - templateId
+      - amountIssued
+      - status
+      properties:
+        amountIssued:
+          type: integer
+          format: int32
+          minimum: 0
+        id:
+          type: string
+        status:
+          $ref: '#/components/schemas/PublicOfferStatus'
+        templateId:
+          type: string
     RemoveConnectionRequest:
       type: object
       required:
@@ -1312,6 +1441,20 @@ components:
       properties:
         id:
           type: string
+    TakePublicOfferOfflineRequest:
+      type: object
+      required:
+      - offerId
+      properties:
+        offerId:
+          type: string
+    TakePublicOfferOnlineRequest:
+      type: object
+      required:
+      - offerId
+      properties:
+        offerId:
+          type: string
     TargetUrlOfferEndpointRequest:
       type: object
       required:
diff --git a/agent_api_http/src/lib.rs b/agent_api_http/src/lib.rs
index 45286693..6d50e1b8 100644
--- a/agent_api_http/src/lib.rs
+++ b/agent_api_http/src/lib.rs
@@ -54,7 +54,7 @@ pub fn app(
 ) -> Router {
     let app = Router::new()
         .merge(identity_state.map(v0::identity::router).unwrap_or_default())
-        .merge(library_state.map(v0::library::router).unwrap_or_default())
+        .merge(library_state.clone().map(v0::library::router).unwrap_or_default())
         .merge(
             authorization_state
                 // The `IssuanceState` is cloned here to ensure that the authorization router can access it. This is
@@ -64,7 +64,11 @@ pub fn app(
                 .map(v0::authorization::router)
                 .unwrap_or_default(),
         )
-        .merge(issuance_state.map(v0::issuance::router).unwrap_or_default())
+        .merge(
+            issuance_state
+                .map(|issuance_state| v0::issuance::router_with_library(issuance_state, library_state.clone()))
+                .unwrap_or_default(),
+        )
         .merge(holder_state.map(v0::holder::router).unwrap_or_default())
         .merge(verification_state.map(v0::verification::router).unwrap_or_default())
         .merge(public::router())
diff --git a/agent_api_http/src/v0/authorization/authorization_server/token.rs b/agent_api_http/src/v0/authorization/authorization_server/token.rs
index d8fafe86..ffbceccb 100644
--- a/agent_api_http/src/v0/authorization/authorization_server/token.rs
+++ b/agent_api_http/src/v0/authorization/authorization_server/token.rs
@@ -41,8 +41,10 @@ pub mod tests {
     use agent_authorization::{
         domain::oauth2_authorization_request::aggregate::test_utils::code_verifier, state::UNIME_REDIRECT_URI,
     };
+    use agent_issuance::public_offer::command::PublicOfferCommand;
     use agent_issuance::services::IssuanceServices;
     use agent_secret_manager::service::Service;
+    use agent_shared::handlers::command_handler;
     use agent_store::{authorization_state, in_memory::InMemory, issuance_state};
     use axum::{
         body::Body,
@@ -177,4 +179,172 @@ pub mod tests {
 
         let _access_token = token(&mut app, is_pre_authorized, grants).await;
     }
+
+    #[serial_test::serial]
+    #[tokio::test]
+    async fn test_pre_authorized_token_redemption_fails_when_public_offer_is_offline() {
+        let issuance_state =
+            Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
+
+        agent_issuance::state::initialize(&issuance_state).await.unwrap();
+
+        let mut issuance_app = issuance::router(issuance_state.clone());
+        credentials(&mut issuance_app, "001").await;
+        let (_authorization_code, pre_authorized_code) = offers(&mut issuance_app, "001").await.unwrap();
+
+        let offer_id = crate::tests::OFFER_ID;
+        let aggregate_id = format!("public_offer:{offer_id}");
+
+        command_handler(
+            &aggregate_id,
+            &issuance_state.command.public_offer,
+            PublicOfferCommand::Create {
+                offer_id: offer_id.to_string(),
+                template_id: "template-001".to_string(),
+            },
+        )
+        .await
+        .unwrap();
+
+        command_handler(
+            &aggregate_id,
+            &issuance_state.command.public_offer,
+            PublicOfferCommand::TakeOffline {
+                offer_id: offer_id.to_string(),
+            },
+        )
+        .await
+        .unwrap();
+
+        let authorization_state = Arc::new(
+            authorization_state(
+                &InMemory,
+                AuthorizationServices::default().await,
+                Default::default(),
+                Default::default(),
+            )
+            .await,
+        );
+
+        agent_authorization::state::initialize(&authorization_state)
+            .await
+            .unwrap();
+
+        let mut app = authorization::router((authorization_state, issuance_state));
+
+        let pre_authorized_code = pre_authorized_code
+            .expect("expected pre-authorized code for pre-authorized flow")
+            .pre_authorized_code;
+
+        let token_request = TokenRequest::PreAuthorizedCode {
+            pre_authorized_code,
+            tx_code: None,
+            authorization_details: None,
+        };
+
+        let response = app
+            .call(
+                Request::builder()
+                    .method(http::Method::POST)
+                    .uri("/auth/token")
+                    .header(
+                        http::header::CONTENT_TYPE,
+                        mime::APPLICATION_WWW_FORM_URLENCODED.as_ref(),
+                    )
+                    .body(Body::from(to_form_urlencoded_string(&token_request).unwrap()))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+
+        assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let body = String::from_utf8(body.to_vec()).unwrap();
+        assert!(body.contains("invalid_grant"));
+    }
+
+    #[serial_test::serial]
+    #[tokio::test]
+    async fn test_pre_authorized_token_redemption_fails_when_public_offer_is_deleted() {
+        let issuance_state =
+            Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
+
+        agent_issuance::state::initialize(&issuance_state).await.unwrap();
+
+        let mut issuance_app = issuance::router(issuance_state.clone());
+        credentials(&mut issuance_app, "001").await;
+        let (_authorization_code, pre_authorized_code) = offers(&mut issuance_app, "001").await.unwrap();
+
+        let offer_id = crate::tests::OFFER_ID;
+        let aggregate_id = format!("public_offer:{offer_id}");
+
+        command_handler(
+            &aggregate_id,
+            &issuance_state.command.public_offer,
+            PublicOfferCommand::Create {
+                offer_id: offer_id.to_string(),
+                template_id: "template-001".to_string(),
+            },
+        )
+        .await
+        .unwrap();
+
+        command_handler(
+            &aggregate_id,
+            &issuance_state.command.public_offer,
+            PublicOfferCommand::Delete {
+                offer_id: offer_id.to_string(),
+            },
+        )
+        .await
+        .unwrap();
+
+        let authorization_state = Arc::new(
+            authorization_state(
+                &InMemory,
+                AuthorizationServices::default().await,
+                Default::default(),
+                Default::default(),
+            )
+            .await,
+        );
+
+        agent_authorization::state::initialize(&authorization_state)
+            .await
+            .unwrap();
+
+        let mut app = authorization::router((authorization_state, issuance_state));
+
+        let pre_authorized_code = pre_authorized_code
+            .expect("expected pre-authorized code for pre-authorized flow")
+            .pre_authorized_code;
+
+        let token_request = TokenRequest::PreAuthorizedCode {
+            pre_authorized_code,
+            tx_code: None,
+            authorization_details: None,
+        };
+
+        let response = app
+            .call(
+                Request::builder()
+                    .method(http::Method::POST)
+                    .uri("/auth/token")
+                    .header(
+                        http::header::CONTENT_TYPE,
+                        mime::APPLICATION_WWW_FORM_URLENCODED.as_ref(),
+                    )
+                    .body(Body::from(to_form_urlencoded_string(&token_request).unwrap()))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+
+        assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let body = String::from_utf8(body.to_vec()).unwrap();
+        assert!(body.contains("invalid_grant"));
+    }
 }
diff --git a/agent_api_http/src/v0/authorization/error.rs b/agent_api_http/src/v0/authorization/error.rs
index c300d370..11e677e0 100644
--- a/agent_api_http/src/v0/authorization/error.rs
+++ b/agent_api_http/src/v0/authorization/error.rs
@@ -12,6 +12,7 @@ impl IntoPublicError for TokenIssuanceError {
             MissingTxCodeError => PublicError::from(TokenErrorResponse::InvalidRequest),
             InvalidTxCodeError => PublicError::from(TokenErrorResponse::InvalidGrant),
             InvalidPreAuthorizedCodeError => PublicError::from(TokenErrorResponse::InvalidGrant),
+            InactivePublicOfferError => PublicError::from(TokenErrorResponse::InvalidGrant),
             UnrequestedTxCodeError => PublicError::from(TokenErrorResponse::InvalidRequest),
             MissingAccessTokenError => PublicError::from(TokenErrorResponse::InvalidRequest),
             Internal(_) => PublicError::InternalServerError,
diff --git a/agent_api_http/src/v0/issuance/credential_issuer/credential_offer.rs b/agent_api_http/src/v0/issuance/credential_issuer/credential_offer.rs
index 6ffbe220..03fa323e 100644
--- a/agent_api_http/src/v0/issuance/credential_issuer/credential_offer.rs
+++ b/agent_api_http/src/v0/issuance/credential_issuer/credential_offer.rs
@@ -1,4 +1,5 @@
 use crate::handlers::query_handler;
+use crate::v0::issuance::public_offers::can_resolve_public_offer;
 use agent_issuance::{offer::aggregate::Offer, state::IssuanceState};
 use axum::{
     extract::{Path, State},
@@ -15,6 +16,10 @@ pub(crate) async fn credential_offer_uri(
     State(state): State<Arc<IssuanceState>>,
     Path(offer_id): Path<String>,
 ) -> Result<Response, ApiError> {
+    if !can_resolve_public_offer(&state, &offer_id).await? {
+        return Err(ApiError::new(StatusCode::NOT_FOUND));
+    }
+
     match query_handler(&offer_id, &state.query.offer).await? {
         Some(Offer {
             credential_offer: Some(CredentialOffer::CredentialOffer(credential_offer_parameters)),
diff --git a/agent_api_http/src/v0/issuance/error.rs b/agent_api_http/src/v0/issuance/error.rs
index 69423df8..eb9a5d0f 100644
--- a/agent_api_http/src/v0/issuance/error.rs
+++ b/agent_api_http/src/v0/issuance/error.rs
@@ -4,7 +4,8 @@ use crate::{
 };
 use agent_issuance::{
     application::access_token_validation_service::AccessTokenValidationError, credential::error::CredentialError,
-    offer::error::OfferError, server_config::error::ServerConfigError, status_list::error::StatusListError,
+    offer::error::OfferError, public_offer::error::PublicOfferError, server_config::error::ServerConfigError,
+    status_list::error::StatusListError,
 };
 use axum::{response::IntoResponse, response::Response, Json};
 use http_api_problem::ApiError;
@@ -155,6 +156,23 @@ impl IntoApiErrorExt for StatusListError {
     }
 }
 
+impl IntoApiErrorExt for PublicOfferError {
+    fn into_api_error(self) -> ApiError {
+        use PublicOfferError::*;
+
+        match self {
+            AlreadyExists => ApiError::new(StatusCode::CONFLICT),
+            NotFound => ApiError::new(StatusCode::NOT_FOUND),
+            TemplateNotFound => ApiError::new(StatusCode::NOT_FOUND),
+            TemplateNotEligible => ApiError::builder(StatusCode::BAD_REQUEST)
+                .title("Template Not Eligible for Public Offer")
+                .type_url(type_url("issuance#template-not-eligible-for-public-offer"))
+                .message("Public offers require templates that only contain constant values.")
+                .finish(),
+        }
+    }
+}
+
 pub enum PublicError {
     TokenError(OID4VCError<TokenErrorResponse>),
     CredentialError(OID4VCError<CredentialErrorResponse>),
@@ -256,6 +274,15 @@ impl IntoPublicError for OfferError {
     }
 }
 
+impl IntoPublicError for PublicOfferError {
+    fn into_public_error(self) -> PublicError {
+        match self {
+            PublicOfferError::NotFound => PublicError::NotFoundError,
+            _ => PublicError::InternalServerError,
+        }
+    }
+}
+
 impl IntoPublicError for ServerConfigError {
     fn into_public_error(self) -> PublicError {
         use ServerConfigError::*;
diff --git a/agent_api_http/src/v0/issuance/mod.rs b/agent_api_http/src/v0/issuance/mod.rs
index 1a059392..0d4a87a5 100644
--- a/agent_api_http/src/v0/issuance/mod.rs
+++ b/agent_api_http/src/v0/issuance/mod.rs
@@ -6,6 +6,7 @@ pub mod ietf_oauth_sd_jwt_vc;
 pub mod nonce;
 pub mod offers;
 pub mod openapi;
+pub mod public_offers;
 
 pub mod error;
 
@@ -26,15 +27,24 @@ use crate::v0::issuance::{
         all_offers, offer, offers,
         send::{individual_offer, organization_offer},
     },
+    public_offers::{
+        all_public_offers, create_public_offer, delete_public_offer, take_public_offer_offline,
+        take_public_offer_online,
+    },
 };
 use crate::API_VERSION;
 use agent_issuance::state::IssuanceState;
+use agent_library::state::LibraryState;
 use axum::routing::get;
 use axum::{routing::post, Router};
 use std::sync::Arc;
 
 pub fn router(issuance_state: Arc<IssuanceState>) -> Router {
-    Router::new()
+    router_with_library(issuance_state, None)
+}
+
+pub fn router_with_library(issuance_state: Arc<IssuanceState>, library_state: Option<Arc<LibraryState>>) -> Router {
+    let issuance_router = Router::new()
         .nest(
             API_VERSION,
             Router::new()
@@ -64,5 +74,19 @@ pub fn router(issuance_state: Arc<IssuanceState>) -> Router {
             "/vct/{credential_configuration_id}/{version}",
             get(ietf_oauth_sd_jwt_vc::type_metadata),
         )
-        .with_state(issuance_state)
+        .with_state(issuance_state.clone());
+
+    let public_offer_router = Router::new()
+        .nest(
+            API_VERSION,
+            Router::new()
+                .route("/get-all-public-offers", get(all_public_offers))
+                .route("/create-public-offer", post(create_public_offer))
+                .route("/take-public-offer-offline", post(take_public_offer_offline))
+                .route("/take-public-offer-online", post(take_public_offer_online))
+                .route("/delete-public-offer", post(delete_public_offer)),
+        )
+        .with_state((issuance_state, library_state));
+
+    issuance_router.merge(public_offer_router)
 }
diff --git a/agent_api_http/src/v0/issuance/openapi.rs b/agent_api_http/src/v0/issuance/openapi.rs
index 3ee614ad..b752eb9a 100644
--- a/agent_api_http/src/v0/issuance/openapi.rs
+++ b/agent_api_http/src/v0/issuance/openapi.rs
@@ -4,11 +4,29 @@ use crate::v0::issuance::offers::{
     __path_all_offers, __path_offer,
     send::{__path_individual_offer, __path_organization_offer},
 };
+use crate::v0::issuance::public_offers::{
+    __path_all_public_offers, __path_create_public_offer, __path_delete_public_offer, __path_take_public_offer_offline,
+    __path_take_public_offer_online,
+};
 use utoipa::OpenApi;
 
 #[derive(OpenApi)]
 #[openapi(
-    paths(credential_configurations,all_credentials, credential, credentials, all_offers, offer, individual_offer, organization_offer),
+    paths(
+        credential_configurations,
+        all_credentials,
+        credential,
+        credentials,
+        all_offers,
+        offer,
+        individual_offer,
+        organization_offer,
+        all_public_offers,
+        create_public_offer,
+        take_public_offer_offline,
+        take_public_offer_online,
+        delete_public_offer
+    ),
     tags(
         (name = "Credentials", description = "Create and revoke verifiable credentials."),
         (name = "Issuance", description = "Issue credentials to individuals and organizations, manage credential offers and track their status."),
diff --git a/agent_api_http/src/v0/issuance/public_offers.rs b/agent_api_http/src/v0/issuance/public_offers.rs
new file mode 100644
index 00000000..5b8b2b7e
--- /dev/null
+++ b/agent_api_http/src/v0/issuance/public_offers.rs
@@ -0,0 +1,657 @@
+use crate::error::IntoApiErrorExt;
+use crate::handlers::{command_handler, query_handler};
+use agent_issuance::public_offer::aggregate::PublicOffer;
+use agent_issuance::public_offer::command::PublicOfferCommand;
+use agent_issuance::public_offer::error::PublicOfferError;
+use agent_issuance::state::IssuanceState;
+use agent_library::state::LibraryState;
+use agent_library::template::aggregate::Status;
+use axum::{
+    extract::State,
+    response::{IntoResponse, Response},
+    Json,
+};
+use http_api_problem::ApiError;
+use hyper::StatusCode;
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use std::sync::Arc;
+
+/// public-offer aggregate ID is namespaced, so it doesn't collide with existing offer streams.
+fn public_offer_aggregate_id(offer_id: &str) -> String {
+    format!("public_offer:{offer_id}")
+}
+
+/// Validates that a schema only contains const-only leaf fields.
+/// A const-only leaf is a field without properties that has `const` set.
+fn validate_schema_has_only_consts(schema: &Option<Value>) -> Result<(), PublicOfferError> {
+    match schema {
+        None => Ok(()),
+        Some(root) => {
+            if !root.is_object() {
+                return Ok(());
+            }
+
+            let properties = root
+                .get("properties")
+                .and_then(|p| p.as_object())
+                .ok_or(PublicOfferError::TemplateNotEligible)?;
+
+            for (_key, prop) in properties {
+                validate_leaf_is_const(prop)?;
+            }
+
+            Ok(())
+        }
+    }
+}
+
+/// Recursively validates that a schema property is either a const value or a container with const children.
+fn validate_leaf_is_const(prop: &Value) -> Result<(), PublicOfferError> {
+    if !prop.is_object() {
+        return Err(PublicOfferError::TemplateNotEligible);
+    }
+
+    let obj = prop.as_object().unwrap();
+
+    // If this has nested properties, it's a container—recurse into children.
+    if let Some(nested_props) = obj.get("properties").and_then(|p| p.as_object()) {
+        for (_key, nested) in nested_props {
+            validate_leaf_is_const(nested)?;
+        }
+        return Ok(());
+    }
+
+    // If this is a leaf and has const, it's valid.
+    if obj.contains_key("const") {
+        return Ok(());
+    }
+
+    // Leaf without const is invalid.
+    Err(PublicOfferError::TemplateNotEligible)
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, utoipa::ToSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct PublicOfferStatusDto {
+    pub id: String,
+    pub template_id: String,
+    pub amount_issued: u32,
+    pub status: PublicOfferStatus,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq, utoipa::ToSchema)]
+pub enum PublicOfferStatus {
+    Active,
+    Inactive,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize, utoipa::ToSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct CreatePublicOfferRequest {
+    pub offer_id: String,
+    pub template_id: String,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize, utoipa::ToSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct TakePublicOfferOfflineRequest {
+    pub offer_id: String,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize, utoipa::ToSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct TakePublicOfferOnlineRequest {
+    pub offer_id: String,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize, utoipa::ToSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct DeletePublicOfferRequest {
+    pub offer_id: String,
+}
+
+impl From<&PublicOffer> for PublicOfferStatusDto {
+    fn from(offer: &PublicOffer) -> Self {
+        PublicOfferStatusDto {
+            id: offer.id.clone(),
+            template_id: offer.template_id.clone(),
+            amount_issued: 0,
+            status: if offer.active && !offer.deleted {
+                PublicOfferStatus::Active
+            } else {
+                PublicOfferStatus::Inactive
+            },
+        }
+    }
+}
+
+/// Get all public offers
+#[utoipa::path(
+    get,
+    path = "/get-all-public-offers",
+    tags = ["Issuance"],
+    responses(
+        (status = 200, description = "Public offers retrieved successfully", body = [PublicOfferStatusDto])
+    )
+)]
+#[axum_macros::debug_handler]
+pub(crate) async fn all_public_offers(
+    State((issuance_state, _library_state)): State<(Arc<IssuanceState>, Option<Arc<LibraryState>>)>,
+) -> Result<Response, ApiError> {
+    let all_offers = query_handler("all_public_offers", &issuance_state.query.all_public_offers)
+        .await?
+        .unwrap_or_default();
+
+    let mut offers = Vec::with_capacity(all_offers.offers.len());
+
+    for public_offer in all_offers.offers.values() {
+        let mut dto = PublicOfferStatusDto::from(public_offer);
+        if let Some(offer_view) = query_handler(&public_offer.id, &issuance_state.query.offer).await? {
+            dto.amount_issued = offer_view.successful_issuances;
+        }
+        offers.push(dto);
+    }
+
+    Ok((StatusCode::OK, Json(offers)).into_response())
+}
+
+/// Create a public offer mapping
+#[utoipa::path(
+    post,
+    path = "/create-public-offer",
+    tags = ["Issuance"],
+    request_body = CreatePublicOfferRequest,
+    responses(
+        (status = 201, description = "Public offer created successfully"),
+        (status = 404, description = "Template or offer not found"),
+        (status = 400, description = "Template schema invalid for public offers")
+    )
+)]
+#[axum_macros::debug_handler]
+pub(crate) async fn create_public_offer(
+    State((issuance_state, library_state)): State<(Arc<IssuanceState>, Option<Arc<LibraryState>>)>,
+    Json(CreatePublicOfferRequest { offer_id, template_id }): Json<CreatePublicOfferRequest>,
+) -> Result<Response, ApiError> {
+    if query_handler(&offer_id, &issuance_state.query.offer).await?.is_none() {
+        return Err(ApiError::new(StatusCode::NOT_FOUND));
+    }
+
+    // Query the template from library state to validate it exists and has valid schema
+    let library_state = library_state.ok_or_else(|| PublicOfferError::TemplateNotFound.into_api_error())?;
+
+    let template = query_handler(&template_id, &library_state.query.template)
+        .await
+        .map_err(|_| PublicOfferError::TemplateNotFound.into_api_error())?
+        .ok_or_else(|| PublicOfferError::TemplateNotFound.into_api_error())?;
+
+    // Only non-deleted templates can be offered publicly
+    if template.status == Status::Deleted {
+        return Err(PublicOfferError::TemplateNotFound.into_api_error());
+    }
+
+    // Validate that the template schema only contains const-only leaf fields
+    validate_schema_has_only_consts(&template.schema).map_err(|e| e.into_api_error())?;
+
+    let command = PublicOfferCommand::Create {
+        offer_id: offer_id.clone(),
+        template_id,
+    };
+
+    let aggregate_id = public_offer_aggregate_id(&offer_id);
+    command_handler(&aggregate_id, &issuance_state.command.public_offer, command).await?;
+
+    Ok((StatusCode::CREATED).into_response())
+}
+
+/// Take a public offer offline
+#[utoipa::path(
+    post,
+    path = "/take-public-offer-offline",
+    tags = ["Issuance"],
+    request_body = TakePublicOfferOfflineRequest,
+    responses(
+        (status = 204, description = "Public offer taken offline successfully"),
+        (status = 404, description = "Public offer not found")
+    )
+)]
+#[axum_macros::debug_handler]
+pub(crate) async fn take_public_offer_offline(
+    State((issuance_state, _library_state)): State<(Arc<IssuanceState>, Option<Arc<LibraryState>>)>,
+    Json(TakePublicOfferOfflineRequest { offer_id }): Json<TakePublicOfferOfflineRequest>,
+) -> Result<Response, ApiError> {
+    let command = PublicOfferCommand::TakeOffline {
+        offer_id: offer_id.clone(),
+    };
+
+    let aggregate_id = public_offer_aggregate_id(&offer_id);
+    command_handler(&aggregate_id, &issuance_state.command.public_offer, command).await?;
+
+    Ok((StatusCode::NO_CONTENT).into_response())
+}
+
+/// Take a public offer online
+#[utoipa::path(
+    post,
+    path = "/take-public-offer-online",
+    tags = ["Issuance"],
+    request_body = TakePublicOfferOnlineRequest,
+    responses(
+        (status = 204, description = "Public offer taken online successfully"),
+        (status = 404, description = "Public offer not found")
+    )
+)]
+#[axum_macros::debug_handler]
+pub(crate) async fn take_public_offer_online(
+    State((issuance_state, _library_state)): State<(Arc<IssuanceState>, Option<Arc<LibraryState>>)>,
+    Json(TakePublicOfferOnlineRequest { offer_id }): Json<TakePublicOfferOnlineRequest>,
+) -> Result<Response, ApiError> {
+    let command = PublicOfferCommand::TakeOnline {
+        offer_id: offer_id.clone(),
+    };
+
+    let aggregate_id = public_offer_aggregate_id(&offer_id);
+    command_handler(&aggregate_id, &issuance_state.command.public_offer, command).await?;
+
+    Ok((StatusCode::NO_CONTENT).into_response())
+}
+
+/// Delete a public offer
+#[utoipa::path(
+    post,
+    path = "/delete-public-offer",
+    tags = ["Issuance"],
+    request_body = DeletePublicOfferRequest,
+    responses(
+        (status = 204, description = "Public offer deleted successfully"),
+        (status = 404, description = "Public offer not found")
+    )
+)]
+#[axum_macros::debug_handler]
+pub(crate) async fn delete_public_offer(
+    State((issuance_state, _library_state)): State<(Arc<IssuanceState>, Option<Arc<LibraryState>>)>,
+    Json(DeletePublicOfferRequest { offer_id }): Json<DeletePublicOfferRequest>,
+) -> Result<Response, ApiError> {
+    let command = PublicOfferCommand::Delete {
+        offer_id: offer_id.clone(),
+    };
+
+    let aggregate_id = public_offer_aggregate_id(&offer_id);
+    command_handler(&aggregate_id, &issuance_state.command.public_offer, command).await?;
+
+    Ok((StatusCode::NO_CONTENT).into_response())
+}
+
+/// Check if a public offer can be resolved (is active and not deleted)
+pub(crate) async fn can_resolve_public_offer(state: &Arc<IssuanceState>, offer_id: &str) -> Result<bool, ApiError> {
+    let aggregate_id = public_offer_aggregate_id(offer_id);
+
+    match query_handler(&aggregate_id, &state.query.public_offer).await? {
+        Some(offer) => Ok(offer.active && !offer.deleted),
+        // If there is no public-offer record, treat it as a normal offer.
+        None => Ok(true),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::handlers::command_handler;
+    use crate::v0::issuance::{credentials::tests::credentials, router_with_library};
+    use crate::API_VERSION;
+    use agent_issuance::services::IssuanceServices;
+    use agent_issuance::state::initialize;
+    use agent_library::state::LibraryState;
+    use agent_library::template::aggregate::{Status as TemplateStatus, Visibility};
+    use agent_library::template::command::TemplateCommand;
+    use agent_secret_manager::service::Service;
+    use agent_store::in_memory::InMemory;
+    use agent_store::{issuance_state, library_state};
+    use axum::{
+        body::Body,
+        http::{self, Request, StatusCode},
+        Router,
+    };
+    use serde_json::Value;
+    use std::sync::Arc;
+    use tower::Service as _;
+
+    const TEMPLATE_ID: &str = "template-001";
+
+    async fn create_public_offer_request(offer_id: &str, template_id: &str) -> Request<Body> {
+        Request::builder()
+            .method(http::Method::POST)
+            .uri(format!("{API_VERSION}/create-public-offer"))
+            .header(http::header::CONTENT_TYPE, mime::APPLICATION_JSON.as_ref())
+            .body(Body::from(
+                serde_json::to_vec(&serde_json::json!({
+                    "offerId": offer_id,
+                    "templateId": template_id,
+                }))
+                .unwrap(),
+            ))
+            .unwrap()
+    }
+
+    async fn get_all_public_offers_request() -> Request<Body> {
+        Request::builder()
+            .method(http::Method::GET)
+            .uri(format!("{API_VERSION}/get-all-public-offers"))
+            .body(Body::empty())
+            .unwrap()
+    }
+
+    async fn setup_app() -> (Router, Arc<LibraryState>) {
+        let issuance_state =
+            Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
+        let library_state = Arc::new(library_state(&InMemory, Default::default(), Default::default()).await);
+
+        initialize(&issuance_state).await.unwrap();
+
+        (
+            router_with_library(issuance_state, Some(library_state.clone())),
+            library_state,
+        )
+    }
+
+    async fn create_template(library_state: &Arc<LibraryState>, template_id: &str, schema: Option<Value>) {
+        let command = TemplateCommand::CreateTemplate {
+            template_id: template_id.to_string(),
+            source_template_id: None,
+            title: Some("Template".to_string()),
+            display: Box::new(None),
+            data_model: None,
+            creator: None,
+            holder_type: None,
+            tags: vec![],
+            status: TemplateStatus::Draft,
+            visibility: Visibility::Private,
+            description: None,
+            r#type: vec![],
+            schema: Box::new(schema),
+            schema_properties_attributes: None,
+        };
+
+        command_handler(template_id, &library_state.command.template, command)
+            .await
+            .unwrap();
+    }
+
+    fn const_only_schema() -> Value {
+        serde_json::json!({
+            "type": "object",
+            "properties": {
+                "credentialSubject": {
+                    "type": "object",
+                    "properties": {
+                        "name": { "const": "Alice" }
+                    }
+                }
+            }
+        })
+    }
+
+    fn non_const_schema() -> Value {
+        serde_json::json!({
+            "type": "object",
+            "properties": {
+                "credentialSubject": {
+                    "type": "object",
+                    "properties": {
+                        "name": { "type": "string" }
+                    }
+                }
+            }
+        })
+    }
+
+    #[serial_test::serial]
+    #[tokio::test]
+    #[tracing_test::traced_test]
+    async fn test_get_all_public_offers_returns_empty_list() {
+        let (mut app, _library_state) = setup_app().await;
+
+        let response = app.call(get_all_public_offers_request().await).await.unwrap();
+        assert_eq!(response.status(), StatusCode::OK);
+
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let list: Vec<Value> = serde_json::from_slice(&body).unwrap();
+        assert!(list.is_empty());
+    }
+
+    #[serial_test::serial]
+    #[tokio::test]
+    #[tracing_test::traced_test]
+    async fn test_create_public_offer_succeeds() {
+        let (mut app, library_state) = setup_app().await;
+
+        create_template(&library_state, TEMPLATE_ID, Some(const_only_schema())).await;
+
+        // A credential (and its associated offer) must exist before creating a public offer.
+        credentials(&mut app, "001").await;
+
+        let response = app
+            .call(create_public_offer_request(crate::tests::OFFER_ID, TEMPLATE_ID).await)
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::CREATED);
+
+        // Should appear as Active in the list.
+        let response = app.call(get_all_public_offers_request().await).await.unwrap();
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let list: Vec<Value> = serde_json::from_slice(&body).unwrap();
+        assert_eq!(list.len(), 1);
+        assert_eq!(list[0]["status"], "Active");
+        assert_eq!(list[0]["id"], crate::tests::OFFER_ID);
+        assert_eq!(list[0]["templateId"], TEMPLATE_ID);
+    }
+
+    #[serial_test::serial]
+    #[tokio::test]
+    #[tracing_test::traced_test]
+    async fn test_create_public_offer_fails_when_underlying_offer_not_found() {
+        let (mut app, _library_state) = setup_app().await;
+
+        let response = app
+            .call(create_public_offer_request("nonexistent-offer", TEMPLATE_ID).await)
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::NOT_FOUND);
+    }
+
+    #[serial_test::serial]
+    #[tokio::test]
+    #[tracing_test::traced_test]
+    async fn test_create_public_offer_fails_when_already_exists() {
+        let (mut app, library_state) = setup_app().await;
+
+        create_template(&library_state, TEMPLATE_ID, Some(const_only_schema())).await;
+
+        credentials(&mut app, "001").await;
+
+        let first = app
+            .call(create_public_offer_request(crate::tests::OFFER_ID, TEMPLATE_ID).await)
+            .await
+            .unwrap();
+        assert_eq!(first.status(), StatusCode::CREATED);
+
+        // Second create on the same offer ID must fail with 409 Conflict.
+        let second = app
+            .call(create_public_offer_request(crate::tests::OFFER_ID, TEMPLATE_ID).await)
+            .await
+            .unwrap();
+        assert_eq!(second.status(), StatusCode::CONFLICT);
+    }
+
+    #[serial_test::serial]
+    #[tokio::test]
+    #[tracing_test::traced_test]
+    async fn test_take_public_offer_offline() {
+        let (mut app, library_state) = setup_app().await;
+
+        create_template(&library_state, TEMPLATE_ID, Some(const_only_schema())).await;
+
+        credentials(&mut app, "001").await;
+        let _ = app
+            .call(create_public_offer_request(crate::tests::OFFER_ID, TEMPLATE_ID).await)
+            .await
+            .unwrap();
+
+        let response = app
+            .call(
+                Request::builder()
+                    .method(http::Method::POST)
+                    .uri(format!("{API_VERSION}/take-public-offer-offline"))
+                    .header(http::header::CONTENT_TYPE, mime::APPLICATION_JSON.as_ref())
+                    .body(Body::from(
+                        serde_json::to_vec(&serde_json::json!({ "offerId": crate::tests::OFFER_ID })).unwrap(),
+                    ))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::NO_CONTENT);
+
+        let response = app.call(get_all_public_offers_request().await).await.unwrap();
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let list: Vec<Value> = serde_json::from_slice(&body).unwrap();
+        assert_eq!(list[0]["status"], "Inactive");
+    }
+
+    #[serial_test::serial]
+    #[tokio::test]
+    #[tracing_test::traced_test]
+    async fn test_take_public_offer_online() {
+        let (mut app, library_state) = setup_app().await;
+
+        create_template(&library_state, TEMPLATE_ID, Some(const_only_schema())).await;
+
+        credentials(&mut app, "001").await;
+        let _ = app
+            .call(create_public_offer_request(crate::tests::OFFER_ID, TEMPLATE_ID).await)
+            .await
+            .unwrap();
+
+        // Take offline first.
+        app.call(
+            Request::builder()
+                .method(http::Method::POST)
+                .uri(format!("{API_VERSION}/take-public-offer-offline"))
+                .header(http::header::CONTENT_TYPE, mime::APPLICATION_JSON.as_ref())
+                .body(Body::from(
+                    serde_json::to_vec(&serde_json::json!({ "offerId": crate::tests::OFFER_ID })).unwrap(),
+                ))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+
+        // Then bring back online.
+        let response = app
+            .call(
+                Request::builder()
+                    .method(http::Method::POST)
+                    .uri(format!("{API_VERSION}/take-public-offer-online"))
+                    .header(http::header::CONTENT_TYPE, mime::APPLICATION_JSON.as_ref())
+                    .body(Body::from(
+                        serde_json::to_vec(&serde_json::json!({ "offerId": crate::tests::OFFER_ID })).unwrap(),
+                    ))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::NO_CONTENT);
+
+        let response = app.call(get_all_public_offers_request().await).await.unwrap();
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let list: Vec<Value> = serde_json::from_slice(&body).unwrap();
+        assert_eq!(list[0]["status"], "Active");
+    }
+
+    #[serial_test::serial]
+    #[tokio::test]
+    #[tracing_test::traced_test]
+    async fn test_delete_public_offer_removes_from_list() {
+        let (mut app, library_state) = setup_app().await;
+
+        create_template(&library_state, TEMPLATE_ID, Some(const_only_schema())).await;
+
+        credentials(&mut app, "001").await;
+        let _ = app
+            .call(create_public_offer_request(crate::tests::OFFER_ID, TEMPLATE_ID).await)
+            .await
+            .unwrap();
+
+        let response = app
+            .call(
+                Request::builder()
+                    .method(http::Method::POST)
+                    .uri(format!("{API_VERSION}/delete-public-offer"))
+                    .header(http::header::CONTENT_TYPE, mime::APPLICATION_JSON.as_ref())
+                    .body(Body::from(
+                        serde_json::to_vec(&serde_json::json!({ "offerId": crate::tests::OFFER_ID })).unwrap(),
+                    ))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::NO_CONTENT);
+
+        let response = app.call(get_all_public_offers_request().await).await.unwrap();
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let list: Vec<Value> = serde_json::from_slice(&body).unwrap();
+        assert!(list.is_empty(), "deleted offer must not appear in list");
+    }
+
+    #[serial_test::serial]
+    #[tokio::test]
+    #[tracing_test::traced_test]
+    async fn test_take_public_offer_offline_returns_not_found_for_unknown_offer() {
+        let (mut app, _library_state) = setup_app().await;
+
+        let response = app
+            .call(
+                Request::builder()
+                    .method(http::Method::POST)
+                    .uri(format!("{API_VERSION}/take-public-offer-offline"))
+                    .header(http::header::CONTENT_TYPE, mime::APPLICATION_JSON.as_ref())
+                    .body(Body::from(
+                        serde_json::to_vec(&serde_json::json!({ "offerId": "nonexistent" })).unwrap(),
+                    ))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::NOT_FOUND);
+    }
+
+    #[serial_test::serial]
+    #[tokio::test]
+    #[tracing_test::traced_test]
+    async fn test_create_public_offer_fails_when_template_not_found() {
+        let (mut app, _library_state) = setup_app().await;
+
+        credentials(&mut app, "001").await;
+
+        let response = app
+            .call(create_public_offer_request(crate::tests::OFFER_ID, "missing-template").await)
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::NOT_FOUND);
+    }
+
+    #[serial_test::serial]
+    #[tokio::test]
+    #[tracing_test::traced_test]
+    async fn test_create_public_offer_fails_when_template_schema_has_non_const_leaf() {
+        let (mut app, library_state) = setup_app().await;
+
+        create_template(&library_state, TEMPLATE_ID, Some(non_const_schema())).await;
+        credentials(&mut app, "001").await;
+
+        let response = app
+            .call(create_public_offer_request(crate::tests::OFFER_ID, TEMPLATE_ID).await)
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    }
+}
diff --git a/agent_authorization/src/application/token_issuance_service.rs b/agent_authorization/src/application/token_issuance_service.rs
index 44d2c67f..a0eda2e9 100644
--- a/agent_authorization/src/application/token_issuance_service.rs
+++ b/agent_authorization/src/application/token_issuance_service.rs
@@ -35,6 +35,8 @@ pub enum TokenIssuanceError {
     UnrequestedTxCodeError,
     #[error("Pre-Authorized Code is invalid.")]
     InvalidPreAuthorizedCodeError,
+    #[error("Public offer is inactive or deleted.")]
+    InactivePublicOfferError,
 
     #[error("Missing access token")]
     MissingAccessTokenError,
@@ -58,6 +60,21 @@ pub struct TokenIssuanceService {}
 //
 // For now, we pass through the Token Request's authorization_details as-is.
 impl TokenIssuanceService {
+    async fn can_redeem_offer(issuance_state: &IssuanceState, offer_id: &str) -> Result<bool, TokenIssuanceError> {
+        // TODO: This mirrors the `public_offer_aggregate_id()`. Aggregate IDs should be generated in a consistent way in a single place.
+        let aggregate_id = format!("public_offer:{offer_id}");
+
+        let public_offer = query_handler(&aggregate_id, &issuance_state.query.public_offer)
+            .await
+            .map_err(|err| TokenIssuanceError::Internal(err.to_string()))?;
+
+        Ok(match public_offer {
+            Some(offer) => offer.active && !offer.deleted,
+            // No public-offer record means this is a normal offer.
+            None => true,
+        })
+    }
+
     pub async fn issue_token(
         authorization_state: &AuthorizationState,
         issuance_state: &IssuanceState,
@@ -145,6 +162,14 @@ impl TokenIssuanceService {
             }
         };
 
+        if let Some(offer_id) = issuer_state.as_deref() {
+            let is_redeemable = Self::can_redeem_offer(issuance_state, offer_id).await?;
+
+            if !is_redeemable {
+                return Err(InactivePublicOfferError);
+            }
+        }
+
         let access_token_id = uuid::Uuid::new_v4().to_string();
 
         let access_token_expires_in = 3600; // 1 hour
diff --git a/agent_event_publisher_http/src/lib.rs b/agent_event_publisher_http/src/lib.rs
index 519be84d..89c8aa83 100644
--- a/agent_event_publisher_http/src/lib.rs
+++ b/agent_event_publisher_http/src/lib.rs
@@ -405,6 +405,10 @@ impl EventPublisher for EventPublisherHttp {
             .map(|publisher| Box::new(publisher) as OfferEventPublisher)
     }
 
+    fn public_offer(&mut self) -> Option<agent_store::PublicOfferEventPublisher> {
+        None
+    }
+
     fn nonce(&mut self) -> Option<NonceEventPublisher> {
         self.nonce
             .take()
diff --git a/agent_event_publisher_nats/src/lib.rs b/agent_event_publisher_nats/src/lib.rs
index 3a461ec8..1148aab6 100644
--- a/agent_event_publisher_nats/src/lib.rs
+++ b/agent_event_publisher_nats/src/lib.rs
@@ -99,6 +99,10 @@ impl EventPublisher for EventPublisherNats {
             .map(|publisher| Box::new(publisher) as OfferEventPublisher)
     }
 
+    fn public_offer(&mut self) -> Option<agent_store::PublicOfferEventPublisher> {
+        None
+    }
+
     fn nonce(&mut self) -> Option<NonceEventPublisher> {
         None
     }
diff --git a/agent_issuance/src/lib.rs b/agent_issuance/src/lib.rs
index 7412fa90..36781287 100644
--- a/agent_issuance/src/lib.rs
+++ b/agent_issuance/src/lib.rs
@@ -9,6 +9,7 @@ use tracing::info;
 pub mod credential;
 pub mod nonce;
 pub mod offer;
+pub mod public_offer;
 pub mod server_config;
 pub mod status_list;
 pub mod utils;
diff --git a/agent_issuance/src/offer/aggregate.rs b/agent_issuance/src/offer/aggregate.rs
index d2fb0e7a..0b32bc00 100644
--- a/agent_issuance/src/offer/aggregate.rs
+++ b/agent_issuance/src/offer/aggregate.rs
@@ -54,6 +54,8 @@ pub struct Offer {
     pub tx_code: Option<String>,
     pub delivery_options: Option<DeliveryOptions>,
     pub offer_link: Option<Url>,
+    #[serde(default)]
+    pub successful_issuances: u32,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, Default, PartialEq, utoipa::ToSchema)]
@@ -399,9 +401,13 @@ impl Aggregate for Offer {
                 self.subject_id = subject_id;
             }
             CredentialResponseCreated {
-                credential_response, ..
+                credential_response,
+                status,
+                ..
             } => {
                 self.credential_response.replace(credential_response);
+                self.status = status;
+                self.successful_issuances = self.successful_issuances.saturating_add(1);
             }
             TxCodeGenerated { tx_code, .. } => {
                 self.tx_code.replace(tx_code);
diff --git a/agent_issuance/src/offer/views/mod.rs b/agent_issuance/src/offer/views/mod.rs
index a0fc3276..d8456ab7 100644
--- a/agent_issuance/src/offer/views/mod.rs
+++ b/agent_issuance/src/offer/views/mod.rs
@@ -78,6 +78,7 @@ impl View<Offer> for Offer {
                 self.offer_id.clone_from(offer_id);
                 self.credential_response.replace(credential_response.clone());
                 self.status.clone_from(status);
+                self.successful_issuances = self.successful_issuances.saturating_add(1);
             }
             TxCodeGenerated {
                 offer_id,
diff --git a/agent_issuance/src/public_offer/aggregate.rs b/agent_issuance/src/public_offer/aggregate.rs
new file mode 100644
index 00000000..731bab7e
--- /dev/null
+++ b/agent_issuance/src/public_offer/aggregate.rs
@@ -0,0 +1,378 @@
+use crate::public_offer::{command::PublicOfferCommand, error::PublicOfferError, event::PublicOfferEvent};
+use crate::services::IssuanceServices;
+use async_trait::async_trait;
+use cqrs_es::Aggregate;
+use serde::{Deserialize, Serialize};
+use std::sync::Arc;
+
+/// PublicOffer aggregate root - represents a shareable credential offer
+/// that multiple holders can claim from a single QR code.
+#[derive(Debug, Clone, Serialize, Deserialize, Default, PartialEq, utoipa::ToSchema)]
+pub struct PublicOffer {
+    pub id: String,
+    pub template_id: String,
+    pub active: bool,
+    pub deleted: bool,
+    pub created_at: Option<chrono::DateTime<chrono::Utc>>,
+}
+
+#[async_trait]
+impl Aggregate for PublicOffer {
+    type Command = PublicOfferCommand;
+    type Event = PublicOfferEvent;
+    type Error = PublicOfferError;
+    type Services = Arc<IssuanceServices>;
+
+    fn aggregate_type() -> String {
+        "public_offer".to_string()
+    }
+
+    async fn handle(
+        &self,
+        command: Self::Command,
+        _services: &Self::Services,
+    ) -> Result<Vec<Self::Event>, Self::Error> {
+        match command {
+            PublicOfferCommand::Create { offer_id, template_id } => {
+                if !self.id.is_empty() && !self.deleted {
+                    return Err(PublicOfferError::AlreadyExists);
+                }
+
+                Ok(vec![PublicOfferEvent::Created {
+                    offer_id,
+                    template_id,
+                    created_at: chrono::Utc::now(),
+                }])
+            }
+            PublicOfferCommand::TakeOffline { offer_id } => {
+                if self.id.is_empty() {
+                    return Err(PublicOfferError::NotFound);
+                }
+                if !self.active {
+                    return Ok(vec![]);
+                }
+
+                Ok(vec![PublicOfferEvent::TakenOffline { offer_id }])
+            }
+            PublicOfferCommand::TakeOnline { offer_id } => {
+                if self.id.is_empty() {
+                    return Err(PublicOfferError::NotFound);
+                }
+                if self.active {
+                    return Ok(vec![]);
+                }
+
+                Ok(vec![PublicOfferEvent::TakenOnline { offer_id }])
+            }
+            PublicOfferCommand::Delete { offer_id } => {
+                if self.id.is_empty() {
+                    return Err(PublicOfferError::NotFound);
+                }
+
+                Ok(vec![PublicOfferEvent::Deleted { offer_id }])
+            }
+        }
+    }
+
+    fn apply(&mut self, event: Self::Event) {
+        match event {
+            PublicOfferEvent::Created {
+                offer_id,
+                template_id,
+                created_at,
+            } => {
+                self.id = offer_id;
+                self.template_id = template_id;
+                self.active = true;
+                self.deleted = false;
+                self.created_at = Some(created_at);
+            }
+
+            PublicOfferEvent::TakenOffline { .. } => {
+                self.active = false;
+            }
+
+            PublicOfferEvent::TakenOnline { .. } => {
+                self.active = true;
+            }
+
+            PublicOfferEvent::Deleted { .. } => {
+                self.deleted = true;
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+pub mod tests {
+    use super::*;
+    use crate::services::IssuanceServices;
+    use agent_secret_manager::service::Service;
+    use cqrs_es::test::TestFramework;
+    use rstest::rstest;
+
+    type PublicOfferTestFramework = TestFramework<PublicOffer>;
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_create_public_offer() {
+        let offer_id = "public-offer-123".to_string();
+        let template_id = "template-456".to_string();
+
+        let issuance_services = IssuanceServices::default().await;
+
+        let aggregate = PublicOffer::default();
+        let events = aggregate
+            .handle(
+                PublicOfferCommand::Create {
+                    offer_id: offer_id.clone(),
+                    template_id: template_id.clone(),
+                },
+                &issuance_services,
+            )
+            .await
+            .expect("create command should succeed");
+
+        assert_eq!(events.len(), 1);
+        match &events[0] {
+            PublicOfferEvent::Created {
+                offer_id: emitted_offer_id,
+                template_id: emitted_template_id,
+                created_at,
+            } => {
+                assert_eq!(emitted_offer_id, &offer_id);
+                assert_eq!(emitted_template_id, &template_id);
+                assert!(*created_at <= chrono::Utc::now());
+            }
+            _ => panic!("expected Created event"),
+        }
+    }
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_create_duplicate_public_offer_fails() {
+        let offer_id = "public-offer-123".to_string();
+        let template_id = "template-456".to_string();
+
+        let issuance_services = IssuanceServices::default().await;
+
+        PublicOfferTestFramework::with(issuance_services)
+            .given(vec![PublicOfferEvent::Created {
+                offer_id: offer_id.clone(),
+                template_id: template_id.clone(),
+                created_at: chrono::Utc::now(),
+            }])
+            .when(PublicOfferCommand::Create { offer_id, template_id })
+            .then_expect_error(PublicOfferError::AlreadyExists);
+    }
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_recreate_public_offer_after_delete_succeeds() {
+        let offer_id = "public-offer-123".to_string();
+        let original_template_id = "template-456".to_string();
+        let new_template_id = "template-789".to_string();
+
+        let issuance_services = IssuanceServices::default().await;
+
+        let mut aggregate = PublicOffer::default();
+        aggregate.apply(PublicOfferEvent::Created {
+            offer_id: offer_id.clone(),
+            template_id: original_template_id,
+            created_at: chrono::Utc::now(),
+        });
+        aggregate.apply(PublicOfferEvent::Deleted {
+            offer_id: offer_id.clone(),
+        });
+
+        let events = aggregate
+            .handle(
+                PublicOfferCommand::Create {
+                    offer_id: offer_id.clone(),
+                    template_id: new_template_id.clone(),
+                },
+                &issuance_services,
+            )
+            .await
+            .expect("recreate command should succeed after delete");
+
+        assert_eq!(events.len(), 1);
+        match &events[0] {
+            PublicOfferEvent::Created {
+                offer_id: emitted_offer_id,
+                template_id: emitted_template_id,
+                created_at,
+            } => {
+                assert_eq!(emitted_offer_id, &offer_id);
+                assert_eq!(emitted_template_id, &new_template_id);
+                assert!(*created_at <= chrono::Utc::now());
+            }
+            _ => panic!("expected Created event"),
+        }
+    }
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_take_public_offer_offline() {
+        let offer_id = "public-offer-123".to_string();
+        let template_id = "template-456".to_string();
+
+        let issuance_services = IssuanceServices::default().await;
+
+        PublicOfferTestFramework::with(issuance_services)
+            .given(vec![PublicOfferEvent::Created {
+                offer_id: offer_id.clone(),
+                template_id: template_id.clone(),
+                created_at: chrono::Utc::now(),
+            }])
+            .when(PublicOfferCommand::TakeOffline {
+                offer_id: offer_id.clone(),
+            })
+            .then_expect_events(vec![PublicOfferEvent::TakenOffline { offer_id }]);
+    }
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_take_public_offer_offline_idempotent() {
+        let offer_id = "public-offer-123".to_string();
+        let template_id = "template-456".to_string();
+
+        let issuance_services = IssuanceServices::default().await;
+
+        PublicOfferTestFramework::with(issuance_services)
+            .given(vec![
+                PublicOfferEvent::Created {
+                    offer_id: offer_id.clone(),
+                    template_id: template_id.clone(),
+                    created_at: chrono::Utc::now(),
+                },
+                PublicOfferEvent::TakenOffline {
+                    offer_id: offer_id.clone(),
+                },
+            ])
+            .when(PublicOfferCommand::TakeOffline { offer_id })
+            .then_expect_events(vec![]);
+    }
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_take_public_offer_online() {
+        let offer_id = "public-offer-123".to_string();
+        let template_id = "template-456".to_string();
+
+        let issuance_services = IssuanceServices::default().await;
+
+        PublicOfferTestFramework::with(issuance_services)
+            .given(vec![
+                PublicOfferEvent::Created {
+                    offer_id: offer_id.clone(),
+                    template_id: template_id.clone(),
+                    created_at: chrono::Utc::now(),
+                },
+                PublicOfferEvent::TakenOffline {
+                    offer_id: offer_id.clone(),
+                },
+            ])
+            .when(PublicOfferCommand::TakeOnline {
+                offer_id: offer_id.clone(),
+            })
+            .then_expect_events(vec![PublicOfferEvent::TakenOnline { offer_id }]);
+    }
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_take_public_offer_online_idempotent() {
+        let offer_id = "public-offer-123".to_string();
+        let template_id = "template-456".to_string();
+
+        let issuance_services = IssuanceServices::default().await;
+
+        PublicOfferTestFramework::with(issuance_services)
+            .given(vec![PublicOfferEvent::Created {
+                offer_id: offer_id.clone(),
+                template_id: template_id.clone(),
+                created_at: chrono::Utc::now(),
+            }])
+            .when(PublicOfferCommand::TakeOnline { offer_id })
+            .then_expect_events(vec![]);
+    }
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_delete_public_offer() {
+        let offer_id = "public-offer-123".to_string();
+        let template_id = "template-456".to_string();
+
+        let issuance_services = IssuanceServices::default().await;
+
+        PublicOfferTestFramework::with(issuance_services)
+            .given(vec![PublicOfferEvent::Created {
+                offer_id: offer_id.clone(),
+                template_id: template_id.clone(),
+                created_at: chrono::Utc::now(),
+            }])
+            .when(PublicOfferCommand::Delete {
+                offer_id: offer_id.clone(),
+            })
+            .then_expect_events(vec![PublicOfferEvent::Deleted { offer_id }]);
+    }
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_delete_nonexistent_public_offer_fails() {
+        let issuance_services = IssuanceServices::default().await;
+
+        PublicOfferTestFramework::with(issuance_services)
+            .given_no_previous_events()
+            .when(PublicOfferCommand::Delete {
+                offer_id: "nonexistent".to_string(),
+            })
+            .then_expect_error(PublicOfferError::NotFound);
+    }
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_take_offline_nonexistent_public_offer_fails() {
+        let issuance_services = IssuanceServices::default().await;
+
+        PublicOfferTestFramework::with(issuance_services)
+            .given_no_previous_events()
+            .when(PublicOfferCommand::TakeOffline {
+                offer_id: "nonexistent".to_string(),
+            })
+            .then_expect_error(PublicOfferError::NotFound);
+    }
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_take_online_nonexistent_public_offer_fails() {
+        let issuance_services = IssuanceServices::default().await;
+
+        PublicOfferTestFramework::with(issuance_services)
+            .given_no_previous_events()
+            .when(PublicOfferCommand::TakeOnline {
+                offer_id: "nonexistent".to_string(),
+            })
+            .then_expect_error(PublicOfferError::NotFound);
+    }
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_public_offer_state_transitions() {
+        let offer_id = "public-offer-123".to_string();
+        let template_id = "template-456".to_string();
+
+        let issuance_services = IssuanceServices::default().await;
+
+        PublicOfferTestFramework::with(issuance_services)
+            .given(vec![PublicOfferEvent::Created {
+                offer_id: offer_id.clone(),
+                template_id: template_id.clone(),
+                created_at: chrono::Utc::now(),
+            }])
+            .when(PublicOfferCommand::TakeOffline { offer_id })
+            .then_expect_events(vec![PublicOfferEvent::TakenOffline {
+                offer_id: "public-offer-123".to_string(),
+            }]);
+    }
+}
diff --git a/agent_issuance/src/public_offer/command.rs b/agent_issuance/src/public_offer/command.rs
new file mode 100644
index 00000000..81a04bb4
--- /dev/null
+++ b/agent_issuance/src/public_offer/command.rs
@@ -0,0 +1,11 @@
+use serde::{Deserialize, Serialize};
+
+/// Commands that represent user intentions for public offers
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(untagged)]
+pub enum PublicOfferCommand {
+    Create { offer_id: String, template_id: String },
+    TakeOffline { offer_id: String },
+    TakeOnline { offer_id: String },
+    Delete { offer_id: String },
+}
diff --git a/agent_issuance/src/public_offer/error.rs b/agent_issuance/src/public_offer/error.rs
new file mode 100644
index 00000000..e6c36d70
--- /dev/null
+++ b/agent_issuance/src/public_offer/error.rs
@@ -0,0 +1,13 @@
+use thiserror::Error;
+
+#[derive(Error, Debug, PartialEq)]
+pub enum PublicOfferError {
+    #[error("Public offer already exists")]
+    AlreadyExists,
+    #[error("Public offer not found")]
+    NotFound,
+    #[error("Template not found")]
+    TemplateNotFound,
+    #[error("Template schema must only contain const-only leaf fields for public offers")]
+    TemplateNotEligible,
+}
diff --git a/agent_issuance/src/public_offer/event.rs b/agent_issuance/src/public_offer/event.rs
new file mode 100644
index 00000000..6e2673e2
--- /dev/null
+++ b/agent_issuance/src/public_offer/event.rs
@@ -0,0 +1,33 @@
+use chrono::{DateTime, Utc};
+use cqrs_es::DomainEvent;
+use serde::{Deserialize, Serialize};
+use strum::Display;
+
+/// Domain events representing public offer lifecycle changes
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize, Display)]
+pub enum PublicOfferEvent {
+    Created {
+        offer_id: String,
+        template_id: String,
+        created_at: DateTime<Utc>,
+    },
+    TakenOffline {
+        offer_id: String,
+    },
+    TakenOnline {
+        offer_id: String,
+    },
+    Deleted {
+        offer_id: String,
+    },
+}
+
+impl DomainEvent for PublicOfferEvent {
+    fn event_type(&self) -> String {
+        self.to_string()
+    }
+
+    fn event_version(&self) -> String {
+        "1".to_string()
+    }
+}
diff --git a/agent_issuance/src/public_offer/mod.rs b/agent_issuance/src/public_offer/mod.rs
new file mode 100644
index 00000000..6f96ee39
--- /dev/null
+++ b/agent_issuance/src/public_offer/mod.rs
@@ -0,0 +1,13 @@
+pub mod aggregate;
+pub mod command;
+pub mod error;
+pub mod event;
+pub mod state;
+pub mod views;
+
+pub use aggregate::PublicOffer;
+pub use command::PublicOfferCommand;
+pub use error::PublicOfferError;
+pub use event::PublicOfferEvent;
+pub use state::PublicOfferState;
+pub use views::{AllPublicOffersView, PublicOfferView};
diff --git a/agent_issuance/src/public_offer/state.rs b/agent_issuance/src/public_offer/state.rs
new file mode 100644
index 00000000..54936e58
--- /dev/null
+++ b/agent_issuance/src/public_offer/state.rs
@@ -0,0 +1,17 @@
+/// State/services for public offer operations
+/// This is currently a unit struct but can be expanded to hold
+/// injected services if needed in the future.
+#[derive(Clone, Debug)]
+pub struct PublicOfferState;
+
+impl PublicOfferState {
+    pub fn new() -> Self {
+        PublicOfferState
+    }
+}
+
+impl Default for PublicOfferState {
+    fn default() -> Self {
+        Self::new()
+    }
+}
diff --git a/agent_issuance/src/public_offer/views/mod.rs b/agent_issuance/src/public_offer/views/mod.rs
new file mode 100644
index 00000000..e2e77997
--- /dev/null
+++ b/agent_issuance/src/public_offer/views/mod.rs
@@ -0,0 +1,276 @@
+use crate::public_offer::aggregate::PublicOffer;
+use cqrs_es::View;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+
+/// Single aggregate view - projects a single PublicOffer from its events
+pub type PublicOfferView = PublicOffer;
+
+impl View<PublicOffer> for PublicOfferView {
+    fn update(&mut self, event: &cqrs_es::EventEnvelope<PublicOffer>) {
+        match &event.payload {
+            crate::public_offer::event::PublicOfferEvent::Created {
+                offer_id,
+                template_id,
+                created_at,
+            } => {
+                self.id = offer_id.clone();
+                self.template_id = template_id.clone();
+                self.active = true;
+                self.deleted = false;
+                self.created_at = Some(*created_at);
+            }
+            crate::public_offer::event::PublicOfferEvent::TakenOffline { .. } => {
+                self.active = false;
+            }
+            crate::public_offer::event::PublicOfferEvent::TakenOnline { .. } => {
+                self.active = true;
+            }
+            crate::public_offer::event::PublicOfferEvent::Deleted { .. } => {
+                self.deleted = true;
+            }
+        }
+    }
+}
+
+/// All aggregates view - projects all PublicOffers into a HashMap
+#[derive(Debug, Default, Serialize, Deserialize, Clone)]
+pub struct AllPublicOffersView {
+    pub offers: HashMap<String, PublicOfferView>,
+}
+
+impl View<PublicOffer> for AllPublicOffersView {
+    fn update(&mut self, event: &cqrs_es::EventEnvelope<PublicOffer>) {
+        match &event.payload {
+            crate::public_offer::event::PublicOfferEvent::Deleted { .. } => {
+                self.offers.remove(&event.aggregate_id);
+            }
+            _ => {
+                self.offers.entry(event.aggregate_id.clone()).or_default().update(event);
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+pub mod tests {
+    use super::*;
+    use chrono::Utc;
+
+    #[test]
+    fn test_single_public_offer_view_created() {
+        let mut view = PublicOfferView::default();
+        let now = Utc::now();
+        let event_envelope = cqrs_es::EventEnvelope {
+            aggregate_id: "offer-1".to_string(),
+            sequence: 0,
+            payload: crate::public_offer::event::PublicOfferEvent::Created {
+                offer_id: "offer-1".to_string(),
+                template_id: "template-1".to_string(),
+                created_at: now,
+            },
+            metadata: Default::default(),
+        };
+
+        view.update(&event_envelope);
+
+        assert_eq!(view.id, "offer-1");
+        assert_eq!(view.template_id, "template-1");
+        assert!(view.active);
+        assert!(!view.deleted);
+        assert_eq!(view.created_at, Some(now));
+    }
+
+    #[test]
+    fn test_single_public_offer_view_taken_offline() {
+        let mut view = PublicOfferView {
+            id: "offer-1".to_string(),
+            template_id: "template-1".to_string(),
+            active: true,
+            deleted: false,
+            created_at: Some(Utc::now()),
+        };
+
+        let event_envelope = cqrs_es::EventEnvelope {
+            aggregate_id: "offer-1".to_string(),
+            sequence: 1,
+            payload: crate::public_offer::event::PublicOfferEvent::TakenOffline {
+                offer_id: "offer-1".to_string(),
+            },
+            metadata: Default::default(),
+        };
+
+        view.update(&event_envelope);
+
+        assert!(!view.active);
+        assert!(!view.deleted);
+    }
+
+    #[test]
+    fn test_single_public_offer_view_taken_online() {
+        let mut view = PublicOfferView {
+            id: "offer-1".to_string(),
+            template_id: "template-1".to_string(),
+            active: false,
+            deleted: false,
+            created_at: Some(Utc::now()),
+        };
+
+        let event_envelope = cqrs_es::EventEnvelope {
+            aggregate_id: "offer-1".to_string(),
+            sequence: 2,
+            payload: crate::public_offer::event::PublicOfferEvent::TakenOnline {
+                offer_id: "offer-1".to_string(),
+            },
+            metadata: Default::default(),
+        };
+
+        view.update(&event_envelope);
+
+        assert!(view.active);
+        assert!(!view.deleted);
+    }
+
+    #[test]
+    fn test_single_public_offer_view_deleted() {
+        let mut view = PublicOfferView {
+            id: "offer-1".to_string(),
+            template_id: "template-1".to_string(),
+            active: true,
+            deleted: false,
+            created_at: Some(Utc::now()),
+        };
+
+        let event_envelope = cqrs_es::EventEnvelope {
+            aggregate_id: "offer-1".to_string(),
+            sequence: 3,
+            payload: crate::public_offer::event::PublicOfferEvent::Deleted {
+                offer_id: "offer-1".to_string(),
+            },
+            metadata: Default::default(),
+        };
+
+        view.update(&event_envelope);
+
+        assert!(view.deleted);
+    }
+
+    #[test]
+    fn test_all_public_offers_view_multiple_offers() {
+        let mut view = AllPublicOffersView::default();
+        let now = Utc::now();
+
+        // First offer created
+        let event1 = cqrs_es::EventEnvelope {
+            aggregate_id: "offer-1".to_string(),
+            sequence: 0,
+            payload: crate::public_offer::event::PublicOfferEvent::Created {
+                offer_id: "offer-1".to_string(),
+                template_id: "template-1".to_string(),
+                created_at: now,
+            },
+            metadata: Default::default(),
+        };
+
+        view.update(&event1);
+        assert_eq!(view.offers.len(), 1);
+        assert!(view.offers.contains_key("offer-1"));
+        assert!(view.offers["offer-1"].active);
+
+        // Second offer created
+        let event2 = cqrs_es::EventEnvelope {
+            aggregate_id: "offer-2".to_string(),
+            sequence: 0,
+            payload: crate::public_offer::event::PublicOfferEvent::Created {
+                offer_id: "offer-2".to_string(),
+                template_id: "template-2".to_string(),
+                created_at: now,
+            },
+            metadata: Default::default(),
+        };
+
+        view.update(&event2);
+        assert_eq!(view.offers.len(), 2);
+        assert!(view.offers.contains_key("offer-2"));
+
+        // First offer taken offline
+        let event3 = cqrs_es::EventEnvelope {
+            aggregate_id: "offer-1".to_string(),
+            sequence: 1,
+            payload: crate::public_offer::event::PublicOfferEvent::TakenOffline {
+                offer_id: "offer-1".to_string(),
+            },
+            metadata: Default::default(),
+        };
+
+        view.update(&event3);
+        assert!(!view.offers["offer-1"].active);
+        assert!(view.offers["offer-2"].active);
+    }
+
+    #[test]
+    fn test_all_public_offers_view_state_progression() {
+        let mut view = AllPublicOffersView::default();
+        let now = Utc::now();
+
+        // Create offer
+        let event_created = cqrs_es::EventEnvelope {
+            aggregate_id: "offer-1".to_string(),
+            sequence: 0,
+            payload: crate::public_offer::event::PublicOfferEvent::Created {
+                offer_id: "offer-1".to_string(),
+                template_id: "template-1".to_string(),
+                created_at: now,
+            },
+            metadata: Default::default(),
+        };
+
+        view.update(&event_created);
+        let offer = &view.offers["offer-1"];
+        assert!(offer.active);
+        assert!(!offer.deleted);
+
+        // Take offline
+        let event_offline = cqrs_es::EventEnvelope {
+            aggregate_id: "offer-1".to_string(),
+            sequence: 1,
+            payload: crate::public_offer::event::PublicOfferEvent::TakenOffline {
+                offer_id: "offer-1".to_string(),
+            },
+            metadata: Default::default(),
+        };
+
+        view.update(&event_offline);
+        let offer = &view.offers["offer-1"];
+        assert!(!offer.active);
+        assert!(!offer.deleted);
+
+        // Take online again
+        let event_online = cqrs_es::EventEnvelope {
+            aggregate_id: "offer-1".to_string(),
+            sequence: 2,
+            payload: crate::public_offer::event::PublicOfferEvent::TakenOnline {
+                offer_id: "offer-1".to_string(),
+            },
+            metadata: Default::default(),
+        };
+
+        view.update(&event_online);
+        let offer = &view.offers["offer-1"];
+        assert!(offer.active);
+        assert!(!offer.deleted);
+
+        // Delete
+        let event_deleted = cqrs_es::EventEnvelope {
+            aggregate_id: "offer-1".to_string(),
+            sequence: 3,
+            payload: crate::public_offer::event::PublicOfferEvent::Deleted {
+                offer_id: "offer-1".to_string(),
+            },
+            metadata: Default::default(),
+        };
+
+        view.update(&event_deleted);
+        assert!(!view.offers.contains_key("offer-1"));
+    }
+}
diff --git a/agent_issuance/src/state.rs b/agent_issuance/src/state.rs
index 415d5296..5e780c68 100644
--- a/agent_issuance/src/state.rs
+++ b/agent_issuance/src/state.rs
@@ -20,6 +20,8 @@ use crate::nonce::views::NonceView;
 use crate::offer::aggregate::Offer;
 use crate::offer::views::all_offers::AllOffersView;
 use crate::offer::views::OfferView;
+use crate::public_offer::aggregate::PublicOffer;
+use crate::public_offer::views::{AllPublicOffersView, PublicOfferView};
 use crate::server_config::aggregate::ServerConfig;
 use crate::server_config::command::ServerConfigCommand;
 use crate::server_config::views::ServerConfigView;
@@ -42,6 +44,7 @@ pub struct CommandHandlers {
     pub offer: CommandHandler<Offer>,
     pub nonce: CommandHandler<Nonce>,
     pub status_list: CommandHandler<StatusListAggregate>,
+    pub public_offer: CommandHandler<PublicOffer>,
 }
 
 /// This type is used to define the queries that are used to query the view repositories. We make use of `dyn` here, so
@@ -56,9 +59,11 @@ type Queries = ViewRepositories<
     dyn ViewRepository<NonceView, Nonce>,
     dyn ViewRepository<StatusListView, StatusListAggregate>,
     dyn ViewRepository<AllStatusListsView, StatusListAggregate>,
+    dyn ViewRepository<PublicOfferView, PublicOffer>,
+    dyn ViewRepository<AllPublicOffersView, PublicOffer>,
 >;
 
-pub struct ViewRepositories<SC, C, C1, O, O1, N, SL, SL1>
+pub struct ViewRepositories<SC, C, C1, O, O1, N, SL, SL1, PO, PO1>
 where
     SC: ViewRepository<ServerConfigView, ServerConfig> + ?Sized,
     C: ViewRepository<CredentialView, Credential> + ?Sized,
@@ -68,6 +73,8 @@ where
     N: ViewRepository<NonceView, Nonce> + ?Sized,
     SL: ViewRepository<StatusListView, StatusListAggregate> + ?Sized,
     SL1: ViewRepository<AllStatusListsView, StatusListAggregate> + ?Sized,
+    PO: ViewRepository<PublicOfferView, PublicOffer> + ?Sized,
+    PO1: ViewRepository<AllPublicOffersView, PublicOffer> + ?Sized,
 {
     pub server_config: Arc<SC>,
     pub credential: Arc<C>,
@@ -77,6 +84,8 @@ where
     pub nonce: Arc<N>,
     pub status_list: Arc<SL>,
     pub all_status_lists: Arc<SL1>,
+    pub public_offer: Arc<PO>,
+    pub all_public_offers: Arc<PO1>,
 }
 
 impl Clone for Queries {
@@ -90,6 +99,8 @@ impl Clone for Queries {
             nonce: self.nonce.clone(),
             status_list: self.status_list.clone(),
             all_status_lists: self.all_status_lists.clone(),
+            public_offer: self.public_offer.clone(),
+            all_public_offers: self.all_public_offers.clone(),
         }
     }
 }
diff --git a/agent_store/src/lib.rs b/agent_store/src/lib.rs
index acb7a27b..087ab2e5 100644
--- a/agent_store/src/lib.rs
+++ b/agent_store/src/lib.rs
@@ -35,6 +35,8 @@ use agent_issuance::credential::views::CredentialView;
 use agent_issuance::nonce::views::NonceView;
 use agent_issuance::offer::views::all_offers::AllOffersView;
 use agent_issuance::offer::views::OfferView;
+use agent_issuance::public_offer::views::AllPublicOffersView;
+use agent_issuance::public_offer::views::PublicOfferView;
 use agent_issuance::server_config::views::ServerConfigView;
 use agent_issuance::status_list::aggregate::StatusListAggregate;
 use agent_issuance::status_list::views::all_status_lists::AllStatusListsView;
@@ -42,7 +44,7 @@ use agent_issuance::status_list::views::StatusListView;
 use agent_issuance::SimpleLoggingQuery;
 use agent_issuance::{
     credential::aggregate::Credential, nonce::aggregate::Nonce, offer::aggregate::Offer,
-    server_config::aggregate::ServerConfig,
+    public_offer::aggregate::PublicOffer, server_config::aggregate::ServerConfig,
 };
 use agent_library::state::LibraryState;
 use agent_library::template::aggregate::Template;
@@ -315,6 +317,7 @@ pub async fn issuance_state<CCB: CqrsComponentBuilder>(
     let Partitions {
         credential_event_publishers,
         offer_event_publishers,
+        public_offer_event_publishers,
         server_config_event_publishers,
         nonce_event_publishers,
         status_list_event_publishers,
@@ -330,6 +333,12 @@ pub async fn issuance_state<CCB: CqrsComponentBuilder>(
     let (offer_command_handler, offer, all_offers) = builder
         .commands_and_queries::<OfferView, Offer, AllOffersView>(services.clone(), offer_event_publishers)
         .await;
+    let (public_offer_command_handler, public_offer, all_public_offers) = builder
+        .commands_and_queries::<PublicOfferView, PublicOffer, AllPublicOffersView>(
+            services.clone(),
+            public_offer_event_publishers,
+        )
+        .await;
     let (server_config_command_handler, server_config, _all_server_configs) = builder
         .commands_and_queries::<ServerConfigView, ServerConfig, ServerConfig>(
             services.clone(),
@@ -350,6 +359,7 @@ pub async fn issuance_state<CCB: CqrsComponentBuilder>(
         command: agent_issuance::state::CommandHandlers {
             credential: credential_command_handler,
             offer: offer_command_handler,
+            public_offer: public_offer_command_handler,
             server_config: server_config_command_handler,
             nonce: nonce_command_handler,
             status_list: status_list_command_handler,
@@ -360,6 +370,8 @@ pub async fn issuance_state<CCB: CqrsComponentBuilder>(
             all_credentials,
             offer,
             all_offers,
+            public_offer,
+            all_public_offers,
             nonce,
             status_list,
             all_status_lists,
@@ -461,6 +473,7 @@ pub type ServerConfigEventPublisher = Box<dyn Query<ServerConfig>>;
 pub type CredentialEventPublisher = Box<dyn Query<Credential>>;
 pub type StatusListEventPublisher = Box<dyn Query<StatusListAggregate>>;
 pub type OfferEventPublisher = Box<dyn Query<Offer>>;
+pub type PublicOfferEventPublisher = Box<dyn Query<PublicOffer>>;
 pub type NonceEventPublisher = Box<dyn Query<Nonce>>;
 pub type HolderCredentialEventPublisher = Box<dyn Query<agent_holder::credential::aggregate::Credential>>;
 pub type PresentationEventPublisher = Box<dyn Query<agent_holder::presentation::aggregate::Presentation>>;
@@ -483,6 +496,7 @@ pub struct Partitions {
     pub credential_event_publishers: Vec<CredentialEventPublisher>,
     pub status_list_event_publishers: Vec<StatusListEventPublisher>,
     pub offer_event_publishers: Vec<OfferEventPublisher>,
+    pub public_offer_event_publishers: Vec<PublicOfferEventPublisher>,
     pub nonce_event_publishers: Vec<NonceEventPublisher>,
     pub holder_credential_event_publishers: Vec<HolderCredentialEventPublisher>,
     pub presentation_event_publishers: Vec<PresentationEventPublisher>,
@@ -510,6 +524,7 @@ pub trait EventPublisher {
     fn server_config(&mut self) -> Option<ServerConfigEventPublisher>;
     fn credential(&mut self) -> Option<CredentialEventPublisher>;
     fn offer(&mut self) -> Option<OfferEventPublisher>;
+    fn public_offer(&mut self) -> Option<PublicOfferEventPublisher>;
     fn nonce(&mut self) -> Option<NonceEventPublisher>;
     fn status_list(&mut self) -> Option<StatusListEventPublisher>;
 
@@ -562,6 +577,9 @@ pub(crate) fn partition_event_publishers(event_publishers: Vec<Box<dyn EventPubl
             if let Some(offer) = event_publisher.offer() {
                 partitions.offer_event_publishers.push(offer);
             }
+            if let Some(public_offer) = event_publisher.public_offer() {
+                partitions.public_offer_event_publishers.push(public_offer);
+            }
             if let Some(nonce) = event_publisher.nonce() {
                 partitions.nonce_event_publishers.push(nonce);
             }
@@ -657,6 +675,10 @@ mod test {
             None
         }
 
+        fn public_offer(&mut self) -> Option<PublicOfferEventPublisher> {
+            None
+        }
+
         fn nonce(&mut self) -> Option<NonceEventPublisher> {
             None
         }
@@ -731,6 +753,10 @@ mod test {
             None
         }
 
+        fn public_offer(&mut self) -> Option<PublicOfferEventPublisher> {
+            None
+        }
+
         fn nonce(&mut self) -> Option<NonceEventPublisher> {
             None
         }
@@ -774,6 +800,7 @@ mod test {
             server_config_event_publishers,
             credential_event_publishers,
             offer_event_publishers,
+            public_offer_event_publishers,
             nonce_event_publishers,
             status_list_event_publishers,
             holder_credential_event_publishers,
@@ -795,8 +822,8 @@ mod test {
         assert_eq!(credential_event_publishers.len(), 0);
         assert_eq!(status_list_event_publishers.len(), 0);
         assert_eq!(offer_event_publishers.len(), 0);
+        assert_eq!(public_offer_event_publishers.len(), 0);
         assert_eq!(nonce_event_publishers.len(), 0);
-        assert_eq!(status_list_event_publishers.len(), 0);
         assert_eq!(holder_credential_event_publishers.len(), 0);
         assert_eq!(presentation_event_publishers.len(), 0);
         assert_eq!(received_offer_event_publishers.len(), 0);
diff --git a/features/public-credential-offers/README.md b/features/public-credential-offers/README.md
new file mode 100644
index 00000000..a96275c9
--- /dev/null
+++ b/features/public-credential-offers/README.md
@@ -0,0 +1,47 @@
+# Public Credential Offers
+
+## What this feature does
+
+Public Credential Offers let an issuer publish a reusable credential offer link that anyone can use, without creating a new one-off offer each time.
+
+This enables "share once, issue many" use cases.
+
+## Why this is useful
+
+- It reduces manual work for teams issuing the same static credential repeatedly.
+- It gives a stable entry point that can be embedded in portals, emails, landing pages, or QR codes.
+- It allows operators to pause, resume, or retire an offer without changing the original credential template.
+
+## How it works (high level)
+
+1. An issuer creates a normal offer and links it to a template to create a public offer.
+2. The public offer is stored with a lifecycle status (active or inactive).
+3. Clients can discover public offers and see how many successful issuances happened.
+4. Operators can take an offer offline, bring it back online, or delete it.
+
+## Built-in safeguards
+
+Public offers are intentionally restricted to static credentials:
+
+- The referenced template must exist.
+- Deleted templates are treated as unavailable.
+- The template schema must use const values for all leaf fields.
+
+If a template is missing, creation fails with not found.
+If a template schema contains non-const leaf fields, creation fails with a business validation error.
+
+## API capabilities
+
+This feature currently provides route-level capabilities to:
+
+- Create a public offer mapping
+- List all public offers
+- Take a public offer offline
+- Take a public offer online
+- Delete a public offer
+
+## Operational intent
+
+Use Public Credential Offers when you want controlled, repeatable issuance of predefined credentials at scale.
+
+Do not use this flow for credentials that require dynamic or user-specific claim values per issuance.

From b652f87036745d370b715cd320c2ef13bf5b8b75 Mon Sep 17 00:00:00 2001
From: Oran Dan <53859531+Oran-Dan@users.noreply.github.com>
Date: Thu, 18 Jun 2026 21:14:24 +0200
Subject: [PATCH 19/34] refactor: implement debug for issuance state (#361)

---
 agent_issuance/src/state.rs | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/agent_issuance/src/state.rs b/agent_issuance/src/state.rs
index 5e780c68..16461cf3 100644
--- a/agent_issuance/src/state.rs
+++ b/agent_issuance/src/state.rs
@@ -36,6 +36,15 @@ pub struct IssuanceState {
     pub subject: Arc<Subject>,
 }
 
+impl std::fmt::Debug for IssuanceState {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("IssuanceState")
+            .field("subject", &self.subject)
+            .finish_non_exhaustive()
+        // We intentionally do not include the command handlers and queries in the debug output, as they don't contain useful information.
+    }
+}
+
 /// The command handlers are used to execute commands on the aggregates.
 #[derive(Clone)]
 pub struct CommandHandlers {

From f0a2999662f03821068a33c48c748d1c46ec5e1c Mon Sep 17 00:00:00 2001
From: Daniel Mader <daniel.mader@impierce.com>
Date: Fri, 26 Jun 2026 10:31:55 +0200
Subject: [PATCH 20/34] feat(templates): enforce template usage, validate
 against `schema` (#330)

---
 AGENTS.md                                     |   41 +
 Cargo.lock                                    |  268 +-
 Cargo.toml                                    |    2 +
 agent_api_http/Cargo.toml                     |    2 +
 agent_api_http/openapi-generated.yaml         |  489 ++--
 agent_api_http/src/lib.rs                     |   58 +-
 .../authorization_server/authorize.rs         |   15 +-
 .../authorization/authorization_server/par.rs |   24 +-
 .../authorization_server/token.rs             |   43 +-
 .../v0/issuance/credential_configurations.rs  |   38 -
 .../issuance/credential_issuer/credential.rs  |   37 +-
 .../credential_issuer/notification.rs         |   29 +-
 .../credential_issuer/token_status_list.rs    |   28 +-
 .../well_known/oauth_authorization_server.rs  |   10 +-
 .../well_known/openid_credential_issuer.rs    |   33 +-
 agent_api_http/src/v0/issuance/credentials.rs |  998 ++++++-
 agent_api_http/src/v0/issuance/error.rs       |    6 -
 agent_api_http/src/v0/issuance/mod.rs         |   37 +-
 agent_api_http/src/v0/issuance/nonce/mod.rs   |   12 +-
 agent_api_http/src/v0/issuance/offers/mod.rs  |  246 +-
 agent_api_http/src/v0/issuance/openapi.rs     |    2 -
 .../src/v0/issuance/public_offers.rs          |   84 +-
 agent_api_http/src/v0/library/error.rs        |  316 ++-
 agent_api_http/src/v0/library/mod.rs          |   12 +-
 agent_api_http/src/v0/templates/mod.rs        |  614 ++++-
 .../v0/verification/relying_party/redirect.rs |    1 +
 agent_application/example.config.yaml         |    3 +-
 agent_application/src/lib.rs                  |   81 +-
 agent_event_publisher_http/README.md          |    4 +-
 agent_holder/Cargo.toml                       |    1 +
 agent_holder/src/offer/aggregate.rs           |   99 +-
 agent_issuance/Cargo.toml                     |    2 +
 .../credential_configuration_projection.rs    |  823 ++++++
 agent_issuance/src/application/mod.rs         |    2 +-
 .../issuer_metadata_synchronization_policy.rs |   38 -
 .../src/application/policies/mod.rs           |    1 -
 agent_issuance/src/credential/error.rs        |    3 -
 agent_issuance/src/offer/aggregate.rs         |   16 +-
 agent_issuance/src/offer/command.rs           |    4 +-
 agent_issuance/src/state.rs                   |  187 +-
 .../credential_configuration_projection.rs    |  875 +++++++
 agent_library/Cargo.toml                      |    4 +-
 agent_library/src/template/aggregate.rs       | 1138 ++++----
 agent_library/src/template/aggregate_tests.rs | 2297 +++++++++++++++++
 agent_library/src/template/command.rs         |   36 +-
 agent_library/src/template/error.rs           |   36 +
 agent_library/src/template/event.rs           |   40 +-
 agent_library/src/template/mod.rs             |    1 +
 agent_library/src/template/open_badges.rs     |  447 ++++
 agent_library/src/template/views/mod.rs       |  159 +-
 agent_shared/src/config/mod.rs                |   17 +-
 agent_shared/src/config/openapi.rs            |   27 +-
 agent_shared/src/credential_status_checker.rs |  137 +-
 agent_shared/tests/test.config.yaml           |    2 -
 .../tests/test_credential_configurations.json |   38 -
 agent_store/src/lib.rs                        |    6 +-
 docs/README.md                                |    2 +
 ...properties-attributes-as-separate-field.md |  108 +
 docs/adr/README.md                            |    3 +
 docs/concepts/public-credential-offers.md     |   33 +
 .../templates/credential-templates.md         |  426 +++
 .../templates/examples/open-badges-3-0.md     |  106 +
 .../concepts/templates/examples/w3c-vc-2-0.md |   83 +
 .../Migrating templates to beta.19.md         |  111 +
 docs/problem-details/issuance.md              |  182 +-
 docs/problem-details/library.md               |   64 +
 docs/problem-details/templates.md             |   65 +
 docs/template-model.md                        |  269 ++
 features/public-credential-offers/README.md   |   47 -
 69 files changed, 9458 insertions(+), 2010 deletions(-)
 create mode 100644 AGENTS.md
 delete mode 100644 agent_api_http/src/v0/issuance/credential_configurations.rs
 create mode 100644 agent_issuance/src/application/credential_configuration_projection.rs
 delete mode 100644 agent_issuance/src/application/policies/issuer_metadata_synchronization_policy.rs
 delete mode 100644 agent_issuance/src/application/policies/mod.rs
 create mode 100644 agent_issuance/tests/credential_configuration_projection.rs
 create mode 100644 agent_library/src/template/aggregate_tests.rs
 create mode 100644 agent_library/src/template/open_badges.rs
 delete mode 100644 agent_shared/tests/test_credential_configurations.json
 create mode 100644 docs/adr/0001-schema-properties-attributes-as-separate-field.md
 create mode 100644 docs/adr/README.md
 create mode 100644 docs/concepts/public-credential-offers.md
 create mode 100644 docs/concepts/templates/credential-templates.md
 create mode 100644 docs/concepts/templates/examples/open-badges-3-0.md
 create mode 100644 docs/concepts/templates/examples/w3c-vc-2-0.md
 create mode 100644 docs/migration-guides/Migrating templates to beta.19.md
 create mode 100644 docs/template-model.md
 delete mode 100644 features/public-credential-offers/README.md

diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 00000000..8f00b04f
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,41 @@
+# AGENTS.md
+
+## Application design
+
+- DDD: The application is designed around the concept of domain-driven design, where the core business logic is organized into domains and subdomains, with a clear separation of concerns.
+- CQRS: The application uses the command-query responsibility segregation pattern, where commands are used to modify state and queries are used to read state. Events are treated as immutable after the are created. Projections are used to derive queryable read models from the event stream.
+- Event sourcing: The application uses event sourcing to capture all changes to the state as a sequence of events. This allows for a complete audit trail and the ability to reconstruct past states by replaying events.
+- Hexagonal architecture: The application tries to abstract how data comes in to the application and how it is stored.
+
+### Architecture
+
+Architecture Decision Records (ADRs) can be found in the [docs/adr](./docs/adr) directory.
+
+## Standards and conventions
+
+- The application follows the [Twelve-Factor App](https://12factor.net) methodology for building modern, scalable applications.
+- The application uses semantic versioning for releases and follows a branching strategy to manage different stages of development (e.g. `main` for stable releases, `next` for upcoming major versions, `beta` for pre-releases, and `alpha` for experimental features).
+- The application uses conventional commits for commit messages to enable automated semantic releases.
+- For errors on the HTTP API, the application follows the [RFC 9457 Problem Details for HTTP APIs](https://www.rfc-editor.org/rfc/rfc9457.html) specification for error responses.
+- Events follow the [CloudEvents specification (v1.0.2)](https://raw.githubusercontent.com/cloudevents/spec/refs/tags/v1.0.2/cloudevents/spec.md) for event structure and metadata _(this is not fully done as of today)_.
+
+## Code style
+
+- If you think a TODO is no longer relevant or has been addressed, ask the user if it can be removed. If it is still relevant but not being addressed in the current PR, leave it in place.
+- Use comments only when necessary. Prefer self-explanatory code, but don't hesitate to add comments to clarify intent, especially for complex logic or non-obvious decisions.
+
+### Cargo.toml
+
+- Sort dependencies alphabetically by name, with the following exceptions:
+  - Internal dependencies (using `path = "..."`) should be listed before external dependencies, followed by a blank line.
+  - Every dependency from `https://github.com/impierce` should be listed before other dependencies, separated by a blank line.
+
+### Commands
+
+The following commands can be used to assert code quality:
+
+- `cargo fmt --all` (format all code)
+- `cargo clippy --all-targets --all-features -- -D warnings` (check for code lints, treat all warnings as errors)
+- `cargo test generate_openapi_spec` (generate the OpenAPI specification by executing a test)
+- `cargo test --workspace` (run all tests)
+- `cargo llvm-cov clean --workspace && cargo llvm-cov --all-features --workspace --json --output-path coverage.raw.json` (generate code coverage report)
diff --git a/Cargo.lock b/Cargo.lock
index 847efe5e..6d8f99c6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -87,10 +87,12 @@ dependencies = [
  "http 1.4.1",
  "http-api-problem",
  "http-body-util",
- "hyper 1.10.0",
+ "hyper 1.10.1",
  "identity_core",
  "identity_credential",
  "identity_did",
+ "iso8601",
+ "jsonschema 0.46.5",
  "jsonwebtoken",
  "lazy_static",
  "metrics",
@@ -107,7 +109,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_urlencoded",
- "serde_with 3.20.0",
+ "serde_with 3.21.0",
  "serial_test",
  "siopv2",
  "thiserror 1.0.69",
@@ -146,7 +148,7 @@ dependencies = [
  "did_manager",
  "serde",
  "serde_json",
- "serde_with 3.20.0",
+ "serde_with 3.21.0",
  "tokio",
  "tower-http 0.6.11",
  "tracing",
@@ -207,7 +209,7 @@ dependencies = [
  "reqwest 0.12.28",
  "serde",
  "serde_json",
- "serde_with 3.20.0",
+ "serde_with 3.21.0",
  "tokio",
  "tracing",
  "wiremock",
@@ -241,6 +243,7 @@ dependencies = [
  "agent_authorization",
  "agent_holder",
  "agent_issuance",
+ "agent_library",
  "agent_secret_manager",
  "agent_shared",
  "agent_store",
@@ -365,11 +368,12 @@ dependencies = [
  "sd-jwt-payload",
  "serde",
  "serde_json",
- "serde_with 3.20.0",
+ "serde_with 3.21.0",
  "serial_test",
  "strum 0.26.3",
  "strum_macros 0.26.4",
  "thiserror 1.0.69",
+ "tokio",
  "tracing",
  "tracing-test",
  "url",
@@ -387,18 +391,20 @@ dependencies = [
  "async-trait",
  "chrono",
  "cqrs-es 0.4.12",
- "jsonschema 0.43.0",
+ "iso8601",
+ "jsonschema 0.46.5",
  "lazy_static",
  "rstest",
  "serde",
  "serde_json",
- "serde_with 3.20.0",
+ "serde_with 3.21.0",
  "serial_test",
  "strum 0.26.3",
  "strum_macros 0.26.4",
  "thiserror 1.0.69",
  "tracing",
  "utoipa",
+ "uuid",
 ]
 
 [[package]]
@@ -471,7 +477,7 @@ dependencies = [
  "reqwest 0.12.28",
  "serde",
  "serde_json",
- "serde_with 3.20.0",
+ "serde_with 3.21.0",
  "serial_test",
  "strum 0.26.3",
  "temp-env",
@@ -1350,7 +1356,7 @@ dependencies = [
  "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.10.0",
+ "hyper 1.10.1",
  "hyper-util",
  "itoa",
  "matchit 0.8.4",
@@ -1454,7 +1460,7 @@ dependencies = [
  "fs-err",
  "http 1.4.1",
  "http-body 1.0.1",
- "hyper 1.10.0",
+ "hyper 1.10.1",
  "hyper-util",
  "pin-project-lite",
  "rustls 0.23.40",
@@ -1672,9 +1678,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.11.1"
+version = "2.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
+checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
 dependencies = [
  "serde_core",
 ]
@@ -1965,9 +1971,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.62"
+version = "1.2.63"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1dce859f0832a7d088c4f1119888ab94ef4b5d6795d1ce05afb7fe159d79f98"
+checksum = "556e016178bb5662a08681bbe0f00f8e17631781a4dfc8c45e466e4b185ec27f"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -2030,9 +2036,9 @@ dependencies = [
 
 [[package]]
 name = "chrono"
-version = "0.4.44"
+version = "0.4.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
 dependencies = [
  "iana-time-zone",
  "js-sys",
@@ -2128,7 +2134,7 @@ source = "git+https://github.com/cloudevents/sdk-rust?rev=6f02d23#6f02d238e4de9e
 dependencies = [
  "async-nats",
  "base64 0.22.1",
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "chrono",
  "delegate-attr",
  "hostname",
@@ -3724,9 +3730,9 @@ dependencies = [
 
 [[package]]
 name = "fancy-regex"
-version = "0.17.0"
+version = "0.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72cf461f865c862bb7dc573f643dd6a2b6842f7c30b07882b56bd148cc2761b8"
+checksum = "e1e1dacd0d2082dfcf1351c4bdd566bbe89a2b263235a2b50058f1e130a47277"
 dependencies = [
  "bit-set 0.8.0",
  "regex-automata",
@@ -3776,7 +3782,7 @@ dependencies = [
  "secp256k1",
  "serde",
  "serde_json",
- "serde_with 3.20.0",
+ "serde_with 3.21.0",
  "sha2 0.10.9",
  "sha3",
  "signature 2.2.0",
@@ -4877,9 +4883,9 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.10.0"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb92f162bf56536459fc83c79b974bb12837acfed43d6bc370a7916d0ae15ecc"
+checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -4918,11 +4924,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
  "http 1.4.1",
- "hyper 1.10.0",
+ "hyper 1.10.1",
  "hyper-util",
  "log",
  "rustls 0.23.40",
- "rustls-native-certs 0.8.3",
+ "rustls-native-certs 0.8.4",
  "tokio",
  "tokio-rustls 0.26.4",
  "tower-service",
@@ -4935,7 +4941,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
 dependencies = [
- "hyper 1.10.0",
+ "hyper 1.10.1",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -4954,7 +4960,7 @@ dependencies = [
  "futures-util",
  "http 1.4.1",
  "http-body 1.0.1",
- "hyper 1.10.0",
+ "hyper 1.10.1",
  "ipnet",
  "libc",
  "percent-encoding",
@@ -5206,7 +5212,7 @@ dependencies = [
  "cfg-if",
  "fastcrypto",
  "futures",
- "hyper 1.10.0",
+ "hyper 1.10.1",
  "identity_core",
  "identity_credential",
  "identity_did",
@@ -5666,7 +5672,7 @@ dependencies = [
  "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.10.0",
+ "hyper 1.10.1",
  "hyper-util",
  "iota-tls",
  "pin-project-lite",
@@ -5744,7 +5750,7 @@ dependencies = [
  "schemars 0.8.22",
  "serde",
  "serde_json",
- "serde_with 3.20.0",
+ "serde_with 3.21.0",
  "strum 0.27.2",
  "tabled",
  "tracing",
@@ -5764,7 +5770,7 @@ dependencies = [
  "regex",
  "serde",
  "serde_json",
- "serde_with 3.20.0",
+ "serde_with 3.21.0",
  "signature 1.6.4",
  "slip10_ed25519",
  "tiny-bip39",
@@ -5937,7 +5943,7 @@ dependencies = [
  "schemars 0.8.22",
  "serde",
  "serde-env",
- "serde_with 3.20.0",
+ "serde_with 3.21.0",
  "tracing",
 ]
 
@@ -5960,7 +5966,7 @@ dependencies = [
  "anymap",
  "async-trait",
  "bech32",
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "bytemuck",
  "derive_more 0.99.20",
  "futures",
@@ -6024,7 +6030,7 @@ dependencies = [
  "rustls 0.23.40",
  "serde",
  "serde_json",
- "serde_with 3.20.0",
+ "serde_with 3.21.0",
  "thiserror 1.0.69",
  "tokio",
  "tracing",
@@ -6048,7 +6054,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_repr",
- "serde_with 3.20.0",
+ "serde_with 3.21.0",
  "strum 0.27.2",
  "thiserror 2.0.18",
  "winnow 0.7.15",
@@ -6145,7 +6151,7 @@ dependencies = [
  "serde",
  "serde-name",
  "serde_json",
- "serde_with 3.20.0",
+ "serde_with 3.21.0",
  "signature 1.6.4",
  "starfish-config",
  "static_assertions",
@@ -6189,7 +6195,7 @@ dependencies = [
  "fastcrypto",
  "fastcrypto-zkp",
  "hex",
- "hyper 1.10.0",
+ "hyper 1.10.1",
  "indexmap 2.14.0",
  "iota-sdk 1.22.0-alpha",
  "iota-sdk-types",
@@ -6209,7 +6215,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_repr",
- "serde_with 3.20.0",
+ "serde_with 3.21.0",
  "strum 0.25.0",
  "thiserror 1.0.69",
  "tokio",
@@ -6244,7 +6250,7 @@ dependencies = [
  "futures",
  "getrandom 0.2.17",
  "getrandom 0.3.4",
- "hyper 1.10.0",
+ "hyper 1.10.1",
  "iota-sdk 1.1.5",
  "iota_interaction",
  "js-sys",
@@ -6821,7 +6827,7 @@ dependencies = [
  "async-trait",
  "base64 0.22.1",
  "http-body 1.0.1",
- "hyper 1.10.0",
+ "hyper 1.10.1",
  "hyper-rustls 0.27.9",
  "hyper-util",
  "jsonrpsee-core",
@@ -6860,7 +6866,7 @@ dependencies = [
  "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.10.0",
+ "hyper 1.10.1",
  "hyper-util",
  "jsonrpsee-core",
  "jsonrpsee-types",
@@ -6943,15 +6949,15 @@ dependencies = [
 
 [[package]]
 name = "jsonschema"
-version = "0.43.0"
+version = "0.46.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dcfbe6df48e0121219eefc8d6a30b872ac2769c7896454bda06f7b64129fa22"
+checksum = "6a5fe5206f06e589caf25e79fc05ccdf91fca745685fe9fe1a13bbdfb479a631"
 dependencies = [
  "ahash 0.8.12",
  "bytecount",
  "data-encoding",
  "email_address",
- "fancy-regex 0.17.0",
+ "fancy-regex 0.18.0",
  "fraction",
  "getrandom 0.3.4",
  "idna",
@@ -7228,10 +7234,10 @@ version = "0.1.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f02ab6bace2054fb888a3c16f990117b579d14a3088e472d63c6011fa185c9d3"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "libc",
  "plain",
- "redox_syscall 0.8.0",
+ "redox_syscall 0.8.1",
 ]
 
 [[package]]
@@ -7311,9 +7317,9 @@ dependencies = [
 
 [[package]]
 name = "libz-sys"
-version = "1.1.28"
+version = "1.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc3a226e576f50782b3305c5ccf458698f92798987f551c6a02efe8276721e22"
+checksum = "85bc9657773828b90eeb625adff10eeac83cc21bbfd8e23a03eaa8a33c9e28d9"
 dependencies = [
  "cc",
  "pkg-config",
@@ -7371,9 +7377,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.30"
+version = "0.4.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "616ec5685824bcc94416c6d4a7a446eea774a31efd7062c8480ba6fd06d7a6e5"
+checksum = "953f07c43838f8e6f9758cab68bf5bed85465e7587ebe0b823f1bcd81978ad3a"
 dependencies = [
  "serde_core",
  "value-bag",
@@ -7559,6 +7565,12 @@ dependencies = [
  "sketches-ddsketch",
 ]
 
+[[package]]
+name = "micromap"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a86d3146ed3995b5913c414f6664344b9617457320782e64f0bb44afd49d74"
+
 [[package]]
 name = "mime"
 version = "0.3.17"
@@ -7716,7 +7728,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "276ba0cd571553d1f6936c6f180964776ece6ab7507dc8765f8a9c9c49d8cd00"
 dependencies = [
  "base64 0.22.1",
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "bson",
  "derive-where",
  "derive_more 2.1.1",
@@ -7739,7 +7751,7 @@ dependencies = [
  "rustls 0.23.40",
  "serde",
  "serde_bytes",
- "serde_with 3.20.0",
+ "serde_with 3.21.0",
  "sha1",
  "sha2 0.10.9",
  "socket2 0.6.4",
@@ -7953,7 +7965,7 @@ dependencies = [
  "ref-cast",
  "serde",
  "serde_bytes",
- "serde_with 3.20.0",
+ "serde_with 3.21.0",
  "thiserror 1.0.69",
  "uint",
 ]
@@ -8606,7 +8618,7 @@ dependencies = [
  "http-body-util",
  "httparse",
  "humantime",
- "hyper 1.10.0",
+ "hyper 1.10.1",
  "itertools 0.14.0",
  "md-5",
  "parking_lot 0.12.5",
@@ -8695,7 +8707,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_urlencoded",
- "serde_with 3.20.0",
+ "serde_with 3.21.0",
  "siopv2",
  "tokio",
  "tower-http 0.4.4",
@@ -8724,7 +8736,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_urlencoded",
- "serde_with 3.20.0",
+ "serde_with 3.21.0",
  "thiserror 1.0.69",
  "tokio",
  "url",
@@ -8756,7 +8768,7 @@ dependencies = [
  "reqwest-retry",
  "serde",
  "serde_json",
- "serde_with 3.20.0",
+ "serde_with 3.21.0",
  "thiserror 1.0.69",
  "tokio",
  "url",
@@ -9064,7 +9076,7 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77144664f6aac5f629d7efa815f5098a054beeeca6ccafee5ec453fd2b0c53f9"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "ciborium",
  "coset",
  "data-encoding",
@@ -9720,7 +9732,7 @@ dependencies = [
  "bcs",
  "cfg-if",
  "fastcrypto",
- "hyper 1.10.0",
+ "hyper 1.10.1",
  "iota-sdk 1.22.0-alpha",
  "iota-sdk-types",
  "iota_interaction",
@@ -9765,9 +9777,9 @@ dependencies = [
 
 [[package]]
 name = "prost"
-version = "0.14.3"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2ea70524a2f82d518bce41317d0fae74151505651af45faf1ffbd6fd33f0568"
+checksum = "528ac67416ff8646872a3c02cad9cc4ee5dc9f9540c9b10771855c95cb2e5ae1"
 dependencies = [
  "bytes",
  "prost-derive",
@@ -9775,9 +9787,9 @@ dependencies = [
 
 [[package]]
 name = "prost-derive"
-version = "0.14.3"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
+checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -9788,9 +9800,9 @@ dependencies = [
 
 [[package]]
 name = "prost-types"
-version = "0.14.3"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8991c4cbdb8bc5b11f0b074ffe286c30e523de90fee5ba8132f1399f23cb3dd7"
+checksum = "f94967dc7688f3054c7fac87473ffae4cc4c3904800e2d9f5b857246d8963b0a"
 dependencies = [
  "prost",
 ]
@@ -9873,9 +9885,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.14"
+version = "0.11.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
+checksum = "4fcb935c5bec503c2f0e306bdd3e58bb9029dcb14fa8d9ac76e3a5256ac0763e"
 dependencies = [
  "bytes",
  "getrandom 0.3.4",
@@ -10098,7 +10110,7 @@ version = "11.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
 ]
 
 [[package]]
@@ -10173,16 +10185,16 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
 ]
 
 [[package]]
 name = "redox_syscall"
-version = "0.8.0"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c7591fa2c6b601dfcfe5f043f65a1c39fcdf50efefcd7f1572e538c1f4b398d"
+checksum = "5b44b894f2a6e36457d665d1e08c3866add6ed5e70050c1b4ba8a8ddedb02ce7"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
 ]
 
 [[package]]
@@ -10218,14 +10230,16 @@ dependencies = [
 
 [[package]]
 name = "referencing"
-version = "0.43.0"
+version = "0.46.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37add1aa1d619a975521d262d09f100f1f767791c9386c03679450f30acd78c1"
+checksum = "69e4e17ef386c5383591d07623d3de49cbc601156e7582973e6db98d66a57de2"
 dependencies = [
  "ahash 0.8.12",
  "fluent-uri",
  "getrandom 0.3.4",
  "hashbrown 0.16.1",
+ "itoa",
+ "micromap",
  "parking_lot 0.12.5",
  "percent-encoding",
  "serde_json",
@@ -10323,7 +10337,7 @@ dependencies = [
  "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.10.0",
+ "hyper 1.10.1",
  "hyper-rustls 0.27.9",
  "hyper-util",
  "js-sys",
@@ -10332,7 +10346,7 @@ dependencies = [
  "pin-project-lite",
  "quinn",
  "rustls 0.23.40",
- "rustls-native-certs 0.8.3",
+ "rustls-native-certs 0.8.4",
  "rustls-pki-types",
  "serde",
  "serde_json",
@@ -10367,7 +10381,7 @@ dependencies = [
  "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.10.0",
+ "hyper 1.10.1",
  "hyper-rustls 0.27.9",
  "hyper-util",
  "js-sys",
@@ -10535,7 +10549,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b91f7eff05f748767f183df4320a63d6936e9c6107d97c9e6bdd9784f4289c94"
 dependencies = [
  "base64 0.21.7",
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "serde",
  "serde_derive",
 ]
@@ -10741,7 +10755,7 @@ version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "errno",
  "libc",
  "linux-raw-sys",
@@ -10803,9 +10817,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-native-certs"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "612460d5f7bea540c490b2b6395d8e34a953e52b491accd6c86c8164c5932a63"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
 dependencies = [
  "openssl-probe 0.2.1",
  "rustls-pki-types",
@@ -10853,7 +10867,7 @@ dependencies = [
  "log",
  "once_cell",
  "rustls 0.23.40",
- "rustls-native-certs 0.8.3",
+ "rustls-native-certs 0.8.4",
  "rustls-platform-verifier-android",
  "rustls-webpki 0.103.13",
  "security-framework 3.7.0",
@@ -10874,7 +10888,7 @@ dependencies = [
  "log",
  "once_cell",
  "rustls 0.23.40",
- "rustls-native-certs 0.8.3",
+ "rustls-native-certs 0.8.4",
  "rustls-platform-verifier-android",
  "rustls-webpki 0.103.13",
  "security-framework 3.7.0",
@@ -10963,15 +10977,6 @@ dependencies = [
  "winapi-util",
 ]
 
-[[package]]
-name = "scc"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46e6f046b7fef48e2660c57ed794263155d713de679057f2d0c169bfc6e756cc"
-dependencies = [
- "sdd",
-]
-
 [[package]]
 name = "schannel"
 version = "0.1.29"
@@ -11076,12 +11081,6 @@ dependencies = [
  "thiserror 1.0.69",
 ]
 
-[[package]]
-name = "sdd"
-version = "3.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "490dcfcbfef26be6800d11870ff2df8774fa6e86d047e3e8c8a76b25655e41ca"
-
 [[package]]
 name = "seahash"
 version = "4.1.0"
@@ -11153,7 +11152,7 @@ version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "core-foundation 0.9.4",
  "core-foundation-sys",
  "libc",
@@ -11166,7 +11165,7 @@ version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "core-foundation 0.10.1",
  "core-foundation-sys",
  "libc",
@@ -11421,9 +11420,9 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.20.0"
+version = "3.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e72c1c2cb7b223fafb600a619537a871c2818583d619401b785e7c0b746ccde2"
+checksum = "76a5c54c7310e7b8b9577c286d7e399ddd876c3e12b3ed917a8aabc4b96e9e8c"
 dependencies = [
  "base64 0.22.1",
  "bs58 0.5.1",
@@ -11435,7 +11434,7 @@ dependencies = [
  "schemars 1.2.1",
  "serde_core",
  "serde_json",
- "serde_with_macros 3.20.0",
+ "serde_with_macros 3.21.0",
  "time",
 ]
 
@@ -11453,9 +11452,9 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.20.0"
+version = "3.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b90c488738ecb4fb0262f41f43bc40efc5868d9fb744319ddf5f5317f417bfac"
+checksum = "84d57bc0c8b9a17920c178daa6bb924850d54a9c97ab45194bb8c17ad66bb660"
 dependencies = [
  "darling 0.23.0",
  "proc-macro2",
@@ -11487,24 +11486,23 @@ dependencies = [
 
 [[package]]
 name = "serial_test"
-version = "3.4.0"
+version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "911bd979bf1070a3f3aa7b691a3b3e9968f339ceeec89e08c280a8a22207a32f"
+checksum = "699f4197115b8a7e7ff19c9a315a4bd6fffec26cc4626ef45ecaea389e081c6d"
 dependencies = [
  "futures-executor",
  "futures-util",
  "log",
  "once_cell",
  "parking_lot 0.12.5",
- "scc",
  "serial_test_derive",
 ]
 
 [[package]]
 name = "serial_test_derive"
-version = "3.4.0"
+version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a7d91949b85b0d2fb687445e448b40d322b6b3e4af6b44a29b21d9a5f33e6d9"
+checksum = "94e153fc76e1c6a068703d6d29c508a0b15c061c4b7e43da59cc097bc342673c"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -11601,9 +11599,9 @@ dependencies = [
 
 [[package]]
 name = "shlex"
-version = "1.3.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "signal-hook-registry"
@@ -11727,7 +11725,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_urlencoded",
- "serde_with 3.20.0",
+ "serde_with 3.21.0",
  "tokio",
  "url",
 ]
@@ -12003,7 +12001,7 @@ checksum = "aa003f0038df784eb8fecbbac13affe3da23b45194bd57dba231c8f48199c526"
 dependencies = [
  "atoi",
  "base64 0.22.1",
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "byteorder",
  "bytes",
  "crc",
@@ -12045,7 +12043,7 @@ checksum = "db58fcd5a53cf07c184b154801ff91347e4c30d17a3562a635ff028ad5deda46"
 dependencies = [
  "atoi",
  "base64 0.22.1",
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "byteorder",
  "crc",
  "dotenvy",
@@ -12650,7 +12648,7 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "core-foundation 0.9.4",
  "system-configuration-sys 0.6.0",
 ]
@@ -13130,7 +13128,7 @@ dependencies = [
  "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.10.0",
+ "hyper 1.10.1",
  "hyper-timeout",
  "hyper-util",
  "percent-encoding",
@@ -13216,7 +13214,7 @@ version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "61c5bb1d698276a2443e5ecfabc1008bf15a36c12e6a7176e7bf089ea9131140"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "bytes",
  "futures-core",
  "futures-util",
@@ -13234,7 +13232,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e9cd434a998747dd2c4276bc96ee2e0c7a2eadf3cae88e52be55a05fa9053f5"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "bytes",
  "http 1.4.1",
  "http-body 1.0.1",
@@ -13252,7 +13250,7 @@ version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "bytes",
  "futures-util",
  "http 1.4.1",
@@ -13488,9 +13486,9 @@ checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
 
 [[package]]
 name = "typenum"
-version = "1.20.0"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
 [[package]]
 name = "typeshare"
@@ -13579,9 +13577,9 @@ checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.13.2"
+version = "1.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9629274872b2bfaf8d66f5f15725007f635594914870f65218920345aa11aa8c"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
 
 [[package]]
 name = "unicode-width"
@@ -13731,9 +13729,9 @@ dependencies = [
 
 [[package]]
 name = "uuid"
-version = "1.23.1"
+version = "1.23.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd74a9687298c6858e9b88ec8935ec45d22e8fd5e6394fa1bd4e99a87789c76"
+checksum = "d258b83ceec21034727ecee8c382cfa6c3e133699b0742c64571814fb420c9f7"
 dependencies = [
  "getrandom 0.4.2",
  "js-sys",
@@ -13996,7 +13994,7 @@ version = "0.244.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "hashbrown 0.15.5",
  "indexmap 2.14.0",
  "semver",
@@ -14623,7 +14621,7 @@ dependencies = [
  "futures",
  "http 1.4.1",
  "http-body-util",
- "hyper 1.10.0",
+ "hyper 1.10.1",
  "hyper-util",
  "log",
  "once_cell",
@@ -14698,7 +14696,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
 dependencies = [
  "anyhow",
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "indexmap 2.14.0",
  "log",
  "serde",
@@ -14742,7 +14740,7 @@ checksum = "e283cc794a890f5bdc01e358ad7c34535025f79ba83c1b5c7e01e5d6c60b336d"
 dependencies = [
  "async-tungstenite",
  "async_io_stream",
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "futures-core",
  "futures-io",
  "futures-sink",
@@ -14849,9 +14847,9 @@ dependencies = [
 
 [[package]]
 name = "yoke"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
 dependencies = [
  "stable_deref_trait",
  "yoke-derive",
@@ -14872,18 +14870,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.49"
+version = "0.8.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bce33a6288fa3f072a8c2c7d0f2fdbb90e28298f0135c1f99b96c3db2efcc60b"
+checksum = "3b065d4f0e55f82fae73202e189638116a87c55ab6b8e6c2721e13dd9d854ad1"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.49"
+version = "0.8.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd425244944f4ab65ccff928e7323354c5a018c75838362fdce749dfad2ee1e"
+checksum = "0b631b19d36a892ab55420c92dbc83ccd79274f25be714855d3074aa71cab639"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/Cargo.toml b/Cargo.toml
index c0920599..060a106d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -73,6 +73,8 @@ iota-sdk-legacy = { version = "1.0", package = "iota-sdk", default-features = fa
     "client",
     "stronghold",
 ] }
+iso8601 = "0.6"
+jsonschema = "0.46"
 jsonwebtoken = "9.3"
 lazy_static = "1.4"
 mime = { version = "0.3" }
diff --git a/agent_api_http/Cargo.toml b/agent_api_http/Cargo.toml
index 622cb721..dd6d0fb3 100644
--- a/agent_api_http/Cargo.toml
+++ b/agent_api_http/Cargo.toml
@@ -30,6 +30,8 @@ hyper = { version = "1.2" }
 identity_core.workspace = true
 identity_credential.workspace = true
 identity_did.workspace = true
+iso8601.workspace = true
+jsonschema.workspace = true
 metrics = "0.24"
 metrics-exporter-prometheus = { version = "0.17", default-features = false }
 oauth_tsl.workspace = true
diff --git a/agent_api_http/openapi-generated.yaml b/agent_api_http/openapi-generated.yaml
index a63c4aab..e9bfb486 100644
--- a/agent_api_http/openapi-generated.yaml
+++ b/agent_api_http/openapi-generated.yaml
@@ -123,41 +123,73 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/Connection'
-  /v0/create-public-offer:
+  /v0/create-new-template:
     post:
       tags:
-      - Issuance
-      summary: Create a public offer mapping
-      operationId: create_public_offer
+      - Library
+      - Templates
+      summary: Create a new template
+      description: Creates a new template which can be used to issue credentials.
+      operationId: create_template
       requestBody:
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/CreatePublicOfferRequest'
+              $ref: '#/components/schemas/CreateNewTemplateRequestBody'
+            examples:
+              OpenBadges template:
+                description: An OpenBadges 3.0 template. The fields `achievement.name`, `achievement.description`, and `achievement.criteria.narrative` must be explicitly included in the schema.
+                value:
+                  title: OpenBadges template
+                  dataModel: open_badges_3-0
+                  holderType: individual
+                  schema:
+                    type: object
+                    properties:
+                      achievement.name:
+                        type: string
+                      achievement.description:
+                        type: string
+                      achievement.criteria.narrative:
+                        type: string
+              Standard template:
+                description: A simple example that will issue credentials in the W3C Verifiable Credentials Data Model v1.1 format.
+                value:
+                  title: Standard template
+                  dataModel: w3c_vc_data_model_v1-1
+                  holderType: individual
         required: true
       responses:
         '201':
-          description: Public offer created successfully
-        '400':
-          description: Template schema invalid for public offers
-        '404':
-          description: Template or offer not found
-  /v0/credential-configurations:
+          description: New template created successfully
+          headers:
+            Location:
+              schema:
+                type: string
+              description: The path of the newly created template
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Template'
+  /v0/create-public-offer:
     post:
       tags:
       - Issuance
-      summary: Update credential configuration
-      description: Publishes the provided credential configuration.
-      operationId: set_credential_configuration
+      summary: Create a public offer mapping
+      operationId: create_public_offer
       requestBody:
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/CredentialConfiguration'
+              $ref: '#/components/schemas/CreatePublicOfferRequest'
         required: true
       responses:
         '201':
-          description: Credential configuration updated successfully
+          description: Public offer created successfully
+        '400':
+          description: Template schema invalid for public offers
+        '404':
+          description: Template or offer not found
   /v0/credentials:
     get:
       tags:
@@ -232,6 +264,23 @@ paths:
           description: Public offer deleted successfully
         '404':
           description: Public offer not found
+  /v0/delete-template:
+    post:
+      tags:
+      - Library
+      - Templates
+      summary: Delete a template
+      description: Deletes a template by marking its status as `Deleted`. Deleted templates will no longer appear in any views.
+      operationId: delete_template_by_id
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/DeleteTemplateEndpointRequest'
+        required: true
+      responses:
+        '204':
+          description: Template deleted successfully
   /v0/documents:
     get:
       tags:
@@ -278,6 +327,36 @@ paths:
                 $ref: '#/components/schemas/Document'
         '404':
           description: Document not found
+  /v0/duplicate-template:
+    post:
+      tags:
+      - Library
+      - Templates
+      summary: Duplicate existing template
+      description: Creates a duplicate of an existing template.
+      operationId: duplicate_template
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/DuplicateTemplateEndpointRequest'
+            example:
+              sourceTemplateId: 91fc790f-d876-4827-9a9d-0fb0f6766dca
+        required: true
+      responses:
+        '201':
+          description: Duplicate created successfully
+          headers:
+            Location:
+              schema:
+                type: string
+              description: The path of the newly created template
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Template'
+        '422':
+          description: Source Template Not Found
   /v0/get-all-public-offers:
     get:
       tags:
@@ -293,6 +372,27 @@ paths:
                 type: array
                 items:
                   $ref: '#/components/schemas/PublicOfferStatusDto'
+  /v0/get-template-by-id/{id}:
+    get:
+      tags:
+      - Library
+      - Templates
+      summary: Get template by ID
+      description: Retrieve a specific template by its ID.
+      operationId: get_template_by_id
+      parameters:
+      - name: id
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        '200':
+          description: Template retrieved successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Template'
   /v0/holder/credentials:
     get:
       tags:
@@ -413,6 +513,23 @@ paths:
                 $ref: '#/components/schemas/OfferView'
         '404':
           description: Offer not found
+  /v0/list-all-templates:
+    get:
+      tags:
+      - Library
+      - Templates
+      summary: List all templates
+      description: List all available templates.
+      operationId: get_all_templates
+      responses:
+        '200':
+          description: All templates retrieved successfully
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/Template'
   /v0/offers:
     get:
       tags:
@@ -550,104 +667,7 @@ paths:
           description: Public offer taken online successfully
         '404':
           description: Public offer not found
-  /v0/templates/create-template:
-    post:
-      tags:
-      - Library
-      - Templates
-      summary: Create a new template
-      description: Creates a new template which can be used to issue credentials.
-      operationId: create_template
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/CreateTemplateEndpointRequest'
-            examples:
-              Standard template:
-                description: A simple example that will issue credentials in the W3C Verifiable Credentials Data Model v1.1 format.
-                value:
-                  title: Standard template
-                  dataModel: w3c_vc_data_model_v1-1
-                  holderType: individual
-        required: true
-      responses:
-        '201':
-          description: New template created successfully
-          headers:
-            Location:
-              schema:
-                type: string
-              description: The path of the newly created template
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Template'
-  /v0/templates/delete-template:
-    post:
-      tags:
-      - Library
-      - Templates
-      summary: Delete a template
-      description: Deletes a template by marking its status as `Deleted`. Deleted templates will no longer appear in any views.
-      operationId: delete_template_by_id
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/DeleteTemplateEndpointRequest'
-        required: true
-      responses:
-        '204':
-          description: Template deleted successfully
-  /v0/templates/duplicate-template:
-    post:
-      tags:
-      - Library
-      - Templates
-      summary: Duplicate existing template
-      description: Creates a duplicate of an existing template.
-      operationId: duplicate_template
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/DuplicateTemplateEndpointRequest'
-            example:
-              sourceTemplateId: 91fc790f-d876-4827-9a9d-0fb0f6766dca
-        required: true
-      responses:
-        '201':
-          description: Duplicate created successfully
-          headers:
-            Location:
-              schema:
-                type: string
-              description: The path of the newly created template
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Template'
-        '422':
-          description: Source Template Not Found
-  /v0/templates/get-all-templates:
-    get:
-      tags:
-      - Library
-      - Templates
-      summary: List all templates
-      description: List all available templates.
-      operationId: get_all_templates
-      responses:
-        '200':
-          description: All templates retrieved successfully
-          content:
-            application/json:
-              schema:
-                type: array
-                items:
-                  $ref: '#/components/schemas/Template'
-  /v0/templates/update-template:
+  /v0/update-template:
     post:
       tags:
       - Library
@@ -664,27 +684,6 @@ paths:
       responses:
         '204':
           description: Template updated successfully
-  /v0/templates/{template_id}:
-    get:
-      tags:
-      - Library
-      - Templates
-      summary: Get template by ID
-      description: Retrieve a specific template by its ID.
-      operationId: get_template_by_id
-      parameters:
-      - name: template_id
-        in: path
-        required: true
-        schema:
-          type: string
-      responses:
-        '200':
-          description: Template retrieved successfully
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Template'
 components:
   schemas:
     AcceptConnectionChangesRequest:
@@ -755,29 +754,18 @@ components:
           type:
           - string
           - 'null'
-    CreatePublicOfferRequest:
+    CreateNewTemplateRequestBody:
       type: object
-      required:
-      - offerId
-      - templateId
       properties:
-        offerId:
-          type: string
-        templateId:
-          type: string
-    CreateTemplateEndpointRequest:
-      type: object
-      properties:
-        creator:
-          type:
-          - string
-          - 'null'
+        credentialExpiration:
+          oneOf:
+          - type: 'null'
+          - $ref: '#/components/schemas/Expiration'
           default: null
         dataModel:
           oneOf:
-          - type: 'null'
           - $ref: '#/components/schemas/DataModel'
-          default: null
+          default: w3c_vc_data_model_v2-0
         description:
           type:
           - string
@@ -788,11 +776,15 @@ components:
           - type: 'null'
           - $ref: '#/components/schemas/Display'
           default: null
+        holderAuthorization:
+          oneOf:
+          - $ref: '#/components/schemas/HolderAuthorization'
+          default:
+            pre_authorized: true
         holderType:
           oneOf:
-          - type: 'null'
           - $ref: '#/components/schemas/HolderType'
-          default: null
+          default: individual
         schema: {}
         schemaPropertiesAttributes:
           type:
@@ -808,15 +800,15 @@ components:
           - $ref: '#/components/schemas/TemplateStatus'
           default: draft
         tags:
-          type: array
-          items:
-            type: string
-          default: []
-        title:
           type:
-          - string
+          - array
           - 'null'
+          items:
+            type: string
           default: null
+        title:
+          type: string
+          default: ''
         type:
           type: array
           items:
@@ -826,6 +818,17 @@ components:
           oneOf:
           - $ref: '#/components/schemas/Visibility'
           default: private
+      additionalProperties: false
+    CreatePublicOfferRequest:
+      type: object
+      required:
+      - offerId
+      - templateId
+      properties:
+        offerId:
+          type: string
+        templateId:
+          type: string
     Credential:
       type: object
       required:
@@ -935,36 +938,6 @@ components:
         signed: {}
         status:
           $ref: '#/components/schemas/IssuanceStatus'
-    CredentialConfiguration:
-      allOf:
-      - type: object
-        properties:
-          claims:
-            type: object
-          display:
-            type: object
-      - type: object
-        required:
-        - credential_configuration_id
-        - format
-        properties:
-          authorization:
-            type: object
-            required:
-            - pre_authorized
-            properties:
-              pre_authorized:
-                type: boolean
-              tx_code_constraints:
-                type: object
-          credential_configuration_id:
-            type: string
-          format:
-            type: string
-          type:
-            type: array
-            items:
-              type: string
     CredentialExpiry:
       oneOf:
       - type: string
@@ -1018,20 +991,21 @@ components:
     CredentialsEndpointRequest:
       type: object
       required:
+      - templateId
       - offerId
       - credential
-      - credentialConfigurationId
-      - expiresAt
       properties:
         credential: {}
-        credentialConfigurationId:
-          type: string
         expiresAt:
-          $ref: '#/components/schemas/CredentialExpiry'
+          oneOf:
+          - type: 'null'
+          - $ref: '#/components/schemas/CredentialExpiry'
         isSigned:
           type: boolean
         offerId:
           type: string
+        templateId:
+          type: string
     Data:
       type: object
       required:
@@ -1135,6 +1109,43 @@ components:
           type: string
         recipientEmail:
           type: string
+    Expiration:
+      oneOf:
+      - type: object
+        description: Never expires.
+        required:
+        - type
+        properties:
+          type:
+            type: string
+            enum:
+            - never
+      - type: object
+        description: Relative duration in ISO 8601 format, e.g. `"P3DT4H"` or seconds as `"PT86400S"`.
+        required:
+        - value
+        - type
+        properties:
+          type:
+            type: string
+            enum:
+            - duration
+          value:
+            type: string
+            description: Relative duration in ISO 8601 format, e.g. `"P3DT4H"` or seconds as `"PT86400S"`.
+      - type: object
+        description: Absolute datetime in ISO 8601 format, e.g. `"2026-12-31T23:59:59Z"`.
+        required:
+        - value
+        - type
+        properties:
+          type:
+            type: string
+            enum:
+            - date-time
+          value:
+            type: string
+            description: Absolute datetime in ISO 8601 format, e.g. `"2026-12-31T23:59:59Z"`.
     GetConnectionsEndpointRequest:
       type: object
       properties:
@@ -1150,6 +1161,27 @@ components:
           type:
           - string
           - 'null'
+    HolderAuthorization:
+      type: object
+      required:
+      - pre_authorized
+      properties:
+        pre_authorized:
+          type: boolean
+        tx_code_constraints:
+          type: object
+          properties:
+            description:
+              type: string
+              description: The length of the string must not exceed 300 characters.
+            input_mode:
+              type: string
+              enum:
+              - numeric
+              - text
+            length:
+              type: integer
+              description: Allows a pin-length of 0-255.
     HolderOfferStatus:
       type: string
       enum:
@@ -1385,6 +1417,13 @@ components:
       required:
       - selectivelyDisclosable
       properties:
+        nonRemovable:
+          type: boolean
+          description: |-
+            Whether this property is non-removable — its leaf field must remain present in the schema
+            and cannot be removed by the caller. Determined by the data model; system-controlled only.
+            For OpenBadges 3.0 templates, only the required standard fields are non-removable.
+            Defaults to `false`.
         selectivelyDisclosable:
           type: boolean
     PublicOfferStatus:
@@ -1471,19 +1510,19 @@ components:
       description: Data transfer object for Templates.
       required:
       - id
-      - tags
+      - title
+      - dataModel
+      - holderType
       - status
       - visibility
+      - credentialExpiration
       - type
+      - holderAuthorization
       properties:
-        creator:
-          type:
-          - string
-          - 'null'
+        credentialExpiration:
+          $ref: '#/components/schemas/Expiration'
         dataModel:
-          oneOf:
-          - type: 'null'
-          - $ref: '#/components/schemas/DataModel'
+          $ref: '#/components/schemas/DataModel'
         description:
           type:
           - string
@@ -1492,10 +1531,10 @@ components:
           oneOf:
           - type: 'null'
           - $ref: '#/components/schemas/Display'
+        holderAuthorization:
+          $ref: '#/components/schemas/HolderAuthorization'
         holderType:
-          oneOf:
-          - type: 'null'
-          - $ref: '#/components/schemas/HolderType'
+          $ref: '#/components/schemas/HolderType'
         id:
           type: string
         modifiedAt:
@@ -1511,20 +1550,16 @@ components:
             $ref: '#/components/schemas/PropertyAttribute'
           propertyNames:
             type: string
-        sourceTemplateId:
-          type:
-          - string
-          - 'null'
         status:
           $ref: '#/components/schemas/TemplateStatus'
         tags:
-          type: array
+          type:
+          - array
+          - 'null'
           items:
             type: string
         title:
-          type:
-          - string
-          - 'null'
+          type: string
         type:
           type: array
           items:
@@ -1541,15 +1576,10 @@ components:
     UpdateTemplateEndpointRequest:
       type: object
       properties:
-        creator:
-          type:
-          - string
-          - 'null'
-          default: null
-        dataModel:
+        credentialExpiration:
           oneOf:
           - type: 'null'
-          - $ref: '#/components/schemas/DataModel'
+          - $ref: '#/components/schemas/Expiration'
           default: null
         description:
           type:
@@ -1561,10 +1591,10 @@ components:
           - type: 'null'
           - $ref: '#/components/schemas/Display'
           default: null
-        holderType:
+        holderAuthorization:
           oneOf:
           - type: 'null'
-          - $ref: '#/components/schemas/HolderType'
+          - $ref: '#/components/schemas/HolderAuthorization'
           default: null
         id:
           type: string
@@ -1585,25 +1615,30 @@ components:
           - $ref: '#/components/schemas/TemplateStatus'
           default: null
         tags:
-          type: array
+          type:
+          - array
+          - 'null'
           items:
             type: string
-          default: []
+          default: null
         title:
           type:
           - string
           - 'null'
           default: null
         type:
-          type: array
+          type:
+          - array
+          - 'null'
           items:
             type: string
-          default: []
+          default: null
         visibility:
           oneOf:
           - type: 'null'
           - $ref: '#/components/schemas/Visibility'
           default: null
+      additionalProperties: false
     Validation:
       oneOf:
       - type: object
diff --git a/agent_api_http/src/lib.rs b/agent_api_http/src/lib.rs
index 6d50e1b8..93c543fb 100644
--- a/agent_api_http/src/lib.rs
+++ b/agent_api_http/src/lib.rs
@@ -66,7 +66,8 @@ pub fn app(
         )
         .merge(
             issuance_state
-                .map(|issuance_state| v0::issuance::router_with_library(issuance_state, library_state.clone()))
+                .zip(library_state.clone())
+                .map(v0::issuance::router)
                 .unwrap_or_default(),
         )
         .merge(holder_state.map(v0::holder::router).unwrap_or_default())
@@ -78,9 +79,13 @@ pub fn app(
                 .layer(
                     TraceLayer::new_for_http()
                         .make_span_with(|request: &Request<_>| {
-                            let path = request.extensions().get::<MatchedPath>().map(MatchedPath::as_str);
+                            let path = request
+                                .extensions()
+                                .get::<MatchedPath>()
+                                .map(MatchedPath::as_str)
+                                .unwrap_or_else(|| request.uri().path());
                             info_span!(
-                                "HTTP Request ",
+                                "HTTP Request",
                                 method = ?request.method(),
                                 path,
                             )
@@ -152,11 +157,12 @@ mod tests {
     use std::collections::HashMap;
 
     pub const OFFER_ID: &str = "00000000-0000-0000-0000-000000000000";
+    pub const TEMPLATE_ID: &str = "001";
 
     lazy_static::lazy_static! {
         static ref CREDENTIAL_CONFIGURATIONS_SUPPORTED: HashMap<String, CredentialConfigurationsSupportedObject> =
             vec![(
-                "001".to_string(),
+                TEMPLATE_ID.to_string(),
                 serde_json::from_value(json!({
                     "format": "jwt_vc_json",
                     "cryptographic_binding_methods_supported": [
@@ -194,50 +200,6 @@ mod tests {
                     }}
                 ))
                 .unwrap()
-            ),
-            (
-                "002".to_string(),
-                serde_json::from_value(json!({
-                    "format": "jwt_vc_json",
-                    "cryptographic_binding_methods_supported": [
-                        "did:jwk",
-                        "did:key",
-                    ],
-                    "credential_signing_alg_values_supported": [
-                        "ES256",
-                        "EdDSA"
-                    ],
-                    "credential_definition":{
-                        "type": [
-                            "VerifiableCredential"
-                        ]
-                    },
-                    "proof_types_supported": {
-                        "jwt": {
-                            "proof_signing_alg_values_supported": [
-                                "ES256",
-                                "EdDSA"
-                            ],
-                        }
-                    },
-                    "credential_metadata": {
-                        "display": [
-                            {
-                                "name": "Verifiable Credential",
-                                "locale": "en",
-                                "logo": {
-                                    "uri": "https://www.impierce.com/external/impierce-logo.png",
-                                    "alt_text": "Impierce Logo",
-                                }
-                            }
-                        ]
-                    },
-                    "authorization": {
-                        "pre_authorized": false
-                    }
-                }
-                ))
-                .unwrap()
             )]
             .into_iter()
             .collect();
diff --git a/agent_api_http/src/v0/authorization/authorization_server/authorize.rs b/agent_api_http/src/v0/authorization/authorization_server/authorize.rs
index fc759233..ff8821b6 100644
--- a/agent_api_http/src/v0/authorization/authorization_server/authorize.rs
+++ b/agent_api_http/src/v0/authorization/authorization_server/authorize.rs
@@ -34,11 +34,13 @@ pub(crate) async fn authorize(
 #[cfg(test)]
 pub mod tests {
     use super::*;
+    use crate::tests::TEMPLATE_ID;
+    use crate::v0::authorization;
     use crate::v0::authorization::authorization_server::consent::tests::{get_consent, post_consent};
     use crate::v0::authorization::authorization_server::par::tests::par;
-    use crate::v0::issuance::credentials::tests::credentials;
+    use crate::v0::issuance::credentials::tests::{create_test_template_with_auth, credentials, setup_library_state};
     use crate::v0::issuance::offers::tests::offers;
-    use crate::v0::{authorization, issuance};
+    use crate::v0::issuance::router;
     use agent_authorization::services::AuthorizationServices;
     use agent_authorization::state::UNIME_CLIENT_ID;
     use agent_issuance::services::IssuanceServices;
@@ -117,10 +119,13 @@ pub mod tests {
 
         agent_issuance::state::initialize(&issuance_state).await.unwrap();
 
-        let mut app = issuance::router(issuance_state.clone());
+        let library_state = setup_library_state(&issuance_state).await;
+        create_test_template_with_auth(&library_state, false).await;
 
-        credentials(&mut app, "002").await;
-        let (authorization_code, _pre_authorized_code) = offers(&mut app, "002").await.unwrap();
+        let mut app = router((issuance_state.clone(), library_state));
+
+        credentials(&mut app).await;
+        let (authorization_code, _pre_authorized_code) = offers(&mut app, TEMPLATE_ID).await.unwrap();
         let AuthorizationCode { issuer_state, .. } = authorization_code.unwrap();
         let issuer_state = issuer_state.unwrap();
 
diff --git a/agent_api_http/src/v0/authorization/authorization_server/par.rs b/agent_api_http/src/v0/authorization/authorization_server/par.rs
index df47982b..5e43bb05 100644
--- a/agent_api_http/src/v0/authorization/authorization_server/par.rs
+++ b/agent_api_http/src/v0/authorization/authorization_server/par.rs
@@ -89,9 +89,14 @@ pub(crate) async fn par(
 #[cfg(test)]
 pub mod tests {
     use super::*;
+    use crate::tests::TEMPLATE_ID;
+    use crate::v0::issuance::router;
     use crate::v0::{
         authorization,
-        issuance::{self, credentials::tests::credentials, offers::tests::offers},
+        issuance::{
+            credentials::tests::{create_test_template_with_auth, credentials, setup_library_state},
+            offers::tests::offers,
+        },
     };
     use agent_authorization::{
         application::interactive_authorization_service::INTERACTION_TYPE_OPENID4VP,
@@ -255,10 +260,13 @@ pub mod tests {
 
         agent_issuance::state::initialize(&issuance_state).await.unwrap();
 
-        let mut app = issuance::router(issuance_state.clone());
+        let library_state = setup_library_state(&issuance_state).await;
+        create_test_template_with_auth(&library_state, false).await;
 
-        credentials(&mut app, "002").await;
-        let (authorization_code, _pre_authorized_code) = offers(&mut app, "002").await.unwrap();
+        let mut app = router((issuance_state.clone(), library_state));
+
+        credentials(&mut app).await;
+        let (authorization_code, _pre_authorized_code) = offers(&mut app, TEMPLATE_ID).await.unwrap();
         let AuthorizationCode { issuer_state, .. } = authorization_code.unwrap();
         let issuer_state = issuer_state.unwrap();
 
@@ -291,11 +299,13 @@ pub mod tests {
             Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
 
         agent_issuance::state::initialize(&issuance_state).await.unwrap();
+        let library_state = setup_library_state(&issuance_state).await;
+        create_test_template_with_auth(&library_state, false).await;
 
-        let mut app = issuance::router(issuance_state.clone());
+        let mut app = router((issuance_state.clone(), library_state));
 
-        credentials(&mut app, "002").await;
-        let (authorization_code, _pre_authorized_code) = offers(&mut app, "002").await.unwrap();
+        credentials(&mut app).await;
+        let (authorization_code, _pre_authorized_code) = offers(&mut app, TEMPLATE_ID).await.unwrap();
         let AuthorizationCode { issuer_state, .. } = authorization_code.unwrap();
         let issuer_state = issuer_state.unwrap();
 
diff --git a/agent_api_http/src/v0/authorization/authorization_server/token.rs b/agent_api_http/src/v0/authorization/authorization_server/token.rs
index ffbceccb..19828f60 100644
--- a/agent_api_http/src/v0/authorization/authorization_server/token.rs
+++ b/agent_api_http/src/v0/authorization/authorization_server/token.rs
@@ -25,6 +25,8 @@ pub(crate) async fn token(
 #[cfg(test)]
 pub mod tests {
     use super::*;
+    use crate::tests::TEMPLATE_ID;
+    use crate::v0::issuance::router;
     use crate::v0::{
         authorization::{
             self,
@@ -34,7 +36,11 @@ pub mod tests {
                 par::tests::par,
             },
         },
-        issuance::{self, credentials::tests::credentials, offers::tests::offers},
+        issuance::{
+            self,
+            credentials::tests::{create_test_template_with_auth, credentials, setup_library_state},
+            offers::tests::offers,
+        },
     };
     use agent_authorization::services::AuthorizationServices;
     use agent_authorization::state::UNIME_CLIENT_ID;
@@ -150,16 +156,13 @@ pub mod tests {
 
         agent_issuance::state::initialize(&issuance_state).await.unwrap();
 
-        let mut app = issuance::router(issuance_state.clone());
+        let library_state = setup_library_state(&issuance_state).await;
+        create_test_template_with_auth(&library_state, is_pre_authorized).await;
 
-        let credential_configuration_id = if is_pre_authorized {
-            "001".to_string()
-        } else {
-            "002".to_string()
-        };
+        let mut app = router((issuance_state.clone(), library_state));
 
-        credentials(&mut app, &credential_configuration_id).await;
-        let grants = offers(&mut app, &credential_configuration_id).await.unwrap();
+        credentials(&mut app).await;
+        let grants = offers(&mut app, TEMPLATE_ID).await.unwrap();
 
         let authorization_state = Arc::new(
             authorization_state(
@@ -188,9 +191,12 @@ pub mod tests {
 
         agent_issuance::state::initialize(&issuance_state).await.unwrap();
 
-        let mut issuance_app = issuance::router(issuance_state.clone());
-        credentials(&mut issuance_app, "001").await;
-        let (_authorization_code, pre_authorized_code) = offers(&mut issuance_app, "001").await.unwrap();
+        let library_state = setup_library_state(&issuance_state).await;
+        create_test_template_with_auth(&library_state, true).await;
+
+        let mut issuance_app = router((issuance_state.clone(), library_state));
+        credentials(&mut issuance_app).await;
+        let (_authorization_code, pre_authorized_code) = offers(&mut issuance_app, TEMPLATE_ID).await.unwrap();
 
         let offer_id = crate::tests::OFFER_ID;
         let aggregate_id = format!("public_offer:{offer_id}");
@@ -200,7 +206,7 @@ pub mod tests {
             &issuance_state.command.public_offer,
             PublicOfferCommand::Create {
                 offer_id: offer_id.to_string(),
-                template_id: "template-001".to_string(),
+                template_id: TEMPLATE_ID.to_string(),
             },
         )
         .await
@@ -272,9 +278,12 @@ pub mod tests {
 
         agent_issuance::state::initialize(&issuance_state).await.unwrap();
 
-        let mut issuance_app = issuance::router(issuance_state.clone());
-        credentials(&mut issuance_app, "001").await;
-        let (_authorization_code, pre_authorized_code) = offers(&mut issuance_app, "001").await.unwrap();
+        let library_state = setup_library_state(&issuance_state).await;
+        create_test_template_with_auth(&library_state, true).await;
+
+        let mut issuance_app = issuance::router((issuance_state.clone(), library_state.clone()));
+        credentials(&mut issuance_app).await;
+        let (_authorization_code, pre_authorized_code) = offers(&mut issuance_app, TEMPLATE_ID).await.unwrap();
 
         let offer_id = crate::tests::OFFER_ID;
         let aggregate_id = format!("public_offer:{offer_id}");
@@ -284,7 +293,7 @@ pub mod tests {
             &issuance_state.command.public_offer,
             PublicOfferCommand::Create {
                 offer_id: offer_id.to_string(),
-                template_id: "template-001".to_string(),
+                template_id: TEMPLATE_ID.to_string(),
             },
         )
         .await
diff --git a/agent_api_http/src/v0/issuance/credential_configurations.rs b/agent_api_http/src/v0/issuance/credential_configurations.rs
deleted file mode 100644
index 37efc4ef..00000000
--- a/agent_api_http/src/v0/issuance/credential_configurations.rs
+++ /dev/null
@@ -1,38 +0,0 @@
-use crate::handlers::command_handler;
-use agent_issuance::server_config::command::ServerConfigCommand;
-use agent_issuance::state::{IssuanceState, SERVER_CONFIG_ID};
-use agent_shared::config::CredentialConfiguration;
-use axum::{
-    extract::{Json, State},
-    http::StatusCode,
-    response::{IntoResponse, Response},
-};
-use http_api_problem::ApiError;
-use std::sync::Arc;
-
-/// Update credential configuration
-///
-/// Publishes the provided credential configuration.
-#[utoipa::path(
-    post,
-    path = "/credential-configurations",
-    operation_id = "set_credential_configuration",
-    tags = ["Issuance"],
-    responses(
-        (status = 201, description = "Credential configuration updated successfully")
-    )
-)]
-#[axum_macros::debug_handler]
-pub(crate) async fn credential_configurations(
-    State(state): State<Arc<IssuanceState>>,
-    Json(credential_configuration): Json<CredentialConfiguration>,
-) -> Result<Response, ApiError> {
-    let command = ServerConfigCommand::UpdateCredentialConfiguration {
-        credential_configuration: credential_configuration.clone(),
-        provisioned: false,
-    };
-
-    command_handler(SERVER_CONFIG_ID, &state.command.server_config, command).await?;
-
-    Ok((StatusCode::CREATED, Json(credential_configuration)).into_response())
-}
diff --git a/agent_api_http/src/v0/issuance/credential_issuer/credential.rs b/agent_api_http/src/v0/issuance/credential_issuer/credential.rs
index f746df0b..0bd4d474 100644
--- a/agent_api_http/src/v0/issuance/credential_issuer/credential.rs
+++ b/agent_api_http/src/v0/issuance/credential_issuer/credential.rs
@@ -198,8 +198,10 @@ pub mod tests {
     use super::*;
     use crate::v0::authorization;
     use crate::v0::authorization::authorization_server::token::tests::token;
-    use crate::v0::issuance::credentials::tests::credentials;
-    use crate::v0::issuance::router;
+    use crate::v0::issuance::{
+        credentials::tests::{create_test_template_with_auth, credentials_with_template, setup_library_state},
+        router,
+    };
     use crate::API_VERSION;
     use crate::{
         tests::OFFER_ID,
@@ -240,6 +242,7 @@ pub mod tests {
         async fn prepare_credential_event_trigger(
             &self,
             app: Arc<Mutex<Option<Router>>>,
+            template_id: String,
             is_self_signed: bool,
             delay: u64,
         );
@@ -252,6 +255,7 @@ pub mod tests {
         async fn prepare_credential_event_trigger(
             &self,
             app: Arc<Mutex<Option<Router>>>,
+            template_id: String,
             is_self_signed: bool,
             delay: u64,
         ) {
@@ -273,15 +277,16 @@ pub mod tests {
                                 // The 'backend' server can either opt for an already signed credential...
                                 let credentials_endpoint_request = if is_self_signed {
                                     CredentialsEndpointRequest {
+                                        template_id: template_id.clone(),
                                         offer_id: offer_id.clone(),
                                         credential: json!(CREDENTIAL_JWT),
                                         is_signed: true,
-                                        credential_configuration_id: "001".to_string(),
-                                        expires_at: CredentialExpiry::Never,
+                                        expires_at: Some(CredentialExpiry::Never),
                                     }
                                 } else {
                                     // ...or else, submitting the data that will be signed inside `UniCore`.
                                     CredentialsEndpointRequest {
+                                        template_id: template_id.clone(),
                                         offer_id: offer_id.clone(),
                                         credential: json!({
                                             "credentialSubject": {
@@ -291,8 +296,7 @@ pub mod tests {
                                             }
                                         }),
                                         is_signed: false,
-                                        credential_configuration_id: "001".to_string(),
-                                        expires_at: CredentialExpiry::Never,
+                                        expires_at: Some(CredentialExpiry::Never),
                                     }
                                 };
 
@@ -328,6 +332,7 @@ pub mod tests {
     pub async fn credential(
         issuance_app: &mut Router,
         issuance_state: &Arc<IssuanceState>,
+        template_id: &str,
         access_token: String,
         external_server: Option<MockServer>,
     ) -> (String, String) {
@@ -347,7 +352,7 @@ pub mod tests {
                     .header(http::header::AUTHORIZATION, format!("Bearer {access_token}"))
                     .body(Body::from(
                         serde_json::to_vec(&json!({
-                            "credential_configuration_id": "001",
+                            "credential_configuration_id": template_id,
                             "proofs": { "jwt": ["eyJ0eXAiOiJvcGVuaWQ0dmNpLXByb29mK2p3dCIsImFsZyI6IkVkRFNBIiwia2lk\
                                         IjoiZGlkOmtleTp6Nk1raWlleW9MTVNWc0pBWnY3SmplNXdXU2tERXltVWdreUY4\
                                         a2JjcmpacFgzcWQjejZNa2lpZXlvTE1TVnNKQVp2N0pqZTV3V1NrREV5bVVna3lG\
@@ -432,6 +437,9 @@ pub mod tests {
             Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, issuance_event_publishers).await);
         agent_issuance::state::initialize(&issuance_state).await.unwrap();
 
+        let library_state = setup_library_state(&issuance_state).await;
+        let template_id = create_test_template_with_auth(&library_state, is_pre_authorized).await;
+
         let command = agent_issuance::nonce::command::NonceCommand::GenerateNonce {
             c_nonce: TEST_NONCE.to_string(),
         };
@@ -439,32 +447,27 @@ pub mod tests {
             .await
             .unwrap();
 
-        let mut issuance_app = router(issuance_state.clone());
+        let mut issuance_app = router((issuance_state.clone(), library_state));
 
         if let Some(external_server) = &external_server {
             external_server
                 .prepare_credential_event_trigger(
                     Arc::new(Mutex::new(Some(issuance_app.clone()))),
+                    template_id.clone(),
                     is_self_signed,
                     delay,
                 )
                 .await;
         }
 
-        let credential_configuration_id = if is_pre_authorized {
-            "001".to_string()
-        } else {
-            "002".to_string()
-        };
-
         // When `with_external_server` is false, then the credentials endpoint does not need to be called before the
         // start of the flow, since the `external_server` will do this once it is triggered by the
         // `CredentialRequestVerified` event.
         if !with_external_server {
-            credentials(&mut issuance_app, &credential_configuration_id).await;
+            credentials_with_template(&mut issuance_app, &template_id).await;
         }
 
-        let grants = offers(&mut issuance_app, &credential_configuration_id).await.unwrap();
+        let grants = offers(&mut issuance_app, &template_id).await.unwrap();
 
         let authorization_state = Arc::new(
             authorization_state(
@@ -499,7 +502,7 @@ pub mod tests {
                     .header(http::header::AUTHORIZATION, format!("Bearer {access_token}"))
                     .body(Body::from(
                         serde_json::to_vec(&json!({
-                            "credential_configuration_id": credential_configuration_id,
+                            "credential_configuration_id": template_id,
                             "proofs": {
                                 "jwt":[jwt]
                             }
diff --git a/agent_api_http/src/v0/issuance/credential_issuer/notification.rs b/agent_api_http/src/v0/issuance/credential_issuer/notification.rs
index 6b206943..094d9646 100644
--- a/agent_api_http/src/v0/issuance/credential_issuer/notification.rs
+++ b/agent_api_http/src/v0/issuance/credential_issuer/notification.rs
@@ -61,9 +61,10 @@ pub async fn notification(
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::tests::TEMPLATE_ID;
     use crate::v0::authorization::authorization_server::token::tests::token;
     use crate::v0::issuance::credential_issuer::credential::tests::credential;
-    use crate::v0::issuance::credentials::tests::credentials;
+    use crate::v0::issuance::credentials::tests::{create_test_template, credentials, setup_library_state};
     use crate::v0::issuance::offers::tests::offers;
     use crate::v0::{authorization, issuance};
     use agent_authorization::services::AuthorizationServices;
@@ -83,10 +84,14 @@ mod tests {
         let issuance_state =
             Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
         agent_issuance::state::initialize(&issuance_state).await.unwrap();
-        let mut issuance_app = issuance::router(issuance_state.clone());
 
-        credentials(&mut issuance_app, "001").await;
-        let grants = offers(&mut issuance_app, "001").await.unwrap();
+        let library_state = setup_library_state(&issuance_state).await;
+        create_test_template(&library_state).await;
+
+        let mut issuance_app = issuance::router((issuance_state.clone(), library_state));
+
+        credentials(&mut issuance_app).await;
+        let grants = offers(&mut issuance_app, TEMPLATE_ID).await.unwrap();
 
         let authorization_state = Arc::new(
             authorization_state(
@@ -104,7 +109,8 @@ mod tests {
 
         let access_token: String = token(&mut authorization_app, true, grants).await;
 
-        let (access_token, notification_id) = credential(&mut issuance_app, &issuance_state, access_token, None).await;
+        let (access_token, notification_id) =
+            credential(&mut issuance_app, &issuance_state, TEMPLATE_ID, access_token, None).await;
 
         let request = Request::builder()
             .uri("/openid4vci/notification")
@@ -130,10 +136,14 @@ mod tests {
         let issuance_state =
             Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
         agent_issuance::state::initialize(&issuance_state).await.unwrap();
-        let mut issuance_app = issuance::router(issuance_state.clone());
 
-        credentials(&mut issuance_app, "001").await;
-        let grants = offers(&mut issuance_app, "001").await.unwrap();
+        let library_state = setup_library_state(&issuance_state).await;
+        create_test_template(&library_state).await;
+
+        let mut issuance_app = issuance::router((issuance_state.clone(), library_state));
+
+        credentials(&mut issuance_app).await;
+        let grants = offers(&mut issuance_app, TEMPLATE_ID).await.unwrap();
 
         let authorization_state = Arc::new(
             authorization_state(
@@ -151,7 +161,8 @@ mod tests {
 
         let access_token: String = token(&mut authorization_app, true, grants).await;
 
-        let (access_token, notification_id) = credential(&mut issuance_app, &issuance_state, access_token, None).await;
+        let (access_token, notification_id) =
+            credential(&mut issuance_app, &issuance_state, TEMPLATE_ID, access_token, None).await;
 
         struct TestCase {
             name: &'static str,
diff --git a/agent_api_http/src/v0/issuance/credential_issuer/token_status_list.rs b/agent_api_http/src/v0/issuance/credential_issuer/token_status_list.rs
index 55f81fd7..fb52df17 100644
--- a/agent_api_http/src/v0/issuance/credential_issuer/token_status_list.rs
+++ b/agent_api_http/src/v0/issuance/credential_issuer/token_status_list.rs
@@ -61,11 +61,14 @@ pub mod tests {
     };
     use oid4vc_core::authentication::verify::Verify;
 
+    use crate::tests::TEMPLATE_ID;
     use crate::v0::{
         authorization::{self, authorization_server::token::tests::token},
         issuance::{
-            credential_issuer::credential::tests::TEST_NONCE, credentials::tests::credentials, offers::tests::offers,
-            router,
+            self,
+            credential_issuer::credential::tests::TEST_NONCE,
+            credentials::tests::{create_test_template, credentials, setup_library_state},
+            offers::tests::offers,
         },
     };
     use serde_json::json;
@@ -79,10 +82,13 @@ pub mod tests {
             Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
         initialize(&issuance_state).await.unwrap();
 
-        let mut app = router(issuance_state.clone());
+        let library_state = setup_library_state(&issuance_state).await;
+        create_test_template(&library_state).await;
+
+        let mut app = issuance::router((issuance_state.clone(), library_state));
 
         // We must create a signed credential first to initiate the status list creation. There is no other way we expose Status List creation through the endpoints.
-        create_test_signed_credential(&mut app, &issuance_state).await;
+        create_test_signed_credential(&mut app, &issuance_state, TEMPLATE_ID).await;
 
         // Fetch the Status List Token
         let token_status_list_response = app
@@ -143,7 +149,11 @@ pub mod tests {
     /// - with_anonymous_access: false
     /// - with_external_server: false
     /// - is_self_signed: false
-    pub async fn create_test_signed_credential(app: &mut Router, issuance_state: &Arc<IssuanceState>) -> String {
+    pub async fn create_test_signed_credential(
+        app: &mut Router,
+        issuance_state: &Arc<IssuanceState>,
+        template_id: &str,
+    ) -> String {
         let command = agent_issuance::nonce::command::NonceCommand::GenerateNonce {
             c_nonce: TEST_NONCE.to_string(),
         };
@@ -151,11 +161,9 @@ pub mod tests {
             .await
             .unwrap();
 
-        let credential_configuration_id = "001".to_string();
-
-        let credential_endpoint = credentials(app, &credential_configuration_id).await;
+        let credential_endpoint = credentials(app).await;
 
-        let grants = offers(app, &credential_configuration_id).await.unwrap();
+        let grants = offers(app, template_id).await.unwrap();
 
         let authorization_state = Arc::new(
             authorization_state(
@@ -185,7 +193,7 @@ pub mod tests {
                     .header(http::header::AUTHORIZATION, format!("Bearer {access_token}"))
                     .body(Body::from(
                         serde_json::to_vec(&json!({
-                            "credential_configuration_id": credential_configuration_id,
+                            "credential_configuration_id": template_id,
                             "proofs": {
                                 "jwt":[jwt]
                             }
diff --git a/agent_api_http/src/v0/issuance/credential_issuer/well_known/oauth_authorization_server.rs b/agent_api_http/src/v0/issuance/credential_issuer/well_known/oauth_authorization_server.rs
index 1810f725..c5e293e0 100644
--- a/agent_api_http/src/v0/issuance/credential_issuer/well_known/oauth_authorization_server.rs
+++ b/agent_api_http/src/v0/issuance/credential_issuer/well_known/oauth_authorization_server.rs
@@ -26,7 +26,10 @@ pub(crate) async fn oauth_authorization_server(State(state): State<Arc<IssuanceS
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::v0::issuance::router;
+    use crate::v0::issuance::{
+        credentials::tests::{create_test_template, setup_library_state},
+        router,
+    };
     use agent_issuance::{services::IssuanceServices, state::initialize};
     use agent_secret_manager::service::Service;
     use agent_store::{in_memory::InMemory, issuance_state};
@@ -78,7 +81,10 @@ mod tests {
             Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
         initialize(&issuance_state).await.unwrap();
 
-        let mut app = router(issuance_state);
+        let library_state = setup_library_state(&issuance_state).await;
+        create_test_template(&library_state).await;
+
+        let mut app = router((issuance_state.clone(), library_state));
 
         let _authorization_server_metadata = oauth_authorization_server(&mut app).await;
     }
diff --git a/agent_api_http/src/v0/issuance/credential_issuer/well_known/openid_credential_issuer.rs b/agent_api_http/src/v0/issuance/credential_issuer/well_known/openid_credential_issuer.rs
index 57452744..110a3e31 100644
--- a/agent_api_http/src/v0/issuance/credential_issuer/well_known/openid_credential_issuer.rs
+++ b/agent_api_http/src/v0/issuance/credential_issuer/well_known/openid_credential_issuer.rs
@@ -33,7 +33,13 @@ pub(crate) async fn openid_credential_issuer(State(state): State<Arc<IssuanceSta
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::{tests::CREDENTIAL_ISSUER_METADATA, v0::issuance::router};
+    use crate::{
+        tests::CREDENTIAL_ISSUER_METADATA,
+        v0::issuance::{
+            self,
+            credentials::tests::{create_test_template, setup_library_state},
+        },
+    };
     use agent_issuance::{services::IssuanceServices, state::initialize};
     use agent_secret_manager::service::Service;
     use agent_store::{in_memory::InMemory, issuance_state};
@@ -62,11 +68,7 @@ mod tests {
         assert_eq!(response.headers().get("Content-Type").unwrap(), "application/json");
 
         let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
-        let credential_issuer_metadata: CredentialIssuerMetadata = serde_json::from_slice(&body).unwrap();
-
-        assert_eq!(credential_issuer_metadata, CREDENTIAL_ISSUER_METADATA.clone());
-
-        credential_issuer_metadata
+        serde_json::from_slice(&body).unwrap()
     }
 
     #[tokio::test]
@@ -75,8 +77,23 @@ mod tests {
             Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
         initialize(&issuance_state).await.unwrap();
 
-        let mut app = router(issuance_state);
+        let library_state = setup_library_state(&issuance_state).await;
+        let template_id = create_test_template(&library_state).await;
+
+        let mut app = issuance::router((issuance_state.clone(), library_state));
+
+        let credential_issuer_metadata = openid_credential_issuer(&mut app).await;
 
-        let _credential_issuer_metadata = openid_credential_issuer(&mut app).await;
+        assert_eq!(
+            credential_issuer_metadata.credential_issuer,
+            CREDENTIAL_ISSUER_METADATA.credential_issuer
+        );
+        assert_eq!(
+            credential_issuer_metadata.credential_endpoint,
+            CREDENTIAL_ISSUER_METADATA.credential_endpoint
+        );
+        assert!(credential_issuer_metadata
+            .credential_configurations_supported
+            .contains_key(&template_id));
     }
 }
diff --git a/agent_api_http/src/v0/issuance/credentials.rs b/agent_api_http/src/v0/issuance/credentials.rs
index 8eed29d2..2de1a385 100644
--- a/agent_api_http/src/v0/issuance/credentials.rs
+++ b/agent_api_http/src/v0/issuance/credentials.rs
@@ -11,15 +11,23 @@ use agent_issuance::{
     offer::command::OfferCommand,
     state::{IssuanceState, SERVER_CONFIG_ID},
 };
+use agent_library::state::LibraryState;
+use agent_library::template::aggregate::{Expiration, Status as TemplateStatus, Template};
+use axum::Extension;
 use axum::{
     extract::{Json, Path, State},
     http::StatusCode,
     response::{IntoResponse, Response},
 };
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
 use http_api_problem::ApiError;
 use hyper::header;
 use oauth_tsl::status_list::StatusType;
 use oid4vci::credential_offer::GrantType;
+use oid4vci::{
+    credential_format_profiles::CredentialFormats,
+    credential_issuer::credential_configurations_supported::CredentialConfigurationsSupportedObject,
+};
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 use std::sync::Arc;
@@ -50,12 +58,13 @@ pub(crate) async fn credential(
 #[derive(Deserialize, Serialize, utoipa::ToSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct CredentialsEndpointRequest {
+    pub template_id: String,
     pub offer_id: String,
     pub credential: Value,
     #[serde(default)]
     pub is_signed: bool,
-    pub credential_configuration_id: String,
-    pub expires_at: CredentialExpiry,
+    #[serde(default)]
+    pub expires_at: Option<CredentialExpiry>,
 }
 
 /// Create a credential
@@ -74,35 +83,83 @@ pub struct CredentialsEndpointRequest {
 )]
 #[axum_macros::debug_handler]
 pub(crate) async fn credentials(
-    State(state): State<Arc<IssuanceState>>,
+    State(issuance_state): State<Arc<IssuanceState>>,
+    Extension(library_state): Extension<Arc<LibraryState>>,
     Json(CredentialsEndpointRequest {
+        template_id,
         offer_id,
         credential,
         is_signed,
-        credential_configuration_id,
         expires_at,
     }): Json<CredentialsEndpointRequest>,
 ) -> Result<Response, ApiError> {
     let credential_id = uuid::Uuid::new_v4().to_string();
 
-    let (_, credential_configuration, authorization) = query_handler(SERVER_CONFIG_ID, &state.query.server_config)
+    // The credential configuration ID is derived from the template ID.
+    let credential_configuration_id = template_id.clone();
+
+    // Validate that template_id is not empty.
+    if template_id.is_empty() {
+        return Err(ApiError::builder(StatusCode::BAD_REQUEST)
+            .title("Missing Template ID")
+            .type_url(type_url("issuance#missing-template-id"))
+            .message("The `templateId` field is required and must not be empty.")
+            .finish());
+    }
+
+    // Look up the template by ID.
+    let template: Template = query_handler(&template_id, &library_state.query.template)
         .await?
-        .and_then(|server_config_view| {
-            server_config_view
-                .credential_configurations
-                .get(&credential_configuration_id)
-                .cloned()
-        })
+        .filter(|t| t.status != TemplateStatus::Deleted)
         .ok_or_else(|| {
             ApiError::builder(StatusCode::NOT_FOUND)
-                .title("No Credential Configuration Found")
-                .type_url(type_url("issuance#no-credential-configuration-found"))
-                .message(format!(
-                    "No Credential Configuration found with id: `{credential_configuration_id}`"
-                ))
+                .title("Template Not Found")
+                .type_url(type_url("issuance#template-not-found"))
+                .message(format!("No template found with id: `{template_id}`"))
                 .finish()
         })?;
 
+    if template.status != TemplateStatus::Published {
+        return Err(ApiError::builder(StatusCode::UNPROCESSABLE_ENTITY)
+            .title("Template Not Published")
+            .type_url(type_url("issuance#template-not-published"))
+            .message("Credential issuance requires the template to be Published.")
+            .finish());
+    }
+
+    // If the template has a schema, validate the credential against it.
+    // Only validate unsigned credentials (objects) - signed credentials are pre-built JWTs
+    // and cannot be validated against a template schema.
+    if !is_signed {
+        if let Some(schema) = template.schema.as_ref() {
+            // The template schema describes the shape of the credential subject data.
+            // Callers are expected to nest their subject properties under `credentialSubject`
+            // in the `credential` payload. We unwrap it here so that the schema is validated
+            // against the subject properties directly, as the schema describes.
+            let data_to_validate = credential.get("credentialSubject").unwrap_or(&credential);
+            validate_credential_against_schema(data_to_validate, schema).map_err(|e| *e)?;
+        }
+    }
+
+    let (_, credential_configuration, authorization) =
+        query_handler(SERVER_CONFIG_ID, &issuance_state.query.server_config)
+            .await?
+            .and_then(|server_config_view| {
+                server_config_view
+                    .credential_configurations
+                    .get(&credential_configuration_id)
+                    .cloned()
+            })
+            .ok_or_else(|| {
+                ApiError::builder(StatusCode::NOT_FOUND)
+                    .title("No Credential Configuration Found")
+                    .type_url(type_url("issuance#no-credential-configuration-found"))
+                    .message(format!(
+                        "No Credential Configuration found with id: `{credential_configuration_id}`"
+                    ))
+                    .finish()
+            })?;
+
     let command = if is_signed {
         // For a signed credential, ensure that the credential is a string.
         if !credential.is_string() {
@@ -113,6 +170,19 @@ pub(crate) async fn credentials(
                 .finish());
         }
 
+        let signed_credential = match credential.as_str() {
+            Some(value) => value,
+            None => {
+                return Err(ApiError::builder(StatusCode::BAD_REQUEST)
+                    .title("Invalid Credential Type")
+                    .type_url(type_url("issuance#invalid-credential-type"))
+                    .message("For signed credentials, the credential must be a string.")
+                    .finish())
+            }
+        };
+
+        validate_signed_credential_format_matches_configuration(signed_credential, &credential_configuration)?;
+
         CredentialCommand::CreateSignedCredential {
             credential_id: credential_id.clone(),
             signed_credential: credential,
@@ -127,6 +197,17 @@ pub(crate) async fn credentials(
                 .finish());
         }
 
+        // Resolve the effective expiration: use the explicitly provided value, or fall back to the template's credential expiration.
+        // When an explicit value is provided it must not exceed the template's expiration deadline.
+        let expires_at = match expires_at {
+            Some(explicit) => {
+                let template_deadline = expiration_to_credential_expiry(&template.credential_expiration)?;
+                validate_expiry_within_template_deadline(&explicit, &template_deadline)?;
+                explicit
+            }
+            None => expiration_to_credential_expiry(&template.credential_expiration)?,
+        };
+
         CredentialCommand::CreateUnsignedCredential {
             credential_id: credential_id.clone(),
             data: Data { raw: credential },
@@ -136,10 +217,10 @@ pub(crate) async fn credentials(
     };
 
     // Create an unsigned/signed credential.
-    command_handler(&credential_id, &state.command.credential, command).await?;
+    command_handler(&credential_id, &issuance_state.command.credential, command).await?;
 
     // Create an offer if it does not exist yet.
-    if query_handler(&offer_id, &state.query.offer).await?.is_none() {
+    if query_handler(&offer_id, &issuance_state.query.offer).await?.is_none() {
         // Extract the tx_code_constraints from the credential configuration if available.
         let tx_code_constraints = authorization
             .pre_authorized
@@ -154,39 +235,155 @@ pub(crate) async fn credentials(
 
         let command = OfferCommand::CreateCredentialOffer {
             offer_id: offer_id.clone(),
-            credential_configuration_ids: vec![credential_configuration_id.clone()],
+            template_ids: vec![credential_configuration_id.clone()],
             grant_types,
             tx_code_constraints,
             delivery_options: None,
         };
 
-        command_handler(&offer_id, &state.command.offer, command).await?
+        command_handler(&offer_id, &issuance_state.command.offer, command).await?
     };
 
     let command = OfferCommand::AddCredentials {
         offer_id: offer_id.clone(),
         credential_ids: vec![credential_id.clone()],
-        credential_configuration_ids: vec![credential_configuration_id],
+        template_ids: vec![credential_configuration_id],
     };
 
     // Add the credential to the offer.
-    command_handler(&offer_id, &state.command.offer, command).await?;
+    command_handler(&offer_id, &issuance_state.command.offer, command).await?;
 
     // Return the credential.
-    query_handler(&credential_id, &state.query.credential)
+    query_handler(&credential_id, &issuance_state.query.credential)
         .await?
-        .and_then(|credential_view| credential_view.data)
-        .map(|data| {
+        .and_then(|credential_view| {
+            if is_signed {
+                credential_view.signed
+            } else {
+                credential_view.data.map(|data| data.raw)
+            }
+        })
+        .map(|credential_body| {
             (
                 StatusCode::CREATED,
                 [(header::LOCATION, &format!("{API_VERSION}/credentials/{credential_id}"))],
-                Json(data.raw),
+                Json(credential_body),
             )
                 .into_response()
         })
         .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
 }
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum SignedCredentialFormat {
+    JwtVcJson,
+    VcSdJwt,
+    DcSdJwt,
+}
+
+impl SignedCredentialFormat {
+    fn as_str(self) -> &'static str {
+        match self {
+            SignedCredentialFormat::JwtVcJson => "jwt_vc_json",
+            SignedCredentialFormat::VcSdJwt => "vc+sd-jwt",
+            SignedCredentialFormat::DcSdJwt => "dc+sd-jwt",
+        }
+    }
+}
+
+#[allow(clippy::result_large_err)]
+fn validate_signed_credential_format_matches_configuration(
+    signed_credential: &str,
+    credential_configuration: &CredentialConfigurationsSupportedObject,
+) -> Result<(), ApiError> {
+    let actual_format = detect_signed_credential_format(signed_credential)?;
+    let expected_format = expected_signed_credential_format(credential_configuration)?;
+
+    if actual_format == expected_format {
+        Ok(())
+    } else {
+        Err(ApiError::builder(StatusCode::UNPROCESSABLE_ENTITY)
+            .title("Signed Credential Format Mismatch")
+            .type_url(type_url("issuance#signed-credential-format-mismatch"))
+            .message(format!(
+                "Signed credential format `{}` does not match template credential configuration format `{}`.",
+                actual_format.as_str(),
+                expected_format.as_str()
+            ))
+            .finish())
+    }
+}
+
+#[allow(clippy::result_large_err)]
+fn expected_signed_credential_format(
+    credential_configuration: &CredentialConfigurationsSupportedObject,
+) -> Result<SignedCredentialFormat, ApiError> {
+    match &credential_configuration.credential_format {
+        CredentialFormats::JwtVcJson(_) => Ok(SignedCredentialFormat::JwtVcJson),
+        CredentialFormats::VcSdJwt(_) => Ok(SignedCredentialFormat::VcSdJwt),
+        CredentialFormats::DcSdJwt(_) => Ok(SignedCredentialFormat::DcSdJwt),
+        _ => Err(ApiError::builder(StatusCode::INTERNAL_SERVER_ERROR)
+            .title("Unsupported Credential Configuration Format")
+            .type_url(type_url("issuance#unsupported-credential-configuration-format"))
+            .message("The template-backed credential configuration uses an unsupported credential format.")
+            .finish()),
+    }
+}
+
+#[allow(clippy::result_large_err)]
+fn detect_signed_credential_format(signed_credential: &str) -> Result<SignedCredentialFormat, ApiError> {
+    if signed_credential.contains('~') {
+        let issuer_jwt = signed_credential
+            .split('~')
+            .find(|segment| !segment.is_empty())
+            .ok_or_else(|| {
+                invalid_signed_credential_format_error("Signed SD-JWT credential is missing the issuer JWT.")
+            })?;
+
+        let header = decode_jwt_segment_json(issuer_jwt, 0)?;
+        match header.get("typ").and_then(Value::as_str) {
+            Some("vc+sd-jwt") => Ok(SignedCredentialFormat::VcSdJwt),
+            Some("dc+sd-jwt") => Ok(SignedCredentialFormat::DcSdJwt),
+            _ => Err(invalid_signed_credential_format_error(
+                "Signed SD-JWT credential must declare header typ `vc+sd-jwt` or `dc+sd-jwt`.",
+            )),
+        }
+    } else {
+        let payload = decode_jwt_segment_json(signed_credential, 1)?;
+        if payload.get("vc").is_some() {
+            Ok(SignedCredentialFormat::JwtVcJson)
+        } else {
+            Err(invalid_signed_credential_format_error(
+                "Signed JWT credential must contain a `vc` claim to match `jwt_vc_json`.",
+            ))
+        }
+    }
+}
+
+#[allow(clippy::result_large_err)]
+fn decode_jwt_segment_json(jwt: &str, segment_index: usize) -> Result<Value, ApiError> {
+    let segment = jwt
+        .split('.')
+        .nth(segment_index)
+        .ok_or_else(|| invalid_signed_credential_format_error("Signed credential is not a valid JWT."))?;
+
+    let decoded = URL_SAFE_NO_PAD
+        .decode(segment)
+        .map_err(|_| invalid_signed_credential_format_error("Signed credential contains invalid base64url data."))?;
+
+    serde_json::from_slice(&decoded).map_err(|_| {
+        invalid_signed_credential_format_error("Signed credential contains invalid JSON in its JWT segments.")
+    })
+}
+
+fn invalid_signed_credential_format_error(message: impl Into<String>) -> ApiError {
+    ApiError::builder(StatusCode::BAD_REQUEST)
+        .title("Invalid Signed Credential Format")
+        .type_url(type_url("issuance#invalid-signed-credential-format"))
+        .message(message.into())
+        .finish()
+}
+
 /// List all credentials
 ///
 /// Lists all credentials including their current status and metadata.
@@ -200,8 +397,8 @@ pub(crate) async fn credentials(
     )
 )]
 #[axum_macros::debug_handler]
-pub(crate) async fn all_credentials(State(state): State<Arc<IssuanceState>>) -> Result<Response, ApiError> {
-    let all_credentials = query_handler("all_credentials", &state.query.all_credentials)
+pub(crate) async fn all_credentials(State(issuance_state): State<Arc<IssuanceState>>) -> Result<Response, ApiError> {
+    let all_credentials = query_handler("all_credentials", &issuance_state.query.all_credentials)
         .await?
         .map(|all_credentials_view| all_credentials_view.credentials.into_values().collect::<Vec<_>>())
         .unwrap_or_default();
@@ -256,24 +453,154 @@ pub async fn patch_credential(
     }
 }
 
+/// Converts a template's `Expiration` value into a `CredentialExpiry` for the issuance pipeline.
+///
+/// - `Never` → `CredentialExpiry::Never`
+/// - `DateTime(s)` → `CredentialExpiry::Fixed(parsed datetime)`
+/// - `Duration(s)` → `CredentialExpiry::Fixed(Utc::now() + duration)`
+#[allow(clippy::result_large_err)]
+fn expiration_to_credential_expiry(expiration: &Expiration) -> Result<CredentialExpiry, ApiError> {
+    match expiration {
+        Expiration::Never => Ok(CredentialExpiry::Never),
+        Expiration::DateTime(s) => chrono::DateTime::parse_from_rfc3339(s)
+            .map(|dt| CredentialExpiry::Fixed(dt.with_timezone(&chrono::Utc)))
+            .map_err(|e| {
+                ApiError::builder(StatusCode::INTERNAL_SERVER_ERROR)
+                    .title("Invalid Template Expiration")
+                    .message(format!("Template expiration datetime `{s}` could not be parsed: {e}"))
+                    .finish()
+            }),
+        Expiration::Duration(s) => iso8601::duration(s)
+            .map_err(|_| {
+                ApiError::builder(StatusCode::INTERNAL_SERVER_ERROR)
+                    .title("Invalid Template Expiration")
+                    .message(format!("Template expiration duration `{s}` could not be parsed"))
+                    .finish()
+            })
+            .map(|d| {
+                let delta = match d {
+                    iso8601::Duration::YMDHMS {
+                        year,
+                        month,
+                        day,
+                        hour,
+                        minute,
+                        second,
+                        millisecond,
+                    } => {
+                        chrono::Duration::days(year as i64 * 365 + month as i64 * 30 + day as i64)
+                            + chrono::Duration::hours(hour as i64)
+                            + chrono::Duration::minutes(minute as i64)
+                            + chrono::Duration::seconds(second as i64)
+                            + chrono::Duration::milliseconds(millisecond as i64)
+                    }
+                    iso8601::Duration::Weeks(w) => chrono::Duration::weeks(w as i64),
+                };
+                CredentialExpiry::Fixed(chrono::Utc::now() + delta)
+            }),
+    }
+}
+
+/// Validates that an explicitly provided `expires_at` does not exceed the template's deadline.
+///
+/// - If the template deadline is `Never`, any explicit value is accepted.
+/// - If the explicit value is `Never` but the template has a fixed deadline, that is rejected.
+/// - Otherwise, the explicit datetime must be ≤ the template deadline.
+#[allow(clippy::result_large_err)]
+fn validate_expiry_within_template_deadline(
+    explicit: &CredentialExpiry,
+    deadline: &CredentialExpiry,
+) -> Result<(), ApiError> {
+    match (explicit, deadline) {
+        // Template has no deadline — anything goes.
+        (_, CredentialExpiry::Never) => Ok(()),
+        // Explicit is "never" but template enforces a deadline.
+        (CredentialExpiry::Never, CredentialExpiry::Fixed(limit)) => Err(ApiError::builder(StatusCode::BAD_REQUEST)
+            .title("Expiration Exceeds Template Limit")
+            .type_url(type_url("issuance#expiration-exceeds-template-limit"))
+            .message(format!(
+                "The template requires an expiration date not after {}",
+                limit.to_rfc3339()
+            ))
+            .finish()),
+        // Both are fixed — compare them.
+        (CredentialExpiry::Fixed(requested), CredentialExpiry::Fixed(limit)) => {
+            if requested > limit {
+                Err(ApiError::builder(StatusCode::BAD_REQUEST)
+                    .title("Expiration Exceeds Template Limit")
+                    .type_url(type_url("issuance#expiration-exceeds-template-limit"))
+                    .message(format!(
+                        "The template requires an expiration date not after {}",
+                        limit.to_rfc3339()
+                    ))
+                    .finish())
+            } else {
+                Ok(())
+            }
+        }
+    }
+}
+
+/// Validates the credential data against the template's JSON Schema.///
+/// Returns a detailed error response if validation fails, listing all schema violations.
+fn validate_credential_against_schema(credential: &Value, schema: &Value) -> Result<(), Box<ApiError>> {
+    let validator = jsonschema::validator_for(schema).map_err(|e| {
+        Box::new(
+            ApiError::builder(StatusCode::INTERNAL_SERVER_ERROR)
+                .title("Invalid Template Schema")
+                .type_url(type_url("issuance#invalid-template-schema"))
+                .message(format!("The template's schema is not a valid JSON Schema: {e}"))
+                .finish(),
+        )
+    })?;
+
+    let errors: Vec<String> = validator
+        .iter_errors(credential)
+        .map(|e| format!("Path `{}`: {} (schema path: {})", e.instance_path(), e, e.schema_path()))
+        .collect();
+
+    if errors.is_empty() {
+        Ok(())
+    } else {
+        Err(Box::new(
+            ApiError::builder(StatusCode::UNPROCESSABLE_ENTITY)
+                .title("Credential Schema Validation Failed")
+                .type_url(type_url("issuance#credential-schema-validation-failed"))
+                .message(format!(
+                    "The credential does not match the template schema. Violations:\n{}",
+                    errors
+                        .iter()
+                        .enumerate()
+                        .map(|(i, e)| format!("  [{}] {}", i + 1, e))
+                        .collect::<Vec<_>>()
+                        .join("\n")
+                ))
+                .finish(),
+        ))
+    }
+}
+
 #[cfg(test)]
 pub mod tests {
     use super::*;
-    use crate::tests::OFFER_ID;
-    use crate::v0::issuance::credential_issuer::token_status_list::tests::create_test_signed_credential;
-    use crate::v0::issuance::router;
+    use crate::tests::{OFFER_ID, TEMPLATE_ID};
+    use crate::v0::issuance::{credential_issuer::token_status_list::tests::create_test_signed_credential, router};
     use crate::API_VERSION;
+    use agent_issuance::application::credential_configuration_projection::CredentialConfigurationProjection;
     use agent_issuance::{services::IssuanceServices, state::initialize};
+    use agent_library::template::aggregate::{DataModel, Display, Expiration, HolderType, Status, Visibility};
+    use agent_library::template::command::TemplateCommand;
     use agent_secret_manager::service::Service;
     use agent_secret_manager::subject::Subject;
     use agent_shared::config::TESTINDEX;
     use agent_store::in_memory::InMemory;
-    use agent_store::issuance_state;
+    use agent_store::{issuance_state, library_state};
     use axum::{
         body::{self, Body},
         http::{self, Request, StatusCode},
         Router,
     };
+    use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
     use lazy_static::lazy_static;
     use oauth_tsl::relying_party::check_status_in_status_list_token_jwt;
     use oauth_tsl::relying_party::{decompress_gzip, StatusListTokenResponseType};
@@ -303,22 +630,62 @@ pub mod tests {
         });
     }
 
-    /// This function creates and tests a credential and returns the endpoint where this credential can be accessed.
-    pub async fn credentials(app: &mut Router, credential_configuration_id: &str) -> String {
-        let response = app
+    /// Creates a [LibraryState] with the [CredentialConfigurationProjection] properly wired
+    /// to the given [IssuanceState], mirroring the production application setup. When a template
+    /// is created or updated through this library state, the credential configuration in the
+    /// issuance state is automatically synchronized via the projection.
+    pub async fn setup_library_state(issuance_state: &Arc<IssuanceState>) -> Arc<LibraryState> {
+        let (projection, view_handle) = CredentialConfigurationProjection::new(issuance_state.clone());
+        let lib = Arc::new(library_state(&InMemory, Default::default(), vec![Box::new(projection)]).await);
+        assert!(
+            view_handle.set(lib.query.template.clone()).is_ok(),
+            "template view already initialized"
+        );
+        lib
+    }
+
+    pub async fn create_new_template(
+        library_state: &Arc<LibraryState>,
+        status: Status,
+        credential_expiration: Option<Expiration>,
+        pre_authorized: bool,
+        data_model: DataModel,
+    ) -> String {
+        let mut library_app = crate::v0::library::router(library_state.clone());
+        let response = library_app
             .call(
                 Request::builder()
                     .method(http::Method::POST)
-                    .uri(format!("{API_VERSION}/credentials"))
+                    .uri(format!("{API_VERSION}/create-new-template"))
                     .header(http::header::CONTENT_TYPE, mime::APPLICATION_JSON.as_ref())
                     .body(Body::from(
                         serde_json::to_vec(&json!({
-                            "offerId": OFFER_ID,
-                            "credential": {
-                                "credentialSubject": CREDENTIAL_SUBJECT.clone(),
+                            "title": "Test Template",
+                            "display": {
+                                "name": "Verifiable Credential",
+                                "logo": {
+                                    "uri": "https://www.impierce.com/external/impierce-logo.png",
+                                    "altText": "Impierce Logo"
+                                }
+                            },
+                            "dataModel": data_model,
+                            "holderType": HolderType::Individual,
+                            "status": status,
+                            "visibility": Visibility::Private,
+                            "credentialExpiration": credential_expiration,
+                            "type": ["VerifiableCredential"],
+                            "schema": {
+                                "type": "object",
+                                "properties": {
+                                    "id": { "type": "string" },
+                                    "first_name": { "type": "string" },
+                                    "last_name": { "type": "string" }
+                                },
+                                "required": ["first_name", "last_name"]
                             },
-                            "credentialConfigurationId": credential_configuration_id,
-                            "expiresAt": "never"
+                            "holderAuthorization": {
+                                "pre_authorized": pre_authorized
+                            }
                         }))
                         .unwrap(),
                     ))
@@ -327,6 +694,226 @@ pub mod tests {
             .await
             .unwrap();
 
+        assert_eq!(response.status(), StatusCode::CREATED);
+
+        let body = body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let body: Value = serde_json::from_slice(&body).unwrap();
+        body["id"].as_str().unwrap().to_string()
+    }
+
+    async fn update_template_status(library_state: &Arc<LibraryState>, template_id: &str, status: Status) {
+        let mut library_app = crate::v0::library::router(library_state.clone());
+        let response = library_app
+            .call(
+                Request::builder()
+                    .method(http::Method::POST)
+                    .uri(format!("{API_VERSION}/update-template"))
+                    .header(http::header::CONTENT_TYPE, mime::APPLICATION_JSON.as_ref())
+                    .body(Body::from(
+                        serde_json::to_vec(&json!({
+                            "id": template_id,
+                            "status": status
+                        }))
+                        .unwrap(),
+                    ))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+
+        assert_eq!(response.status(), StatusCode::NO_CONTENT);
+    }
+
+    async fn delete_template(library_state: &Arc<LibraryState>, template_id: &str) {
+        let mut library_app = crate::v0::library::router(library_state.clone());
+        let response = library_app
+            .call(
+                Request::builder()
+                    .method(http::Method::POST)
+                    .uri(format!("{API_VERSION}/delete-template"))
+                    .header(http::header::CONTENT_TYPE, mime::APPLICATION_JSON.as_ref())
+                    .body(Body::from(
+                        serde_json::to_vec(&json!({
+                            "id": template_id
+                        }))
+                        .unwrap(),
+                    ))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+
+        assert_eq!(response.status(), StatusCode::NO_CONTENT);
+    }
+
+    /// Creates a test template in the library state and returns its ID.
+    /// The template will be automatically synchronized as a credential configuration in the
+    /// issuance state if the library state was created with [setup_library_with_projection].
+    /// The `pre_authorized` parameter controls the authorization flow type for the credential configuration.
+    pub async fn create_test_template_with_auth(library_state: &Arc<LibraryState>, pre_authorized: bool) -> String {
+        let template_id = TEMPLATE_ID.to_string();
+
+        command_handler(
+            &template_id,
+            &library_state.command.template,
+            TemplateCommand::CreateNewTemplate {
+                template_id: template_id.clone(),
+                source_template_id: None,
+                title: "Test Template".to_string(),
+                display: Box::new(Some(Display {
+                    name: "Verifiable Credential".to_string(),
+                    logo: None,
+                })),
+                data_model: DataModel::W3CVcDataModelV1_1,
+                holder_type: HolderType::Individual,
+                tags: None,
+                status: Status::Published,
+                visibility: Visibility::Private,
+                credential_expiration: Some(Expiration::Never),
+                description: None,
+                r#type: vec!["VerifiableCredential".to_string()],
+                schema: Box::new(Some(json!({
+                    "type": "object",
+                    "properties": {
+                        "id": { "type": "string" },
+                        "first_name": { "type": "string" },
+                        "last_name": { "type": "string" }
+                    },
+                    "required": ["first_name", "last_name"]
+                }))),
+                schema_properties_attributes: None,
+                holder_authorization: agent_shared::config::Authorization {
+                    pre_authorized,
+                    tx_code_constraints: None,
+                },
+            },
+        )
+        .await
+        .unwrap();
+
+        template_id
+    }
+
+    /// Creates a test template with pre-authorized credential configuration (default).
+    pub async fn create_test_template(library_state: &Arc<LibraryState>) -> String {
+        create_test_template_with_auth(library_state, true).await
+    }
+
+    pub async fn create_test_template_with_status_and_format(
+        library_state: &Arc<LibraryState>,
+        status: Status,
+        credential_expiration: Option<Expiration>,
+        format: &str,
+    ) -> String {
+        let data_model = match format {
+            "jwt_vc_json" => DataModel::W3CVcDataModelV1_1,
+            "vc+sd-jwt" => DataModel::W3CVcDataModelV2_0,
+            _ => panic!("unsupported test format: {format}"),
+        };
+        let initial_status = match status.clone() {
+            Status::Archived | Status::Deleted => Status::Draft,
+            _ => status.clone(),
+        };
+
+        let template_id =
+            create_new_template(library_state, initial_status, credential_expiration, true, data_model).await;
+
+        match status {
+            Status::Archived => update_template_status(library_state, &template_id, Status::Archived).await,
+            Status::Deleted => delete_template(library_state, &template_id).await,
+            _ => {}
+        }
+
+        template_id
+    }
+
+    fn encode_base64url_json(value: Value) -> String {
+        URL_SAFE_NO_PAD.encode(serde_json::to_vec(&value).unwrap())
+    }
+
+    /// No _valid_ signature is produced, which is sufficient for the testing purpose.
+    fn build_test_signed_jwt_vc_json() -> String {
+        let header = encode_base64url_json(json!({
+            "alg": "EdDSA",
+            "typ": "JWT"
+        }));
+        let payload = encode_base64url_json(json!({
+            "iss": "did:example:issuer",
+            "sub": "did:example:holder",
+            "vc": {
+                "@context": ["https://www.w3.org/2018/credentials/v1"],
+                "type": ["VerifiableCredential"],
+                "credentialSubject": {
+                    "id": "did:example:holder"
+                }
+            }
+        }));
+        let signature = URL_SAFE_NO_PAD.encode(b"signature");
+
+        format!("{header}.{payload}.{signature}")
+    }
+
+    pub async fn signed_credentials_with_template(
+        app: &mut Router,
+        template_id: &str,
+        signed_credential: &str,
+        expires_at: Option<Value>,
+    ) -> Response {
+        let mut request_body = json!({
+            "templateId": template_id,
+            "offerId": OFFER_ID,
+            "credential": signed_credential,
+            "isSigned": true,
+        });
+
+        if let Some(expires_at) = expires_at {
+            request_body["expiresAt"] = expires_at;
+        }
+
+        app.call(
+            Request::builder()
+                .method(http::Method::POST)
+                .uri(format!("{API_VERSION}/credentials"))
+                .header(http::header::CONTENT_TYPE, mime::APPLICATION_JSON.as_ref())
+                .body(Body::from(serde_json::to_vec(&request_body).unwrap()))
+                .unwrap(),
+        )
+        .await
+        .unwrap()
+    }
+
+    pub async fn unsigned_credentials_request_with_template(app: &mut Router, template_id: &str) -> Response {
+        app.call(
+            Request::builder()
+                .method(http::Method::POST)
+                .uri(format!("{API_VERSION}/credentials"))
+                .header(http::header::CONTENT_TYPE, mime::APPLICATION_JSON.as_ref())
+                .body(Body::from(
+                    serde_json::to_vec(&json!({
+                        "templateId": template_id,
+                        "offerId": OFFER_ID,
+                        "credential": {
+                            "credentialSubject": CREDENTIAL_SUBJECT.clone(),
+                        },
+                        "expiresAt": "never"
+                    }))
+                    .unwrap(),
+                ))
+                .unwrap(),
+        )
+        .await
+        .unwrap()
+    }
+
+    /// This function creates and tests a credential and returns the endpoint where this credential can be accessed.
+    pub async fn credentials(app: &mut Router) -> String {
+        credentials_with_template(app, TEMPLATE_ID).await
+    }
+
+    /// This function creates and tests a credential with a specific template ID and returns the endpoint where this credential can be accessed.
+    pub async fn credentials_with_template(app: &mut Router, template_id: &str) -> String {
+        let response = unsigned_credentials_request_with_template(app, template_id).await;
+
         assert_eq!(response.status(), StatusCode::CREATED);
         assert_eq!(response.headers().get("Content-Type").unwrap(), "application/json");
 
@@ -425,9 +1012,12 @@ pub mod tests {
             Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
         initialize(&issuance_state).await.unwrap();
 
-        let mut app = router(issuance_state.clone());
+        let library_state = setup_library_state(&issuance_state).await;
+        let template_id = create_test_template(&library_state).await;
+
+        let mut app = router((issuance_state.clone(), library_state));
 
-        let credential_endpoint = create_test_signed_credential(&mut app, &issuance_state).await;
+        let credential_endpoint = create_test_signed_credential(&mut app, &issuance_state, &template_id).await;
         patch_credential(&mut app, credential_endpoint).await;
     }
 
@@ -438,7 +1028,325 @@ pub mod tests {
             Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
         initialize(&issuance_state).await.unwrap();
 
-        let mut app = router(issuance_state.clone());
-        credentials(&mut app, "001").await;
+        let library_state = setup_library_state(&issuance_state).await;
+        let template_id = create_test_template(&library_state).await;
+
+        let mut app = router((issuance_state.clone(), library_state));
+
+        credentials_with_template(&mut app, &template_id).await;
+    }
+
+    #[tokio::test]
+    async fn test_credentials_endpoint_requires_template_id() {
+        let issuance_state =
+            Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
+        initialize(&issuance_state).await.unwrap();
+
+        let library_state = setup_library_state(&issuance_state).await;
+        let mut app = router((issuance_state.clone(), library_state));
+
+        let response = unsigned_credentials_request_with_template(&mut app, "").await;
+
+        assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let body: Value = serde_json::from_slice(&body).unwrap();
+        assert_eq!(body["title"], "Missing Template ID");
+    }
+
+    #[tokio::test]
+    async fn test_credentials_endpoint_requires_existing_template() {
+        let issuance_state =
+            Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
+        initialize(&issuance_state).await.unwrap();
+
+        let library_state = setup_library_state(&issuance_state).await;
+        let mut app = router((issuance_state.clone(), library_state));
+
+        let response = unsigned_credentials_request_with_template(&mut app, "missing-template").await;
+
+        assert_eq!(response.status(), StatusCode::NOT_FOUND);
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let body: Value = serde_json::from_slice(&body).unwrap();
+        assert_eq!(body["title"], "Template Not Found");
+    }
+
+    #[tokio::test]
+    async fn test_credentials_endpoint_requires_credential_configuration() {
+        let issuance_state =
+            Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
+        initialize(&issuance_state).await.unwrap();
+
+        let library_state = Arc::new(library_state(&InMemory, Default::default(), Default::default()).await);
+        let template_id = create_new_template(
+            &library_state,
+            Status::Published,
+            Some(Expiration::Never),
+            true,
+            DataModel::W3CVcDataModelV1_1,
+        )
+        .await;
+
+        let mut app = router((issuance_state.clone(), library_state));
+        let response = unsigned_credentials_request_with_template(&mut app, &template_id).await;
+
+        assert_eq!(response.status(), StatusCode::NOT_FOUND);
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let body: Value = serde_json::from_slice(&body).unwrap();
+        assert_eq!(body["title"], "No Credential Configuration Found");
+    }
+
+    #[tokio::test]
+    async fn test_signed_credentials_require_published_template() {
+        let issuance_state =
+            Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
+        initialize(&issuance_state).await.unwrap();
+
+        let library_state = setup_library_state(&issuance_state).await;
+        let template_id = create_test_template_with_status_and_format(
+            &library_state,
+            Status::Draft,
+            Some(Expiration::Never),
+            "jwt_vc_json",
+        )
+        .await;
+
+        let mut app = router((issuance_state.clone(), library_state));
+        let response = signed_credentials_with_template(
+            &mut app,
+            &template_id,
+            &build_test_signed_jwt_vc_json(),
+            Some(json!("never")),
+        )
+        .await;
+
+        assert_eq!(response.status(), StatusCode::UNPROCESSABLE_ENTITY);
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let body: Value = serde_json::from_slice(&body).unwrap();
+        assert_eq!(body["title"], "Template Not Published");
+    }
+
+    #[tokio::test]
+    async fn test_unsigned_credentials_require_published_template() {
+        let issuance_state =
+            Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
+        initialize(&issuance_state).await.unwrap();
+
+        let library_state = setup_library_state(&issuance_state).await;
+        let draft_template_id = create_test_template_with_status_and_format(
+            &library_state,
+            Status::Draft,
+            Some(Expiration::Never),
+            "jwt_vc_json",
+        )
+        .await;
+        let archived_template_id = create_test_template_with_status_and_format(
+            &library_state,
+            Status::Archived,
+            Some(Expiration::Never),
+            "jwt_vc_json",
+        )
+        .await;
+
+        let mut app = router((issuance_state.clone(), library_state));
+
+        for template_id in [&draft_template_id, &archived_template_id] {
+            let response = unsigned_credentials_request_with_template(&mut app, template_id).await;
+
+            assert_eq!(response.status(), StatusCode::UNPROCESSABLE_ENTITY);
+            let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+            let body: Value = serde_json::from_slice(&body).unwrap();
+            assert_eq!(body["title"], "Template Not Published");
+        }
+    }
+
+    #[tokio::test]
+    async fn test_signed_credentials_ignore_expires_at_request_override() {
+        let issuance_state =
+            Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
+        initialize(&issuance_state).await.unwrap();
+
+        let library_state = setup_library_state(&issuance_state).await;
+        let template_id = create_test_template_with_status_and_format(
+            &library_state,
+            Status::Published,
+            Some(Expiration::DateTime("2000-01-01T00:00:00Z".to_string())),
+            "jwt_vc_json",
+        )
+        .await;
+
+        let mut app = router((issuance_state.clone(), library_state));
+        let signed_credential = build_test_signed_jwt_vc_json();
+        let response =
+            signed_credentials_with_template(&mut app, &template_id, &signed_credential, Some(json!("never"))).await;
+
+        assert_eq!(response.status(), StatusCode::CREATED);
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let body: Value = serde_json::from_slice(&body).unwrap();
+        assert_eq!(body, json!(signed_credential));
+    }
+
+    #[tokio::test]
+    async fn test_signed_credentials_must_match_template_configuration_format() {
+        let issuance_state =
+            Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
+        initialize(&issuance_state).await.unwrap();
+
+        let library_state = setup_library_state(&issuance_state).await;
+        let template_id = create_test_template_with_status_and_format(
+            &library_state,
+            Status::Published,
+            Some(Expiration::Never),
+            "vc+sd-jwt",
+        )
+        .await;
+
+        let mut app = router((issuance_state.clone(), library_state));
+        let response =
+            signed_credentials_with_template(&mut app, &template_id, &build_test_signed_jwt_vc_json(), None).await;
+
+        assert_eq!(response.status(), StatusCode::UNPROCESSABLE_ENTITY);
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let body: Value = serde_json::from_slice(&body).unwrap();
+        assert_eq!(body["title"], "Signed Credential Format Mismatch");
+    }
+
+    mod expiration_to_credential_expiry_tests {
+        use super::*;
+        use agent_library::template::aggregate::Expiration;
+
+        #[test]
+        fn never_maps_to_never() {
+            let result = expiration_to_credential_expiry(&Expiration::Never).unwrap();
+            assert!(matches!(result, CredentialExpiry::Never));
+        }
+
+        #[test]
+        fn datetime_maps_to_fixed() {
+            let result =
+                expiration_to_credential_expiry(&Expiration::DateTime("2030-06-01T00:00:00Z".to_string())).unwrap();
+            match result {
+                CredentialExpiry::Fixed(dt) => {
+                    assert_eq!(dt.to_rfc3339(), "2030-06-01T00:00:00+00:00");
+                }
+                _ => panic!("expected Fixed"),
+            }
+        }
+
+        #[test]
+        fn invalid_datetime_returns_error() {
+            let result = expiration_to_credential_expiry(&Expiration::DateTime("not-a-date".to_string()));
+            assert!(result.is_err());
+            assert_eq!(result.unwrap_err().status(), StatusCode::INTERNAL_SERVER_ERROR);
+        }
+
+        #[test]
+        fn duration_days_maps_to_fixed_in_the_future() {
+            let before = chrono::Utc::now();
+            let result = expiration_to_credential_expiry(&Expiration::Duration("P30D".to_string())).unwrap();
+            let after = chrono::Utc::now();
+
+            match result {
+                CredentialExpiry::Fixed(dt) => {
+                    let thirty_days = chrono::Duration::days(30);
+                    assert!(dt >= before + thirty_days);
+                    assert!(dt <= after + thirty_days);
+                }
+                _ => panic!("expected Fixed"),
+            }
+        }
+
+        #[test]
+        fn duration_weeks_maps_to_fixed_in_the_future() {
+            let before = chrono::Utc::now();
+            let result = expiration_to_credential_expiry(&Expiration::Duration("P2W".to_string())).unwrap();
+            let after = chrono::Utc::now();
+
+            match result {
+                CredentialExpiry::Fixed(dt) => {
+                    let two_weeks = chrono::Duration::weeks(2);
+                    assert!(dt >= before + two_weeks);
+                    assert!(dt <= after + two_weeks);
+                }
+                _ => panic!("expected Fixed"),
+            }
+        }
+
+        #[test]
+        fn invalid_duration_returns_error() {
+            let result = expiration_to_credential_expiry(&Expiration::Duration("not-a-duration".to_string()));
+            assert!(result.is_err());
+            assert_eq!(result.unwrap_err().status(), StatusCode::INTERNAL_SERVER_ERROR);
+        }
+    }
+
+    mod validate_expiry_within_template_deadline_tests {
+        use super::*;
+
+        fn fixed(rfc3339: &str) -> CredentialExpiry {
+            CredentialExpiry::Fixed(
+                chrono::DateTime::parse_from_rfc3339(rfc3339)
+                    .unwrap()
+                    .with_timezone(&chrono::Utc),
+            )
+        }
+
+        #[test]
+        fn never_deadline_accepts_never() {
+            let result = validate_expiry_within_template_deadline(&CredentialExpiry::Never, &CredentialExpiry::Never);
+            assert!(result.is_ok());
+        }
+
+        #[test]
+        fn never_deadline_accepts_fixed() {
+            let result =
+                validate_expiry_within_template_deadline(&fixed("2030-01-01T00:00:00Z"), &CredentialExpiry::Never);
+            assert!(result.is_ok());
+        }
+
+        #[test]
+        fn never_explicit_with_fixed_deadline_is_rejected() {
+            let result =
+                validate_expiry_within_template_deadline(&CredentialExpiry::Never, &fixed("2030-01-01T00:00:00Z"));
+            assert!(result.is_err());
+            let err = result.unwrap_err();
+            assert_eq!(err.status(), StatusCode::BAD_REQUEST);
+            assert!(err
+                .message()
+                .unwrap_or_default()
+                .contains("The template requires an expiration date not after"));
+        }
+
+        #[test]
+        fn fixed_within_deadline_is_accepted() {
+            let result = validate_expiry_within_template_deadline(
+                &fixed("2029-06-01T00:00:00Z"),
+                &fixed("2030-01-01T00:00:00Z"),
+            );
+            assert!(result.is_ok());
+        }
+
+        #[test]
+        fn fixed_equal_to_deadline_is_accepted() {
+            let result = validate_expiry_within_template_deadline(
+                &fixed("2030-01-01T00:00:00Z"),
+                &fixed("2030-01-01T00:00:00Z"),
+            );
+            assert!(result.is_ok());
+        }
+
+        #[test]
+        fn fixed_exceeding_deadline_is_rejected() {
+            let result = validate_expiry_within_template_deadline(
+                &fixed("2031-01-01T00:00:00Z"),
+                &fixed("2030-01-01T00:00:00Z"),
+            );
+            assert!(result.is_err());
+            let err = result.unwrap_err();
+            assert_eq!(err.status(), StatusCode::BAD_REQUEST);
+            assert!(err
+                .message()
+                .unwrap_or_default()
+                .contains("The template requires an expiration date not after 2030-01-01T00:00:00+00:00"));
+        }
     }
 }
diff --git a/agent_api_http/src/v0/issuance/error.rs b/agent_api_http/src/v0/issuance/error.rs
index eb9a5d0f..ec554399 100644
--- a/agent_api_http/src/v0/issuance/error.rs
+++ b/agent_api_http/src/v0/issuance/error.rs
@@ -26,11 +26,6 @@ impl IntoApiErrorExt for CredentialError {
                 .type_url(type_url("issuance#unsupported-credential-format"))
                 .source(self)
                 .finish(),
-            UnsupportedCredentialType => ApiError::builder(StatusCode::INTERNAL_SERVER_ERROR)
-                .title("Unsupported Credential Type")
-                .type_url(type_url("issuance#unsupported-credential-type"))
-                .source(self)
-                .finish(),
             InvalidCredentialPayloadError(_) => ApiError::builder(StatusCode::BAD_REQUEST)
                 .title("Invalid Credential Payload")
                 .type_url(type_url("issuance#invalid-credential-payload"))
@@ -218,7 +213,6 @@ impl IntoPublicError for CredentialError {
         use CredentialError::*;
         match self {
             UnsupportedCredentialFormat(_) => PublicError::InternalServerError,
-            UnsupportedCredentialType => PublicError::InternalServerError,
             InvalidCredentialPayloadError(_) => PublicError::InternalServerError,
             InvalidIdentifierError => PublicError::InternalServerError,
             InvalidCredentialDataError => PublicError::InternalServerError,
diff --git a/agent_api_http/src/v0/issuance/mod.rs b/agent_api_http/src/v0/issuance/mod.rs
index 0d4a87a5..43f5d0d3 100644
--- a/agent_api_http/src/v0/issuance/mod.rs
+++ b/agent_api_http/src/v0/issuance/mod.rs
@@ -1,5 +1,4 @@
 // Endpoint handlers
-pub mod credential_configurations;
 pub mod credential_issuer;
 pub mod credentials;
 pub mod ietf_oauth_sd_jwt_vc;
@@ -11,7 +10,6 @@ pub mod public_offers;
 pub mod error;
 
 use crate::v0::issuance::{
-    credential_configurations::credential_configurations,
     credential_issuer::{
         credential::credential,
         credential_offer::credential_offer_uri,
@@ -39,12 +37,8 @@ use axum::routing::get;
 use axum::{routing::post, Router};
 use std::sync::Arc;
 
-pub fn router(issuance_state: Arc<IssuanceState>) -> Router {
-    router_with_library(issuance_state, None)
-}
-
-pub fn router_with_library(issuance_state: Arc<IssuanceState>, library_state: Option<Arc<LibraryState>>) -> Router {
-    let issuance_router = Router::new()
+pub fn router((issuance_state, library_state): (Arc<IssuanceState>, Arc<LibraryState>)) -> Router {
+    Router::new()
         .nest(
             API_VERSION,
             Router::new()
@@ -53,11 +47,18 @@ pub fn router_with_library(issuance_state: Arc<IssuanceState>, library_state: Op
                     "/credentials/{credential_id}",
                     get(credentials::credential).patch(patch_credential),
                 )
-                .route("/credential-configurations", post(credential_configurations))
                 .route("/offers", post(offers).get(all_offers))
                 .route("/offers/{offer_id}", get(offer))
                 .route("/offers/send-offer-to-individual", post(individual_offer))
-                .route("/offers/send-offer-to-organization", post(organization_offer)),
+                .route("/offers/send-offer-to-organization", post(organization_offer))
+                // Public offers
+                .route("/get-all-public-offers", get(all_public_offers))
+                .route("/create-public-offer", post(create_public_offer))
+                .route("/take-public-offer-offline", post(take_public_offer_offline))
+                .route("/take-public-offer-online", post(take_public_offer_online))
+                .route("/delete-public-offer", post(delete_public_offer))
+                .with_state(issuance_state.clone())
+                .layer(axum::Extension(library_state.clone())),
         )
         .route(
             "/.well-known/oauth-authorization-server",
@@ -74,19 +75,5 @@ pub fn router_with_library(issuance_state: Arc<IssuanceState>, library_state: Op
             "/vct/{credential_configuration_id}/{version}",
             get(ietf_oauth_sd_jwt_vc::type_metadata),
         )
-        .with_state(issuance_state.clone());
-
-    let public_offer_router = Router::new()
-        .nest(
-            API_VERSION,
-            Router::new()
-                .route("/get-all-public-offers", get(all_public_offers))
-                .route("/create-public-offer", post(create_public_offer))
-                .route("/take-public-offer-offline", post(take_public_offer_offline))
-                .route("/take-public-offer-online", post(take_public_offer_online))
-                .route("/delete-public-offer", post(delete_public_offer)),
-        )
-        .with_state((issuance_state, library_state));
-
-    issuance_router.merge(public_offer_router)
+        .with_state(issuance_state)
 }
diff --git a/agent_api_http/src/v0/issuance/nonce/mod.rs b/agent_api_http/src/v0/issuance/nonce/mod.rs
index 4b8f818f..dc557e3b 100644
--- a/agent_api_http/src/v0/issuance/nonce/mod.rs
+++ b/agent_api_http/src/v0/issuance/nonce/mod.rs
@@ -31,6 +31,11 @@ pub(crate) async fn nonce(State(state): State<Arc<IssuanceState>>) -> Result<Res
 
 #[cfg(test)]
 pub mod tests {
+    use crate::v0::issuance::{
+        credentials::tests::{create_test_template, setup_library_state},
+        router,
+    };
+
     use super::*;
     use agent_issuance::services::IssuanceServices;
     use agent_secret_manager::service::Service;
@@ -39,14 +44,17 @@ pub mod tests {
 
     #[tokio::test]
     async fn test_nonce_endpoint() {
-        use crate::v0::issuance;
         use agent_store::in_memory::InMemory;
         use agent_store::issuance_state;
 
         let issuance_state =
             Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
         agent_issuance::state::initialize(&issuance_state).await.unwrap();
-        let issuance_app = issuance::router(issuance_state.clone());
+
+        let library_state = setup_library_state(&issuance_state).await;
+        create_test_template(&library_state).await;
+
+        let issuance_app = router((issuance_state.clone(), library_state));
 
         let request = Request::builder()
             .uri("/openid4vci/nonce")
diff --git a/agent_api_http/src/v0/issuance/offers/mod.rs b/agent_api_http/src/v0/issuance/offers/mod.rs
index 4868e532..220e77b1 100644
--- a/agent_api_http/src/v0/issuance/offers/mod.rs
+++ b/agent_api_http/src/v0/issuance/offers/mod.rs
@@ -6,12 +6,17 @@ use crate::{
 };
 use agent_issuance::{
     offer::{aggregate::DeliveryOptions, command::OfferCommand, views::OfferView},
-    state::{IssuanceState, SERVER_CONFIG_ID},
+    state::IssuanceState,
+};
+use agent_library::{
+    state::LibraryState,
+    template::aggregate::{Status as TemplateStatus, Template},
 };
 use axum::{
     extract::{Json, Path, State},
     http::StatusCode,
     response::{IntoResponse, Response},
+    Extension,
 };
 use http_api_problem::ApiError;
 use hyper::header;
@@ -23,8 +28,7 @@ use std::sync::Arc;
 #[serde(rename_all = "camelCase")]
 pub struct OffersEndpointRequest {
     pub offer_id: String,
-    #[serde(default)]
-    pub credential_configuration_ids: Vec<String>,
+    pub template_ids: Vec<String>,
     #[serde(default)]
     pub delivery_options: Option<DeliveryOptions>,
 }
@@ -32,41 +36,54 @@ pub struct OffersEndpointRequest {
 #[axum_macros::debug_handler]
 pub(crate) async fn offers(
     State(state): State<Arc<IssuanceState>>,
+    Extension(library_state): Extension<Arc<LibraryState>>,
     Json(OffersEndpointRequest {
         offer_id,
-        credential_configuration_ids,
+        template_ids,
         delivery_options,
     }): Json<OffersEndpointRequest>,
 ) -> Result<Response, ApiError> {
-    // Check if the credential configuration IDs are valid.
-    let credential_configurations = query_handler(SERVER_CONFIG_ID, &state.query.server_config)
-        .await?
-        .map(|server_config_view| server_config_view.credential_configurations)
-        // Unreachable error
-        .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))?;
-
-    let persisted_credential_configuration_ids = credential_configurations.keys().collect::<Vec<_>>();
-
-    if let Some(credential_configuration_id) = credential_configuration_ids.iter().find(|credential_configuration_id| {
-        !persisted_credential_configuration_ids.contains(credential_configuration_id)
-    }) {
-        return Err(ApiError::builder(StatusCode::NOT_FOUND)
-            .title("No Credential Configuration Found")
-            .type_url(type_url("issuance#no-credential-configuration-found"))
-            .message(format!(
-                "No Credential Configuration found with id: `{credential_configuration_id}`"
-            ))
+    if template_ids.is_empty() || template_ids.iter().any(|id| id.is_empty()) {
+        return Err(ApiError::builder(StatusCode::BAD_REQUEST)
+            .title("Missing Template IDs")
+            .type_url(type_url("issuance#missing-template-ids"))
+            .message("The `templateIds` field is required and all IDs must not be empty.")
             .finish());
     }
 
-    let authorization = credential_configurations
-        .into_iter()
-        .find_map(|(credential_configuration_id, (_, _, authorization))| {
-            credential_configuration_ids
-                .contains(&credential_configuration_id)
-                .then_some(authorization)
-        })
-        .unwrap_or_default();
+    // Validate and load all templates.
+    let mut templates = Vec::with_capacity(template_ids.len());
+
+    for template_id in &template_ids {
+        let template: Template = query_handler(template_id, &library_state.query.template)
+            .await?
+            .filter(|t| t.status != TemplateStatus::Deleted)
+            .ok_or_else(|| {
+                ApiError::builder(StatusCode::UNPROCESSABLE_ENTITY)
+                    .title("Template Not Found")
+                    .type_url(type_url("issuance#template-not-found"))
+                    .message(format!("No template found with id: `{template_id}`"))
+                    .finish()
+            })?;
+
+        // Template must be in "Published" status
+        if template.status != TemplateStatus::Published {
+            return Err(ApiError::builder(StatusCode::UNPROCESSABLE_ENTITY)
+                .title("Template Not Published")
+                .type_url(type_url("issuance#template-not-published"))
+                .message(format!(
+                    "Template `{template_id}` must be Published to be used in an offer."
+                ))
+                .finish());
+        }
+
+        templates.push(template);
+    }
+
+    // Use first template for authorization/grant determination.
+    let first_template = templates.first().expect("template_ids can not be empty");
+
+    let authorization = first_template.holder_authorization.clone();
 
     let tx_code_constraints = authorization
         .pre_authorized
@@ -79,11 +96,10 @@ pub(crate) async fn offers(
         GrantType::AuthorizationCode
     }];
 
-    // Create an offer if it does not exist yet.
     if query_handler(&offer_id, &state.query.offer).await?.is_none() {
         let command = OfferCommand::CreateCredentialOffer {
             offer_id: offer_id.clone(),
-            credential_configuration_ids,
+            template_ids,
             grant_types,
             tx_code_constraints,
             delivery_options,
@@ -156,50 +172,58 @@ pub(crate) async fn offer(
 #[cfg(test)]
 pub mod tests {
     use super::*;
-    use crate::API_VERSION;
-    use crate::{
-        tests::OFFER_ID,
-        v0::issuance::{credentials::tests::credentials, router},
+    use crate::tests::OFFER_ID;
+    use crate::v0::issuance::{
+        credentials::tests::{
+            create_new_template, create_test_template, create_test_template_with_status_and_format,
+            credentials_with_template, setup_library_state,
+        },
+        router,
     };
+    use crate::API_VERSION;
     use agent_issuance::services::IssuanceServices;
     use agent_issuance::state::initialize;
+    use agent_library::template::aggregate::{Expiration, Status};
     use agent_secret_manager::service::Service;
     use agent_shared::config::set_config;
     use agent_store::in_memory::InMemory;
-    use agent_store::issuance_state;
+    use agent_store::{issuance_state, library_state};
     use axum::{
         body::Body,
-        http::{self, Request},
+        http::{self, Request, StatusCode},
         Router,
     };
     use oid4vci::credential_offer::{
         AuthorizationCode, CredentialOffer, CredentialOfferParameters, Grants, PreAuthorizedCode,
     };
-    use serde_json::json;
+    use serde_json::{json, Value};
     use std::str::FromStr;
     use tower::Service as _;
 
+    async fn post_offer_request(app: &mut Router, template_id: &str) -> Response {
+        app.call(
+            Request::builder()
+                .method(http::Method::POST)
+                .uri(format!("{API_VERSION}/offers"))
+                .header(http::header::CONTENT_TYPE, mime::APPLICATION_JSON.as_ref())
+                .body(Body::from(
+                    serde_json::to_vec(&json!({
+                        "offerId": OFFER_ID,
+                        "templateIds": vec![template_id],
+                    }))
+                    .unwrap(),
+                ))
+                .unwrap(),
+        )
+        .await
+        .unwrap()
+    }
+
     pub async fn offers(
         app: &mut Router,
-        credential_configuration_id: &str,
+        template_id: &str,
     ) -> Option<(Option<AuthorizationCode>, Option<PreAuthorizedCode>)> {
-        let response = app
-            .call(
-                Request::builder()
-                    .method(http::Method::POST)
-                    .uri(format!("{API_VERSION}/offers"))
-                    .header(http::header::CONTENT_TYPE, mime::APPLICATION_JSON.as_ref())
-                    .body(Body::from(
-                        serde_json::to_vec(&json!({
-                            "offerId": OFFER_ID,
-                            "credentialConfigurationIds": [credential_configuration_id]
-                        }))
-                        .unwrap(),
-                    ))
-                    .unwrap(),
-            )
-            .await
-            .unwrap();
+        let response = post_offer_request(app, template_id).await;
 
         assert_eq!(response.status(), StatusCode::OK);
         assert_eq!(
@@ -214,7 +238,7 @@ pub mod tests {
             CredentialOffer::CredentialOffer(credential_offer) => {
                 assert_eq!(
                     &*credential_offer.credential_configuration_ids,
-                    &vec![credential_configuration_id.to_string()]
+                    &vec![template_id.to_string()]
                 );
 
                 let CredentialOfferParameters {
@@ -245,6 +269,94 @@ pub mod tests {
         }
     }
 
+    #[serial_test::serial]
+    #[tokio::test]
+    async fn test_offers_endpoint_requires_existing_template() {
+        let issuance_state =
+            Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
+        initialize(&issuance_state).await.unwrap();
+
+        let library_state = Arc::new(library_state(&InMemory, Default::default(), Default::default()).await);
+        let mut app = router((issuance_state, library_state));
+
+        let response = post_offer_request(&mut app, "missing-template").await;
+
+        assert_eq!(response.status(), StatusCode::UNPROCESSABLE_ENTITY);
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let body: Value = serde_json::from_slice(&body).unwrap();
+        assert_eq!(body["title"], "Template Not Found");
+    }
+
+    #[serial_test::serial]
+    #[tokio::test]
+    async fn test_offers_endpoint_requires_template_id() {
+        let issuance_state =
+            Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
+        initialize(&issuance_state).await.unwrap();
+
+        let library_state = Arc::new(library_state(&InMemory, Default::default(), Default::default()).await);
+        let mut app = router((issuance_state, library_state));
+
+        let response = post_offer_request(&mut app, "").await;
+
+        assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let body: Value = serde_json::from_slice(&body).unwrap();
+        assert_eq!(body["title"], "Missing Template IDs");
+    }
+
+    #[serial_test::serial]
+    #[tokio::test]
+    async fn test_offers_endpoint_requires_published_template() {
+        let issuance_state =
+            Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
+        initialize(&issuance_state).await.unwrap();
+
+        let library_state = Arc::new(library_state(&InMemory, Default::default(), Default::default()).await);
+        let template_id = create_test_template_with_status_and_format(
+            &library_state,
+            Status::Draft,
+            Some(Expiration::Never),
+            "jwt_vc_json",
+        )
+        .await;
+
+        let mut app = router((issuance_state, library_state));
+        let response = post_offer_request(&mut app, &template_id).await;
+
+        assert_eq!(response.status(), StatusCode::UNPROCESSABLE_ENTITY);
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let body: Value = serde_json::from_slice(&body).unwrap();
+        assert_eq!(body["title"], "Template Not Published");
+    }
+
+    #[serial_test::serial]
+    #[tokio::test]
+    async fn test_offers_endpoint_accepts_published_template_without_pre_synced_configuration() {
+        let issuance_state =
+            Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
+        initialize(&issuance_state).await.unwrap();
+
+        let library_state = Arc::new(library_state(&InMemory, Default::default(), Default::default()).await);
+        let template_id = create_new_template(
+            &library_state,
+            Status::Published,
+            Some(Expiration::Never),
+            true,
+            agent_library::template::aggregate::DataModel::W3CVcDataModelV1_1,
+        )
+        .await;
+
+        let mut app = router((issuance_state, library_state));
+        let response = post_offer_request(&mut app, &template_id).await;
+
+        assert_eq!(response.status(), StatusCode::OK);
+        assert_eq!(
+            response.headers().get("Content-Type").unwrap(),
+            "application/x-www-form-urlencoded"
+        );
+    }
+
     #[serial_test::serial]
     #[tokio::test]
     #[tracing_test::traced_test]
@@ -253,10 +365,13 @@ pub mod tests {
             Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
         initialize(&issuance_state).await.unwrap();
 
-        let mut app = router(issuance_state);
+        let library_state = setup_library_state(&issuance_state).await;
+        let template_id = create_test_template(&library_state).await;
 
-        credentials(&mut app, "001").await;
-        let (_authorization_code, _pre_authorized_code) = offers(&mut app, "001").await.unwrap();
+        let mut app = router((issuance_state, library_state));
+
+        credentials_with_template(&mut app, &template_id).await;
+        let (_authorization_code, _pre_authorized_code) = offers(&mut app, &template_id).await.unwrap();
     }
 
     #[serial_test::serial]
@@ -268,10 +383,13 @@ pub mod tests {
             Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
         initialize(&issuance_state).await.unwrap();
 
-        let mut app = router(issuance_state);
+        let library_state = setup_library_state(&issuance_state).await;
+        let template_id = create_test_template(&library_state).await;
+
+        let mut app = router((issuance_state, library_state));
 
-        credentials(&mut app, "001").await;
-        let none = offers(&mut app, "001").await;
+        credentials_with_template(&mut app, &template_id).await;
+        let none = offers(&mut app, &template_id).await;
 
         // When `credential_offer_by_value_enabled` is false, we expect no grants to be returned from the `offers` test function.
         assert!(none.is_none());
diff --git a/agent_api_http/src/v0/issuance/openapi.rs b/agent_api_http/src/v0/issuance/openapi.rs
index b752eb9a..329064f4 100644
--- a/agent_api_http/src/v0/issuance/openapi.rs
+++ b/agent_api_http/src/v0/issuance/openapi.rs
@@ -1,4 +1,3 @@
-use crate::v0::issuance::credential_configurations::__path_credential_configurations;
 use crate::v0::issuance::credentials::{__path_all_credentials, __path_credential, __path_credentials};
 use crate::v0::issuance::offers::{
     __path_all_offers, __path_offer,
@@ -13,7 +12,6 @@ use utoipa::OpenApi;
 #[derive(OpenApi)]
 #[openapi(
     paths(
-        credential_configurations,
         all_credentials,
         credential,
         credentials,
diff --git a/agent_api_http/src/v0/issuance/public_offers.rs b/agent_api_http/src/v0/issuance/public_offers.rs
index 5b8b2b7e..907359c9 100644
--- a/agent_api_http/src/v0/issuance/public_offers.rs
+++ b/agent_api_http/src/v0/issuance/public_offers.rs
@@ -6,6 +6,7 @@ use agent_issuance::public_offer::error::PublicOfferError;
 use agent_issuance::state::IssuanceState;
 use agent_library::state::LibraryState;
 use agent_library::template::aggregate::Status;
+use axum::Extension;
 use axum::{
     extract::State,
     response::{IntoResponse, Response},
@@ -136,9 +137,7 @@ impl From<&PublicOffer> for PublicOfferStatusDto {
     )
 )]
 #[axum_macros::debug_handler]
-pub(crate) async fn all_public_offers(
-    State((issuance_state, _library_state)): State<(Arc<IssuanceState>, Option<Arc<LibraryState>>)>,
-) -> Result<Response, ApiError> {
+pub(crate) async fn all_public_offers(State(issuance_state): State<Arc<IssuanceState>>) -> Result<Response, ApiError> {
     let all_offers = query_handler("all_public_offers", &issuance_state.query.all_public_offers)
         .await?
         .unwrap_or_default();
@@ -170,16 +169,14 @@ pub(crate) async fn all_public_offers(
 )]
 #[axum_macros::debug_handler]
 pub(crate) async fn create_public_offer(
-    State((issuance_state, library_state)): State<(Arc<IssuanceState>, Option<Arc<LibraryState>>)>,
+    State(issuance_state): State<Arc<IssuanceState>>,
+    Extension(library_state): Extension<Arc<LibraryState>>,
     Json(CreatePublicOfferRequest { offer_id, template_id }): Json<CreatePublicOfferRequest>,
 ) -> Result<Response, ApiError> {
     if query_handler(&offer_id, &issuance_state.query.offer).await?.is_none() {
         return Err(ApiError::new(StatusCode::NOT_FOUND));
     }
 
-    // Query the template from library state to validate it exists and has valid schema
-    let library_state = library_state.ok_or_else(|| PublicOfferError::TemplateNotFound.into_api_error())?;
-
     let template = query_handler(&template_id, &library_state.query.template)
         .await
         .map_err(|_| PublicOfferError::TemplateNotFound.into_api_error())?
@@ -217,7 +214,7 @@ pub(crate) async fn create_public_offer(
 )]
 #[axum_macros::debug_handler]
 pub(crate) async fn take_public_offer_offline(
-    State((issuance_state, _library_state)): State<(Arc<IssuanceState>, Option<Arc<LibraryState>>)>,
+    State(issuance_state): State<Arc<IssuanceState>>,
     Json(TakePublicOfferOfflineRequest { offer_id }): Json<TakePublicOfferOfflineRequest>,
 ) -> Result<Response, ApiError> {
     let command = PublicOfferCommand::TakeOffline {
@@ -243,7 +240,7 @@ pub(crate) async fn take_public_offer_offline(
 )]
 #[axum_macros::debug_handler]
 pub(crate) async fn take_public_offer_online(
-    State((issuance_state, _library_state)): State<(Arc<IssuanceState>, Option<Arc<LibraryState>>)>,
+    State(issuance_state): State<Arc<IssuanceState>>,
     Json(TakePublicOfferOnlineRequest { offer_id }): Json<TakePublicOfferOnlineRequest>,
 ) -> Result<Response, ApiError> {
     let command = PublicOfferCommand::TakeOnline {
@@ -269,7 +266,7 @@ pub(crate) async fn take_public_offer_online(
 )]
 #[axum_macros::debug_handler]
 pub(crate) async fn delete_public_offer(
-    State((issuance_state, _library_state)): State<(Arc<IssuanceState>, Option<Arc<LibraryState>>)>,
+    State(issuance_state): State<Arc<IssuanceState>>,
     Json(DeletePublicOfferRequest { offer_id }): Json<DeletePublicOfferRequest>,
 ) -> Result<Response, ApiError> {
     let command = PublicOfferCommand::Delete {
@@ -296,16 +293,17 @@ pub(crate) async fn can_resolve_public_offer(state: &Arc<IssuanceState>, offer_i
 #[cfg(test)]
 mod tests {
     use crate::handlers::command_handler;
-    use crate::v0::issuance::{credentials::tests::credentials, router_with_library};
+    use crate::tests::TEMPLATE_ID;
+    use crate::v0::issuance::credentials::tests::{create_test_template_with_auth, credentials, setup_library_state};
+    use crate::v0::issuance::router;
     use crate::API_VERSION;
     use agent_issuance::services::IssuanceServices;
     use agent_issuance::state::initialize;
     use agent_library::state::LibraryState;
-    use agent_library::template::aggregate::{Status as TemplateStatus, Visibility};
     use agent_library::template::command::TemplateCommand;
     use agent_secret_manager::service::Service;
     use agent_store::in_memory::InMemory;
-    use agent_store::{issuance_state, library_state};
+    use agent_store::issuance_state;
     use axum::{
         body::Body,
         http::{self, Request, StatusCode},
@@ -315,8 +313,6 @@ mod tests {
     use std::sync::Arc;
     use tower::Service as _;
 
-    const TEMPLATE_ID: &str = "template-001";
-
     async fn create_public_offer_request(offer_id: &str, template_id: &str) -> Request<Body> {
         Request::builder()
             .method(http::Method::POST)
@@ -343,32 +339,22 @@ mod tests {
     async fn setup_app() -> (Router, Arc<LibraryState>) {
         let issuance_state =
             Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
-        let library_state = Arc::new(library_state(&InMemory, Default::default(), Default::default()).await);
-
         initialize(&issuance_state).await.unwrap();
 
-        (
-            router_with_library(issuance_state, Some(library_state.clone())),
-            library_state,
-        )
+        let library_state = setup_library_state(&issuance_state).await;
+        create_test_template_with_auth(&library_state, true).await;
+
+        (router((issuance_state, library_state.clone())), library_state)
     }
 
-    async fn create_template(library_state: &Arc<LibraryState>, template_id: &str, schema: Option<Value>) {
-        let command = TemplateCommand::CreateTemplate {
+    /// Updates the schema of an existing template for public-offer schema validation tests.
+    /// Uses `UpdateSchema` rather than `CreateNewTemplate` to preserve the template's Published
+    /// status (required for credential creation) while setting the schema under test.
+    async fn update_template_schema(library_state: &Arc<LibraryState>, template_id: &str, schema: Option<Value>) {
+        let Some(schema) = schema else { return };
+        let command = TemplateCommand::UpdateSchema {
             template_id: template_id.to_string(),
-            source_template_id: None,
-            title: Some("Template".to_string()),
-            display: Box::new(None),
-            data_model: None,
-            creator: None,
-            holder_type: None,
-            tags: vec![],
-            status: TemplateStatus::Draft,
-            visibility: Visibility::Private,
-            description: None,
-            r#type: vec![],
-            schema: Box::new(schema),
-            schema_properties_attributes: None,
+            schema,
         };
 
         command_handler(template_id, &library_state.command.template, command)
@@ -424,10 +410,10 @@ mod tests {
     async fn test_create_public_offer_succeeds() {
         let (mut app, library_state) = setup_app().await;
 
-        create_template(&library_state, TEMPLATE_ID, Some(const_only_schema())).await;
+        update_template_schema(&library_state, TEMPLATE_ID, Some(const_only_schema())).await;
 
         // A credential (and its associated offer) must exist before creating a public offer.
-        credentials(&mut app, "001").await;
+        credentials(&mut app).await;
 
         let response = app
             .call(create_public_offer_request(crate::tests::OFFER_ID, TEMPLATE_ID).await)
@@ -464,9 +450,9 @@ mod tests {
     async fn test_create_public_offer_fails_when_already_exists() {
         let (mut app, library_state) = setup_app().await;
 
-        create_template(&library_state, TEMPLATE_ID, Some(const_only_schema())).await;
+        update_template_schema(&library_state, TEMPLATE_ID, Some(const_only_schema())).await;
 
-        credentials(&mut app, "001").await;
+        credentials(&mut app).await;
 
         let first = app
             .call(create_public_offer_request(crate::tests::OFFER_ID, TEMPLATE_ID).await)
@@ -488,9 +474,9 @@ mod tests {
     async fn test_take_public_offer_offline() {
         let (mut app, library_state) = setup_app().await;
 
-        create_template(&library_state, TEMPLATE_ID, Some(const_only_schema())).await;
+        update_template_schema(&library_state, TEMPLATE_ID, Some(const_only_schema())).await;
 
-        credentials(&mut app, "001").await;
+        credentials(&mut app).await;
         let _ = app
             .call(create_public_offer_request(crate::tests::OFFER_ID, TEMPLATE_ID).await)
             .await
@@ -523,9 +509,9 @@ mod tests {
     async fn test_take_public_offer_online() {
         let (mut app, library_state) = setup_app().await;
 
-        create_template(&library_state, TEMPLATE_ID, Some(const_only_schema())).await;
+        update_template_schema(&library_state, TEMPLATE_ID, Some(const_only_schema())).await;
 
-        credentials(&mut app, "001").await;
+        credentials(&mut app).await;
         let _ = app
             .call(create_public_offer_request(crate::tests::OFFER_ID, TEMPLATE_ID).await)
             .await
@@ -573,9 +559,9 @@ mod tests {
     async fn test_delete_public_offer_removes_from_list() {
         let (mut app, library_state) = setup_app().await;
 
-        create_template(&library_state, TEMPLATE_ID, Some(const_only_schema())).await;
+        update_template_schema(&library_state, TEMPLATE_ID, Some(const_only_schema())).await;
 
-        credentials(&mut app, "001").await;
+        credentials(&mut app).await;
         let _ = app
             .call(create_public_offer_request(crate::tests::OFFER_ID, TEMPLATE_ID).await)
             .await
@@ -630,7 +616,7 @@ mod tests {
     async fn test_create_public_offer_fails_when_template_not_found() {
         let (mut app, _library_state) = setup_app().await;
 
-        credentials(&mut app, "001").await;
+        credentials(&mut app).await;
 
         let response = app
             .call(create_public_offer_request(crate::tests::OFFER_ID, "missing-template").await)
@@ -645,8 +631,8 @@ mod tests {
     async fn test_create_public_offer_fails_when_template_schema_has_non_const_leaf() {
         let (mut app, library_state) = setup_app().await;
 
-        create_template(&library_state, TEMPLATE_ID, Some(non_const_schema())).await;
-        credentials(&mut app, "001").await;
+        update_template_schema(&library_state, TEMPLATE_ID, Some(non_const_schema())).await;
+        credentials(&mut app).await;
 
         let response = app
             .call(create_public_offer_request(crate::tests::OFFER_ID, TEMPLATE_ID).await)
diff --git a/agent_api_http/src/v0/library/error.rs b/agent_api_http/src/v0/library/error.rs
index 80adc051..fa7aa09b 100644
--- a/agent_api_http/src/v0/library/error.rs
+++ b/agent_api_http/src/v0/library/error.rs
@@ -10,11 +10,325 @@ impl IntoApiErrorExt for TemplateError {
                 .title("Invalid JSON Schema")
                 .source(self)
                 .finish(),
+            TemplateError::InvalidStatusTransition(_) => ApiError::builder(StatusCode::CONFLICT)
+                .title("Invalid Status Transition")
+                .type_url(type_url("library#invalid-status-transition"))
+                .source(self)
+                .finish(),
             TemplateError::InvalidSchemaPropertiesAttributes(_) => ApiError::builder(StatusCode::BAD_REQUEST)
                 .title("Invalid Schema Properties Attributes")
-                .type_url(type_url("templates#invalid-schema-properties-attributes"))
+                .type_url(type_url("library#invalid-schema-properties-attributes"))
+                .source(self)
+                .finish(),
+            TemplateError::NonRemovablePropertyViolation(_) => ApiError::builder(StatusCode::CONFLICT)
+                .title("Non-removable Property Violation")
+                .type_url(type_url("library#non-removable-property-violation"))
+                .source(self)
+                .finish(),
+            TemplateError::DisallowedOpenBadgesProperties(_) => ApiError::builder(StatusCode::BAD_REQUEST)
+                .title("Disallowed OpenBadges Schema Properties")
+                .type_url(type_url("library#disallowed-open-badges-properties"))
+                .source(self)
+                .finish(),
+            TemplateError::MissingRequiredOpenBadgesProperties(_) => ApiError::builder(StatusCode::BAD_REQUEST)
+                .title("Missing Required OpenBadges Schema Properties")
+                .type_url(type_url("library#missing-required-open-badges-properties"))
+                .source(self)
+                .finish(),
+            TemplateError::InvalidRequiredPropertyType(_) => ApiError::builder(StatusCode::BAD_REQUEST)
+                .title("Invalid Required Property Type")
+                .type_url(type_url("library#invalid-required-property-type"))
+                .source(self)
+                .finish(),
+            TemplateError::MissingTitle => ApiError::builder(StatusCode::BAD_REQUEST)
+                .title("Missing Title")
+                .type_url(type_url("library#missing-title"))
+                .source(self)
+                .finish(),
+            TemplateError::ArchivedTemplateImmutable => ApiError::builder(StatusCode::CONFLICT)
+                .title("Archived Template Immutable")
+                .type_url(type_url("library#archived-template-immutable"))
+                .source(self)
+                .finish(),
+            TemplateError::DeletedTemplateTerminal => ApiError::builder(StatusCode::CONFLICT)
+                .title("Deleted Template Terminal")
+                .type_url(type_url("library#deleted-template-terminal"))
+                .source(self)
+                .finish(),
+            TemplateError::ArchiveBeforeDeleteRequired => ApiError::builder(StatusCode::CONFLICT)
+                .title("Archive Before Delete Required")
+                .type_url(type_url("library#archive-before-delete-required"))
+                .source(self)
+                .finish(),
+            TemplateError::InvalidExpiration(_) => ApiError::builder(StatusCode::BAD_REQUEST)
+                .title("Invalid Expiration")
+                .type_url(type_url("library#invalid-expiration"))
+                .source(self)
+                .finish(),
+            TemplateError::InvalidType(_) => ApiError::builder(StatusCode::UNPROCESSABLE_ENTITY)
+                .title("Invalid Type")
+                .type_url(type_url("library#invalid-type"))
+                .source(self)
+                .finish(),
+            TemplateError::InvalidStatusOnCreate => ApiError::builder(StatusCode::UNPROCESSABLE_ENTITY)
+                .title("Invalid Status On Create")
+                .type_url(type_url("library#invalid-status-on-create"))
+                .source(self)
+                .finish(),
+            TemplateError::SchemaPropertiesAttributesNotAllowed => ApiError::builder(StatusCode::UNPROCESSABLE_ENTITY)
+                .title("Schema Properties Attributes Not Allowed")
+                .type_url(type_url("library#schema-properties-attributes-not-allowed"))
+                .source(self)
+                .finish(),
+            TemplateError::DuplicateSchemaPropertiesAttributeKey(_) => {
+                ApiError::builder(StatusCode::UNPROCESSABLE_ENTITY)
+                    .title("Duplicate Schema Properties Attribute Key")
+                    .type_url(type_url("library#duplicate-schema-properties-attribute-key"))
+                    .source(self)
+                    .finish()
+            }
+            TemplateError::DraftTemplateCannotBePublic => ApiError::builder(StatusCode::UNPROCESSABLE_ENTITY)
+                .title("Draft Template Cannot Be Public")
+                .type_url(type_url("library#draft-template-cannot-be-public"))
+                .source(self)
+                .finish(),
+            TemplateError::SourceTemplateNotFound(ref id) => ApiError::builder(StatusCode::UNPROCESSABLE_ENTITY)
+                .title("Source Template Not Found")
+                .type_url(type_url("library#source-template-not-found"))
+                .message(format!("No Source Template found with id: `{id}`"))
+                .source(self)
+                .finish(),
+            TemplateError::TemplateIdMissing => ApiError::builder(StatusCode::BAD_REQUEST)
+                .title("Template ID Missing")
+                .type_url(type_url("library#template-id-missing"))
+                .message("The `id` field is required to update a template.")
+                .source(self)
+                .finish(),
+            TemplateError::TemplateNotFound(ref template_id) => ApiError::builder(StatusCode::NOT_FOUND)
+                .title("Template Not Found")
+                .type_url(type_url("library#template-not-found"))
+                .message(format!("No Template found with id: `{template_id}`"))
                 .source(self)
                 .finish(),
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::error::tests::into_json_value;
+    use serde_json::json;
+
+    macro_rules! assert_problem_details {
+        ($error:expr, $expected:expr) => {
+            assert_eq!(
+                into_json_value($error.into_api_error().into_axum_response()).await,
+                $expected,
+            );
+        };
+    }
+
+    #[tokio::test]
+    async fn template_errors_successfully_convert_to_problem_details() {
+        assert_problem_details!(
+            TemplateError::InvalidSchema("bad schema".to_string()),
+            json!({
+                "type": "https://httpstatuses.com/400",
+                "title": "Invalid JSON Schema",
+                "status": 400,
+                "detail": "Invalid JSON Schema: bad schema"
+            })
+        );
+
+        assert_problem_details!(
+            TemplateError::InvalidStatusTransition("draft -> draft".to_string()),
+            json!({
+                "type": type_url("library#invalid-status-transition"),
+                "title": "Invalid Status Transition",
+                "status": 409,
+                "detail": "Invalid status transition: draft -> draft"
+            })
+        );
+
+        assert_problem_details!(
+            TemplateError::InvalidSchemaPropertiesAttributes("bad key".to_string()),
+            json!({
+                "type": type_url("library#invalid-schema-properties-attributes"),
+                "title": "Invalid Schema Properties Attributes",
+                "status": 400,
+                "detail": "Invalid schema_properties_attributes key(s): bad key"
+            })
+        );
+
+        assert_problem_details!(
+            TemplateError::NonRemovablePropertyViolation("/name".to_string()),
+            json!({
+                "type": type_url("library#non-removable-property-violation"),
+                "title": "Non-removable Property Violation",
+                "status": 409,
+                "detail": "Cannot remove immutable schema properties: /name"
+            })
+        );
+
+        assert_problem_details!(
+            TemplateError::DisallowedOpenBadgesProperties("achievement.foo".to_string()),
+            json!({
+                "type": type_url("library#disallowed-open-badges-properties"),
+                "title": "Disallowed OpenBadges Schema Properties",
+                "status": 400,
+                "detail": "Disallowed OpenBadges 3.0 schema properties: achievement.foo"
+            })
+        );
+
+        assert_problem_details!(
+            TemplateError::MissingRequiredOpenBadgesProperties("/achievement/name".to_string()),
+            json!({
+                "type": type_url("library#missing-required-open-badges-properties"),
+                "title": "Missing Required OpenBadges Schema Properties",
+                "status": 400,
+                "detail": "Missing required OpenBadges 3.0 schema properties: /achievement/name"
+            })
+        );
+
+        assert_problem_details!(
+            TemplateError::InvalidRequiredPropertyType("/achievement/name".to_string()),
+            json!({
+                "type": type_url("library#invalid-required-property-type"),
+                "title": "Invalid Required Property Type",
+                "status": 400,
+                "detail": "Invalid type for required OpenBadges 3.0 schema properties: /achievement/name"
+            })
+        );
+
+        assert_problem_details!(
+            TemplateError::MissingTitle,
+            json!({
+                "type": type_url("library#missing-title"),
+                "title": "Missing Title",
+                "status": 400,
+                "detail": "A title is required when creating or updating a template"
+            })
+        );
+
+        assert_problem_details!(
+            TemplateError::ArchivedTemplateImmutable,
+            json!({
+                "type": type_url("library#archived-template-immutable"),
+                "title": "Archived Template Immutable",
+                "status": 409,
+                "detail": "Archived templates are immutable except for status changes"
+            })
+        );
+
+        assert_problem_details!(
+            TemplateError::DeletedTemplateTerminal,
+            json!({
+                "type": type_url("library#deleted-template-terminal"),
+                "title": "Deleted Template Terminal",
+                "status": 409,
+                "detail": "Deleted templates are terminal and cannot be changed"
+            })
+        );
+
+        assert_problem_details!(
+            TemplateError::ArchiveBeforeDeleteRequired,
+            json!({
+                "type": type_url("library#archive-before-delete-required"),
+                "title": "Archive Before Delete Required",
+                "status": 409,
+                "detail": "Published templates must be archived before they can be deleted"
+            })
+        );
+
+        assert_problem_details!(
+            TemplateError::InvalidExpiration("PXD".to_string()),
+            json!({
+                "type": type_url("library#invalid-expiration"),
+                "title": "Invalid Expiration",
+                "status": 400,
+                "detail": "Invalid expiration value: PXD"
+            })
+        );
+
+        assert_problem_details!(
+            TemplateError::InvalidType("bad type".to_string()),
+            json!({
+                "type": type_url("library#invalid-type"),
+                "title": "Invalid Type",
+                "status": 422,
+                "detail": "Invalid type: bad type"
+            })
+        );
+
+        assert_problem_details!(
+            TemplateError::InvalidStatusOnCreate,
+            json!({
+                "type": type_url("library#invalid-status-on-create"),
+                "title": "Invalid Status On Create",
+                "status": 422,
+                "detail": "Invalid status on create: only Draft or Published are allowed"
+            })
+        );
+
+        assert_problem_details!(
+            TemplateError::SchemaPropertiesAttributesNotAllowed,
+            json!({
+                "type": type_url("library#schema-properties-attributes-not-allowed"),
+                "title": "Schema Properties Attributes Not Allowed",
+                "status": 422,
+                "detail": "schemaPropertiesAttributes are not allowed for W3C VC 1.1 templates"
+            })
+        );
+
+        assert_problem_details!(
+            TemplateError::DuplicateSchemaPropertiesAttributeKey("/name".to_string()),
+            json!({
+                "type": type_url("library#duplicate-schema-properties-attribute-key"),
+                "title": "Duplicate Schema Properties Attribute Key",
+                "status": 422,
+                "detail": "Duplicate schemaPropertiesAttributes key after trimming: `/name`"
+            })
+        );
+
+        assert_problem_details!(
+            TemplateError::DraftTemplateCannotBePublic,
+            json!({
+                "type": type_url("library#draft-template-cannot-be-public"),
+                "title": "Draft Template Cannot Be Public",
+                "status": 422,
+                "detail": "A template must not be in \"Draft\" stage when making it public"
+            })
+        );
+
+        assert_problem_details!(
+            TemplateError::SourceTemplateNotFound("source-id".to_string()),
+            json!({
+                "type": type_url("library#source-template-not-found"),
+                "title": "Source Template Not Found",
+                "status": 422,
+                "detail": "No Source Template found with id: `source-id`"
+            })
+        );
+
+        assert_problem_details!(
+            TemplateError::TemplateIdMissing,
+            json!({
+                "type": type_url("library#template-id-missing"),
+                "title": "Template ID Missing",
+                "status": 400,
+                "detail": "The `id` field is required to update a template."
+            })
+        );
+
+        assert_problem_details!(
+            TemplateError::TemplateNotFound("missing-id".to_string()),
+            json!({
+                "type": type_url("library#template-not-found"),
+                "title": "Template Not Found",
+                "status": 404,
+                "detail": "No Template found with id: `missing-id`"
+            })
+        );
+    }
+}
diff --git a/agent_api_http/src/v0/library/mod.rs b/agent_api_http/src/v0/library/mod.rs
index 53455e0f..f9b3e75d 100644
--- a/agent_api_http/src/v0/library/mod.rs
+++ b/agent_api_http/src/v0/library/mod.rs
@@ -21,12 +21,12 @@ pub fn router(library_state: Arc<LibraryState>) -> Router {
         .nest(
             API_VERSION,
             Router::new()
-                .route("/templates/{template_id}", get(get_template))
-                .route("/templates/get-all-templates", get(get_templates))
-                .route("/templates/create-template", post(create_template))
-                .route("/templates/delete-template", post(delete_template))
-                .route("/templates/update-template", post(update_template))
-                .route("/templates/duplicate-template", post(duplicate_template)),
+                .route("/get-template-by-id/{id}", get(get_template))
+                .route("/list-all-templates", get(get_templates))
+                .route("/create-new-template", post(create_template))
+                .route("/delete-template", post(delete_template))
+                .route("/update-template", post(update_template))
+                .route("/duplicate-template", post(duplicate_template)),
         )
         .with_state(library_state)
 }
diff --git a/agent_api_http/src/v0/templates/mod.rs b/agent_api_http/src/v0/templates/mod.rs
index 09916d90..55400a59 100644
--- a/agent_api_http/src/v0/templates/mod.rs
+++ b/agent_api_http/src/v0/templates/mod.rs
@@ -1,11 +1,13 @@
-use crate::error::type_url;
+use crate::error::IntoApiErrorExt;
 use crate::handlers::{command_handler, query_handler};
 use crate::API_VERSION;
 use agent_library::state::LibraryState;
 use agent_library::template::aggregate::{
-    DataModel, Display, HolderType, PropertyAttribute, Status, Template, Visibility,
+    DataModel, Display, Expiration, HolderType, PropertyAttribute, Status, Template, Visibility,
 };
 use agent_library::template::command::TemplateCommand;
+use agent_library::template::error::TemplateError;
+use agent_shared::config::Authorization;
 use axum::{
     extract::{Path, State},
     response::{IntoResponse, Response},
@@ -26,59 +28,60 @@ pub mod openapi;
 pub struct TemplateDto {
     #[serde(rename = "id")]
     pub template_id: String,
-    pub source_template_id: Option<String>,
-    pub title: Option<String>,
+    pub title: String,
     pub display: Option<Display>,
-    pub data_model: Option<DataModel>,
-    pub creator: Option<String>,
-    pub holder_type: Option<HolderType>,
+    pub data_model: DataModel,
+    pub holder_type: HolderType,
     pub modified_at: Option<String>,
-    pub tags: Vec<String>,
+    pub tags: Option<Vec<String>>,
     pub status: Status,
     pub visibility: Visibility,
+    pub credential_expiration: Expiration,
     pub description: Option<String>,
     pub r#type: Vec<String>,
     pub schema: Option<serde_json::Value>,
     pub schema_properties_attributes: Option<HashMap<String, PropertyAttribute>>,
+    pub holder_authorization: Authorization,
 }
 
 impl From<Template> for TemplateDto {
     fn from(value: Template) -> Self {
         Self {
             template_id: value.template_id,
-            source_template_id: value.source_template_id,
             title: value.title,
             display: value.display,
             data_model: value.data_model,
-            creator: value.creator,
             holder_type: value.holder_type,
             modified_at: value.modified_at,
             tags: value.tags,
             status: value.status,
             visibility: value.visibility,
+            credential_expiration: value.credential_expiration,
             description: value.description,
             r#type: value.r#type,
             schema: *value.schema,
             schema_properties_attributes: value.schema_properties_attributes,
+            holder_authorization: value.holder_authorization,
         }
     }
 }
 
-#[derive(Deserialize, Serialize, Default, utoipa::ToSchema)]
-#[serde(default, rename_all = "camelCase")]
-pub struct CreateTemplateEndpointRequest {
-    pub title: Option<String>,
+#[derive(Debug, Deserialize, Serialize, Default, utoipa::ToSchema)]
+#[serde(default, deny_unknown_fields, rename_all = "camelCase")]
+pub struct CreateNewTemplateRequestBody {
+    pub title: String,
     pub display: Option<Display>,
-    pub data_model: Option<DataModel>,
-    pub creator: Option<String>,
-    pub holder_type: Option<HolderType>,
-    pub tags: Vec<String>,
+    pub data_model: DataModel,
+    pub holder_type: HolderType,
+    pub tags: Option<Vec<String>>,
     pub status: Status,
     pub visibility: Visibility,
+    pub credential_expiration: Option<Expiration>,
     pub description: Option<String>,
     pub r#type: Vec<String>,
     pub schema: Option<serde_json::Value>,
     pub schema_properties_attributes: Option<HashMap<String, PropertyAttribute>>,
+    pub holder_authorization: Authorization,
 }
 
 /// Create a new template
@@ -86,14 +89,18 @@ pub struct CreateTemplateEndpointRequest {
 /// Creates a new template which can be used to issue credentials.
 #[utoipa::path(
     post,
-    path = "/templates/create-template",
+    path = "/create-new-template",
     tags = ["Library", "Templates"],
     request_body(
-        content = CreateTemplateEndpointRequest,
+        content = CreateNewTemplateRequestBody,
         examples(
             ("Standard template" = (
                 description = "A simple example that will issue credentials in the W3C Verifiable Credentials Data Model v1.1 format.",
                 value = json!({ "title": "Standard template", "dataModel": "w3c_vc_data_model_v1-1", "holderType": "individual" })
+            )),
+            ("OpenBadges template" = (
+                description = "An OpenBadges 3.0 template. The fields `achievement.name`, `achievement.description`, and `achievement.criteria.narrative` must be explicitly included in the schema.",
+                value = json!({ "title": "OpenBadges template", "dataModel": "open_badges_3-0", "holderType": "individual", "schema": { "type": "object", "properties": { "achievement.name": { "type": "string" }, "achievement.description": { "type": "string" }, "achievement.criteria.narrative": { "type": "string" } } } })
             ))
         )
     ),
@@ -104,38 +111,41 @@ pub struct CreateTemplateEndpointRequest {
 #[axum_macros::debug_handler]
 pub(crate) async fn create_template(
     State(state): State<Arc<LibraryState>>,
-    Json(CreateTemplateEndpointRequest {
+    Json(CreateNewTemplateRequestBody {
         title,
         display,
         data_model,
-        creator,
         holder_type,
         tags,
         status,
         visibility,
+        credential_expiration,
         description,
         r#type,
         schema,
         schema_properties_attributes,
-    }): Json<CreateTemplateEndpointRequest>,
+        holder_authorization,
+    }): Json<CreateNewTemplateRequestBody>,
 ) -> Result<Response, ApiError> {
     let template_id = Uuid::new_v4().to_string();
 
-    let command = TemplateCommand::CreateTemplate {
+    let command = TemplateCommand::CreateNewTemplate {
         template_id: template_id.clone(),
         source_template_id: None,
         title,
         display: Box::new(display),
         data_model,
-        creator,
         holder_type,
         tags,
         status,
         visibility,
+        credential_expiration,
         description,
         r#type,
         schema: Box::new(schema),
-        schema_properties_attributes,
+        schema_properties_attributes: schema_properties_attributes
+            .map(|attrs| attrs.into_iter().map(|(k, v)| (k, v.strip_non_removable())).collect()),
+        holder_authorization,
     };
 
     command_handler(&template_id, &state.command.template, command).await?;
@@ -146,7 +156,10 @@ pub(crate) async fn create_template(
         .map(|template_view| {
             (
                 StatusCode::CREATED,
-                [(header::LOCATION, &format!("{API_VERSION}/templates/{template_id}"))],
+                [(
+                    header::LOCATION,
+                    &format!("{API_VERSION}/get-template-by-id/{template_id}"),
+                )],
                 Json(TemplateDto::from(template_view)),
             )
                 .into_response()
@@ -166,7 +179,7 @@ pub struct DuplicateTemplateEndpointRequest {
 /// Creates a duplicate of an existing template.
 #[utoipa::path(
     post,
-    path = "/templates/duplicate-template",
+    path = "/duplicate-template",
     tags = ["Library", "Templates"],
     request_body(
         content = DuplicateTemplateEndpointRequest,
@@ -186,29 +199,25 @@ pub(crate) async fn duplicate_template(
 
     let original_template = query_handler(&source_template_id, &state.query.template)
         .await?
-        .ok_or_else(|| {
-            ApiError::builder(StatusCode::UNPROCESSABLE_ENTITY)
-                .title("Source Template Not Found")
-                .type_url(type_url("library#source-template-not-found"))
-                .message(format!("No Source Template found with id: `{source_template_id}`"))
-                .finish()
-        })?;
-
-    let command = TemplateCommand::CreateTemplate {
+        .filter(|template| template.status != Status::Deleted)
+        .ok_or_else(|| TemplateError::SourceTemplateNotFound(source_template_id.clone()).into_api_error())?;
+
+    let command = TemplateCommand::CreateNewTemplate {
         template_id: new_template_id.clone(),
         source_template_id: Some(source_template_id),
-        title: original_template.title.map(|t| format!("{} Copy", t)),
+        title: format!("{} Copy", original_template.title),
         display: Box::new(original_template.display),
         data_model: original_template.data_model,
-        creator: original_template.creator,
         holder_type: original_template.holder_type,
         tags: original_template.tags,
         status: Status::Draft,
-        visibility: original_template.visibility,
+        visibility: Visibility::Private,
+        credential_expiration: Some(original_template.credential_expiration),
         description: original_template.description,
         r#type: original_template.r#type,
         schema: original_template.schema,
         schema_properties_attributes: original_template.schema_properties_attributes,
+        holder_authorization: original_template.holder_authorization,
     };
 
     command_handler(&new_template_id, &state.command.template, command).await?;
@@ -220,29 +229,31 @@ pub(crate) async fn duplicate_template(
 
     Ok((
         StatusCode::CREATED,
-        [(header::LOCATION, &format!("{API_VERSION}/templates/{new_template_id}"))],
-        Json(new_template),
+        [(
+            header::LOCATION,
+            &format!("{API_VERSION}/get-template-by-id/{new_template_id}"),
+        )],
+        Json(TemplateDto::from(new_template)),
     )
         .into_response())
 }
 
-#[derive(Deserialize, Serialize, Default, utoipa::ToSchema)]
-#[serde(default, rename_all = "camelCase")]
+#[derive(Debug, Deserialize, Serialize, Default, utoipa::ToSchema)]
+#[serde(default, deny_unknown_fields, rename_all = "camelCase")]
 pub struct UpdateTemplateEndpointRequest {
     #[serde(rename = "id")]
     pub template_id: String,
     pub title: Option<String>,
     pub display: Option<Display>,
-    pub data_model: Option<DataModel>,
-    pub creator: Option<String>,
-    pub holder_type: Option<HolderType>,
-    pub tags: Vec<String>,
+    pub tags: Option<Vec<String>>,
     pub status: Option<Status>,
     pub visibility: Option<Visibility>,
+    pub credential_expiration: Option<Expiration>,
     pub description: Option<String>,
-    pub r#type: Vec<String>,
+    pub r#type: Option<Vec<String>>,
     pub schema: Option<serde_json::Value>,
     pub schema_properties_attributes: Option<HashMap<String, PropertyAttribute>>,
+    pub holder_authorization: Option<Authorization>,
 }
 
 /// Update a template
@@ -250,7 +261,7 @@ pub struct UpdateTemplateEndpointRequest {
 /// Updates an existing template with the provided content.
 #[utoipa::path(
     post,
-    path = "/templates/update-template",
+    path = "/update-template",
     operation_id = "update_template",
     tags = ["Library", "Templates"],
     responses(
@@ -264,35 +275,25 @@ pub(crate) async fn update_template(
         template_id,
         title,
         display,
-        data_model,
-        creator,
-        holder_type,
         tags,
         status,
         visibility,
+        credential_expiration,
         description,
         r#type,
         schema,
         schema_properties_attributes,
+        holder_authorization,
     }): Json<UpdateTemplateEndpointRequest>,
 ) -> Result<Response, ApiError> {
     if template_id.is_empty() {
-        return Err(ApiError::builder(StatusCode::BAD_REQUEST)
-            .title("Template ID Missing")
-            .type_url(type_url("library#template-id-missing"))
-            .message("The `id` field is required to update a template.")
-            .finish());
+        return Err(TemplateError::TemplateIdMissing.into_api_error());
     }
 
     query_handler(&template_id, &state.query.template)
         .await?
-        .ok_or_else(|| {
-            ApiError::builder(StatusCode::NOT_FOUND)
-                .title("Template Not Found")
-                .type_url(type_url("library#template-not-found"))
-                .message(format!("No Template found with id: `{template_id}`"))
-                .finish()
-        })?;
+        .filter(|t| t.status != Status::Deleted)
+        .ok_or_else(|| TemplateError::TemplateNotFound(template_id.clone()).into_api_error())?;
 
     if let Some(title) = title {
         let command = TemplateCommand::UpdateTitle {
@@ -310,31 +311,7 @@ pub(crate) async fn update_template(
         command_handler(&template_id, &state.command.template, command).await?;
     }
 
-    if let Some(data_model) = data_model {
-        let command = TemplateCommand::UpdateDataModel {
-            template_id: template_id.clone(),
-            data_model,
-        };
-        command_handler(&template_id, &state.command.template, command).await?;
-    }
-
-    if let Some(creator) = creator {
-        let command = TemplateCommand::UpdateCreator {
-            template_id: template_id.clone(),
-            creator,
-        };
-        command_handler(&template_id, &state.command.template, command).await?;
-    }
-
-    if let Some(holder_type) = holder_type {
-        let command = TemplateCommand::UpdateHolderType {
-            template_id: template_id.clone(),
-            holder_type,
-        };
-        command_handler(&template_id, &state.command.template, command).await?;
-    }
-
-    if !tags.is_empty() {
+    if let Some(tags) = tags {
         let command = TemplateCommand::UpdateTags {
             template_id: template_id.clone(),
             tags,
@@ -358,6 +335,14 @@ pub(crate) async fn update_template(
         command_handler(&template_id, &state.command.template, command).await?;
     }
 
+    if let Some(credential_expiration) = credential_expiration {
+        let command = TemplateCommand::UpdateCredentialExpiration {
+            template_id: template_id.clone(),
+            credential_expiration,
+        };
+        command_handler(&template_id, &state.command.template, command).await?;
+    }
+
     if let Some(description) = description {
         let command = TemplateCommand::UpdateDescription {
             template_id: template_id.clone(),
@@ -366,7 +351,7 @@ pub(crate) async fn update_template(
         command_handler(&template_id, &state.command.template, command).await?;
     }
 
-    if !r#type.is_empty() {
+    if let Some(r#type) = r#type {
         let command = TemplateCommand::UpdateType {
             template_id: template_id.clone(),
             r#type,
@@ -385,7 +370,18 @@ pub(crate) async fn update_template(
     if let Some(schema_properties_attributes) = schema_properties_attributes {
         let command = TemplateCommand::UpdateSchemaPropertiesAttributes {
             template_id: template_id.clone(),
-            schema_properties_attributes,
+            schema_properties_attributes: schema_properties_attributes
+                .into_iter()
+                .map(|(k, v)| (k, v.strip_non_removable()))
+                .collect(),
+        };
+        command_handler(&template_id, &state.command.template, command).await?;
+    }
+
+    if let Some(holder_authorization) = holder_authorization {
+        let command = TemplateCommand::UpdateHolderAuthorization {
+            template_id: template_id.clone(),
+            holder_authorization,
         };
         command_handler(&template_id, &state.command.template, command).await?;
     }
@@ -398,7 +394,7 @@ pub(crate) async fn update_template(
 /// List all available templates.
 #[utoipa::path(
     get,
-    path = "/templates/get-all-templates",
+    path = "/list-all-templates",
     operation_id = "get_all_templates",
     tags = ["Library", "Templates"],
     responses(
@@ -410,7 +406,7 @@ pub(crate) async fn get_templates(State(state): State<Arc<LibraryState>>) -> Res
     let filtered_templates = query_handler("all_templates", &state.query.all_templates)
         .await?
         .map(|all_templates_view| {
-            let filtered_templates: Vec<TemplateDto> = all_templates_view
+            let mut filtered_templates: Vec<TemplateDto> = all_templates_view
                 .templates
                 .into_values()
                 .filter(|template| {
@@ -420,6 +416,9 @@ pub(crate) async fn get_templates(State(state): State<Arc<LibraryState>>) -> Res
                 .map(TemplateDto::from)
                 .collect();
 
+            // Sort by most recently modified first (RFC 3339 strings are lexicographically comparable).
+            filtered_templates.sort_by(|a, b| b.modified_at.cmp(&a.modified_at));
+
             filtered_templates
         })
         .unwrap_or_default();
@@ -432,7 +431,7 @@ pub(crate) async fn get_templates(State(state): State<Arc<LibraryState>>) -> Res
 /// Retrieve a specific template by its ID.
 #[utoipa::path(
     get,
-    path = "/templates/{template_id}",
+    path = "/get-template-by-id/{id}",
     operation_id = "get_template_by_id",
     tags = ["Library", "Templates"],
     responses(
@@ -469,7 +468,7 @@ pub struct DeleteTemplateEndpointRequest {
 /// Deletes a template by marking its status as `Deleted`. Deleted templates will no longer appear in any views.
 #[utoipa::path(
     post,
-    path = "/templates/delete-template",
+    path = "/delete-template",
     operation_id = "delete_template_by_id",
     tags = ["Library", "Templates"],
     responses(
@@ -482,22 +481,13 @@ pub(crate) async fn delete_template(
     Json(DeleteTemplateEndpointRequest { template_id }): Json<DeleteTemplateEndpointRequest>,
 ) -> Result<Response, ApiError> {
     if template_id.is_empty() {
-        return Err(ApiError::builder(StatusCode::BAD_REQUEST)
-            .title("Template ID Missing")
-            .type_url(type_url("library#template-id-missing"))
-            .message("The `id` field is required to delete a template.")
-            .finish());
+        return Err(TemplateError::TemplateIdMissing.into_api_error());
     }
 
     query_handler(&template_id, &state.query.template)
         .await?
-        .ok_or_else(|| {
-            ApiError::builder(StatusCode::NOT_FOUND)
-                .title("Template Not Found")
-                .type_url(type_url("library#template-not-found"))
-                .message(format!("No Template found with id: `{template_id}`"))
-                .finish()
-        })?;
+        .filter(|t| t.status != Status::Deleted)
+        .ok_or_else(|| TemplateError::TemplateNotFound(template_id.clone()).into_api_error())?;
 
     let command = TemplateCommand::DeleteTemplate {
         template_id: template_id.clone(),
@@ -506,3 +496,411 @@ pub(crate) async fn delete_template(
     command_handler(&template_id, &state.command.template, command).await?;
     Ok(StatusCode::NO_CONTENT.into_response())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use agent_store::{in_memory::InMemory, library_state};
+    use axum::{body::to_bytes, response::IntoResponse};
+    use serde_json::json;
+    use std::sync::Arc;
+
+    async fn create_source_template(state: &Arc<LibraryState>, template_id: &str, visibility: Visibility) {
+        create_source_template_with_title(state, template_id, "Source Template", visibility).await;
+    }
+
+    async fn create_source_template_with_title(
+        state: &Arc<LibraryState>,
+        template_id: &str,
+        title: &str,
+        visibility: Visibility,
+    ) {
+        command_handler(
+            template_id,
+            &state.command.template,
+            TemplateCommand::CreateNewTemplate {
+                template_id: template_id.to_string(),
+                source_template_id: None,
+                title: title.to_string(),
+                display: Box::new(None),
+                data_model: DataModel::W3CVcDataModelV1_1,
+                holder_type: HolderType::Individual,
+                tags: None,
+                status: Status::Draft,
+                visibility,
+                credential_expiration: Some(Expiration::Never),
+                description: Some("Template description".to_string()),
+                r#type: vec!["VerifiableCredential".to_string()],
+                schema: Box::new(Some(json!({
+                    "type": "object",
+                    "properties": {
+                        "first_name": { "type": "string" }
+                    },
+                    "required": ["first_name"]
+                }))),
+                schema_properties_attributes: None,
+                holder_authorization: Authorization::default(),
+            },
+        )
+        .await
+        .unwrap();
+    }
+
+    #[test]
+    fn create_template_request_accepts_credential_expiration() {
+        let request = serde_json::from_value::<CreateNewTemplateRequestBody>(json!({
+            "title": "Standard template",
+            "dataModel": "w3c_vc_data_model_v1-1",
+            "holderType": "individual",
+            "credentialExpiration": { "type": "never" }
+        }))
+        .unwrap();
+
+        assert_eq!(request.credential_expiration, Some(Expiration::Never));
+    }
+
+    #[test]
+    fn create_template_request_rejects_legacy_fields() {
+        let creator_error = serde_json::from_value::<CreateNewTemplateRequestBody>(json!({
+            "title": "Standard template",
+            "dataModel": "w3c_vc_data_model_v1-1",
+            "holderType": "individual",
+            "creator": "legacy"
+        }))
+        .err()
+        .unwrap();
+        assert!(creator_error.to_string().contains("creator"));
+
+        let expiration_error = serde_json::from_value::<CreateNewTemplateRequestBody>(json!({
+            "title": "Standard template",
+            "dataModel": "w3c_vc_data_model_v1-1",
+            "holderType": "individual",
+            "expiration": { "type": "never" }
+        }))
+        .err()
+        .unwrap();
+        assert!(expiration_error.to_string().contains("expiration"));
+    }
+
+    #[test]
+    fn update_template_request_accepts_credential_expiration() {
+        let request = serde_json::from_value::<UpdateTemplateEndpointRequest>(json!({
+            "id": "template-id",
+            "credentialExpiration": { "type": "never" }
+        }))
+        .unwrap();
+
+        assert_eq!(request.credential_expiration, Some(Expiration::Never));
+    }
+
+    #[test]
+    fn update_template_request_rejects_legacy_fields() {
+        let creator_error = serde_json::from_value::<UpdateTemplateEndpointRequest>(json!({
+            "id": "template-id",
+            "creator": "legacy"
+        }))
+        .err()
+        .unwrap();
+        assert!(creator_error.to_string().contains("creator"));
+
+        let expiration_error = serde_json::from_value::<UpdateTemplateEndpointRequest>(json!({
+            "id": "template-id",
+            "expiration": { "type": "never" }
+        }))
+        .err()
+        .unwrap();
+        assert!(expiration_error.to_string().contains("expiration"));
+    }
+
+    #[test]
+    fn template_dto_hides_internal_source_template_id() {
+        let dto = TemplateDto::from(Template {
+            template_id: "template-id".to_string(),
+            source_template_id: Some("parent-template-id".to_string()),
+            title: "Template".to_string(),
+            display: None,
+            data_model: DataModel::W3CVcDataModelV1_1,
+            holder_type: HolderType::Individual,
+            modified_at: Some("2024-01-01T00:00:00Z".to_string()),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::Never,
+            description: None,
+            r#type: vec!["VerifiableCredential".to_string()],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        });
+
+        let serialized = serde_json::to_value(dto).unwrap();
+
+        assert!(serialized.get("sourceTemplateId").is_none());
+    }
+
+    #[tokio::test]
+    async fn duplicate_template_resets_visibility_and_hides_lineage() {
+        let state = Arc::new(library_state(&InMemory, Default::default(), Default::default()).await);
+        create_source_template(&state, "source-template", Visibility::Public).await;
+
+        let response = duplicate_template(
+            State(state),
+            Json(DuplicateTemplateEndpointRequest {
+                source_template_id: "source-template".to_string(),
+            }),
+        )
+        .await
+        .unwrap();
+
+        assert_eq!(response.status(), StatusCode::CREATED);
+
+        let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let body: serde_json::Value = serde_json::from_slice(&body).unwrap();
+
+        assert_eq!(body["status"], "draft");
+        assert_eq!(body["visibility"], "private");
+        assert_eq!(body["title"], "Source Template Copy");
+        assert!(body.get("sourceTemplateId").is_none());
+    }
+
+    #[tokio::test]
+    async fn duplicate_template_rejects_deleted_source_template() {
+        let state = Arc::new(library_state(&InMemory, Default::default(), Default::default()).await);
+        create_source_template(&state, "deleted-source", Visibility::Private).await;
+
+        command_handler(
+            "deleted-source",
+            &state.command.template,
+            TemplateCommand::DeleteTemplate {
+                template_id: "deleted-source".to_string(),
+            },
+        )
+        .await
+        .unwrap();
+
+        let response = duplicate_template(
+            State(state),
+            Json(DuplicateTemplateEndpointRequest {
+                source_template_id: "deleted-source".to_string(),
+            }),
+        )
+        .await
+        .unwrap_err()
+        .into_response();
+
+        assert_eq!(response.status(), StatusCode::UNPROCESSABLE_ENTITY);
+
+        let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let body: serde_json::Value = serde_json::from_slice(&body).unwrap();
+
+        assert_eq!(body["title"], "Source Template Not Found");
+    }
+
+    #[tokio::test]
+    async fn create_template_returns_created_template() {
+        let state = Arc::new(library_state(&InMemory, Default::default(), Default::default()).await);
+
+        let response = create_template(
+            State(state),
+            Json(CreateNewTemplateRequestBody {
+                title: "Created Template".to_string(),
+                display: None,
+                data_model: DataModel::W3CVcDataModelV1_1,
+                holder_type: HolderType::Individual,
+                tags: None,
+                status: Status::Draft,
+                visibility: Visibility::Private,
+                credential_expiration: Some(Expiration::Never),
+                description: Some("Created description".to_string()),
+                r#type: vec!["EmployeeCredential".to_string()],
+                schema: None,
+                schema_properties_attributes: None,
+                holder_authorization: Authorization::default(),
+            }),
+        )
+        .await
+        .unwrap();
+
+        assert_eq!(response.status(), StatusCode::CREATED);
+
+        let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let body: serde_json::Value = serde_json::from_slice(&body).unwrap();
+
+        assert_eq!(body["title"], "Created Template");
+        assert_eq!(body["description"], "Created description");
+        assert_eq!(body["type"], json!(["VerifiableCredential", "EmployeeCredential"]));
+    }
+
+    #[tokio::test]
+    async fn update_template_requires_id() {
+        let state = Arc::new(library_state(&InMemory, Default::default(), Default::default()).await);
+
+        let response = update_template(
+            State(state),
+            Json(UpdateTemplateEndpointRequest {
+                template_id: String::new(),
+                title: Some("Updated title".to_string()),
+                display: None,
+                tags: None,
+                status: None,
+                visibility: None,
+                credential_expiration: None,
+                description: None,
+                r#type: None,
+                schema: None,
+                schema_properties_attributes: None,
+                holder_authorization: None,
+            }),
+        )
+        .await
+        .unwrap_err()
+        .into_response();
+
+        assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+
+        let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let body: serde_json::Value = serde_json::from_slice(&body).unwrap();
+
+        assert_eq!(body["title"], "Template ID Missing");
+    }
+
+    #[tokio::test]
+    async fn update_template_rejects_deleted_template() {
+        let state = Arc::new(library_state(&InMemory, Default::default(), Default::default()).await);
+        create_source_template(&state, "deleted-template", Visibility::Private).await;
+
+        command_handler(
+            "deleted-template",
+            &state.command.template,
+            TemplateCommand::DeleteTemplate {
+                template_id: "deleted-template".to_string(),
+            },
+        )
+        .await
+        .unwrap();
+
+        let response = update_template(
+            State(state),
+            Json(UpdateTemplateEndpointRequest {
+                template_id: "deleted-template".to_string(),
+                title: Some("Updated title".to_string()),
+                display: None,
+                tags: None,
+                status: None,
+                visibility: None,
+                credential_expiration: None,
+                description: None,
+                r#type: None,
+                schema: None,
+                schema_properties_attributes: None,
+                holder_authorization: None,
+            }),
+        )
+        .await
+        .unwrap_err()
+        .into_response();
+
+        assert_eq!(response.status(), StatusCode::NOT_FOUND);
+
+        let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let body: serde_json::Value = serde_json::from_slice(&body).unwrap();
+
+        assert_eq!(body["title"], "Template Not Found");
+    }
+
+    #[tokio::test]
+    async fn update_template_applies_type_and_credential_expiration_changes() {
+        let state = Arc::new(library_state(&InMemory, Default::default(), Default::default()).await);
+        create_source_template(&state, "template-to-update", Visibility::Private).await;
+
+        let response = update_template(
+            State(state.clone()),
+            Json(UpdateTemplateEndpointRequest {
+                template_id: "template-to-update".to_string(),
+                title: None,
+                display: None,
+                tags: None,
+                status: None,
+                visibility: None,
+                credential_expiration: Some(Expiration::Duration("P30D".to_string())),
+                description: Some("Updated description".to_string()),
+                r#type: Some(vec!["EmployeeCredential".to_string()]),
+                schema: None,
+                schema_properties_attributes: None,
+                holder_authorization: None,
+            }),
+        )
+        .await
+        .unwrap();
+
+        assert_eq!(response.status(), StatusCode::NO_CONTENT);
+
+        let template = query_handler("template-to-update", &state.query.template)
+            .await
+            .unwrap()
+            .unwrap();
+
+        assert_eq!(template.credential_expiration, Expiration::Duration("P30D".to_string()));
+        assert_eq!(template.description.as_deref(), Some("Updated description"));
+        assert_eq!(
+            template.r#type,
+            vec!["VerifiableCredential".to_string(), "EmployeeCredential".to_string(),]
+        );
+    }
+
+    #[tokio::test]
+    async fn get_templates_filters_deleted_and_sorts_latest_first() {
+        let state = Arc::new(library_state(&InMemory, Default::default(), Default::default()).await);
+        create_source_template_with_title(&state, "older-template", "Older Template", Visibility::Private).await;
+        create_source_template_with_title(&state, "newer-template", "Newer Template", Visibility::Private).await;
+        create_source_template_with_title(&state, "deleted-template", "Deleted Template", Visibility::Private).await;
+
+        command_handler(
+            "deleted-template",
+            &state.command.template,
+            TemplateCommand::DeleteTemplate {
+                template_id: "deleted-template".to_string(),
+            },
+        )
+        .await
+        .unwrap();
+
+        let response = get_templates(State(state)).await.unwrap();
+        assert_eq!(response.status(), StatusCode::OK);
+
+        let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let body: serde_json::Value = serde_json::from_slice(&body).unwrap();
+        let titles: Vec<&str> = body
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|template| template["title"].as_str().unwrap())
+            .collect();
+
+        assert_eq!(titles, vec!["Newer Template", "Older Template"]);
+    }
+
+    #[tokio::test]
+    async fn delete_template_hides_template_from_get_endpoint() {
+        let state = Arc::new(library_state(&InMemory, Default::default(), Default::default()).await);
+        create_source_template(&state, "template-to-delete", Visibility::Private).await;
+
+        let response = delete_template(
+            State(state.clone()),
+            Json(DeleteTemplateEndpointRequest {
+                template_id: "template-to-delete".to_string(),
+            }),
+        )
+        .await
+        .unwrap();
+
+        assert_eq!(response.status(), StatusCode::NO_CONTENT);
+
+        let response = get_template(State(state), Path("template-to-delete".to_string()))
+            .await
+            .unwrap_err()
+            .into_response();
+
+        assert_eq!(response.status(), StatusCode::NOT_FOUND);
+    }
+}
diff --git a/agent_api_http/src/v0/verification/relying_party/redirect.rs b/agent_api_http/src/v0/verification/relying_party/redirect.rs
index fddedc7f..edb8c6e3 100644
--- a/agent_api_http/src/v0/verification/relying_party/redirect.rs
+++ b/agent_api_http/src/v0/verification/relying_party/redirect.rs
@@ -127,6 +127,7 @@ pub mod tests {
         assert_eq!(response.status(), StatusCode::OK);
     }
 
+    #[serial_test::serial]
     #[tokio::test(flavor = "multi_thread")]
     #[tracing_test::traced_test]
     async fn test_redirect_endpoint() {
diff --git a/agent_application/example.config.yaml b/agent_application/example.config.yaml
index df436efb..feef959b 100644
--- a/agent_application/example.config.yaml
+++ b/agent_application/example.config.yaml
@@ -15,6 +15,7 @@ did_methods:
     enabled: false
 
 domain_linkage_enabled: false
+
 enable_interactive_authorization_flow: true
 
 signing_algorithms_supported:
@@ -39,8 +40,6 @@ event_publishers:
         credential: [UnsignedCredentialCreated, CredentialSigned]
         # To enable the interactive authorization flow for OID4VCIm, the event below needs to be listened to.
         # authorization_request: [OID4VPAuthorizationResponseVerified]
-
-
   nats:
     enabled: true
     nats_url: "nats://localhost:4222"
diff --git a/agent_application/src/lib.rs b/agent_application/src/lib.rs
index 8c8c8552..43068084 100644
--- a/agent_application/src/lib.rs
+++ b/agent_application/src/lib.rs
@@ -9,8 +9,7 @@ use agent_event_publisher_nats::EventPublisherNats;
 use agent_holder::services::HolderServices;
 use agent_identity::services::IdentityServices;
 use agent_issuance::{
-    application::policies::issuer_metadata_synchronization_policy::IssuerMetadataSynchronizationPolicy,
-    services::IssuanceServices,
+    application::credential_configuration_projection::CredentialConfigurationProjection, services::IssuanceServices,
 };
 use agent_secret_manager::{service::Service as _, subject::Subject};
 use agent_shared::config::{config, EventStoreType};
@@ -92,8 +91,21 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
                 let issuance_state =
                     Arc::new(agent_store::issuance_state(&builder, issuance_services, issuance_event_publishers).await);
 
-                let issuer_metadata_synchronization_policy =
-                    IssuerMetadataSynchronizationPolicy::new(issuance_state.clone());
+                let (credential_configuration_projection, template_view_handle) =
+                    CredentialConfigurationProjection::new(issuance_state.clone());
+
+                let library_state = Arc::new(
+                    agent_store::library_state(
+                        &builder,
+                        library_event_publishers,
+                        vec![Box::new(credential_configuration_projection)],
+                    )
+                    .await,
+                );
+                assert!(
+                    template_view_handle.set(library_state.query.template.clone()).is_ok(),
+                    "template view already initialized"
+                );
 
                 let verification_state = Arc::new(
                     agent_store::verification_state(&builder, verification_services, verification_event_publishers)
@@ -106,14 +118,7 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
 
                 (
                     Arc::new(agent_store::identity_state(&builder, identity_services, identity_event_publishers).await),
-                    Arc::new(
-                        agent_store::library_state(
-                            &builder,
-                            library_event_publishers,
-                            vec![Box::new(issuer_metadata_synchronization_policy)],
-                        )
-                        .await,
-                    ),
+                    library_state,
                     Arc::new(
                         agent_store::authorization_state(
                             &builder,
@@ -134,8 +139,21 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
                 let issuance_state =
                     Arc::new(agent_store::issuance_state(&builder, issuance_services, issuance_event_publishers).await);
 
-                let issuer_metadata_synchronization_policy =
-                    IssuerMetadataSynchronizationPolicy::new(issuance_state.clone());
+                let (credential_configuration_projection, template_view_handle) =
+                    CredentialConfigurationProjection::new(issuance_state.clone());
+
+                let library_state = Arc::new(
+                    agent_store::library_state(
+                        &builder,
+                        library_event_publishers,
+                        vec![Box::new(credential_configuration_projection)],
+                    )
+                    .await,
+                );
+                assert!(
+                    template_view_handle.set(library_state.query.template.clone()).is_ok(),
+                    "template view already initialized"
+                );
 
                 let verification_state = Arc::new(
                     agent_store::verification_state(&builder, verification_services, verification_event_publishers)
@@ -148,14 +166,7 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
 
                 (
                     Arc::new(agent_store::identity_state(&builder, identity_services, identity_event_publishers).await),
-                    Arc::new(
-                        agent_store::library_state(
-                            &builder,
-                            library_event_publishers,
-                            vec![Box::new(issuer_metadata_synchronization_policy)],
-                        )
-                        .await,
-                    ),
+                    library_state,
                     Arc::new(
                         agent_store::authorization_state(
                             &builder,
@@ -175,8 +186,21 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
                     agent_store::issuance_state(&InMemory, issuance_services, issuance_event_publishers).await,
                 );
 
-                let issuer_metadata_synchronization_policy =
-                    IssuerMetadataSynchronizationPolicy::new(issuance_state.clone());
+                let (credential_configuration_projection, template_view_handle) =
+                    CredentialConfigurationProjection::new(issuance_state.clone());
+
+                let library_state = Arc::new(
+                    agent_store::library_state(
+                        &InMemory,
+                        library_event_publishers,
+                        vec![Box::new(credential_configuration_projection)],
+                    )
+                    .await,
+                );
+                assert!(
+                    template_view_handle.set(library_state.query.template.clone()).is_ok(),
+                    "template view already initialized"
+                );
 
                 let verification_state = Arc::new(
                     agent_store::verification_state(&InMemory, verification_services, verification_event_publishers)
@@ -191,14 +215,7 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
                     Arc::new(
                         agent_store::identity_state(&InMemory, identity_services, identity_event_publishers).await,
                     ),
-                    Arc::new(
-                        agent_store::library_state(
-                            &InMemory,
-                            library_event_publishers,
-                            vec![Box::new(issuer_metadata_synchronization_policy)],
-                        )
-                        .await,
-                    ),
+                    library_state,
                     Arc::new(
                         agent_store::authorization_state(
                             &InMemory,
diff --git a/agent_event_publisher_http/README.md b/agent_event_publisher_http/README.md
index aabd8954..403d8a77 100644
--- a/agent_event_publisher_http/README.md
+++ b/agent_event_publisher_http/README.md
@@ -115,15 +115,13 @@ LinkedVerifiablePresentationServiceCreated
 TemplateCreated
 TitleUpdated
 DisplayUpdated
-DataModelUpdated
-CreatorUpdated
-HolderTypeUpdated
 TagsUpdated
 StatusUpdated
 VisibilityUpdated
 DescriptionUpdated
 TypeUpdated
 SchemaUpdated
+CredentialExpirationUpdated
 ```
 
 #### `server_config`
diff --git a/agent_holder/Cargo.toml b/agent_holder/Cargo.toml
index 22cf6415..30f2bfa6 100644
--- a/agent_holder/Cargo.toml
+++ b/agent_holder/Cargo.toml
@@ -36,6 +36,7 @@ agent_authorization = { path = "../agent_authorization", features = [
 ] }
 agent_holder = { path = ".", features = ["test_utils"] }
 agent_issuance = { path = "../agent_issuance", features = ["test_utils"] }
+agent_library = { path = "../agent_library", features = ["test_utils"] }
 agent_secret_manager = { path = "../agent_secret_manager", features = [
     "test_utils",
 ] }
diff --git a/agent_holder/src/offer/aggregate.rs b/agent_holder/src/offer/aggregate.rs
index 372ce0f8..b97588d6 100644
--- a/agent_holder/src/offer/aggregate.rs
+++ b/agent_holder/src/offer/aggregate.rs
@@ -327,14 +327,19 @@ pub mod tests {
     use agent_api_http::v0::{authorization, issuance};
     use agent_api_http::API_VERSION;
     use agent_authorization::services::AuthorizationServices;
-    use agent_issuance::server_config::aggregate::test_utils::credential_configurations_supported;
+    use agent_issuance::server_config::command::ServerConfigCommand;
     use agent_issuance::services::IssuanceServices;
+    use agent_issuance::state::SERVER_CONFIG_ID;
+    use agent_library::template::aggregate::{
+        DataModel, Display, HolderType, Logo, Status as TemplateStatus, Visibility,
+    };
+    use agent_library::template::command::TemplateCommand;
     use agent_secret_manager::service::Service;
-    use agent_shared::config::config;
-    use agent_shared::config::config_mut;
+    use agent_shared::config::{config, config_mut, Authorization, CredentialConfiguration};
     use agent_shared::generate_random_string;
+    use agent_shared::handlers::command_handler;
     use agent_store::in_memory::InMemory;
-    use agent_store::{authorization_state, issuance_state};
+    use agent_store::{authorization_state, issuance_state, library_state};
     use axum::{
         body::Body,
         http::{self, Request},
@@ -346,6 +351,8 @@ pub mod tests {
     use tokio::net::TcpListener;
     use tower::Service as _;
 
+    const TEMPLATE_ID: &str = "001";
+
     type OfferTestFramework = TestFramework<Offer>;
 
     async fn bootstrap_issuer_server() -> CredentialOffer {
@@ -364,7 +371,70 @@ pub mod tests {
         let issuance_state =
             Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
         agent_issuance::state::initialize(&issuance_state).await.unwrap();
-        let mut credential_isser = issuance::router(issuance_state.clone());
+
+        let library_state = Arc::new(library_state(&InMemory, Default::default(), Default::default()).await);
+
+        // Create a template and register a credential configuration for it.
+        // (The CredentialConfigurationProjection is not wired in tests, so we do this manually.)
+        command_handler(
+            TEMPLATE_ID,
+            &library_state.command.template,
+            TemplateCommand::CreateNewTemplate {
+                template_id: TEMPLATE_ID.to_string(),
+                source_template_id: None,
+                title: "Test Template".to_string(),
+                display: Box::new(Some(Display {
+                    name: "Verifiable Credential".to_string(),
+                    logo: Some(Logo {
+                        uri: "https://www.impierce.com/external/impierce-logo.png".to_string(),
+                        alt_text: Some("Impierce Logo".to_string()),
+                    }),
+                })),
+                data_model: DataModel::W3CVcDataModelV1_1,
+                holder_type: HolderType::Individual,
+                tags: None,
+                status: TemplateStatus::Published,
+                visibility: Visibility::Private,
+                credential_expiration: None,
+                description: None,
+                r#type: vec!["VerifiableCredential".to_string()],
+                schema: Box::new(None),
+                schema_properties_attributes: None,
+                holder_authorization: Authorization::default(),
+            },
+        )
+        .await
+        .unwrap();
+
+        let credential_configuration: CredentialConfiguration = serde_json::from_value(json!({
+            "credential_configuration_id": TEMPLATE_ID,
+            "format": "jwt_vc_json",
+            "type": ["VerifiableCredential"],
+            "display": [
+                {
+                    "name": "Verifiable Credential",
+                    "locale": "en",
+                    "logo": {
+                        "uri": "https://www.impierce.com/external/impierce-logo.png",
+                        "alt_text": "Impierce Logo"
+                    }
+                }
+            ],
+            "authorization": { "pre_authorized": true }
+        }))
+        .unwrap();
+        command_handler(
+            SERVER_CONFIG_ID,
+            &issuance_state.command.server_config,
+            ServerConfigCommand::UpdateCredentialConfiguration {
+                credential_configuration,
+                provisioned: false,
+            },
+        )
+        .await
+        .unwrap();
+
+        let mut issuance_router = issuance::router((issuance_state.clone(), library_state));
 
         let authorization_state = Arc::new(
             authorization_state(
@@ -382,7 +452,7 @@ pub mod tests {
 
         let received_offer_id = generate_random_string();
 
-        let _ = credential_isser
+        let _ = issuance_router
             .call(
                 Request::builder()
                     .method(http::Method::POST)
@@ -400,7 +470,7 @@ pub mod tests {
                                         "name": "Master of Oceanography"
                                     }
                             }},
-                            "credentialConfigurationId": "001",
+                            "templateId": TEMPLATE_ID,
                             "expiresAt": "never",
                         }))
                         .unwrap(),
@@ -409,7 +479,7 @@ pub mod tests {
             )
             .await;
 
-        let response = credential_isser
+        let response = issuance_router
             .call(
                 Request::builder()
                     .method(http::Method::POST)
@@ -418,7 +488,7 @@ pub mod tests {
                     .body(Body::from(
                         serde_json::to_vec(&json!({
                             "offerId": received_offer_id,
-                            "credentialConfigurationIds": ["001"],
+                            "templateIds": [TEMPLATE_ID],
                         }))
                         .unwrap(),
                     ))
@@ -432,7 +502,7 @@ pub mod tests {
         let credential_offer: CredentialOffer = String::from_utf8(body.to_vec()).unwrap().parse().unwrap();
 
         tokio::spawn(async move {
-            axum::serve(listener, credential_isser.merge(authorization_server))
+            axum::serve(listener, issuance_router.merge(authorization_server))
                 .await
                 .unwrap();
         });
@@ -450,6 +520,15 @@ pub mod tests {
         }
     }
 
+    #[fixture]
+    fn credential_configurations_supported() -> HashMap<String, CredentialConfigurationsSupportedObject> {
+        use agent_issuance::credential::aggregate::test_utils::JWT_VC_JSON_VC1_1_CREDENTIAL_CONFIGURATION;
+        HashMap::from_iter(vec![(
+            TEMPLATE_ID.to_string(),
+            JWT_VC_JSON_VC1_1_CREDENTIAL_CONFIGURATION.clone(),
+        )])
+    }
+
     #[rstest]
     #[serial_test::serial]
     #[tokio::test]
diff --git a/agent_issuance/Cargo.toml b/agent_issuance/Cargo.toml
index d88f1d2a..c4c57268 100644
--- a/agent_issuance/Cargo.toml
+++ b/agent_issuance/Cargo.toml
@@ -44,6 +44,7 @@ rstest = { workspace = true, optional = true }
 [dev-dependencies]
 agent_holder = { path = "../agent_holder", features = ["test_utils"] }
 agent_issuance = { path = ".", features = ["test_utils"] }
+agent_library = { path = "../agent_library" }
 agent_secret_manager = { path = "../agent_secret_manager", features = [
     "test_utils",
 ] }
@@ -51,6 +52,7 @@ agent_shared = { path = "../agent_shared", features = ["test_utils"] }
 agent_store = { path = "../agent_store" }
 async-std.workspace = true
 serial_test = "3.0"
+tokio.workspace = true
 tracing-test.workspace = true
 
 [features]
diff --git a/agent_issuance/src/application/credential_configuration_projection.rs b/agent_issuance/src/application/credential_configuration_projection.rs
new file mode 100644
index 00000000..ebf9a95b
--- /dev/null
+++ b/agent_issuance/src/application/credential_configuration_projection.rs
@@ -0,0 +1,823 @@
+use crate::server_config::command::ServerConfigCommand;
+use crate::state::{IssuanceState, SERVER_CONFIG_ID};
+use agent_library::template::aggregate::{DataModel, PropertyAttribute, Template};
+use agent_library::template::views::TemplateView;
+use agent_shared::config::CredentialConfiguration;
+use agent_shared::handlers::{command_handler, query_handler};
+use async_trait::async_trait;
+use cqrs_es::persist::ViewRepository;
+use cqrs_es::{EventEnvelope, Query};
+use oid4vc_core::claim_path_pointer::{ClaimPathElement, ClaimPathPointer};
+use oid4vci::credential_issuer::credential_configurations_supported::{
+    ClaimDescription, CredentialConfigurationsSupportedDisplay, CredentialMetadata, Logo as OidcLogo,
+};
+use std::{
+    collections::HashMap,
+    sync::{Arc, OnceLock},
+};
+use tracing::warn;
+
+type TemplateViewHandle = Arc<OnceLock<Arc<dyn ViewRepository<TemplateView, Template>>>>;
+
+pub struct CredentialConfigurationProjection {
+    issuance_state: Arc<IssuanceState>,
+    /// The template view repository used to re-query the current template state on partial updates.
+    ///
+    /// This is a `OnceLock` so that the real library state's view repository can be injected AFTER
+    /// the library state (and hence the CQRS framework) is constructed, avoiding the circular
+    /// dependency: projection → library state → projection. By the time any template events arrive the
+    /// application is already started and the lock is set.
+    template_view: TemplateViewHandle,
+}
+
+impl CredentialConfigurationProjection {
+    /// Creates a new projection.
+    ///
+    /// Returns both the projection and the `OnceLock` handle.  After building the library state that
+    /// owns this projection, call `handle.set(library_state.query.template.clone()).unwrap()` to wire
+    /// the real (shared) view repository into the projection.
+    pub fn new(issuance_state: Arc<IssuanceState>) -> (Self, TemplateViewHandle) {
+        let template_view = Arc::new(OnceLock::new());
+        let projection = Self {
+            issuance_state,
+            template_view: template_view.clone(),
+        };
+        (projection, template_view)
+    }
+
+    /// Re-queries the current template state from the view repository and keeps the corresponding
+    /// credential configuration synchronized for published templates only.
+    async fn sync_from_view(&self, template_id: &str) {
+        use agent_library::template::aggregate::Status;
+
+        let Some(view) = self.template_view.get() else {
+            warn!("Template view not yet initialized; skipping credential configuration sync for `{template_id}`");
+            return;
+        };
+        match query_handler(template_id, view).await {
+            Ok(Some(template)) => {
+                if template.status != Status::Published {
+                    self.remove_credential_configuration(template_id).await;
+                    return;
+                }
+                let credential_configuration = credential_configuration_from_template(&template);
+                let command = ServerConfigCommand::UpdateCredentialConfiguration {
+                    credential_configuration,
+                    provisioned: false,
+                };
+                if let Err(e) =
+                    command_handler(SERVER_CONFIG_ID, &self.issuance_state.command.server_config, command).await
+                {
+                    warn!("Failed to update credential configuration for template `{template_id}`: {e}");
+                }
+            }
+            Ok(None) => {
+                warn!("Template `{template_id}` not found when trying to sync credential configuration");
+            }
+            Err(e) => {
+                warn!("Failed to query template `{template_id}` for credential configuration sync: {e}");
+            }
+        }
+    }
+
+    /// Removes the credential configuration associated with the given template ID.
+    async fn remove_credential_configuration(&self, template_id: &str) {
+        let command = ServerConfigCommand::RemoveCredentialConfiguration {
+            credential_configuration_id: template_id.to_string(),
+            provisioned: false,
+        };
+        if let Err(e) = command_handler(SERVER_CONFIG_ID, &self.issuance_state.command.server_config, command).await {
+            warn!("Failed to remove credential configuration for template `{template_id}`: {e}");
+        }
+    }
+}
+
+/// Derives a `CredentialConfiguration` from a `Template`.
+///
+/// The display name is taken from `template.display.name` if present, falling back to `template.title`.
+/// When the format is "vc+sd-jwt", claims are derived from `schema.properties` merged with
+/// `schema_properties_attributes.selectivelyDisclosable`.
+///
+/// The `credential_definition.type` array prefers the template's explicit `type` values.
+/// Narrow fallbacks are only used when the template does not yet provide any type values.
+fn credential_configuration_from_template(template: &Template) -> CredentialConfiguration {
+    let format = match template.data_model {
+        DataModel::W3CVcDataModelV1_1 => "jwt_vc_json",
+        _ => "vc+sd-jwt",
+    }
+    .to_string();
+
+    let type_ = if template.r#type.is_empty() {
+        match template.data_model {
+            DataModel::W3CVcDataModelV1_1 | DataModel::W3CVcDataModelV2_0 => {
+                vec!["VerifiableCredential".to_string()]
+            }
+            DataModel::OpenBadges3_0 => {
+                vec!["VerifiableCredential".to_string(), "OpenBadgeCredential".to_string()]
+            }
+            _ => template.r#type.clone(),
+        }
+    } else {
+        template.r#type.clone()
+    };
+
+    let display = template
+        .display
+        .as_ref()
+        .map(|d| {
+            let logo = d.logo.as_ref().and_then(|logo| {
+                logo.uri.parse().ok().map(|uri| OidcLogo {
+                    uri,
+                    alt_text: logo.alt_text.clone(),
+                })
+            });
+            vec![CredentialConfigurationsSupportedDisplay {
+                name: d.name.clone(),
+                locale: None,
+                logo,
+                description: None,
+                background_image: None,
+                background_color: None,
+                text_color: None,
+            }]
+        })
+        .or_else(|| {
+            Some(vec![CredentialConfigurationsSupportedDisplay {
+                name: template.title.clone(),
+                locale: None,
+                logo: None,
+                description: None,
+                background_image: None,
+                background_color: None,
+                text_color: None,
+            }])
+        });
+
+    let claims = if format == "vc+sd-jwt" {
+        build_claims_from_schema(template, Some("credentialSubject."))
+    } else if format == "dc+sd-jwt" {
+        build_claims_from_schema(template, None)
+    } else {
+        None
+    };
+
+    CredentialConfiguration {
+        credential_configuration_id: template.template_id.clone(),
+        format,
+        type_,
+        credential_metadata: CredentialMetadata { display, claims },
+        authorization: template.holder_authorization.clone(),
+    }
+}
+
+/// Builds claim descriptions from the template schema.
+///
+/// Nested objects are traversed recursively and only leaf fields become claims.
+/// Arrays are exposed as a single claim at the array field itself.
+/// Attribute lookup uses dotted keys such as `achievement.criteria.narrative`.
+/// A claim defaults to non-mandatory unless attributes explicitly mark it as non-disclosable.
+fn build_claims_from_schema(template: &Template, prefix: Option<&str>) -> Option<Vec<ClaimDescription>> {
+    let schema = template.schema.as_ref().as_ref()?;
+    let attributes = template.schema_properties_attributes.as_ref();
+    let prefix_segments: Vec<String> = prefix
+        .iter()
+        .flat_map(|value| value.split('.').filter(|segment| !segment.is_empty()))
+        .map(|segment| segment.to_string())
+        .collect();
+
+    let mut claims = Vec::new();
+    collect_claim_descriptions(schema, &prefix_segments, &[], attributes, &mut claims);
+
+    if claims.is_empty() {
+        None
+    } else {
+        Some(claims)
+    }
+}
+
+fn collect_claim_descriptions(
+    schema: &serde_json::Value,
+    prefix_segments: &[String],
+    current_segments: &[String],
+    attributes: Option<&HashMap<String, PropertyAttribute>>,
+    claims: &mut Vec<ClaimDescription>,
+) {
+    let Some(properties) = schema.get("properties").and_then(|value| value.as_object()) else {
+        return;
+    };
+
+    for (property_name, property_schema) in properties {
+        let mut property_segments = current_segments.to_vec();
+        property_segments.extend(split_path_segments(property_name));
+
+        if has_nested_object_properties(property_schema) {
+            collect_claim_descriptions(property_schema, prefix_segments, &property_segments, attributes, claims);
+            continue;
+        }
+
+        if is_object_schema(property_schema) {
+            continue;
+        }
+
+        if let Some(claim) = build_claim_description(&property_segments, prefix_segments, attributes) {
+            claims.push(claim);
+        }
+    }
+}
+
+fn build_claim_description(
+    property_segments: &[String],
+    prefix_segments: &[String],
+    attributes: Option<&HashMap<String, PropertyAttribute>>,
+) -> Option<ClaimDescription> {
+    let path = ClaimPathPointer::try_new(
+        prefix_segments
+            .iter()
+            .chain(property_segments.iter())
+            .cloned()
+            .map(ClaimPathElement::String)
+            .collect(),
+    )
+    .ok()?;
+
+    let attribute_key = property_segments.join(".");
+    let mandatory = attributes
+        .and_then(|attrs| attrs.get(&attribute_key))
+        .map(|attr| !attr.is_selectively_disclosable())
+        .unwrap_or(false);
+
+    Some(ClaimDescription {
+        path,
+        mandatory,
+        display: vec![],
+    })
+}
+
+fn split_path_segments(path: &str) -> Vec<String> {
+    path.split('.')
+        .filter(|segment| !segment.is_empty())
+        .map(|segment| segment.to_string())
+        .collect()
+}
+
+fn has_nested_object_properties(schema: &serde_json::Value) -> bool {
+    schema
+        .get("properties")
+        .and_then(|value| value.as_object())
+        .is_some_and(|properties| !properties.is_empty())
+}
+
+fn is_object_schema(schema: &serde_json::Value) -> bool {
+    schema.get("type").and_then(|value| value.as_str()) == Some("object")
+}
+
+#[async_trait]
+impl Query<Template> for CredentialConfigurationProjection {
+    async fn dispatch(&self, _aggregate_id: &str, events: &[EventEnvelope<Template>]) {
+        use agent_library::template::aggregate::Status;
+        use agent_library::template::event::TemplateEvent::*;
+
+        for event in events {
+            match &event.payload {
+                // On creation we have the full template state in the event itself.
+                TemplateCreated {
+                    template_id,
+                    title,
+                    display,
+                    data_model,
+                    r#type,
+                    status,
+                    schema,
+                    schema_properties_attributes,
+                    holder_authorization,
+                    ..
+                } => {
+                    // Only published templates have a credential configuration.
+                    if *status != Status::Published {
+                        continue;
+                    }
+
+                    let template = Template {
+                        template_id: template_id.clone(),
+                        title: title.clone(),
+                        display: *display.clone(),
+                        data_model: data_model.clone(),
+                        r#type: r#type.clone(),
+                        status: status.clone(),
+                        schema: schema.clone(),
+                        schema_properties_attributes: schema_properties_attributes.clone(),
+                        holder_authorization: holder_authorization.clone(),
+                        ..Default::default()
+                    };
+
+                    let credential_configuration = credential_configuration_from_template(&template);
+                    let command = ServerConfigCommand::UpdateCredentialConfiguration {
+                        credential_configuration,
+                        provisioned: false,
+                    };
+                    if let Err(e) =
+                        command_handler(SERVER_CONFIG_ID, &self.issuance_state.command.server_config, command).await
+                    {
+                        warn!("Failed to update credential configuration for template `{template_id}`: {e}");
+                    }
+                }
+
+                // When the status changes to Deleted, remove the credential configuration;
+                // for any other transition (e.g. Draft → Published) re-query and sync.
+                StatusUpdated {
+                    template_id, status, ..
+                } => {
+                    if *status == Status::Deleted {
+                        self.remove_credential_configuration(template_id).await;
+                        continue;
+                    }
+                    self.sync_from_view(template_id).await;
+                }
+
+                // For partial updates re-query the current template state to rebuild the full
+                // credential configuration.
+                TitleUpdated { template_id, .. }
+                | DisplayUpdated { template_id, .. }
+                | TypeUpdated { template_id, .. }
+                | SchemaUpdated { template_id, .. }
+                | SchemaPropertiesAttributesUpdated { template_id, .. }
+                | HolderAuthorizationUpdated { template_id, .. } => {
+                    self.sync_from_view(template_id).await;
+                }
+
+                // When a template is deleted, remove the corresponding credential configuration.
+                TemplateDeleted { template_id } => {
+                    self.remove_credential_configuration(template_id).await;
+                }
+
+                _ => {}
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use agent_library::template::aggregate::{DataModel, Display};
+
+    #[test]
+    fn test_v1_data_model_produces_jwt_vc_json_format() {
+        let template = Template {
+            template_id: "t1".to_string(),
+            data_model: DataModel::W3CVcDataModelV1_1,
+            r#type: vec!["VerifiableCredential".to_string()],
+            ..Default::default()
+        };
+        let config = credential_configuration_from_template(&template);
+        assert_eq!(config.format, "jwt_vc_json");
+    }
+
+    #[test]
+    fn test_v2_data_model_produces_vc_sd_jwt_format() {
+        let template = Template {
+            template_id: "t2".to_string(),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            r#type: vec!["VerifiableCredential".to_string()],
+            ..Default::default()
+        };
+        let config = credential_configuration_from_template(&template);
+        assert_eq!(config.format, "vc+sd-jwt");
+    }
+
+    #[test]
+    fn test_display_name_takes_precedence_over_title() {
+        let template = Template {
+            template_id: "t4".to_string(),
+            display: Some(Display {
+                name: "Display Name".to_string(),
+                logo: None,
+            }),
+            title: "Fallback Title".to_string(),
+            ..Default::default()
+        };
+        let config = credential_configuration_from_template(&template);
+        let name = config
+            .credential_metadata
+            .display
+            .as_ref()
+            .unwrap()
+            .first()
+            .unwrap()
+            .name
+            .clone();
+        assert_eq!(name, "Display Name");
+    }
+
+    #[test]
+    fn test_title_used_as_fallback_display_name() {
+        let template = Template {
+            template_id: "t5".to_string(),
+            display: None,
+            title: "My Title".to_string(),
+            ..Default::default()
+        };
+        let config = credential_configuration_from_template(&template);
+        let name = config
+            .credential_metadata
+            .display
+            .as_ref()
+            .unwrap()
+            .first()
+            .unwrap()
+            .name
+            .clone();
+        assert_eq!(name, "My Title");
+    }
+
+    #[test]
+    fn test_vc_sd_jwt_includes_claims_from_schema_properties() {
+        use agent_library::template::aggregate::PropertyAttribute;
+        use std::collections::HashMap;
+
+        let schema = serde_json::json!({
+            "type": "object",
+            "properties": {
+                "name": { "type": "string" },
+                "age": { "type": "integer" }
+            }
+        });
+
+        let mut attrs = HashMap::new();
+        attrs.insert("name".to_string(), PropertyAttribute::new(true, false));
+        attrs.insert("age".to_string(), PropertyAttribute::new(false, false));
+
+        let template = Template {
+            template_id: "t7".to_string(),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            schema: Box::new(Some(schema)),
+            schema_properties_attributes: Some(attrs),
+            ..Default::default()
+        };
+
+        let config = credential_configuration_from_template(&template);
+        assert_eq!(config.format, "vc+sd-jwt");
+
+        let claims = config.credential_metadata.claims.expect("claims should be present");
+        assert_eq!(claims.len(), 2);
+
+        // Find claim for "name" - selectively disclosable, so mandatory = false
+        let name_claim = claims
+            .iter()
+            .find(|c| {
+                c.path.as_ref()
+                    == &[
+                        ClaimPathElement::String("credentialSubject".to_string()),
+                        ClaimPathElement::String("name".to_string()),
+                    ]
+            })
+            .expect("name claim should exist");
+        assert!(!name_claim.mandatory);
+
+        // Find claim for "age" - not selectively disclosable, so mandatory = true
+        let age_claim = claims
+            .iter()
+            .find(|c| {
+                c.path.as_ref()
+                    == &[
+                        ClaimPathElement::String("credentialSubject".to_string()),
+                        ClaimPathElement::String("age".to_string()),
+                    ]
+            })
+            .expect("age claim should exist");
+        assert!(age_claim.mandatory);
+    }
+
+    #[test]
+    fn test_vc_sd_jwt_claim_without_attributes_defaults_to_non_mandatory() {
+        let schema = serde_json::json!({
+            "type": "object",
+            "properties": {
+                "name": { "type": "string" }
+            }
+        });
+
+        let template = Template {
+            template_id: "t_default_mandatory".to_string(),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            schema: Box::new(Some(schema)),
+            schema_properties_attributes: None,
+            ..Default::default()
+        };
+
+        let config = credential_configuration_from_template(&template);
+        let claim = config
+            .credential_metadata
+            .claims
+            .expect("claims should be present")
+            .into_iter()
+            .next()
+            .expect("claim should exist");
+
+        assert!(!claim.mandatory);
+    }
+
+    #[test]
+    fn test_vc_sd_jwt_dotted_keys_become_path_elements() {
+        let schema = serde_json::json!({
+            "type": "object",
+            "properties": {
+                "achievement.name": { "type": "string" }
+            }
+        });
+
+        let template = Template {
+            template_id: "t8".to_string(),
+            data_model: DataModel::OpenBadges3_0,
+            schema: Box::new(Some(schema)),
+            schema_properties_attributes: None,
+            ..Default::default()
+        };
+
+        let config = credential_configuration_from_template(&template);
+        let claims = config.credential_metadata.claims.expect("claims should be present");
+        assert_eq!(claims.len(), 1);
+        assert_eq!(
+            claims[0].path.as_ref(),
+            &[
+                ClaimPathElement::String("credentialSubject".to_string()),
+                ClaimPathElement::String("achievement".to_string()),
+                ClaimPathElement::String("name".to_string()),
+            ]
+        );
+    }
+
+    #[test]
+    fn test_nested_object_claims_only_emit_leaf_fields() {
+        let schema = serde_json::json!({
+            "type": "object",
+            "properties": {
+                "achievement": {
+                    "type": "object",
+                    "properties": {
+                        "name": { "type": "string" },
+                        "criteria": {
+                            "type": "object",
+                            "properties": {
+                                "narrative": { "type": "string" }
+                            }
+                        }
+                    }
+                }
+            }
+        });
+
+        let template = Template {
+            template_id: "t_nested".to_string(),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            schema: Box::new(Some(schema)),
+            ..Default::default()
+        };
+
+        let claims = credential_configuration_from_template(&template)
+            .credential_metadata
+            .claims
+            .expect("claims should be present");
+
+        assert_eq!(claims.len(), 2);
+        assert!(claims.iter().any(|claim| {
+            claim.path.as_ref()
+                == &[
+                    ClaimPathElement::String("credentialSubject".to_string()),
+                    ClaimPathElement::String("achievement".to_string()),
+                    ClaimPathElement::String("name".to_string()),
+                ]
+        }));
+        assert!(claims.iter().any(|claim| {
+            claim.path.as_ref()
+                == &[
+                    ClaimPathElement::String("credentialSubject".to_string()),
+                    ClaimPathElement::String("achievement".to_string()),
+                    ClaimPathElement::String("criteria".to_string()),
+                    ClaimPathElement::String("narrative".to_string()),
+                ]
+        }));
+    }
+
+    #[test]
+    fn test_array_claims_emit_only_the_array_field() {
+        let schema = serde_json::json!({
+            "type": "object",
+            "properties": {
+                "achievements": {
+                    "type": "array",
+                    "items": {
+                        "type": "object",
+                        "properties": {
+                            "name": { "type": "string" }
+                        }
+                    }
+                }
+            }
+        });
+
+        let template = Template {
+            template_id: "t_array".to_string(),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            schema: Box::new(Some(schema)),
+            ..Default::default()
+        };
+
+        let claims = credential_configuration_from_template(&template)
+            .credential_metadata
+            .claims
+            .expect("claims should be present");
+
+        assert_eq!(claims.len(), 1);
+        assert_eq!(
+            claims[0].path.as_ref(),
+            &[
+                ClaimPathElement::String("credentialSubject".to_string()),
+                ClaimPathElement::String("achievements".to_string()),
+            ]
+        );
+    }
+
+    #[test]
+    fn test_nested_attributes_use_dotted_keys_for_mandatory_resolution() {
+        use agent_library::template::aggregate::PropertyAttribute;
+        use std::collections::HashMap;
+
+        let schema = serde_json::json!({
+            "type": "object",
+            "properties": {
+                "achievement": {
+                    "type": "object",
+                    "properties": {
+                        "criteria": {
+                            "type": "object",
+                            "properties": {
+                                "narrative": { "type": "string" }
+                            }
+                        }
+                    }
+                }
+            }
+        });
+
+        let mut attrs = HashMap::new();
+        attrs.insert(
+            "achievement.criteria.narrative".to_string(),
+            PropertyAttribute::new(false, false),
+        );
+
+        let template = Template {
+            template_id: "t_nested_attrs".to_string(),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            schema: Box::new(Some(schema)),
+            schema_properties_attributes: Some(attrs),
+            ..Default::default()
+        };
+
+        let claim = credential_configuration_from_template(&template)
+            .credential_metadata
+            .claims
+            .expect("claims should be present")
+            .into_iter()
+            .next()
+            .expect("claim should exist");
+
+        assert!(claim.mandatory);
+    }
+
+    #[test]
+    fn test_jwt_vc_json_format_does_not_include_claims() {
+        let schema = serde_json::json!({
+            "type": "object",
+            "properties": {
+                "name": { "type": "string" }
+            }
+        });
+
+        let template = Template {
+            template_id: "t9".to_string(),
+            data_model: DataModel::W3CVcDataModelV1_1,
+            schema: Box::new(Some(schema)),
+            ..Default::default()
+        };
+
+        let config = credential_configuration_from_template(&template);
+        assert_eq!(config.format, "jwt_vc_json");
+        assert!(config.credential_metadata.claims.is_none());
+    }
+
+    #[test]
+    fn test_vc_sd_jwt_no_schema_yields_no_claims() {
+        let template = Template {
+            template_id: "t10".to_string(),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            schema: Box::new(None),
+            ..Default::default()
+        };
+
+        let config = credential_configuration_from_template(&template);
+        assert!(config.credential_metadata.claims.is_none());
+    }
+
+    #[test]
+    fn test_w3c_v1_data_model_type_includes_verifiable_credential() {
+        let template = Template {
+            template_id: "t11".to_string(),
+            data_model: DataModel::W3CVcDataModelV1_1,
+            ..Default::default()
+        };
+        let config = credential_configuration_from_template(&template);
+        assert_eq!(config.type_, vec!["VerifiableCredential".to_string()]);
+    }
+
+    #[test]
+    fn test_w3c_v2_data_model_type_includes_verifiable_credential() {
+        let template = Template {
+            template_id: "t12".to_string(),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            ..Default::default()
+        };
+        let config = credential_configuration_from_template(&template);
+        assert_eq!(config.type_, vec!["VerifiableCredential".to_string()]);
+    }
+
+    #[test]
+    fn test_non_empty_template_type_is_used_for_projection() {
+        let template = Template {
+            template_id: "t12_custom".to_string(),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            r#type: vec![
+                "VerifiableCredential".to_string(),
+                "UniversityDegreeCredential".to_string(),
+            ],
+            ..Default::default()
+        };
+
+        let config = credential_configuration_from_template(&template);
+        assert_eq!(
+            config.type_,
+            vec![
+                "VerifiableCredential".to_string(),
+                "UniversityDegreeCredential".to_string(),
+            ]
+        );
+    }
+
+    #[test]
+    fn test_vc_sd_jwt_claims_are_prefixed_with_credential_subject() {
+        let schema = serde_json::json!({
+            "type": "object",
+            "properties": {
+                "name": { "type": "string" }
+            }
+        });
+
+        let template = Template {
+            template_id: "t_prefix".to_string(),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            schema: Box::new(Some(schema)),
+            ..Default::default()
+        };
+
+        let config = credential_configuration_from_template(&template);
+        let claims = config.credential_metadata.claims.expect("claims should be present");
+        assert_eq!(claims.len(), 1);
+        assert_eq!(
+            claims[0].path.as_ref(),
+            &[
+                ClaimPathElement::String("credentialSubject".to_string()),
+                ClaimPathElement::String("name".to_string()),
+            ]
+        );
+    }
+
+    #[test]
+    fn test_open_badges_empty_type_defaults_to_ob_fallback() {
+        let template = Template {
+            template_id: "t13".to_string(),
+            data_model: DataModel::OpenBadges3_0,
+            ..Default::default()
+        };
+        let config = credential_configuration_from_template(&template);
+        assert_eq!(
+            config.type_,
+            vec!["VerifiableCredential".to_string(), "OpenBadgeCredential".to_string(),]
+        );
+    }
+
+    #[test]
+    fn test_open_badges_non_empty_template_type_is_used_for_projection() {
+        let template = Template {
+            template_id: "t13_custom".to_string(),
+            data_model: DataModel::OpenBadges3_0,
+            r#type: vec!["VerifiableCredential".to_string(), "AchievementCredential".to_string()],
+            ..Default::default()
+        };
+
+        let config = credential_configuration_from_template(&template);
+        assert_eq!(
+            config.type_,
+            vec!["VerifiableCredential".to_string(), "AchievementCredential".to_string(),]
+        );
+    }
+}
diff --git a/agent_issuance/src/application/mod.rs b/agent_issuance/src/application/mod.rs
index 170a3c1e..a9400fa7 100644
--- a/agent_issuance/src/application/mod.rs
+++ b/agent_issuance/src/application/mod.rs
@@ -1,3 +1,3 @@
 pub mod access_token_validation_service;
+pub mod credential_configuration_projection;
 pub mod nonce_validation_service;
-pub mod policies;
diff --git a/agent_issuance/src/application/policies/issuer_metadata_synchronization_policy.rs b/agent_issuance/src/application/policies/issuer_metadata_synchronization_policy.rs
deleted file mode 100644
index cadc0b5d..00000000
--- a/agent_issuance/src/application/policies/issuer_metadata_synchronization_policy.rs
+++ /dev/null
@@ -1,38 +0,0 @@
-use crate::state::IssuanceState;
-use agent_library::template::aggregate::Template;
-use async_trait::async_trait;
-use cqrs_es::{EventEnvelope, Query};
-use std::sync::Arc;
-
-pub struct IssuerMetadataSynchronizationPolicy {
-    // TODO: Actually use this.
-    _issuance_state: Arc<IssuanceState>,
-}
-
-impl IssuerMetadataSynchronizationPolicy {
-    pub fn new(issuance_state: Arc<IssuanceState>) -> Self {
-        Self {
-            _issuance_state: issuance_state,
-        }
-    }
-}
-
-#[async_trait]
-impl Query<Template> for IssuerMetadataSynchronizationPolicy {
-    async fn dispatch(&self, _aggregate_id: &str, events: &[EventEnvelope<Template>]) {
-        use agent_library::template::event::TemplateEvent::*;
-
-        for event in events {
-            // TODO: Remove this when we implement the actual issuer metadata synchronization policy.
-            #[allow(clippy::single_match)]
-            match &event.payload {
-                TemplateCreated {
-                    title: Some(_title), ..
-                } => {
-                    // TODO: Update issuer metadata.
-                }
-                _ => {}
-            }
-        }
-    }
-}
diff --git a/agent_issuance/src/application/policies/mod.rs b/agent_issuance/src/application/policies/mod.rs
deleted file mode 100644
index 9db298b2..00000000
--- a/agent_issuance/src/application/policies/mod.rs
+++ /dev/null
@@ -1 +0,0 @@
-pub mod issuer_metadata_synchronization_policy;
diff --git a/agent_issuance/src/credential/error.rs b/agent_issuance/src/credential/error.rs
index 1397bea8..a7673b4c 100644
--- a/agent_issuance/src/credential/error.rs
+++ b/agent_issuance/src/credential/error.rs
@@ -6,9 +6,6 @@ pub enum CredentialError {
     // TODO: Remove this error when fixing: https://github.com/impierce/ssi-agent/issues/136
     #[error("Credential format not supported: `{0}`")]
     UnsupportedCredentialFormat(serde_json::Value),
-    // TODO: Remove this error when fixing: https://github.com/impierce/ssi-agent/issues/136
-    #[error("This Credential type is not supported")]
-    UnsupportedCredentialType,
     #[error("The credential data payload is invalid: {0}")]
     InvalidCredentialPayloadError(JsonSchemaError),
     #[error("The `id` value could not be parsed to a valid URI")]
diff --git a/agent_issuance/src/offer/aggregate.rs b/agent_issuance/src/offer/aggregate.rs
index 0b32bc00..0da16354 100644
--- a/agent_issuance/src/offer/aggregate.rs
+++ b/agent_issuance/src/offer/aggregate.rs
@@ -99,7 +99,7 @@ impl Aggregate for Offer {
             CreateCredentialOffer {
                 offer_id,
                 grant_types,
-                credential_configuration_ids,
+                template_ids,
                 tx_code_constraints,
                 delivery_options,
             } => {
@@ -131,7 +131,7 @@ impl Aggregate for Offer {
 
                 let credential_offer = CredentialOffer::CredentialOffer(Box::new(CredentialOfferParameters {
                     credential_issuer: credential_issuer.clone(),
-                    credential_configuration_ids: CredentialConfigurationIds::try_new(credential_configuration_ids)
+                    credential_configuration_ids: CredentialConfigurationIds::try_new(template_ids)
                         .map_err(|_| OfferError::MissingCredentialConfigurationIdsError)?,
                     grants: Some(grants),
                 }));
@@ -182,7 +182,7 @@ impl Aggregate for Offer {
             AddCredentials {
                 offer_id,
                 credential_ids,
-                credential_configuration_ids,
+                template_ids,
             } => {
                 let mut credential_offer = self
                     .credential_offer
@@ -190,12 +190,12 @@ impl Aggregate for Offer {
                     .ok_or_else(|| MissingCredentialOfferError)?;
 
                 if let CredentialOffer::CredentialOffer(credential_offer) = &mut credential_offer {
-                    // Deduplicate credential_configuration_ids to ensure uniqueness
+                    // Deduplicate template_ids to ensure uniqueness
                     let credential_configuration_id_set: HashSet<String> = credential_offer
                         .credential_configuration_ids
                         .iter()
                         .cloned()
-                        .chain(credential_configuration_ids)
+                        .chain(template_ids)
                         .collect();
 
                     credential_offer.credential_configuration_ids =
@@ -470,7 +470,7 @@ pub mod tests {
             .given_no_previous_events()
             .when(OfferCommand::CreateCredentialOffer {
                 offer_id: offer_id.clone(),
-                credential_configuration_ids: vec!["UniversityDegree".to_string()],
+                template_ids: vec!["UniversityDegree".to_string()],
                 grant_types: grant_types.clone(),
                 tx_code_constraints: None,
                 delivery_options: None,
@@ -510,7 +510,7 @@ pub mod tests {
             .given_no_previous_events()
             .when(OfferCommand::CreateCredentialOffer {
                 offer_id: offer_id.clone(),
-                credential_configuration_ids: vec!["UniversityDegree".to_string()],
+                template_ids: vec!["UniversityDegree".to_string()],
                 grant_types: grant_types.clone(),
                 tx_code_constraints: None,
                 delivery_options: Some(delivery_options.clone()),
@@ -559,7 +559,7 @@ pub mod tests {
             .when(OfferCommand::AddCredentials {
                 offer_id: offer_id.clone(),
                 credential_ids: vec!["credential-id".to_string()],
-                credential_configuration_ids: vec!["UniversityDegree".to_string()],
+                template_ids: vec!["UniversityDegree".to_string()],
             })
             .then_expect_events(vec![
                 OfferEvent::CredentialsAdded {
diff --git a/agent_issuance/src/offer/command.rs b/agent_issuance/src/offer/command.rs
index 5a9a752e..94e13b11 100644
--- a/agent_issuance/src/offer/command.rs
+++ b/agent_issuance/src/offer/command.rs
@@ -13,7 +13,7 @@ use serde::Deserialize;
 pub enum OfferCommand {
     CreateCredentialOffer {
         offer_id: String,
-        credential_configuration_ids: Vec<String>,
+        template_ids: Vec<String>,
         grant_types: Vec<GrantType>,
         tx_code_constraints: Option<TxCodeConstraints>,
         delivery_options: Option<DeliveryOptions>,
@@ -21,7 +21,7 @@ pub enum OfferCommand {
     AddCredentials {
         offer_id: String,
         credential_ids: Vec<String>,
-        credential_configuration_ids: Vec<String>,
+        template_ids: Vec<String>,
     },
     SendCredentialOffer {
         offer_id: String,
diff --git a/agent_issuance/src/state.rs b/agent_issuance/src/state.rs
index 16461cf3..e772d8f2 100644
--- a/agent_issuance/src/state.rs
+++ b/agent_issuance/src/state.rs
@@ -1,10 +1,7 @@
 use agent_secret_manager::subject::Subject;
 use agent_shared::application_state::CommandHandler;
-use agent_shared::config::{
-    config, get_all_enabled_did_methods, get_all_enabled_signing_algorithms_supported, CredentialConfiguration,
-};
+use agent_shared::config::{config, get_all_enabled_did_methods, get_all_enabled_signing_algorithms_supported};
 use agent_shared::handlers::{command_handler, query_handler};
-use agent_shared::profile::ApplicationProfile;
 use agent_shared::UrlAppendHelpers;
 use cqrs_es::persist::ViewRepository;
 use oid4vci::credential_issuer::authorization_server_metadata::AuthorizationServerMetadata;
@@ -124,7 +121,6 @@ pub async fn initialize(state: &IssuanceState) -> anyhow::Result<()> {
     load_server_metadata(state).await?;
     update_cryptographic_binding_methods(state).await?;
     update_signing_algorithms(state).await?;
-    update_credential_configurations(state).await?;
 
     Ok(())
 }
@@ -256,184 +252,3 @@ pub async fn update_signing_algorithms(state: &IssuanceState) -> anyhow::Result<
 
     Ok(())
 }
-
-pub async fn update_credential_configurations(state: &IssuanceState) -> anyhow::Result<()> {
-    let provisioned_credential_configurations: Vec<CredentialConfiguration> = config()
-        .credential_configuration_file
-        .as_ref()
-        .map(|file| {
-            debug!("Path to credential configuration file: {}", file.as_path().display());
-
-            let file = std::fs::read(file.as_path()).expect("Failed to read credential configuration file");
-            serde_json::from_slice(&file).expect("Failed to parse credential configurations from file")
-        })
-        .unwrap_or_else(|| match ApplicationProfile::load() {
-            ApplicationProfile::Development => {
-                info!("Using default development credential configurations.");
-                serde_json::from_value::<Vec<CredentialConfiguration>>(serde_json::json!([
-                  {
-                    "credential_configuration_id": "001",
-                    "format": "jwt_vc_json",
-                    "type": ["VerifiableCredential"],
-                    "credential_metadata": {
-                        "display": [
-                            {
-                                "name": "Verifiable Credential",
-                                "locale": "en",
-                                "logo": {
-                                "uri": "https://www.impierce.com/external/impierce-logo.png",
-                                    "alt_text": "Impierce Logo"
-                                }
-                            }
-                        ],
-                        "claims": [
-                            {
-                                "path": ["credentialSubject", "first_name"],
-                                "display": [{
-                                    "name": "First Name",
-                                    "locale": "en"
-                                }],
-                            },
-                            {
-                                "path": ["credentialSubject", "last_name"],
-                                "display": [{
-                                    "name": "Last Name",
-                                    "locale": "en"
-                                }],
-                            },
-                            {
-                                "path": ["credentialSubject", "dob"],
-                                "display": [{
-                                    "name": "Date of Birth",
-                                    "locale": "en"
-                                }],
-                            }
-                        ]
-                    }
-                  },
-                  {
-                    "credential_configuration_id": "SD-JWT VC",
-                    "format": "dc+sd-jwt",
-                    "display": [
-                        {
-                            "name": "SD-JWT VC Credential",
-                            "locale": "en",
-                            "logo": {
-                            "uri": "https://www.impierce.com/external/impierce-logo.png",
-                                "alt_text": "Impierce Logo"
-                            }
-                        }
-                    ],
-                    "claims": [
-                        {
-                            "path": ["first_name"],
-                            "display": [{
-                                "name": "First Name",
-                                "locale": "en"
-                            }],
-                        },
-                        {
-                            "path": ["last_name"],
-                            "display": [{
-                                "name": "Last Name",
-                                "locale": "en"
-                            }],
-                        },
-                        {
-                            "path": ["dob"],
-                            "display": [{
-                                "name": "Date of Birth",
-                                "locale": "en"
-                            }],
-                        }
-                    ]
-                  },
-                  {
-                    "credential_configuration_id": "VCDM 2.0 SD-JWT",
-                    "format": "vc+sd-jwt",
-                    "type": ["VerifiableCredential"],
-                    "display": [
-                        {
-                            "name": "VCDM 2.0 SD-JWT Credential",
-                            "locale": "en",
-                            "logo": {
-                            "uri": "https://www.impierce.com/external/impierce-logo.png",
-                                "alt_text": "Impierce Logo"
-                            }
-                        }
-                    ],
-                    "claims": [
-                        {
-                            "path": ["credentialSubject", "first_name"],
-                            "display": [{
-                                "name": "First Name",
-                                "locale": "en"
-                            }],
-                        },
-                        {
-                            "path": ["credentialSubject", "last_name"],
-                            "display": [{
-                                "name": "Last Name",
-                                "locale": "en"
-                            }],
-                        },
-                        {
-                            "path": ["credentialSubject", "dob"],
-                            "display": [{
-                                "name": "Date of Birth",
-                                "locale": "en"
-                            }],
-                        }
-                    ]
-                  }
-                ]))
-                .expect("Failed to parse default development credential configurations")
-            }
-            ApplicationProfile::Production => {
-                info!("No credential configurations found");
-                vec![]
-            }
-        });
-
-    let previous_provisioned_credential_configuration_ids = query_handler(SERVER_CONFIG_ID, &state.query.server_config)
-        .await?
-        .map(|server_config_view| {
-            server_config_view
-                .credential_configurations
-                .into_iter()
-                .filter_map(
-                    |(credential_configuration_id, (provisioned, _credential_configuration, _authorization))| {
-                        (provisioned
-                            && !provisioned_credential_configurations.iter().any(
-                                |provisioned_credential_configuration| {
-                                    *provisioned_credential_configuration.credential_configuration_id
-                                        == credential_configuration_id
-                                },
-                            ))
-                        .then_some(credential_configuration_id)
-                    },
-                )
-                .collect::<Vec<_>>()
-        })
-        .unwrap_or_default();
-
-    for credential_configuration_id in previous_provisioned_credential_configuration_ids {
-        let command = ServerConfigCommand::RemoveCredentialConfiguration {
-            credential_configuration_id,
-            provisioned: true,
-        };
-
-        command_handler(SERVER_CONFIG_ID, &state.command.server_config, command).await?;
-    }
-
-    for provisioned_credential_configuration in provisioned_credential_configurations {
-        let command = ServerConfigCommand::UpdateCredentialConfiguration {
-            credential_configuration: provisioned_credential_configuration,
-            provisioned: true,
-        };
-
-        command_handler(SERVER_CONFIG_ID, &state.command.server_config, command).await?;
-    }
-
-    Ok(())
-}
diff --git a/agent_issuance/tests/credential_configuration_projection.rs b/agent_issuance/tests/credential_configuration_projection.rs
new file mode 100644
index 00000000..cdbfa523
--- /dev/null
+++ b/agent_issuance/tests/credential_configuration_projection.rs
@@ -0,0 +1,875 @@
+use agent_issuance::application::credential_configuration_projection::CredentialConfigurationProjection;
+use agent_issuance::services::IssuanceServices;
+use agent_issuance::state::{IssuanceState, SERVER_CONFIG_ID};
+use agent_library::state::LibraryState;
+use agent_library::template::aggregate::{DataModel, Display, PropertyAttribute, Status, Visibility};
+use agent_library::template::command::TemplateCommand;
+use agent_library::template::event::{Expiration, HolderType, TemplateEvent};
+use agent_secret_manager::service::Service;
+use agent_shared::config::Authorization;
+use agent_shared::handlers::{command_handler, query_handler};
+use agent_store::in_memory::InMemory;
+use agent_store::{issuance_state, library_state};
+use cqrs_es::{EventEnvelope, Query};
+use std::collections::HashMap;
+use std::sync::Arc;
+
+fn create_test_event_template_created(
+    template_id: &str,
+    types: Vec<String>,
+    data_model: DataModel,
+    title: String,
+    display: Option<Display>,
+    status: Status,
+) -> EventEnvelope<agent_library::template::aggregate::Template> {
+    EventEnvelope {
+        aggregate_id: template_id.to_string(),
+        sequence: 1,
+        payload: TemplateEvent::TemplateCreated {
+            template_id: template_id.to_string(),
+            source_template_id: None,
+            title,
+            display: Box::new(display),
+            data_model,
+            holder_type: HolderType::Individual,
+            modified_at: "2024-01-01T00:00:00Z".to_string(),
+            tags: None,
+            status,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::Never,
+            description: None,
+            r#type: types,
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        },
+        metadata: HashMap::new(),
+    }
+}
+
+async fn setup() -> (Arc<IssuanceState>, Arc<LibraryState>, CredentialConfigurationProjection) {
+    let issuance = Arc::new(issuance_state(&InMemory, IssuanceServices::default().await, Default::default()).await);
+    let (projection, template_view_handle) = CredentialConfigurationProjection::new(issuance.clone());
+    // Build the library state WITHOUT the projection (the projection dispatches commands to issuance_state,
+    // not to this library state). Then wire the real view repo into the projection's OnceLock handle so
+    // that partial-update re-queries use the same MemRepository that the CQRS framework updates.
+    let lib_state = Arc::new(library_state(&InMemory, Default::default(), vec![]).await);
+    assert!(
+        template_view_handle.set(lib_state.query.template.clone()).is_ok(),
+        "template view already initialized"
+    );
+    (issuance, lib_state, projection)
+}
+
+#[tokio::test]
+async fn test_template_created_registers_credential_configuration() {
+    let (issuance, _library, projection) = setup().await;
+
+    let template_id = "my-template";
+    let event = create_test_event_template_created(
+        template_id,
+        vec!["VerifiableCredential".to_string()],
+        DataModel::W3CVcDataModelV2_0,
+        "My Credential".to_string(),
+        None,
+        Status::Published,
+    );
+
+    projection.dispatch(template_id, &[event]).await;
+
+    let server_config = query_handler(SERVER_CONFIG_ID, &issuance.query.server_config)
+        .await
+        .unwrap()
+        .unwrap();
+    assert!(server_config.credential_configurations.contains_key(template_id));
+}
+
+#[tokio::test]
+async fn test_template_created_with_v2_data_model_uses_vc_sd_jwt_format() {
+    let (issuance, _library, projection) = setup().await;
+
+    let template_id = "v2-template";
+    let event = create_test_event_template_created(
+        template_id,
+        vec!["VerifiableCredential".to_string()],
+        DataModel::W3CVcDataModelV2_0,
+        "My Credential".to_string(),
+        None,
+        Status::Published,
+    );
+
+    projection.dispatch(template_id, &[event]).await;
+
+    let server_config = query_handler(SERVER_CONFIG_ID, &issuance.query.server_config)
+        .await
+        .unwrap()
+        .unwrap();
+    let (_, config_obj, _) = server_config.credential_configurations.get(template_id).unwrap();
+    assert!(matches!(
+        &config_obj.credential_format,
+        oid4vci::credential_format_profiles::CredentialFormats::VcSdJwt(_)
+    ));
+}
+
+#[tokio::test]
+async fn test_template_created_with_draft_status_skips_registration() {
+    let (issuance, _library, projection) = setup().await;
+
+    let template_id = "draft-template";
+    let event = create_test_event_template_created(
+        template_id,
+        vec!["VerifiableCredential".to_string()],
+        DataModel::W3CVcDataModelV2_0,
+        "Draft Credential".to_string(),
+        None,
+        Status::Draft,
+    );
+
+    projection.dispatch(template_id, &[event]).await;
+
+    let contains_key = query_handler(SERVER_CONFIG_ID, &issuance.query.server_config)
+        .await
+        .unwrap()
+        .map(|sc| sc.credential_configurations.contains_key(template_id))
+        .unwrap_or(false);
+    assert!(!contains_key);
+}
+
+#[tokio::test]
+async fn test_template_created_with_deleted_status_skips_registration() {
+    let (issuance, _library, projection) = setup().await;
+
+    let template_id = "deleted-template";
+    let event = create_test_event_template_created(
+        template_id,
+        vec!["VerifiableCredential".to_string()],
+        DataModel::W3CVcDataModelV2_0,
+        "My Credential".to_string(),
+        None,
+        Status::Deleted,
+    );
+
+    projection.dispatch(template_id, &[event]).await;
+
+    // A ServerConfig may not exist yet; if it does, it must not contain the deleted template.
+    let contains_key = query_handler(SERVER_CONFIG_ID, &issuance.query.server_config)
+        .await
+        .unwrap()
+        .map(|sc| sc.credential_configurations.contains_key(template_id))
+        .unwrap_or(false);
+    assert!(!contains_key);
+}
+
+#[tokio::test]
+async fn test_template_created_with_archived_status_skips_registration() {
+    let (issuance, _library, projection) = setup().await;
+
+    let template_id = "archived-template";
+    let event = create_test_event_template_created(
+        template_id,
+        vec!["VerifiableCredential".to_string()],
+        DataModel::W3CVcDataModelV2_0,
+        "Archived Credential".to_string(),
+        None,
+        Status::Archived,
+    );
+
+    projection.dispatch(template_id, &[event]).await;
+
+    let contains_key = query_handler(SERVER_CONFIG_ID, &issuance.query.server_config)
+        .await
+        .unwrap()
+        .map(|sc| sc.credential_configurations.contains_key(template_id))
+        .unwrap_or(false);
+    assert!(!contains_key);
+}
+
+#[tokio::test]
+async fn test_display_updated_reflects_in_credential_configuration() {
+    let (issuance, lib_state, projection) = setup().await;
+
+    let template_id = "display-update-template";
+
+    // Create the template in the shared library state with an initial display.
+    command_handler(
+        template_id,
+        &lib_state.command.template,
+        TemplateCommand::CreateNewTemplate {
+            template_id: template_id.to_string(),
+            source_template_id: None,
+            title: "Display Update Test".to_string(),
+            display: Box::new(Some(Display {
+                name: "Original Display".to_string(),
+                logo: None,
+            })),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Published,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec!["VerifiableCredential".to_string()],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        },
+    )
+    .await
+    .unwrap();
+
+    // Register the initial credential configuration via TemplateCreated.
+    let create_event = create_test_event_template_created(
+        template_id,
+        vec!["VerifiableCredential".to_string()],
+        DataModel::W3CVcDataModelV2_0,
+        "My Credential".to_string(),
+        Some(Display {
+            name: "Original Display".to_string(),
+            logo: None,
+        }),
+        Status::Published,
+    );
+    projection.dispatch(template_id, &[create_event]).await;
+
+    // Update the display in the shared library state (the projection will re-query this exact view).
+    command_handler(
+        template_id,
+        &lib_state.command.template,
+        TemplateCommand::UpdateDisplay {
+            template_id: template_id.to_string(),
+            display: Display {
+                name: "Updated Display".to_string(),
+                logo: None,
+            },
+        },
+    )
+    .await
+    .unwrap();
+
+    // Dispatch DisplayUpdated — the projection re-queries the shared view and picks up the new display.
+    let update_event: EventEnvelope<agent_library::template::aggregate::Template> = EventEnvelope {
+        aggregate_id: template_id.to_string(),
+        sequence: 2,
+        payload: TemplateEvent::DisplayUpdated {
+            template_id: template_id.to_string(),
+            display: Display {
+                name: "Updated Display".to_string(),
+                logo: None,
+            },
+            modified_at: "2024-01-01T00:01:00Z".to_string(),
+        },
+        metadata: HashMap::new(),
+    };
+    projection.dispatch(template_id, &[update_event]).await;
+
+    let server_config = query_handler(SERVER_CONFIG_ID, &issuance.query.server_config)
+        .await
+        .unwrap()
+        .unwrap();
+    let (_, config_obj, _) = server_config.credential_configurations.get(template_id).unwrap();
+    let display_name = config_obj
+        .credential_metadata
+        .as_ref()
+        .unwrap()
+        .display
+        .as_ref()
+        .unwrap()
+        .first()
+        .unwrap()
+        .name
+        .clone();
+    assert_eq!(display_name, "Updated Display");
+}
+
+#[tokio::test]
+async fn test_title_updated_while_in_draft_skips_sync() {
+    let (issuance, library_for_query, projection) = setup().await;
+
+    let template_id = "draft-update-template";
+
+    // Create the template in Draft status in the library state.
+    command_handler(
+        template_id,
+        &library_for_query.command.template,
+        TemplateCommand::CreateNewTemplate {
+            template_id: template_id.to_string(),
+            source_template_id: None,
+            title: "Draft Title".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec!["VerifiableCredential".to_string()],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        },
+    )
+    .await
+    .unwrap();
+
+    // Dispatch TitleUpdated — template is still Draft, so no credential config should be created.
+    let update_event: EventEnvelope<agent_library::template::aggregate::Template> = EventEnvelope {
+        aggregate_id: template_id.to_string(),
+        sequence: 2,
+        payload: TemplateEvent::TitleUpdated {
+            template_id: template_id.to_string(),
+            title: "New Draft Title".to_string(),
+            modified_at: "2024-01-01T00:01:00Z".to_string(),
+        },
+        metadata: HashMap::new(),
+    };
+    projection.dispatch(template_id, &[update_event]).await;
+
+    let contains_key = query_handler(SERVER_CONFIG_ID, &issuance.query.server_config)
+        .await
+        .unwrap()
+        .map(|sc| sc.credential_configurations.contains_key(template_id))
+        .unwrap_or(false);
+    assert!(!contains_key);
+}
+
+#[tokio::test]
+async fn test_title_updated_refreshes_credential_configuration() {
+    let (issuance, library_for_query, projection) = setup().await;
+
+    let template_id = "updatable-template";
+
+    // Pre-populate the library state that the projection re-queries on partial updates.
+    command_handler(
+        template_id,
+        &library_for_query.command.template,
+        TemplateCommand::CreateNewTemplate {
+            template_id: template_id.to_string(),
+            source_template_id: None,
+            title: "Original Title".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Published,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec!["VerifiableCredential".to_string()],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        },
+    )
+    .await
+    .unwrap();
+
+    // Dispatch TemplateCreated to register the initial credential configuration.
+    let create_event = create_test_event_template_created(
+        template_id,
+        vec!["VerifiableCredential".to_string()],
+        DataModel::W3CVcDataModelV2_0,
+        "Original Title".to_string(),
+        None,
+        Status::Published,
+    );
+    projection.dispatch(template_id, &[create_event]).await;
+
+    // Apply the title update to the library state that the projection will re-query.
+    command_handler(
+        template_id,
+        &library_for_query.command.template,
+        TemplateCommand::UpdateTitle {
+            template_id: template_id.to_string(),
+            title: "Updated Title".to_string(),
+        },
+    )
+    .await
+    .unwrap();
+
+    // Dispatch TitleUpdated so the projection re-queries and syncs the credential configuration.
+    let update_event: EventEnvelope<agent_library::template::aggregate::Template> = EventEnvelope {
+        aggregate_id: template_id.to_string(),
+        sequence: 2,
+        payload: TemplateEvent::TitleUpdated {
+            template_id: template_id.to_string(),
+            title: "Updated Title".to_string(),
+            modified_at: "2024-01-01T00:01:00Z".to_string(),
+        },
+        metadata: HashMap::new(),
+    };
+    projection.dispatch(template_id, &[update_event]).await;
+
+    let server_config = query_handler(SERVER_CONFIG_ID, &issuance.query.server_config)
+        .await
+        .unwrap()
+        .unwrap();
+    let (_, config_obj, _) = server_config.credential_configurations.get(template_id).unwrap();
+    let display_name = config_obj
+        .credential_metadata
+        .as_ref()
+        .unwrap()
+        .display
+        .as_ref()
+        .unwrap()
+        .first()
+        .unwrap()
+        .name
+        .clone();
+    assert_eq!(display_name, "Updated Title");
+}
+
+#[tokio::test]
+async fn test_template_deleted_removes_credential_configuration() {
+    let (issuance, _library, projection) = setup().await;
+
+    let template_id = "to-be-deleted";
+
+    // Register the credential configuration first.
+    let create_event = create_test_event_template_created(
+        template_id,
+        vec!["VerifiableCredential".to_string()],
+        DataModel::W3CVcDataModelV2_0,
+        "Temp".to_string(),
+        None,
+        Status::Published,
+    );
+    projection.dispatch(template_id, &[create_event]).await;
+
+    let server_config = query_handler(SERVER_CONFIG_ID, &issuance.query.server_config)
+        .await
+        .unwrap()
+        .unwrap();
+    assert!(server_config.credential_configurations.contains_key(template_id));
+
+    // Now delete it.
+    let delete_event: EventEnvelope<agent_library::template::aggregate::Template> = EventEnvelope {
+        aggregate_id: template_id.to_string(),
+        sequence: 2,
+        payload: TemplateEvent::TemplateDeleted {
+            template_id: template_id.to_string(),
+        },
+        metadata: HashMap::new(),
+    };
+    projection.dispatch(template_id, &[delete_event]).await;
+
+    let server_config = query_handler(SERVER_CONFIG_ID, &issuance.query.server_config)
+        .await
+        .unwrap()
+        .unwrap();
+    assert!(!server_config.credential_configurations.contains_key(template_id));
+}
+
+#[tokio::test]
+async fn test_status_updated_to_published_creates_credential_configuration() {
+    let (issuance, lib_state, projection) = setup().await;
+
+    let template_id = "draft-to-published";
+
+    // Create template in Draft — no credential config should be registered yet.
+    command_handler(
+        template_id,
+        &lib_state.command.template,
+        TemplateCommand::CreateNewTemplate {
+            template_id: template_id.to_string(),
+            source_template_id: None,
+            title: "My Credential".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec!["VerifiableCredential".to_string()],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        },
+    )
+    .await
+    .unwrap();
+
+    let create_event = create_test_event_template_created(
+        template_id,
+        vec!["VerifiableCredential".to_string()],
+        DataModel::W3CVcDataModelV2_0,
+        "My Credential".to_string(),
+        None,
+        Status::Draft,
+    );
+    projection.dispatch(template_id, &[create_event]).await;
+
+    let contains_key = query_handler(SERVER_CONFIG_ID, &issuance.query.server_config)
+        .await
+        .unwrap()
+        .map(|sc| sc.credential_configurations.contains_key(template_id))
+        .unwrap_or(false);
+    assert!(
+        !contains_key,
+        "Draft template should not have a credential configuration"
+    );
+
+    // Transition to Published in the shared library state.
+    command_handler(
+        template_id,
+        &lib_state.command.template,
+        TemplateCommand::UpdateStatus {
+            template_id: template_id.to_string(),
+            status: Status::Published,
+        },
+    )
+    .await
+    .unwrap();
+
+    // Dispatch StatusUpdated — the projection should now create the credential configuration.
+    let status_event: EventEnvelope<agent_library::template::aggregate::Template> = EventEnvelope {
+        aggregate_id: template_id.to_string(),
+        sequence: 2,
+        payload: TemplateEvent::StatusUpdated {
+            template_id: template_id.to_string(),
+            status: Status::Published,
+            modified_at: "2024-01-01T00:01:00Z".to_string(),
+        },
+        metadata: HashMap::new(),
+    };
+    projection.dispatch(template_id, &[status_event]).await;
+
+    let server_config = query_handler(SERVER_CONFIG_ID, &issuance.query.server_config)
+        .await
+        .unwrap()
+        .unwrap();
+    assert!(
+        server_config.credential_configurations.contains_key(template_id),
+        "Published template should have a credential configuration"
+    );
+}
+
+#[tokio::test]
+async fn test_status_updated_to_deleted_removes_credential_configuration() {
+    let (issuance, lib_state, projection) = setup().await;
+
+    let template_id = "published-to-deleted";
+
+    // Create and publish the template.
+    command_handler(
+        template_id,
+        &lib_state.command.template,
+        TemplateCommand::CreateNewTemplate {
+            template_id: template_id.to_string(),
+            source_template_id: None,
+            title: "Temp".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Published,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec!["VerifiableCredential".to_string()],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        },
+    )
+    .await
+    .unwrap();
+
+    let create_event = create_test_event_template_created(
+        template_id,
+        vec!["VerifiableCredential".to_string()],
+        DataModel::W3CVcDataModelV2_0,
+        "Temp".to_string(),
+        None,
+        Status::Published,
+    );
+    projection.dispatch(template_id, &[create_event]).await;
+
+    let server_config = query_handler(SERVER_CONFIG_ID, &issuance.query.server_config)
+        .await
+        .unwrap()
+        .unwrap();
+    assert!(server_config.credential_configurations.contains_key(template_id));
+
+    // Soft-delete via StatusUpdated.
+    let status_event: EventEnvelope<agent_library::template::aggregate::Template> = EventEnvelope {
+        aggregate_id: template_id.to_string(),
+        sequence: 2,
+        payload: TemplateEvent::StatusUpdated {
+            template_id: template_id.to_string(),
+            status: Status::Deleted,
+            modified_at: "2024-01-01T00:01:00Z".to_string(),
+        },
+        metadata: HashMap::new(),
+    };
+    projection.dispatch(template_id, &[status_event]).await;
+
+    let server_config = query_handler(SERVER_CONFIG_ID, &issuance.query.server_config)
+        .await
+        .unwrap()
+        .unwrap();
+    assert!(!server_config.credential_configurations.contains_key(template_id));
+}
+
+#[tokio::test]
+async fn test_status_updated_to_archived_removes_credential_configuration() {
+    let (issuance, lib_state, projection) = setup().await;
+
+    let template_id = "published-to-archived";
+
+    command_handler(
+        template_id,
+        &lib_state.command.template,
+        TemplateCommand::CreateNewTemplate {
+            template_id: template_id.to_string(),
+            source_template_id: None,
+            title: "Temp".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Published,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec!["VerifiableCredential".to_string()],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        },
+    )
+    .await
+    .unwrap();
+
+    let create_event = create_test_event_template_created(
+        template_id,
+        vec!["VerifiableCredential".to_string()],
+        DataModel::W3CVcDataModelV2_0,
+        "Temp".to_string(),
+        None,
+        Status::Published,
+    );
+    projection.dispatch(template_id, &[create_event]).await;
+
+    let server_config = query_handler(SERVER_CONFIG_ID, &issuance.query.server_config)
+        .await
+        .unwrap()
+        .unwrap();
+    assert!(server_config.credential_configurations.contains_key(template_id));
+
+    command_handler(
+        template_id,
+        &lib_state.command.template,
+        TemplateCommand::UpdateStatus {
+            template_id: template_id.to_string(),
+            status: Status::Archived,
+        },
+    )
+    .await
+    .unwrap();
+
+    let status_event: EventEnvelope<agent_library::template::aggregate::Template> = EventEnvelope {
+        aggregate_id: template_id.to_string(),
+        sequence: 2,
+        payload: TemplateEvent::StatusUpdated {
+            template_id: template_id.to_string(),
+            status: Status::Archived,
+            modified_at: "2024-01-01T00:01:00Z".to_string(),
+        },
+        metadata: HashMap::new(),
+    };
+    projection.dispatch(template_id, &[status_event]).await;
+
+    let server_config = query_handler(SERVER_CONFIG_ID, &issuance.query.server_config)
+        .await
+        .unwrap()
+        .unwrap();
+    assert!(!server_config.credential_configurations.contains_key(template_id));
+}
+
+#[tokio::test]
+async fn test_schema_updated_refreshes_credential_configuration() {
+    let (issuance, lib_state, projection) = setup().await;
+
+    let template_id = "schema-update-template";
+    let updated_schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "name": { "type": "string" }
+        }
+    });
+
+    command_handler(
+        template_id,
+        &lib_state.command.template,
+        TemplateCommand::CreateNewTemplate {
+            template_id: template_id.to_string(),
+            source_template_id: None,
+            title: "Schema Update Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Published,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec!["VerifiableCredential".to_string()],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        },
+    )
+    .await
+    .unwrap();
+
+    let create_event = create_test_event_template_created(
+        template_id,
+        vec!["VerifiableCredential".to_string()],
+        DataModel::W3CVcDataModelV2_0,
+        "Schema Update Test".to_string(),
+        None,
+        Status::Published,
+    );
+    projection.dispatch(template_id, &[create_event]).await;
+
+    command_handler(
+        template_id,
+        &lib_state.command.template,
+        TemplateCommand::UpdateSchema {
+            template_id: template_id.to_string(),
+            schema: updated_schema.clone(),
+        },
+    )
+    .await
+    .unwrap();
+
+    let update_event: EventEnvelope<agent_library::template::aggregate::Template> = EventEnvelope {
+        aggregate_id: template_id.to_string(),
+        sequence: 2,
+        payload: TemplateEvent::SchemaUpdated {
+            template_id: template_id.to_string(),
+            schema: updated_schema,
+            modified_at: "2024-01-01T00:01:00Z".to_string(),
+        },
+        metadata: HashMap::new(),
+    };
+    projection.dispatch(template_id, &[update_event]).await;
+
+    let server_config = query_handler(SERVER_CONFIG_ID, &issuance.query.server_config)
+        .await
+        .unwrap()
+        .unwrap();
+    let (_, config_obj, _) = server_config.credential_configurations.get(template_id).unwrap();
+    let claim_count = config_obj
+        .credential_metadata
+        .as_ref()
+        .and_then(|metadata| metadata.claims.as_ref())
+        .map(|claims| claims.len())
+        .unwrap_or_default();
+    assert_eq!(claim_count, 1);
+}
+
+#[tokio::test]
+async fn test_schema_properties_attributes_updated_refreshes_credential_configuration() {
+    let (issuance, lib_state, projection) = setup().await;
+
+    let template_id = "schema-attributes-update-template";
+    let schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "name": { "type": "string" }
+        }
+    });
+
+    command_handler(
+        template_id,
+        &lib_state.command.template,
+        TemplateCommand::CreateNewTemplate {
+            template_id: template_id.to_string(),
+            source_template_id: None,
+            title: "Schema Attributes Update Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Published,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec!["VerifiableCredential".to_string()],
+            schema: Box::new(Some(schema.clone())),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        },
+    )
+    .await
+    .unwrap();
+
+    let create_event: EventEnvelope<agent_library::template::aggregate::Template> = EventEnvelope {
+        aggregate_id: template_id.to_string(),
+        sequence: 1,
+        payload: TemplateEvent::TemplateCreated {
+            template_id: template_id.to_string(),
+            source_template_id: None,
+            title: "Schema Attributes Update Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            modified_at: "2024-01-01T00:00:00Z".to_string(),
+            tags: None,
+            status: Status::Published,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::Never,
+            description: None,
+            r#type: vec!["VerifiableCredential".to_string()],
+            schema: Box::new(Some(schema)),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        },
+        metadata: HashMap::new(),
+    };
+    projection.dispatch(template_id, &[create_event]).await;
+
+    let mut attrs = HashMap::new();
+    attrs.insert("/name".to_string(), PropertyAttribute::new(true, false));
+
+    command_handler(
+        template_id,
+        &lib_state.command.template,
+        TemplateCommand::UpdateSchemaPropertiesAttributes {
+            template_id: template_id.to_string(),
+            schema_properties_attributes: attrs.clone(),
+        },
+    )
+    .await
+    .unwrap();
+
+    let update_event: EventEnvelope<agent_library::template::aggregate::Template> = EventEnvelope {
+        aggregate_id: template_id.to_string(),
+        sequence: 2,
+        payload: TemplateEvent::SchemaPropertiesAttributesUpdated {
+            template_id: template_id.to_string(),
+            schema_properties_attributes: attrs,
+            modified_at: "2024-01-01T00:01:00Z".to_string(),
+        },
+        metadata: HashMap::new(),
+    };
+    projection.dispatch(template_id, &[update_event]).await;
+
+    let server_config = query_handler(SERVER_CONFIG_ID, &issuance.query.server_config)
+        .await
+        .unwrap()
+        .unwrap();
+    let (_, config_obj, _) = server_config.credential_configurations.get(template_id).unwrap();
+    let claim = config_obj
+        .credential_metadata
+        .as_ref()
+        .and_then(|metadata| metadata.claims.as_ref())
+        .and_then(|claims| claims.first())
+        .expect("claim should be present after schema attribute update");
+    assert!(!claim.mandatory);
+}
diff --git a/agent_library/Cargo.toml b/agent_library/Cargo.toml
index ca0c6e56..2e06981c 100644
--- a/agent_library/Cargo.toml
+++ b/agent_library/Cargo.toml
@@ -11,7 +11,8 @@ agent_shared = { path = "../agent_shared" }
 async-trait.workspace = true
 chrono.workspace = true
 cqrs-es.workspace = true
-jsonschema = "0.43"
+iso8601.workspace = true
+jsonschema.workspace = true
 lazy_static.workspace = true
 serde.workspace = true
 serde_json.workspace = true
@@ -21,6 +22,7 @@ strum_macros.workspace = true
 thiserror.workspace = true
 tracing.workspace = true
 utoipa.workspace = true
+uuid.workspace = true
 
 # `test_utils` dependencies
 rstest = { workspace = true, optional = true }
diff --git a/agent_library/src/template/aggregate.rs b/agent_library/src/template/aggregate.rs
index f27073f9..e007ca3a 100644
--- a/agent_library/src/template/aggregate.rs
+++ b/agent_library/src/template/aggregate.rs
@@ -1,11 +1,16 @@
 use std::collections::HashMap;
 
+use agent_shared::config::Authorization;
 use async_trait::async_trait;
 use cqrs_es::Aggregate;
 use serde::{Deserialize, Serialize};
 use serde_with::skip_serializing_none;
 use tracing::{debug, info};
 
+pub use super::open_badges::open_badges_required_leaf_paths;
+use super::open_badges::{
+    ensure_schema_required_keys, validate_open_badges_required_properties, validate_open_badges_schema_properties,
+};
 use super::{command::TemplateCommand, error::TemplateError, event::TemplateEvent};
 
 #[skip_serializing_none]
@@ -22,13 +27,14 @@ pub struct Display {
     pub logo: Option<Logo>,
 }
 
-#[derive(Debug, Clone, Serialize, Deserialize, Eq, PartialEq, utoipa::ToSchema)]
+#[derive(Debug, Clone, Serialize, Deserialize, Default, Eq, PartialEq, utoipa::ToSchema)]
 pub enum DataModel {
     // See https://www.w3.org/TR/vc-data-model-1.1/
     #[serde(rename = "w3c_vc_data_model_v1-1")]
     W3CVcDataModelV1_1,
     // See https://www.w3.org/TR/vc-data-model-2.0/
     #[serde(rename = "w3c_vc_data_model_v2-0")]
+    #[default]
     W3CVcDataModelV2_0,
     // See https://www.imsglobal.org/spec/ob/v3p0/
     #[serde(rename = "open_badges_3-0")]
@@ -38,9 +44,10 @@ pub enum DataModel {
     EuropeanLearningModelV3_3,
 }
 
-#[derive(Debug, Clone, Serialize, Deserialize, Eq, PartialEq, utoipa::ToSchema)]
+#[derive(Debug, Clone, Serialize, Deserialize, Default, Eq, PartialEq, utoipa::ToSchema)]
 #[serde(rename_all = "snake_case")]
 pub enum HolderType {
+    #[default]
     Individual,
     Organization,
 }
@@ -64,10 +71,58 @@ pub enum Visibility {
     Public,
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, utoipa::ToSchema)]
+#[serde(tag = "type", content = "value", rename_all = "kebab-case")]
+pub enum Expiration {
+    /// Never expires.
+    Never,
+    /// Relative duration in ISO 8601 format, e.g. `"P3DT4H"` or seconds as `"PT86400S"`.
+    Duration(String),
+    /// Absolute datetime in ISO 8601 format, e.g. `"2026-12-31T23:59:59Z"`.
+    DateTime(String),
+}
+
+impl Default for Expiration {
+    /// Defaults to a relative 90-day expiration (`P90D`).
+    fn default() -> Self {
+        Expiration::Duration("P90D".to_string())
+    }
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, utoipa::ToSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct PropertyAttribute {
-    selectively_disclosable: bool,
+    pub selectively_disclosable: bool,
+    /// Whether this property is non-removable — its leaf field must remain present in the schema
+    /// and cannot be removed by the caller. Determined by the data model; system-controlled only.
+    /// For OpenBadges 3.0 templates, only the required standard fields are non-removable.
+    /// Defaults to `false`.
+    #[serde(default)]
+    pub non_removable: bool,
+}
+
+impl PropertyAttribute {
+    /// Creates a new `PropertyAttribute`.
+    pub fn new(selectively_disclosable: bool, non_removable: bool) -> Self {
+        Self {
+            selectively_disclosable,
+            non_removable,
+        }
+    }
+
+    /// Returns whether this property is selectively disclosable.
+    pub fn is_selectively_disclosable(&self) -> bool {
+        self.selectively_disclosable
+    }
+
+    /// Returns a copy of this attribute with `non_removable` forced to `false`.
+    /// Use at API boundaries to ensure callers cannot set system-controlled flags.
+    pub fn strip_non_removable(self) -> Self {
+        Self {
+            non_removable: false,
+            ..self
+        }
+    }
 }
 
 #[skip_serializing_none]
@@ -76,19 +131,21 @@ pub struct Template {
     #[serde(rename = "id")]
     pub template_id: String,
     pub source_template_id: Option<String>,
-    pub title: Option<String>,
+    pub title: String,
     pub display: Option<Display>,
-    pub data_model: Option<DataModel>,
-    pub creator: Option<String>,
-    pub holder_type: Option<HolderType>,
+    pub data_model: DataModel,
+    pub holder_type: HolderType,
     pub modified_at: Option<String>,
-    pub tags: Vec<String>,
+    pub tags: Option<Vec<String>>,
     pub status: Status,
     pub visibility: Visibility,
+    pub credential_expiration: Expiration,
     pub description: Option<String>,
     pub r#type: Vec<String>,
+    /// JSON schema which defines the structure of the actual content of the credential.
     pub schema: Box<Option<serde_json::Value>>,
     pub schema_properties_attributes: Option<HashMap<String, PropertyAttribute>>,
+    pub holder_authorization: Authorization,
 }
 
 #[async_trait]
@@ -113,30 +170,108 @@ impl Aggregate for Template {
         info!("Handling command: {:?}", command);
 
         match command {
-            CreateTemplate {
+            CreateNewTemplate {
                 template_id,
                 source_template_id,
                 title,
                 display,
                 data_model,
-                creator,
                 holder_type,
                 tags,
                 status,
                 visibility,
+                credential_expiration,
                 description,
                 r#type,
                 schema,
                 schema_properties_attributes,
+                holder_authorization,
             } => {
+                // Only Draft and Published are allowed on creation.
+                if matches!(status, Status::Archived | Status::Deleted) {
+                    return Err(TemplateError::InvalidStatusOnCreate);
+                }
+
+                // Validate that a title is provided
+                let title = title.trim().to_string();
+                if title.is_empty() {
+                    return Err(TemplateError::MissingTitle);
+                }
+
+                // Normalize type (defaults, canonical order, dedup).
+                let r#type = normalize_and_validate_type(r#type, &data_model)?;
+
+                // Normalize tags.
+                let tags = normalize_tags(tags);
+
+                // Validate the credential expiration value if provided.
+                let credential_expiration = credential_expiration.unwrap_or_default();
+                validate_expiration(&credential_expiration)?;
+
+                // W3C VC 1.1 does not expose claim metadata and must not have
+                // schemaPropertiesAttributes.
+                if data_model == DataModel::W3CVcDataModelV1_1
+                    && schema_properties_attributes.as_ref().is_some_and(|a| !a.is_empty())
+                {
+                    return Err(TemplateError::SchemaPropertiesAttributesNotAllowed);
+                }
+
+                // For OpenBadges 3.0 templates, validate that the required properties are present
+                // in the user-supplied schema. They are NOT auto-added.
+                let schema = if data_model == DataModel::OpenBadges3_0 {
+                    let mut s = (*schema).unwrap_or(serde_json::json!({"type": "object"}));
+                    // Ensure schema has "type": "object" and "properties"
+                    if let Some(obj) = s.as_object_mut() {
+                        obj.entry("type").or_insert(serde_json::json!("object"));
+                        obj.entry("properties").or_insert(serde_json::json!({}));
+                    }
+                    validate_open_badges_required_properties(&s)?;
+                    // Ensure required keys are included in schema.required
+                    ensure_schema_required_keys(&mut s);
+                    Box::new(Some(s))
+                } else {
+                    schema
+                };
+
                 if let Some(ref s) = *schema {
                     validate_json_schema(s)?;
+                    validate_schema_no_array_types(s)?;
+
+                    if data_model == DataModel::OpenBadges3_0 {
+                        validate_open_badges_schema_properties(s)?;
+                    }
                 }
 
                 if let Some(ref attrs) = schema_properties_attributes {
-                    validate_schema_properties_attributes(&schema, attrs)?;
+                    if !attrs.is_empty() {
+                        validate_schema_properties_attributes(&schema, attrs)?;
+                    }
                 }
 
+                // For OpenBadges 3.0 templates, auto-populate non_removable attributes
+                // for schema properties. Only required standard fields are non-removable.
+                let schema_properties_attributes = if data_model == DataModel::OpenBadges3_0 {
+                    if let Some(ref s) = *schema {
+                        let leaf_paths = collect_leaf_paths(s);
+                        let required_paths = open_badges_required_leaf_paths();
+                        let mut attrs = schema_properties_attributes.unwrap_or_default();
+                        for key in leaf_paths {
+                            let is_required = required_paths.contains(&key);
+                            let attr = attrs.entry(key).or_insert(PropertyAttribute {
+                                selectively_disclosable: false,
+                                non_removable: false,
+                            });
+                            attr.non_removable = is_required;
+                        }
+                        Some(attrs)
+                    } else {
+                        schema_properties_attributes
+                    }
+                } else {
+                    // Normalize empty map to None.
+                    schema_properties_attributes.filter(|a| !a.is_empty())
+                };
+
                 #[cfg(not(test))]
                 let modified_at = chrono::Utc::now().to_rfc3339();
                 #[cfg(test)]
@@ -148,19 +283,27 @@ impl Aggregate for Template {
                     title,
                     display,
                     data_model,
-                    creator,
                     holder_type,
                     modified_at,
                     tags,
                     status,
                     visibility,
+                    credential_expiration,
                     description,
                     r#type,
                     schema,
                     schema_properties_attributes,
+                    holder_authorization,
                 }])
             }
             UpdateTitle { template_id, title } => {
+                ensure_template_editable(&self.status)?;
+
+                let title = title.trim().to_string();
+                if title.is_empty() {
+                    return Err(TemplateError::MissingTitle);
+                }
+
                 #[cfg(not(test))]
                 let modified_at = chrono::Utc::now().to_rfc3339();
                 #[cfg(test)]
@@ -173,6 +316,8 @@ impl Aggregate for Template {
                 }])
             }
             UpdateDisplay { template_id, display } => {
+                ensure_template_editable(&self.status)?;
+
                 #[cfg(not(test))]
                 let modified_at = chrono::Utc::now().to_rfc3339();
                 #[cfg(test)]
@@ -184,49 +329,12 @@ impl Aggregate for Template {
                     modified_at,
                 }])
             }
-            UpdateDataModel {
-                template_id,
-                data_model,
-            } => {
-                #[cfg(not(test))]
-                let modified_at = chrono::Utc::now().to_rfc3339();
-                #[cfg(test)]
-                let modified_at = test_utils::modified_at();
-
-                Ok(vec![DataModelUpdated {
-                    template_id,
-                    data_model,
-                    modified_at,
-                }])
-            }
-            UpdateCreator { template_id, creator } => {
-                #[cfg(not(test))]
-                let modified_at = chrono::Utc::now().to_rfc3339();
-                #[cfg(test)]
-                let modified_at = test_utils::modified_at();
+            UpdateTags { template_id, tags } => {
+                ensure_template_editable(&self.status)?;
 
-                Ok(vec![CreatorUpdated {
-                    template_id,
-                    creator,
-                    modified_at,
-                }])
-            }
-            UpdateHolderType {
-                template_id,
-                holder_type,
-            } => {
-                #[cfg(not(test))]
-                let modified_at = chrono::Utc::now().to_rfc3339();
-                #[cfg(test)]
-                let modified_at = test_utils::modified_at();
+                // Normalize: trim, dedup, drop empty.  Empty result is stored as None via apply.
+                let tags = normalize_tags(Some(tags)).unwrap_or_default();
 
-                Ok(vec![HolderTypeUpdated {
-                    template_id,
-                    holder_type,
-                    modified_at,
-                }])
-            }
-            UpdateTags { template_id, tags } => {
                 #[cfg(not(test))]
                 let modified_at = chrono::Utc::now().to_rfc3339();
                 #[cfg(test)]
@@ -239,6 +347,8 @@ impl Aggregate for Template {
                 }])
             }
             UpdateStatus { template_id, status } => {
+                ensure_status_transition_allowed(&self.status, &status)?;
+
                 #[cfg(not(test))]
                 let modified_at = chrono::Utc::now().to_rfc3339();
                 #[cfg(test)]
@@ -254,6 +364,11 @@ impl Aggregate for Template {
                 template_id,
                 visibility,
             } => {
+                ensure_template_editable(&self.status)?;
+
+                if self.status == Status::Draft && visibility == Visibility::Public {
+                    return Err(TemplateError::DraftTemplateCannotBePublic);
+                }
                 #[cfg(not(test))]
                 let modified_at = chrono::Utc::now().to_rfc3339();
                 #[cfg(test)]
@@ -269,6 +384,11 @@ impl Aggregate for Template {
                 template_id,
                 description,
             } => {
+                ensure_template_editable(&self.status)?;
+
+                // Trim whitespace.  An empty description clears the field (stored as None via apply).
+                let description = description.trim().to_string();
+
                 #[cfg(not(test))]
                 let modified_at = chrono::Utc::now().to_rfc3339();
                 #[cfg(test)]
@@ -281,6 +401,10 @@ impl Aggregate for Template {
                 }])
             }
             UpdateType { template_id, r#type } => {
+                ensure_template_editable(&self.status)?;
+
+                let r#type = normalize_and_validate_type(r#type, &self.data_model)?;
+
                 #[cfg(not(test))]
                 let modified_at = chrono::Utc::now().to_rfc3339();
                 #[cfg(test)]
@@ -293,7 +417,40 @@ impl Aggregate for Template {
                 }])
             }
             UpdateSchema { template_id, schema } => {
+                ensure_template_editable(&self.status)?;
+
                 validate_json_schema(&schema)?;
+                validate_schema_no_array_types(&schema)?;
+
+                if self.data_model == DataModel::OpenBadges3_0 {
+                    validate_open_badges_schema_properties(&schema)?;
+                    validate_open_badges_required_properties(&schema)?;
+                }
+
+                // Ensure required keys are included in schema.required for OpenBadges 3.0
+                let mut schema = schema;
+                if self.data_model == DataModel::OpenBadges3_0 {
+                    ensure_schema_required_keys(&mut schema);
+                }
+
+                // Enforce non-removable properties: reject if any property with non_removable=true
+                // is missing from the new schema.
+                if let Some(ref existing_attrs) = self.schema_properties_attributes {
+                    let new_leaf_paths = collect_leaf_paths(&schema);
+                    let immutable_missing: Vec<&str> = existing_attrs
+                        .iter()
+                        .filter(|(_, attr)| attr.non_removable)
+                        .filter(|(k, _)| !new_leaf_paths.contains(*k))
+                        .map(|(k, _)| k.as_str())
+                        .collect();
+
+                    if !immutable_missing.is_empty() {
+                        return Err(TemplateError::NonRemovablePropertyViolation(format!(
+                            "The following non-removable properties cannot be removed from the schema: [{}]",
+                            immutable_missing.join(", ")
+                        )));
+                    }
+                }
 
                 #[cfg(not(test))]
                 let modified_at = chrono::Utc::now().to_rfc3339();
@@ -308,10 +465,10 @@ impl Aggregate for Template {
 
                 // Prune schema_properties_attributes whose keys no longer exist in the new schema.
                 if let Some(ref existing_attrs) = self.schema_properties_attributes {
-                    let new_property_keys = get_schema_property_keys(&schema);
+                    let new_leaf_paths = collect_leaf_paths(&schema);
                     let pruned: HashMap<String, PropertyAttribute> = existing_attrs
                         .iter()
-                        .filter(|(k, _)| new_property_keys.contains(*k))
+                        .filter(|(k, _)| new_leaf_paths.contains(*k))
                         .map(|(k, v)| (k.clone(), v.clone()))
                         .collect();
 
@@ -330,8 +487,24 @@ impl Aggregate for Template {
                 template_id,
                 schema_properties_attributes,
             } => {
+                ensure_template_editable(&self.status)?;
+
+                // W3C VC 1.1 does not expose claim metadata and must not have
+                // schemaPropertiesAttributes.
+                if self.data_model == DataModel::W3CVcDataModelV1_1 {
+                    return Err(TemplateError::SchemaPropertiesAttributesNotAllowed);
+                }
+
+                // Trim keys and detect collisions after trimming.
+                let schema_properties_attributes = trim_and_deduplicate_attribute_keys(schema_properties_attributes)?;
+
                 validate_schema_properties_attributes(&self.schema, &schema_properties_attributes)?;
 
+                // The `non_removable` flag is system-determined by the data model and cannot
+                // be altered through any command. Override it with the existing values.
+                let schema_properties_attributes =
+                    enforce_non_removable_flag(schema_properties_attributes, &self.schema_properties_attributes);
+
                 #[cfg(not(test))]
                 let modified_at = chrono::Utc::now().to_rfc3339();
                 #[cfg(test)]
@@ -343,7 +516,46 @@ impl Aggregate for Template {
                     modified_at,
                 }])
             }
-            DeleteTemplate { template_id } => Ok(vec![TemplateDeleted { template_id }]),
+            DeleteTemplate { template_id } => {
+                ensure_template_can_be_deleted(&self.status)?;
+                Ok(vec![TemplateDeleted { template_id }])
+            }
+            UpdateCredentialExpiration {
+                template_id,
+                credential_expiration,
+            } => {
+                ensure_template_editable(&self.status)?;
+
+                validate_expiration(&credential_expiration)?;
+
+                #[cfg(not(test))]
+                let modified_at = chrono::Utc::now().to_rfc3339();
+                #[cfg(test)]
+                let modified_at = test_utils::modified_at();
+
+                Ok(vec![CredentialExpirationUpdated {
+                    template_id,
+                    credential_expiration,
+                    modified_at,
+                }])
+            }
+            UpdateHolderAuthorization {
+                template_id,
+                holder_authorization,
+            } => {
+                ensure_template_editable(&self.status)?;
+
+                #[cfg(not(test))]
+                let modified_at = chrono::Utc::now().to_rfc3339();
+                #[cfg(test)]
+                let modified_at = test_utils::modified_at();
+
+                Ok(vec![HolderAuthorizationUpdated {
+                    template_id,
+                    holder_authorization,
+                    modified_at,
+                }])
+            }
         }
     }
 
@@ -359,39 +571,41 @@ impl Aggregate for Template {
                 title,
                 display,
                 data_model,
-                creator,
                 holder_type,
                 modified_at,
                 tags,
                 status,
                 visibility,
+                credential_expiration,
                 description,
                 r#type,
                 schema,
                 schema_properties_attributes,
+                holder_authorization,
             } => {
                 self.template_id = template_id;
                 self.source_template_id = source_template_id;
                 self.title = title;
                 self.display = *display;
                 self.data_model = data_model;
-                self.creator = creator;
                 self.holder_type = holder_type;
                 self.modified_at.replace(modified_at);
                 self.tags = tags;
                 self.status = status;
                 self.visibility = visibility;
+                self.credential_expiration = credential_expiration;
                 self.description = description;
                 self.r#type = r#type;
                 self.schema = schema;
                 self.schema_properties_attributes = schema_properties_attributes;
+                self.holder_authorization = holder_authorization;
             }
             TitleUpdated {
                 template_id: _,
                 title,
                 modified_at,
             } => {
-                self.title = Some(title);
+                self.title = title;
                 self.modified_at.replace(modified_at);
             }
             DisplayUpdated {
@@ -402,36 +616,12 @@ impl Aggregate for Template {
                 self.display = Some(display);
                 self.modified_at.replace(modified_at);
             }
-            DataModelUpdated {
-                template_id: _,
-                data_model,
-                modified_at,
-            } => {
-                self.data_model = Some(data_model);
-                self.modified_at.replace(modified_at);
-            }
-            CreatorUpdated {
-                template_id: _,
-                creator,
-                modified_at,
-            } => {
-                self.creator = Some(creator);
-                self.modified_at.replace(modified_at);
-            }
-            HolderTypeUpdated {
-                template_id: _,
-                holder_type,
-                modified_at,
-            } => {
-                self.holder_type = Some(holder_type);
-                self.modified_at.replace(modified_at);
-            }
             TagsUpdated {
                 template_id: _,
                 tags,
                 modified_at,
             } => {
-                self.tags = tags;
+                self.tags = if tags.is_empty() { None } else { Some(tags) };
                 self.modified_at.replace(modified_at);
             }
             StatusUpdated {
@@ -455,7 +645,11 @@ impl Aggregate for Template {
                 description,
                 modified_at,
             } => {
-                self.description = Some(description);
+                self.description = if description.is_empty() {
+                    None
+                } else {
+                    Some(description)
+                };
                 self.modified_at.replace(modified_at);
             }
             TypeUpdated {
@@ -482,6 +676,22 @@ impl Aggregate for Template {
                 self.schema_properties_attributes = Some(schema_properties_attributes);
                 self.modified_at.replace(modified_at);
             }
+            CredentialExpirationUpdated {
+                template_id: _,
+                credential_expiration,
+                modified_at,
+            } => {
+                self.credential_expiration = credential_expiration;
+                self.modified_at.replace(modified_at);
+            }
+            HolderAuthorizationUpdated {
+                template_id: _,
+                holder_authorization,
+                modified_at,
+            } => {
+                self.holder_authorization = holder_authorization;
+                self.modified_at.replace(modified_at);
+            }
             TemplateDeleted { template_id } => {
                 *self = Self::default();
                 self.template_id = template_id;
@@ -497,522 +707,306 @@ fn validate_json_schema(schema: &serde_json::Value) -> Result<(), TemplateError>
         .map_err(|e| TemplateError::InvalidSchema(e.to_string()))
 }
 
-fn get_schema_property_keys(schema: &serde_json::Value) -> std::collections::HashSet<String> {
-    schema
-        .get("properties")
-        .and_then(|p| p.as_object())
-        .map(|obj| obj.keys().cloned().collect())
-        .unwrap_or_default()
+/// Validates that no field in the schema (at any nesting level) has `"type": "array"`.
+///
+/// Arrays are not supported in template schemas at this time. Supporting arrays would require
+/// a strategy for addressing individual array item fields in `schemaPropertiesAttributes` and
+/// in SD-JWT claim paths, which is deferred to a future release.
+fn validate_schema_no_array_types(schema: &serde_json::Value) -> Result<(), TemplateError> {
+    validate_no_array_types_recursive(schema)
 }
 
-fn validate_schema_properties_attributes(
-    schema: &Option<serde_json::Value>,
-    attributes: &HashMap<String, PropertyAttribute>,
-) -> Result<(), TemplateError> {
-    let property_keys = match schema {
-        Some(s) => get_schema_property_keys(s),
-        None => std::collections::HashSet::new(),
-    };
-
-    let invalid_keys: Vec<&String> = attributes.keys().filter(|k| !property_keys.contains(*k)).collect();
+fn validate_no_array_types_recursive(schema: &serde_json::Value) -> Result<(), TemplateError> {
+    if let Some(type_val) = schema.get("type").and_then(|t| t.as_str()) {
+        if type_val == "array" {
+            return Err(TemplateError::InvalidSchema(
+                "Array types are not supported in template schemas. \
+                 Define only object and scalar fields."
+                    .to_string(),
+            ));
+        }
+    }
 
-    if !invalid_keys.is_empty() {
-        let keys_str: Vec<&str> = invalid_keys.iter().map(|k| k.as_str()).collect();
-        return Err(TemplateError::InvalidSchemaPropertiesAttributes(format!(
-            "The following keys do not match any field in schema.properties: [{}]",
-            keys_str.join(", ")
-        )));
+    if let Some(properties) = schema.get("properties").and_then(|p| p.as_object()) {
+        for value in properties.values() {
+            validate_no_array_types_recursive(value)?;
+        }
     }
 
     Ok(())
 }
 
-#[cfg(test)]
-pub mod document_tests {
-    use super::test_utils::*;
-    use super::*;
-    use cqrs_es::test::TestFramework;
-    use rstest::rstest;
-
-    type TemplateTestFramework = TestFramework<Template>;
-
-    #[allow(clippy::too_many_arguments)]
-    #[rstest]
-    #[serial_test::serial]
-    async fn test_create_template(
-        template_id: String,
-        title: Option<String>,
-        display: Option<Display>,
-        data_model: Option<DataModel>,
-        creator: Option<String>,
-        holder_type: Option<HolderType>,
-        modified_at: String,
-        tags: Vec<String>,
-        status: Status,
-        visibility: Visibility,
-        description: Option<String>,
-        r#type: Vec<String>,
-        schema: Option<serde_json::Value>,
-        schema_properties_attributes: Option<HashMap<String, PropertyAttribute>>,
-    ) {
-        TemplateTestFramework::with(())
-            .given_no_previous_events()
-            .when(TemplateCommand::CreateTemplate {
-                template_id: template_id.clone(),
-                source_template_id: None,
-                title: title.clone(),
-                display: Box::new(display.clone()),
-                data_model: data_model.clone(),
-                creator: creator.clone(),
-                holder_type: holder_type.clone(),
-                tags: tags.clone(),
-                status: status.clone(),
-                visibility: visibility.clone(),
-                description: description.clone(),
-                r#type: r#type.clone(),
-                schema: Box::new(schema.clone()),
-                schema_properties_attributes: schema_properties_attributes.clone(),
-            })
-            .then_expect_events(vec![TemplateEvent::TemplateCreated {
-                template_id,
-                source_template_id: None,
-                title,
-                display: Box::new(display),
-                data_model,
-                creator,
-                holder_type,
-                modified_at,
-                tags,
-                status,
-                visibility,
-                description,
-                r#type,
-                schema: Box::new(schema),
-                schema_properties_attributes,
-            }])
+/// Normalizes and validates the `type` field.
+///
+/// - Drops blank/whitespace-only entries.
+/// - For OpenBadges 3.0: enforces that exactly one badge-specific subtype is present,
+///   that no extra types are included, and defaults to `['VerifiableCredential', 'OpenBadgeCredential']`
+///   for empty or incomplete input.
+/// - For all other data models: ensures `VerifiableCredential` is present (adds it if missing),
+///   deduplicates, and applies canonical ordering (VerifiableCredential first).
+fn normalize_and_validate_type(type_input: Vec<String>, data_model: &DataModel) -> Result<Vec<String>, TemplateError> {
+    // Drop blank/whitespace-only entries.
+    let filtered: Vec<String> = type_input.into_iter().filter(|t| !t.trim().is_empty()).collect();
+
+    match data_model {
+        DataModel::OpenBadges3_0 => normalize_open_badges_type(filtered),
+        _ => normalize_standard_type(filtered),
     }
+}
 
-    #[rstest]
-    #[serial_test::serial]
-    async fn test_create_template_with_invalid_schema(template_id: String) {
-        let invalid_schema = serde_json::json!({
-            "type": "not_a_valid_type"
-        });
+fn normalize_standard_type(filtered: Vec<String>) -> Result<Vec<String>, TemplateError> {
+    const VC: &str = "VerifiableCredential";
 
-        TemplateTestFramework::with(())
-            .given_no_previous_events()
-            .when(TemplateCommand::CreateTemplate {
-                template_id,
-                source_template_id: None,
-                title: None,
-                display: Box::new(None),
-                data_model: None,
-                creator: None,
-                holder_type: None,
-                tags: vec![],
-                status: Status::Draft,
-                visibility: Visibility::Private,
-                description: None,
-                r#type: vec![],
-                schema: Box::new(Some(invalid_schema)),
-                schema_properties_attributes: None,
-            })
-            .then_expect_error_message("Invalid JSON Schema: \"not_a_valid_type\" is not valid under any of the schemas listed in the 'anyOf' keyword")
+    // Empty input defaults to ['VerifiableCredential'].
+    if filtered.is_empty() {
+        return Ok(vec![VC.to_string()]);
     }
 
-    #[rstest]
-    #[serial_test::serial]
-    async fn test_create_template_with_no_schema(template_id: String) {
-        TemplateTestFramework::with(())
-            .given_no_previous_events()
-            .when(TemplateCommand::CreateTemplate {
-                template_id: template_id.clone(),
-                source_template_id: None,
-                title: None,
-                display: Box::new(None),
-                data_model: None,
-                creator: None,
-                holder_type: None,
-                tags: vec![],
-                status: Status::Draft,
-                visibility: Visibility::Private,
-                description: None,
-                r#type: vec![],
-                schema: Box::new(None),
-                schema_properties_attributes: None,
-            })
-            .then_expect_events(vec![TemplateEvent::TemplateCreated {
-                template_id,
-                source_template_id: None,
-                title: None,
-                display: Box::new(None),
-                data_model: None,
-                creator: None,
-                holder_type: None,
-                modified_at: test_utils::modified_at(),
-                tags: vec![],
-                status: Status::Draft,
-                visibility: Visibility::Private,
-                description: None,
-                r#type: vec![],
-                schema: Box::new(None),
-                schema_properties_attributes: None,
-            }])
-    }
+    // Deduplicate preserving first-seen order.
+    let mut seen = std::collections::HashSet::new();
+    let deduped: Vec<String> = filtered.into_iter().filter(|t| seen.insert(t.clone())).collect();
 
-    #[rstest]
-    #[serial_test::serial]
-    async fn test_update_schema_with_invalid_schema(template_id: String) {
-        let invalid_schema = serde_json::json!({
-            "type": "not_a_valid_type"
-        });
-
-        TemplateTestFramework::with(())
-            .given(vec![TemplateEvent::TemplateCreated {
-                template_id: template_id.clone(),
-                source_template_id: None,
-                title: None,
-                display: Box::new(None),
-                data_model: None,
-                creator: None,
-                holder_type: None,
-                modified_at: test_utils::modified_at(),
-                tags: vec![],
-                status: Status::Draft,
-                visibility: Visibility::Private,
-                description: None,
-                r#type: vec![],
-                schema: Box::new(None),
-                schema_properties_attributes: None,
-            }])
-            .when(TemplateCommand::UpdateSchema {
-                template_id,
-                schema: invalid_schema,
-            })
-            .then_expect_error_message("Invalid JSON Schema: \"not_a_valid_type\" is not valid under any of the schemas listed in the 'anyOf' keyword")
+    // Canonical order: VerifiableCredential first, then extras.
+    let mut result = vec![VC.to_string()];
+    for t in &deduped {
+        if t != VC {
+            result.push(t.clone());
+        }
     }
 
-    #[rstest]
-    #[serial_test::serial]
-    async fn test_update_schema_with_valid_schema(template_id: String) {
-        let valid_schema = serde_json::json!({
-            "type": "object",
-            "properties": {
-                "name": { "type": "string" }
-            }
-        });
-
-        TemplateTestFramework::with(())
-            .given(vec![TemplateEvent::TemplateCreated {
-                template_id: template_id.clone(),
-                source_template_id: None,
-                title: None,
-                display: Box::new(None),
-                data_model: None,
-                creator: None,
-                holder_type: None,
-                modified_at: test_utils::modified_at(),
-                tags: vec![],
-                status: Status::Draft,
-                visibility: Visibility::Private,
-                description: None,
-                r#type: vec![],
-                schema: Box::new(None),
-                schema_properties_attributes: None,
-            }])
-            .when(TemplateCommand::UpdateSchema {
-                template_id: template_id.clone(),
-                schema: valid_schema.clone(),
-            })
-            .then_expect_events(vec![TemplateEvent::SchemaUpdated {
-                template_id,
-                schema: valid_schema,
-                modified_at: test_utils::modified_at(),
-            }])
+    Ok(result)
+}
+
+fn normalize_open_badges_type(filtered: Vec<String>) -> Result<Vec<String>, TemplateError> {
+    const OBC: &str = "OpenBadgeCredential";
+    const AC: &str = "AchievementCredential";
+    const VC: &str = "VerifiableCredential";
+
+    // Empty or only-VC input defaults to ['VerifiableCredential', 'OpenBadgeCredential'].
+    if filtered.is_empty() || (filtered.len() == 1 && filtered[0] == VC) {
+        return Ok(vec![VC.to_string(), OBC.to_string()]);
     }
 
-    #[rstest]
-    #[serial_test::serial]
-    async fn test_create_template_with_invalid_schema_properties_attributes(template_id: String) {
-        let schema = serde_json::json!({
-            "type": "object",
-            "properties": {
-                "name": { "type": "string" }
-            }
-        });
+    let has_obc = filtered.contains(&OBC.to_string());
+    let has_ac = filtered.contains(&AC.to_string());
 
-        let mut attrs = HashMap::new();
-        attrs.insert(
-            "nonexistent".to_string(),
-            PropertyAttribute {
-                selectively_disclosable: true,
-            },
-        );
+    if has_obc && has_ac {
+        return Err(TemplateError::InvalidType(
+            "OpenBadges type cannot include both `OpenBadgeCredential` and `AchievementCredential`".to_string(),
+        ));
+    }
 
-        TemplateTestFramework::with(())
-            .given_no_previous_events()
-            .when(TemplateCommand::CreateTemplate {
-                template_id,
-                source_template_id: None,
-                title: None,
-                display: Box::new(None),
-                data_model: None,
-                creator: None,
-                holder_type: None,
-                tags: vec![],
-                status: Status::Draft,
-                visibility: Visibility::Private,
-                description: None,
-                r#type: vec![],
-                schema: Box::new(Some(schema)),
-                schema_properties_attributes: Some(attrs),
-            })
-            .then_expect_error_message("Invalid schema_properties_attributes key(s): The following keys do not match any field in schema.properties: [nonexistent]")
+    // No extra types allowed beyond VC, OBC, AC.
+    let allowed = [VC, OBC, AC];
+    let extras: Vec<&str> = filtered
+        .iter()
+        .filter(|t| !allowed.contains(&t.as_str()))
+        .map(|t| t.as_str())
+        .collect();
+    if !extras.is_empty() {
+        return Err(TemplateError::InvalidType(format!(
+            "OpenBadges type includes disallowed extra entries: [{}]",
+            extras.join(", ")
+        )));
     }
 
-    #[rstest]
-    #[serial_test::serial]
-    async fn test_create_template_with_attributes_but_no_schema(template_id: String) {
-        let mut attrs = HashMap::new();
-        attrs.insert(
-            "name".to_string(),
-            PropertyAttribute {
-                selectively_disclosable: true,
-            },
-        );
+    // Must contain exactly one badge-specific subtype; deduplicate preserving order.
+    let badge_type = if has_obc { OBC } else { AC };
 
-        TemplateTestFramework::with(())
-            .given_no_previous_events()
-            .when(TemplateCommand::CreateTemplate {
-                template_id,
-                source_template_id: None,
-                title: None,
-                display: Box::new(None),
-                data_model: None,
-                creator: None,
-                holder_type: None,
-                tags: vec![],
-                status: Status::Draft,
-                visibility: Visibility::Private,
-                description: None,
-                r#type: vec![],
-                schema: Box::new(None),
-                schema_properties_attributes: Some(attrs),
-            })
-            .then_expect_error_message("Invalid schema_properties_attributes key(s): The following keys do not match any field in schema.properties: [name]")
+    Ok(vec![VC.to_string(), badge_type.to_string()])
+}
+
+/// Normalizes a tags vector: trims each entry, drops empty entries, deduplicates
+/// preserving first-seen order.  Returns `None` when the result would be empty.
+fn normalize_tags(tags: Option<Vec<String>>) -> Option<Vec<String>> {
+    let tags = tags?;
+
+    let mut seen = std::collections::HashSet::new();
+    let normalized: Vec<String> = tags
+        .into_iter()
+        .map(|t| t.trim().to_string())
+        .filter(|t| !t.is_empty())
+        .filter(|t| seen.insert(t.clone()))
+        .collect();
+
+    if normalized.is_empty() {
+        None
+    } else {
+        Some(normalized)
     }
+}
 
-    #[rstest]
-    #[serial_test::serial]
-    async fn test_update_field_attributes_with_invalid_keys(template_id: String) {
-        let schema = serde_json::json!({
-            "type": "object",
-            "properties": {
-                "name": { "type": "string" }
-            }
-        });
+fn ensure_template_editable(status: &Status) -> Result<(), TemplateError> {
+    match status {
+        Status::Draft | Status::Published => Ok(()),
+        Status::Archived => Err(TemplateError::ArchivedTemplateImmutable),
+        Status::Deleted => Err(TemplateError::DeletedTemplateTerminal),
+    }
+}
 
-        let mut attrs = HashMap::new();
-        attrs.insert(
-            "nonexistent".to_string(),
-            PropertyAttribute {
-                selectively_disclosable: true,
-            },
-        );
+fn ensure_status_transition_allowed(current: &Status, next: &Status) -> Result<(), TemplateError> {
+    use Status::*;
+
+    match (current, next) {
+        (Deleted, _) => Err(TemplateError::DeletedTemplateTerminal),
+        (Draft, Draft | Published | Archived | Deleted) => Ok(()),
+        (Published, Published | Archived) => Ok(()),
+        (Published, Deleted) => Err(TemplateError::ArchiveBeforeDeleteRequired),
+        (Archived, Archived | Published | Deleted) => Ok(()),
+        (from, to) => Err(TemplateError::InvalidStatusTransition(format!(
+            "cannot transition template status from `{}` to `{}`",
+            status_name(from),
+            status_name(to)
+        ))),
+    }
+}
 
-        TemplateTestFramework::with(())
-            .given(vec![TemplateEvent::TemplateCreated {
-                template_id: template_id.clone(),
-                source_template_id: None,
-                title: None,
-                display: Box::new(None),
-                data_model: None,
-                creator: None,
-                holder_type: None,
-                modified_at: test_utils::modified_at(),
-                tags: vec![],
-                status: Status::Draft,
-                visibility: Visibility::Private,
-                description: None,
-                r#type: vec![],
-                schema: Box::new(Some(schema)),
-                schema_properties_attributes: None,
-            }])
-            .when(TemplateCommand::UpdateSchemaPropertiesAttributes {
-                template_id,
-                schema_properties_attributes: attrs,
-            })
-            .then_expect_error_message("Invalid schema_properties_attributes key(s): The following keys do not match any field in schema.properties: [nonexistent]")
+fn ensure_template_can_be_deleted(status: &Status) -> Result<(), TemplateError> {
+    match status {
+        Status::Draft | Status::Archived => Ok(()),
+        Status::Published => Err(TemplateError::ArchiveBeforeDeleteRequired),
+        Status::Deleted => Err(TemplateError::DeletedTemplateTerminal),
     }
+}
 
-    #[rstest]
-    #[serial_test::serial]
-    async fn test_update_field_attributes_with_no_schema(template_id: String) {
-        let mut attrs = HashMap::new();
-        attrs.insert(
-            "name".to_string(),
-            PropertyAttribute {
-                selectively_disclosable: true,
-            },
-        );
+fn status_name(status: &Status) -> &'static str {
+    match status {
+        Status::Draft => "draft",
+        Status::Published => "published",
+        Status::Archived => "archived",
+        Status::Deleted => "deleted",
+    }
+}
 
-        TemplateTestFramework::with(())
-            .given(vec![TemplateEvent::TemplateCreated {
-                template_id: template_id.clone(),
-                source_template_id: None,
-                title: None,
-                display: Box::new(None),
-                data_model: None,
-                creator: None,
-                holder_type: None,
-                modified_at: test_utils::modified_at(),
-                tags: vec![],
-                status: Status::Draft,
-                visibility: Visibility::Private,
-                description: None,
-                r#type: vec![],
-                schema: Box::new(None),
-                schema_properties_attributes: None,
-            }])
-            .when(TemplateCommand::UpdateSchemaPropertiesAttributes {
-                template_id,
-                schema_properties_attributes: attrs,
-            })
-            .then_expect_error_message("Invalid schema_properties_attributes key(s): The following keys do not match any field in schema.properties: [name]")
+fn validate_expiration(expiration: &Expiration) -> Result<(), TemplateError> {
+    match expiration {
+        Expiration::Never => Ok(()),
+        Expiration::Duration(s) => iso8601::duration(s)
+            .map(|_| ())
+            .map_err(|_| TemplateError::InvalidExpiration(format!("`{s}` is not a valid ISO 8601 duration"))),
+        Expiration::DateTime(s) => chrono::DateTime::parse_from_rfc3339(s)
+            .map(|_| ())
+            .map_err(|e| TemplateError::InvalidExpiration(format!("`{s}` is not a valid ISO 8601 datetime: {e}"))),
     }
+}
 
-    #[rstest]
-    #[serial_test::serial]
-    async fn test_update_schema_prunes_attributes(template_id: String) {
-        let original_schema = serde_json::json!({
-            "type": "object",
-            "properties": {
-                "name": { "type": "string" },
-                "age": { "type": "integer" }
-            }
-        });
+/// Recursively collects JSON Pointer paths (RFC 6901) to all leaf fields in a JSON Schema.
+///
+/// Rules:
+/// - Object nodes with defined, non-empty sub-properties are NOT added themselves; only their
+///   leaf descendants are added.
+/// - Object nodes with no defined sub-properties (or empty `properties`) are treated as leaves.
+/// - Arrays are not currently supported and must be rejected separately.
+/// - Paths follow RFC 6901 format: `/fieldName`, `/parent/child`, `/a/b/c`.
+///
+/// This matches how `schemaPropertiesAttributes` keys must be addressed, and maps 1:1 to
+/// SD-JWT claim paths without any translation step.
+fn collect_leaf_paths(schema: &serde_json::Value) -> std::collections::HashSet<String> {
+    let mut paths = std::collections::HashSet::new();
+    collect_leaf_paths_with_prefix(schema, "", &mut paths);
+    paths
+}
 
-        let mut attrs = HashMap::new();
-        attrs.insert(
-            "name".to_string(),
-            PropertyAttribute {
-                selectively_disclosable: true,
-            },
-        );
-        attrs.insert(
-            "age".to_string(),
-            PropertyAttribute {
-                selectively_disclosable: false,
-            },
-        );
+fn collect_leaf_paths_with_prefix(
+    schema: &serde_json::Value,
+    prefix: &str,
+    paths: &mut std::collections::HashSet<String>,
+) {
+    let properties = match schema.get("properties").and_then(|p| p.as_object()) {
+        Some(p) => p,
+        None => return,
+    };
 
-        let new_schema = serde_json::json!({
-            "type": "object",
-            "properties": {
-                "name": { "type": "string" }
-            }
-        });
+    for (key, value) in properties {
+        // RFC 6901: escape `~` as `~0` and `/` as `~1` in key segments.
+        let escaped_key = key.replace('~', "~0").replace('/', "~1");
+        let path = format!("{}/{}", prefix, escaped_key);
+
+        // A node is a "nested object" only when it has defined, non-empty sub-properties.
+        // Such nodes are not added themselves — only their leaf descendants are.
+        let has_sub_properties = value
+            .get("properties")
+            .and_then(|p| p.as_object())
+            .is_some_and(|p| !p.is_empty());
+
+        if has_sub_properties {
+            collect_leaf_paths_with_prefix(value, &path, paths);
+        } else {
+            paths.insert(path);
+        }
+    }
+}
 
-        let mut expected_attrs = HashMap::new();
-        expected_attrs.insert(
-            "name".to_string(),
-            PropertyAttribute {
-                selectively_disclosable: true,
-            },
-        );
+fn validate_schema_properties_attributes(
+    schema: &Option<serde_json::Value>,
+    attributes: &HashMap<String, PropertyAttribute>,
+) -> Result<(), TemplateError> {
+    let leaf_paths = match schema {
+        Some(s) => collect_leaf_paths(s),
+        None => std::collections::HashSet::new(),
+    };
 
-        TemplateTestFramework::with(())
-            .given(vec![TemplateEvent::TemplateCreated {
-                template_id: template_id.clone(),
-                source_template_id: None,
-                title: None,
-                display: Box::new(None),
-                data_model: None,
-                creator: None,
-                holder_type: None,
-                modified_at: test_utils::modified_at(),
-                tags: vec![],
-                status: Status::Draft,
-                visibility: Visibility::Private,
-                description: None,
-                r#type: vec![],
-                schema: Box::new(Some(original_schema)),
-                schema_properties_attributes: Some(attrs),
-            }])
-            .when(TemplateCommand::UpdateSchema {
-                template_id: template_id.clone(),
-                schema: new_schema.clone(),
-            })
-            .then_expect_events(vec![
-                TemplateEvent::SchemaUpdated {
-                    template_id: template_id.clone(),
-                    schema: new_schema,
-                    modified_at: test_utils::modified_at(),
-                },
-                TemplateEvent::SchemaPropertiesAttributesUpdated {
-                    template_id,
-                    schema_properties_attributes: expected_attrs,
-                    modified_at: test_utils::modified_at(),
-                },
-            ])
+    let mut invalid_keys: Vec<&str> = attributes
+        .keys()
+        .filter(|k| !leaf_paths.contains(*k))
+        .map(|k| k.as_str())
+        .collect();
+
+    if !invalid_keys.is_empty() {
+        invalid_keys.sort();
+        return Err(TemplateError::InvalidSchemaPropertiesAttributes(format!(
+            "The following keys do not match any field in schema.properties: [{}]",
+            invalid_keys.join(", ")
+        )));
     }
 
-    #[rstest]
-    #[serial_test::serial]
-    async fn test_update_schema_no_prune_needed(template_id: String) {
-        let original_schema = serde_json::json!({
-            "type": "object",
-            "properties": {
-                "name": { "type": "string" }
-            }
-        });
+    Ok(())
+}
 
-        let mut attrs = HashMap::new();
-        attrs.insert(
-            "name".to_string(),
-            PropertyAttribute {
-                selectively_disclosable: true,
-            },
-        );
+/// Trims each key in `attributes` and returns a new map with trimmed keys.
+/// Returns an error if two distinct keys collide after trimming.
+fn trim_and_deduplicate_attribute_keys(
+    attributes: HashMap<String, PropertyAttribute>,
+) -> Result<HashMap<String, PropertyAttribute>, TemplateError> {
+    let mut result: HashMap<String, PropertyAttribute> = HashMap::new();
+    for (key, value) in attributes {
+        let trimmed = key.trim().to_string();
+        if result.contains_key(&trimmed) {
+            return Err(TemplateError::DuplicateSchemaPropertiesAttributeKey(trimmed));
+        }
+        result.insert(trimmed, value);
+    }
+    Ok(result)
+}
 
-        let new_schema = serde_json::json!({
-            "type": "object",
-            "properties": {
-                "name": { "type": "string" },
-                "age": { "type": "integer" }
+/// Ensures the `non_removable` flag on each property attribute preserves the existing
+/// system-determined value. Users cannot alter `non_removable` through commands.
+fn enforce_non_removable_flag(
+    mut new_attrs: HashMap<String, PropertyAttribute>,
+    existing_attrs: &Option<HashMap<String, PropertyAttribute>>,
+) -> HashMap<String, PropertyAttribute> {
+    if let Some(existing) = existing_attrs {
+        for (key, new_attr) in new_attrs.iter_mut() {
+            if let Some(existing_attr) = existing.get(key) {
+                new_attr.non_removable = existing_attr.non_removable;
+            } else {
+                // New properties not previously tracked default to non-removable=false.
+                new_attr.non_removable = false;
             }
-        });
-
-        TemplateTestFramework::with(())
-            .given(vec![TemplateEvent::TemplateCreated {
-                template_id: template_id.clone(),
-                source_template_id: None,
-                title: None,
-                display: Box::new(None),
-                data_model: None,
-                creator: None,
-                holder_type: None,
-                modified_at: test_utils::modified_at(),
-                tags: vec![],
-                status: Status::Draft,
-                visibility: Visibility::Private,
-                description: None,
-                r#type: vec![],
-                schema: Box::new(Some(original_schema)),
-                schema_properties_attributes: Some(attrs),
-            }])
-            .when(TemplateCommand::UpdateSchema {
-                template_id: template_id.clone(),
-                schema: new_schema.clone(),
-            })
-            .then_expect_events(vec![TemplateEvent::SchemaUpdated {
-                template_id,
-                schema: new_schema,
-                modified_at: test_utils::modified_at(),
-            }])
+        }
+    } else {
+        // No existing attributes means no non-removable flags to preserve.
+        for attr in new_attrs.values_mut() {
+            attr.non_removable = false;
+        }
     }
+    new_attrs
 }
 
+#[cfg(test)]
+#[path = "aggregate_tests.rs"]
+mod document_tests;
+
 #[cfg(feature = "test_utils")]
 pub mod test_utils {
     use super::*;
@@ -1024,8 +1018,8 @@ pub mod test_utils {
     }
 
     #[fixture]
-    pub fn title() -> Option<String> {
-        Some("Sample Template".to_string())
+    pub fn title() -> String {
+        "Sample Template".to_string()
     }
 
     #[fixture]
@@ -1037,18 +1031,13 @@ pub mod test_utils {
     }
 
     #[fixture]
-    pub fn data_model() -> Option<DataModel> {
-        Some(DataModel::W3CVcDataModelV1_1)
-    }
-
-    #[fixture]
-    pub fn creator() -> Option<String> {
-        Some("Creator Name".to_string())
+    pub fn data_model() -> DataModel {
+        DataModel::W3CVcDataModelV2_0
     }
 
     #[fixture]
-    pub fn holder_type() -> Option<HolderType> {
-        Some(HolderType::Individual)
+    pub fn holder_type() -> HolderType {
+        HolderType::Individual
     }
 
     #[fixture]
@@ -1057,8 +1046,8 @@ pub mod test_utils {
     }
 
     #[fixture]
-    pub fn tags() -> Vec<String> {
-        vec!["tag1".to_string(), "tag2".to_string()]
+    pub fn tags() -> Option<Vec<String>> {
+        Some(vec!["tag1".to_string(), "tag2".to_string()])
     }
 
     #[fixture]
@@ -1078,7 +1067,11 @@ pub mod test_utils {
 
     #[fixture]
     pub fn r#type() -> Vec<String> {
-        vec!["Type1".to_string(), "Type2".to_string()]
+        vec![
+            "VerifiableCredential".to_string(),
+            "Type1".to_string(),
+            "Type2".to_string(),
+        ]
     }
 
     #[fixture]
@@ -1095,9 +1088,10 @@ pub mod test_utils {
     pub fn schema_properties_attributes() -> Option<HashMap<String, PropertyAttribute>> {
         let mut config = HashMap::new();
         config.insert(
-            "name".to_string(),
+            "/name".to_string(),
             PropertyAttribute {
                 selectively_disclosable: true,
+                non_removable: false,
             },
         );
         Some(config)
diff --git a/agent_library/src/template/aggregate_tests.rs b/agent_library/src/template/aggregate_tests.rs
new file mode 100644
index 00000000..01d84b4e
--- /dev/null
+++ b/agent_library/src/template/aggregate_tests.rs
@@ -0,0 +1,2297 @@
+use std::collections::HashMap;
+
+use cqrs_es::test::TestFramework;
+use rstest::rstest;
+
+use super::test_utils::*;
+use super::*;
+
+type TemplateTestFramework = TestFramework<Template>;
+
+fn template_created_event_with_status(template_id: &str, status: Status) -> TemplateEvent {
+    TemplateEvent::TemplateCreated {
+        template_id: template_id.to_string(),
+        source_template_id: None,
+        title: "Test".to_string(),
+        display: Box::new(None),
+        data_model: DataModel::W3CVcDataModelV1_1,
+        holder_type: HolderType::Individual,
+        modified_at: test_utils::modified_at(),
+        tags: None,
+        status,
+        visibility: Visibility::Private,
+        credential_expiration: Expiration::default(),
+        description: None,
+        r#type: vec![],
+        schema: Box::new(None),
+        schema_properties_attributes: None,
+        holder_authorization: Authorization::default(),
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+#[rstest]
+#[serial_test::serial]
+async fn test_create_template(
+    template_id: String,
+    title: String,
+    display: Option<Display>,
+    data_model: DataModel,
+    holder_type: HolderType,
+    modified_at: String,
+    tags: Option<Vec<String>>,
+    status: Status,
+    visibility: Visibility,
+    description: Option<String>,
+    r#type: Vec<String>,
+    schema: Option<serde_json::Value>,
+    schema_properties_attributes: Option<HashMap<String, PropertyAttribute>>,
+) {
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: title.clone(),
+            display: Box::new(display.clone()),
+            data_model: data_model.clone(),
+            holder_type: holder_type.clone(),
+            tags: tags.clone(),
+            status: status.clone(),
+            visibility: visibility.clone(),
+            credential_expiration: None,
+            description: description.clone(),
+            r#type: r#type.clone(),
+            schema: Box::new(schema.clone()),
+            schema_properties_attributes: schema_properties_attributes.clone(),
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_events(vec![TemplateEvent::TemplateCreated {
+            template_id,
+            source_template_id: None,
+            title,
+            display: Box::new(display),
+            data_model,
+            holder_type,
+            modified_at,
+            tags,
+            status,
+            visibility,
+            credential_expiration: Expiration::default(),
+            description,
+            r#type,
+            schema: Box::new(schema),
+            schema_properties_attributes,
+            holder_authorization: Authorization::default(),
+        }])
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_create_template_without_title(template_id: String) {
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id,
+            source_template_id: None,
+            title: String::new(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV1_1,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec![],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_error_message("A title is required when creating or updating a template")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_create_template_with_empty_title(template_id: String) {
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id,
+            source_template_id: None,
+            title: "".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV1_1,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec![],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_error_message("A title is required when creating or updating a template")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_create_template_rejects_archived_status_on_create(template_id: String) {
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id,
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV1_1,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Archived,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec![],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_error_message("Invalid status on create: only Draft or Published are allowed")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_title_with_empty_string(template_id: String) {
+    TemplateTestFramework::with(())
+        .given(vec![TemplateEvent::TemplateCreated {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Original".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV1_1,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec![],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        }])
+        .when(TemplateCommand::UpdateTitle {
+            template_id,
+            title: "   ".to_string(),
+        })
+        .then_expect_error_message("A title is required when creating or updating a template")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_title_on_archived_template_is_rejected(template_id: String) {
+    TemplateTestFramework::with(())
+        .given(vec![template_created_event_with_status(&template_id, Status::Archived)])
+        .when(TemplateCommand::UpdateTitle {
+            template_id,
+            title: "Updated title".to_string(),
+        })
+        .then_expect_error_message("Archived templates are immutable except for status changes")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_status_from_published_to_draft_is_rejected(template_id: String) {
+    TemplateTestFramework::with(())
+        .given(vec![template_created_event_with_status(
+            &template_id,
+            Status::Published,
+        )])
+        .when(TemplateCommand::UpdateStatus {
+            template_id,
+            status: Status::Draft,
+        })
+        .then_expect_error_message(
+            "Invalid status transition: cannot transition template status from `published` to `draft`",
+        )
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_status_from_archived_to_published_is_allowed(template_id: String) {
+    TemplateTestFramework::with(())
+        .given(vec![template_created_event_with_status(&template_id, Status::Archived)])
+        .when(TemplateCommand::UpdateStatus {
+            template_id: template_id.clone(),
+            status: Status::Published,
+        })
+        .then_expect_events(vec![TemplateEvent::StatusUpdated {
+            template_id,
+            status: Status::Published,
+            modified_at: test_utils::modified_at(),
+        }])
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_tags_normalizes_input(template_id: String) {
+    TemplateTestFramework::with(())
+        .given(vec![template_created_event_with_status(&template_id, Status::Draft)])
+        .when(TemplateCommand::UpdateTags {
+            template_id: template_id.clone(),
+            tags: vec![
+                " alpha ".to_string(),
+                "".to_string(),
+                "beta".to_string(),
+                "alpha".to_string(),
+                "beta ".to_string(),
+            ],
+        })
+        .then_expect_events(vec![TemplateEvent::TagsUpdated {
+            template_id,
+            tags: vec!["alpha".to_string(), "beta".to_string()],
+            modified_at: test_utils::modified_at(),
+        }])
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_description_trims_whitespace(template_id: String) {
+    TemplateTestFramework::with(())
+        .given(vec![template_created_event_with_status(&template_id, Status::Draft)])
+        .when(TemplateCommand::UpdateDescription {
+            template_id: template_id.clone(),
+            description: "  trimmed description  ".to_string(),
+        })
+        .then_expect_events(vec![TemplateEvent::DescriptionUpdated {
+            template_id,
+            description: "trimmed description".to_string(),
+            modified_at: test_utils::modified_at(),
+        }])
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_type_normalizes_standard_input(template_id: String) {
+    TemplateTestFramework::with(())
+        .given(vec![TemplateEvent::TemplateCreated {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec!["VerifiableCredential".to_string()],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        }])
+        .when(TemplateCommand::UpdateType {
+            template_id: template_id.clone(),
+            r#type: vec![
+                "ExampleCredential".to_string(),
+                "VerifiableCredential".to_string(),
+                "ExampleCredential".to_string(),
+                "".to_string(),
+            ],
+        })
+        .then_expect_events(vec![TemplateEvent::TypeUpdated {
+            template_id,
+            r#type: vec!["VerifiableCredential".to_string(), "ExampleCredential".to_string()],
+            modified_at: test_utils::modified_at(),
+        }])
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_type_rejects_conflicting_open_badges_subtypes(template_id: String) {
+    TemplateTestFramework::with(())
+        .given(vec![TemplateEvent::TemplateCreated {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Open Badges Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::OpenBadges3_0,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec!["VerifiableCredential".to_string(), "OpenBadgeCredential".to_string()],
+            schema: Box::new(Some(serde_json::json!({
+                "type": "object",
+                "properties": {
+                    "achievement": {
+                        "type": "object",
+                        "properties": {
+                            "name": { "type": "string" },
+                            "description": { "type": "string" },
+                            "criteria": {
+                                "type": "object",
+                                "properties": {
+                                    "narrative": { "type": "string" }
+                                }
+                            }
+                        }
+                    }
+                }
+            }))),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        }])
+        .when(TemplateCommand::UpdateType {
+            template_id,
+            r#type: vec![
+                "VerifiableCredential".to_string(),
+                "OpenBadgeCredential".to_string(),
+                "AchievementCredential".to_string(),
+            ],
+        })
+        .then_expect_error_message(
+            "Invalid type: OpenBadges type cannot include both `OpenBadgeCredential` and `AchievementCredential`",
+        )
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_credential_expiration_emits_event(template_id: String) {
+    TemplateTestFramework::with(())
+        .given(vec![template_created_event_with_status(&template_id, Status::Draft)])
+        .when(TemplateCommand::UpdateCredentialExpiration {
+            template_id: template_id.clone(),
+            credential_expiration: Expiration::Duration("P30D".to_string()),
+        })
+        .then_expect_events(vec![TemplateEvent::CredentialExpirationUpdated {
+            template_id,
+            credential_expiration: Expiration::Duration("P30D".to_string()),
+            modified_at: test_utils::modified_at(),
+        }])
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_credential_expiration_rejects_invalid_iso8601(template_id: String) {
+    TemplateTestFramework::with(())
+        .given(vec![template_created_event_with_status(&template_id, Status::Draft)])
+        .when(TemplateCommand::UpdateCredentialExpiration {
+            template_id,
+            credential_expiration: Expiration::Duration("30 days".to_string()),
+        })
+        .then_expect_error_message("Invalid expiration value: `30 days` is not a valid ISO 8601 duration")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_create_open_badges_template_rejects_extra_types(template_id: String) {
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "OB with extra types".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::OpenBadges3_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec![
+                "VerifiableCredential".to_string(),
+                "OpenBadgeCredential".to_string(),
+                "ExtraType".to_string(),
+            ],
+            schema: Box::new(Some(serde_json::json!({
+                "type": "object",
+                "properties": {
+                    "achievement": {
+                        "type": "object",
+                        "properties": {
+                            "name": { "type": "string" },
+                            "description": { "type": "string" },
+                            "criteria": {
+                                "type": "object",
+                                "properties": {
+                                    "narrative": { "type": "string" }
+                                }
+                            }
+                        }
+                    }
+                }
+            }))),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_error_message("Invalid type: OpenBadges type includes disallowed extra entries: [ExtraType]")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_status_reject_invalid_archived_to_draft(template_id: String) {
+    TemplateTestFramework::with(())
+        .given(vec![TemplateEvent::TemplateCreated {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Archived,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec!["VerifiableCredential".to_string()],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        }])
+        .when(TemplateCommand::UpdateStatus {
+            template_id,
+            status: Status::Draft,
+        })
+        .then_expect_error_message(
+            "Invalid status transition: cannot transition template status from `archived` to `draft`",
+        )
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_create_open_badges_template_missing_required_achievement_properties(template_id: String) {
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "OB Missing Props".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::OpenBadges3_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec![
+                "VerifiableCredential".to_string(),
+                "OpenBadgeCredential".to_string(),
+            ],
+            schema: Box::new(Some(serde_json::json!({
+                "type": "object",
+                "properties": {
+                    "achievement": {
+                        "type": "object",
+                        "properties": {
+                            "description": { "type": "string" }
+                        }
+                    }
+                }
+            }))),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_error_message(
+            "Missing required OpenBadges 3.0 schema properties: The following required fields must be present in the schema for OpenBadges 3.0 templates: [/achievement/criteria, /achievement/name]"
+        )
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_create_open_badges_template_with_array_type_in_schema(template_id: String) {
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "OB with array type".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::OpenBadges3_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec![
+                "VerifiableCredential".to_string(),
+                "OpenBadgeCredential".to_string(),
+            ],
+            schema: Box::new(Some(serde_json::json!({
+                "type": "object",
+                "properties": {
+                    "achievement": {
+                        "type": "object",
+                        "properties": {
+                            "name": { "type": "string" },
+                            "description": { "type": "string" },
+                            "criteria": {
+                                "type": "object",
+                                "properties": {
+                                    "narrative": { "type": "string" },
+                                    "tags": { "type": "array" }
+                                }
+                            }
+                        }
+                    }
+                }
+            }))),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_error_message(
+            "Invalid JSON Schema: Array types are not supported in template schemas. Define only object and scalar fields."
+        )
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_delete_template_from_published_requires_archive_first(template_id: String) {
+    TemplateTestFramework::with(())
+        .given(vec![template_created_event_with_status(
+            &template_id,
+            Status::Published,
+        )])
+        .when(TemplateCommand::DeleteTemplate { template_id })
+        .then_expect_error_message("Published templates must be archived before they can be deleted")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_delete_template_from_archived_is_allowed(template_id: String) {
+    TemplateTestFramework::with(())
+        .given(vec![template_created_event_with_status(&template_id, Status::Archived)])
+        .when(TemplateCommand::DeleteTemplate {
+            template_id: template_id.clone(),
+        })
+        .then_expect_events(vec![TemplateEvent::TemplateDeleted { template_id }])
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_deleted_template_status_is_terminal(template_id: String) {
+    TemplateTestFramework::with(())
+        .given(vec![
+            template_created_event_with_status(&template_id, Status::Draft),
+            TemplateEvent::TemplateDeleted {
+                template_id: template_id.clone(),
+            },
+        ])
+        .when(TemplateCommand::UpdateStatus {
+            template_id,
+            status: Status::Published,
+        })
+        .then_expect_error_message("Deleted templates are terminal and cannot be changed")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_create_template_with_invalid_schema(template_id: String) {
+    let invalid_schema = serde_json::json!({
+        "type": "not_a_valid_type"
+    });
+
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id,
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV1_1,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(invalid_schema)),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_error_message("Invalid JSON Schema: \"not_a_valid_type\" is not valid under any of the schemas listed in the 'anyOf' keyword")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_create_template_with_no_schema(template_id: String) {
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV1_1,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec![],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_events(vec![TemplateEvent::TemplateCreated {
+            template_id,
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV1_1,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec!["VerifiableCredential".to_string()],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        }])
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_schema_with_invalid_schema(template_id: String) {
+    let invalid_schema = serde_json::json!({
+        "type": "not_a_valid_type"
+    });
+
+    TemplateTestFramework::with(())
+        .given(vec![TemplateEvent::TemplateCreated {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV1_1,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec![],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        }])
+        .when(TemplateCommand::UpdateSchema {
+            template_id,
+            schema: invalid_schema,
+        })
+        .then_expect_error_message("Invalid JSON Schema: \"not_a_valid_type\" is not valid under any of the schemas listed in the 'anyOf' keyword")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_schema_with_valid_schema(template_id: String) {
+    let valid_schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "name": { "type": "string" }
+        }
+    });
+
+    TemplateTestFramework::with(())
+        .given(vec![TemplateEvent::TemplateCreated {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV1_1,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec![],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        }])
+        .when(TemplateCommand::UpdateSchema {
+            template_id: template_id.clone(),
+            schema: valid_schema,
+        })
+        .then_expect_events(vec![TemplateEvent::SchemaUpdated {
+            template_id,
+            schema: serde_json::json!({
+                "type": "object",
+                "properties": {
+                    "name": { "type": "string" }
+                }
+            }),
+            modified_at: test_utils::modified_at(),
+        }])
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_create_template_with_invalid_schema_properties_attributes(template_id: String) {
+    let schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "name": { "type": "string" }
+        }
+    });
+
+    let mut attrs = HashMap::new();
+    attrs.insert(
+        "nonexistent".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: true,
+            non_removable: false,
+        },
+    );
+
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id,
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(schema)),
+            schema_properties_attributes: Some(attrs),
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_error_message("Invalid schema_properties_attributes key(s): The following keys do not match any field in schema.properties: [nonexistent]")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_create_template_with_attributes_but_no_schema(template_id: String) {
+    let mut attrs = HashMap::new();
+    attrs.insert(
+        "name".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: true,
+            non_removable: false,
+        },
+    );
+
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id,
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec![],
+            schema: Box::new(None),
+            schema_properties_attributes: Some(attrs),
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_error_message("Invalid schema_properties_attributes key(s): The following keys do not match any field in schema.properties: [name]")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_create_template_rejects_schema_properties_attributes_for_vc_1_1(template_id: String) {
+    let schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "name": { "type": "string" }
+        }
+    });
+
+    let mut attrs = HashMap::new();
+    attrs.insert(
+        "/name".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: true,
+            non_removable: false,
+        },
+    );
+
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id,
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV1_1,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(schema)),
+            schema_properties_attributes: Some(attrs),
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_error_message("schemaPropertiesAttributes are not allowed for W3C VC 1.1 templates")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_field_attributes_with_invalid_keys(template_id: String) {
+    let schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "name": { "type": "string" }
+        }
+    });
+
+    let mut attrs = HashMap::new();
+    attrs.insert(
+        "nonexistent".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: true,
+            non_removable: false,
+        },
+    );
+
+    TemplateTestFramework::with(())
+        .given(vec![TemplateEvent::TemplateCreated {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(schema)),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        }])
+        .when(TemplateCommand::UpdateSchemaPropertiesAttributes {
+            template_id,
+            schema_properties_attributes: attrs,
+        })
+        .then_expect_error_message("Invalid schema_properties_attributes key(s): The following keys do not match any field in schema.properties: [nonexistent]")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_field_attributes_with_no_schema(template_id: String) {
+    let mut attrs = HashMap::new();
+    attrs.insert(
+        "name".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: true,
+            non_removable: false,
+        },
+    );
+
+    TemplateTestFramework::with(())
+        .given(vec![TemplateEvent::TemplateCreated {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec![],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        }])
+        .when(TemplateCommand::UpdateSchemaPropertiesAttributes {
+            template_id,
+            schema_properties_attributes: attrs,
+        })
+        .then_expect_error_message("Invalid schema_properties_attributes key(s): The following keys do not match any field in schema.properties: [name]")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_field_attributes_rejected_for_vc_1_1(template_id: String) {
+    let schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "name": { "type": "string" }
+        }
+    });
+
+    let mut attrs = HashMap::new();
+    attrs.insert(
+        "/name".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: true,
+            non_removable: false,
+        },
+    );
+
+    TemplateTestFramework::with(())
+        .given(vec![TemplateEvent::TemplateCreated {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV1_1,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(schema)),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        }])
+        .when(TemplateCommand::UpdateSchemaPropertiesAttributes {
+            template_id,
+            schema_properties_attributes: attrs,
+        })
+        .then_expect_error_message("schemaPropertiesAttributes are not allowed for W3C VC 1.1 templates")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_field_attributes_rejects_duplicate_trimmed_keys(template_id: String) {
+    let schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "name": { "type": "string" }
+        }
+    });
+
+    let mut attrs = HashMap::new();
+    attrs.insert(
+        "/name".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: true,
+            non_removable: false,
+        },
+    );
+    attrs.insert(
+        " /name ".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: false,
+        },
+    );
+
+    TemplateTestFramework::with(())
+        .given(vec![TemplateEvent::TemplateCreated {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(schema)),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        }])
+        .when(TemplateCommand::UpdateSchemaPropertiesAttributes {
+            template_id,
+            schema_properties_attributes: attrs,
+        })
+        .then_expect_error_message("Duplicate schemaPropertiesAttributes key after trimming: `/name`")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_schema_prunes_attributes(template_id: String) {
+    let original_schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "name": { "type": "string" },
+            "age": { "type": "integer" }
+        }
+    });
+
+    let mut attrs = HashMap::new();
+    attrs.insert(
+        "/name".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: true,
+            non_removable: false,
+        },
+    );
+    attrs.insert(
+        "/age".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: false,
+        },
+    );
+
+    let new_schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "name": { "type": "string" }
+        }
+    });
+
+    let mut expected_attrs = HashMap::new();
+    expected_attrs.insert(
+        "/name".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: true,
+            non_removable: false,
+        },
+    );
+
+    TemplateTestFramework::with(())
+        .given(vec![TemplateEvent::TemplateCreated {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV1_1,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(original_schema)),
+            schema_properties_attributes: Some(attrs),
+            holder_authorization: Authorization::default(),
+        }])
+        .when(TemplateCommand::UpdateSchema {
+            template_id: template_id.clone(),
+            schema: new_schema.clone(),
+        })
+        .then_expect_events(vec![
+            TemplateEvent::SchemaUpdated {
+                template_id: template_id.clone(),
+                schema: serde_json::json!({
+                    "type": "object",
+                    "properties": { "name": { "type": "string" } }
+                }),
+                modified_at: test_utils::modified_at(),
+            },
+            TemplateEvent::SchemaPropertiesAttributesUpdated {
+                template_id,
+                schema_properties_attributes: expected_attrs,
+                modified_at: test_utils::modified_at(),
+            },
+        ])
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_schema_no_prune_needed(template_id: String) {
+    let original_schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "name": { "type": "string" }
+        }
+    });
+
+    let mut attrs = HashMap::new();
+    attrs.insert(
+        "/name".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: true,
+            non_removable: false,
+        },
+    );
+
+    let new_schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "name": { "type": "string" },
+            "age": { "type": "integer" }
+        }
+    });
+
+    TemplateTestFramework::with(())
+        .given(vec![TemplateEvent::TemplateCreated {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV1_1,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(original_schema)),
+            schema_properties_attributes: Some(attrs),
+            holder_authorization: Authorization::default(),
+        }])
+        .when(TemplateCommand::UpdateSchema {
+            template_id: template_id.clone(),
+            schema: new_schema,
+        })
+        .then_expect_events(vec![TemplateEvent::SchemaUpdated {
+            template_id,
+            schema: serde_json::json!({
+                "type": "object",
+                "properties": {
+                    "name": { "type": "string" },
+                    "age": { "type": "integer" }
+                }
+            }),
+            modified_at: test_utils::modified_at(),
+        }])
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_schema_rejects_removal_of_immutable_property(template_id: String) {
+    // Use a W3C VC template where a field has been manually marked non_removable=true
+    // (e.g. by a previous system action). Verify that updating the schema to remove
+    // that field is rejected.
+    let original_schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "name": { "type": "string" },
+            "description": { "type": "string" }
+        },
+        "additionalProperties": false
+    });
+
+    let mut attrs = HashMap::new();
+    attrs.insert(
+        "/name".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: true,
+        },
+    );
+    attrs.insert(
+        "/description".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: false,
+        },
+    );
+
+    // Try to remove the non-removable "/name" property.
+    let new_schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "description": { "type": "string" }
+        }
+    });
+
+    TemplateTestFramework::with(())
+        .given(vec![TemplateEvent::TemplateCreated {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(original_schema)),
+            schema_properties_attributes: Some(attrs),
+            holder_authorization: Authorization::default(),
+        }])
+        .when(TemplateCommand::UpdateSchema {
+            template_id,
+            schema: new_schema,
+        })
+        .then_expect_error_message("Cannot remove immutable schema properties: The following non-removable properties cannot be removed from the schema: [/name]")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_schema_allows_removal_of_non_immutable_property(template_id: String) {
+    // OB template with nested schema. Achievement has required fields (non_removable)
+    // plus an optional "tag" field (non_removable: false). Removing "tag" must succeed.
+    let original_schema = serde_json::json!({
+        "type": "object",
+        "required": ["achievement"],
+        "properties": {
+            "achievement": {
+                "type": "object",
+                "required": ["name", "description", "criteria"],
+                "properties": {
+                    "name": { "type": "string" },
+                    "description": { "type": "string" },
+                    "criteria": {
+                        "type": "object",
+                        "required": ["narrative"],
+                        "properties": {
+                            "narrative": { "type": "string" }
+                        },
+                        "additionalProperties": false
+                    },
+                    "tag": { "type": "string" }
+                },
+                "additionalProperties": false
+            }
+        },
+        "additionalProperties": false
+    });
+
+    let mut attrs = HashMap::new();
+    attrs.insert(
+        "/achievement/name".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: true,
+        },
+    );
+    attrs.insert(
+        "/achievement/description".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: true,
+        },
+    );
+    attrs.insert(
+        "/achievement/criteria/narrative".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: true,
+        },
+    );
+    attrs.insert(
+        "/achievement/tag".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: false,
+        },
+    );
+
+    // Remove non-removable "/achievement/tag" — should succeed.
+    let new_schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "achievement": {
+                "type": "object",
+                "properties": {
+                    "name": { "type": "string" },
+                    "description": { "type": "string" },
+                    "criteria": {
+                        "type": "object",
+                        "properties": {
+                            "narrative": { "type": "string" }
+                        }
+                    }
+                }
+            }
+        }
+    });
+
+    let mut expected_attrs = HashMap::new();
+    expected_attrs.insert(
+        "/achievement/name".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: true,
+        },
+    );
+    expected_attrs.insert(
+        "/achievement/description".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: true,
+        },
+    );
+    expected_attrs.insert(
+        "/achievement/criteria/narrative".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: true,
+        },
+    );
+
+    let expected_schema = serde_json::json!({
+        "type": "object",
+        "required": ["achievement"],
+        "properties": {
+            "achievement": {
+                "type": "object",
+                "required": ["criteria", "description", "name"],
+                "properties": {
+                    "name": { "type": "string" },
+                    "description": { "type": "string" },
+                    "criteria": {
+                        "type": "object",
+                        "required": ["narrative"],
+                        "properties": {
+                            "narrative": { "type": "string" }
+                        }
+                    }
+                }
+            }
+        }
+    });
+
+    TemplateTestFramework::with(())
+        .given(vec![TemplateEvent::TemplateCreated {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::OpenBadges3_0,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(original_schema)),
+            schema_properties_attributes: Some(attrs),
+            holder_authorization: Authorization::default(),
+        }])
+        .when(TemplateCommand::UpdateSchema {
+            template_id: template_id.clone(),
+            schema: new_schema,
+        })
+        .then_expect_events(vec![
+            TemplateEvent::SchemaUpdated {
+                template_id: template_id.clone(),
+                schema: expected_schema,
+                modified_at: test_utils::modified_at(),
+            },
+            TemplateEvent::SchemaPropertiesAttributesUpdated {
+                template_id,
+                schema_properties_attributes: expected_attrs,
+                modified_at: test_utils::modified_at(),
+            },
+        ])
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_create_open_badges_template_errors_when_required_properties_missing(template_id: String) {
+    // Nested OB schema that has only description — missing name and criteria/narrative.
+    let schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "achievement": {
+                "type": "object",
+                "properties": {
+                    "description": { "type": "string" }
+                }
+            }
+        }
+    });
+
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id,
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::OpenBadges3_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(schema)),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_error_message("Missing required OpenBadges 3.0 schema properties: The following required fields must be present in the schema for OpenBadges 3.0 templates: [/achievement/criteria, /achievement/name]")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_create_open_badges_template_succeeds_with_required_properties(template_id: String) {
+    let schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "achievement": {
+                "type": "object",
+                "properties": {
+                    "name": { "type": "string" },
+                    "description": { "type": "string" },
+                    "criteria": {
+                        "type": "object",
+                        "properties": {
+                            "narrative": { "type": "string" }
+                        }
+                    }
+                }
+            }
+        }
+    });
+
+    let mut expected_attrs = HashMap::new();
+    expected_attrs.insert(
+        "/achievement/name".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: true,
+        },
+    );
+    expected_attrs.insert(
+        "/achievement/description".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: true,
+        },
+    );
+    expected_attrs.insert(
+        "/achievement/criteria/narrative".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: true,
+        },
+    );
+
+    let expected_schema = serde_json::json!({
+        "type": "object",
+        "required": ["achievement"],
+        "properties": {
+            "achievement": {
+                "type": "object",
+                "required": ["criteria", "description", "name"],
+                "properties": {
+                    "name": { "type": "string" },
+                    "description": { "type": "string" },
+                    "criteria": {
+                        "type": "object",
+                        "required": ["narrative"],
+                        "properties": {
+                            "narrative": { "type": "string" }
+                        }
+                    }
+                }
+            }
+        }
+    });
+
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::OpenBadges3_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(schema)),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_events(vec![TemplateEvent::TemplateCreated {
+            template_id,
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::OpenBadges3_0,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec!["VerifiableCredential".to_string(), "OpenBadgeCredential".to_string()],
+            schema: Box::new(Some(expected_schema)),
+            schema_properties_attributes: Some(expected_attrs),
+            holder_authorization: Authorization::default(),
+        }])
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_create_open_badges_template_succeeds_with_const_required_properties(template_id: String) {
+    let schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "achievement": {
+                "type": "object",
+                "properties": {
+                    "name": { "const": "Fixed Achievement Name" },
+                    "description": { "type": "string" },
+                    "criteria": {
+                        "type": "object",
+                        "properties": {
+                            "narrative": { "type": "string" }
+                        }
+                    }
+                }
+            }
+        }
+    });
+
+    let mut expected_attrs = HashMap::new();
+    expected_attrs.insert(
+        "/achievement/name".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: true,
+        },
+    );
+    expected_attrs.insert(
+        "/achievement/description".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: true,
+        },
+    );
+    expected_attrs.insert(
+        "/achievement/criteria/narrative".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: true,
+        },
+    );
+
+    let expected_schema = serde_json::json!({
+        "type": "object",
+        "required": ["achievement"],
+        "properties": {
+            "achievement": {
+                "type": "object",
+                "required": ["criteria", "description", "name"],
+                "properties": {
+                    "name": { "const": "Fixed Achievement Name" },
+                    "description": { "type": "string" },
+                    "criteria": {
+                        "type": "object",
+                        "required": ["narrative"],
+                        "properties": {
+                            "narrative": { "type": "string" }
+                        }
+                    }
+                }
+            }
+        }
+    });
+
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::OpenBadges3_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(schema)),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_events(vec![TemplateEvent::TemplateCreated {
+            template_id,
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::OpenBadges3_0,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec!["VerifiableCredential".to_string(), "OpenBadgeCredential".to_string()],
+            schema: Box::new(Some(expected_schema)),
+            schema_properties_attributes: Some(expected_attrs),
+            holder_authorization: Authorization::default(),
+        }])
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_attributes_cannot_change_immutable_flag(template_id: String) {
+    let schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "name": { "type": "string" }
+        }
+    });
+
+    let mut existing_attrs = HashMap::new();
+    existing_attrs.insert(
+        "/name".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: true,
+        },
+    );
+
+    // User tries to set non_removable to false — it should be preserved as true.
+    let mut user_attrs = HashMap::new();
+    user_attrs.insert(
+        "/name".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: true,
+            non_removable: false, // User tries to change this
+        },
+    );
+
+    let mut expected_attrs = HashMap::new();
+    expected_attrs.insert(
+        "/name".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: true,
+            non_removable: true, // System preserves non_removable
+        },
+    );
+
+    TemplateTestFramework::with(())
+        .given(vec![TemplateEvent::TemplateCreated {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::OpenBadges3_0,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(schema)),
+            schema_properties_attributes: Some(existing_attrs),
+            holder_authorization: Authorization::default(),
+        }])
+        .when(TemplateCommand::UpdateSchemaPropertiesAttributes {
+            template_id: template_id.clone(),
+            schema_properties_attributes: user_attrs,
+        })
+        .then_expect_events(vec![TemplateEvent::SchemaPropertiesAttributesUpdated {
+            template_id,
+            schema_properties_attributes: expected_attrs,
+            modified_at: test_utils::modified_at(),
+        }])
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_create_open_badges_template_rejects_disallowed_properties(template_id: String) {
+    // A property at the root level that is not in AchievementSubject def.
+    let schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "achievement": {
+                "type": "object",
+                "properties": {
+                    "name": { "type": "string" },
+                    "description": { "type": "string" },
+                    "criteria": {
+                        "type": "object",
+                        "properties": {
+                            "narrative": { "type": "string" }
+                        }
+                    }
+                }
+            },
+            "not_allowed_field": { "type": "string" }
+        }
+    });
+
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id,
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::OpenBadges3_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(schema)),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_error_message("Disallowed OpenBadges 3.0 schema properties: The following properties are not allowed for OpenBadges 3.0 templates at path `/`: [not_allowed_field]")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_schema_rejects_disallowed_open_badges_properties(template_id: String) {
+    let original_schema = serde_json::json!({
+        "type": "object",
+        "required": ["achievement"],
+        "properties": {
+            "achievement": {
+                "type": "object",
+                "required": ["name", "description", "criteria"],
+                "properties": {
+                    "name": { "type": "string" },
+                    "description": { "type": "string" },
+                    "criteria": {
+                        "type": "object",
+                        "required": ["narrative"],
+                        "properties": {
+                            "narrative": { "type": "string" }
+                        },
+                        "additionalProperties": false
+                    }
+                },
+                "additionalProperties": false
+            }
+        },
+        "additionalProperties": false
+    });
+
+    let mut attrs = HashMap::new();
+    attrs.insert(
+        "/achievement/name".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: true,
+        },
+    );
+    attrs.insert(
+        "/achievement/description".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: true,
+        },
+    );
+    attrs.insert(
+        "/achievement/criteria/narrative".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: true,
+        },
+    );
+
+    // New schema adds an invalid root-level field.
+    let new_schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "achievement": {
+                "type": "object",
+                "properties": {
+                    "name": { "type": "string" },
+                    "description": { "type": "string" },
+                    "criteria": {
+                        "type": "object",
+                        "properties": {
+                            "narrative": { "type": "string" }
+                        }
+                    }
+                }
+            },
+            "invalid_field": { "type": "string" }
+        }
+    });
+
+    TemplateTestFramework::with(())
+        .given(vec![TemplateEvent::TemplateCreated {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::OpenBadges3_0,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(original_schema)),
+            schema_properties_attributes: Some(attrs),
+            holder_authorization: Authorization::default(),
+        }])
+        .when(TemplateCommand::UpdateSchema {
+            template_id,
+            schema: new_schema,
+        })
+        .then_expect_error_message("Disallowed OpenBadges 3.0 schema properties: The following properties are not allowed for OpenBadges 3.0 templates at path `/`: [invalid_field]")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_create_open_badges_template_allows_valid_optional_properties(template_id: String) {
+    // Nested OB schema with all required fields plus allowed optional fields.
+    let schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "achievement": {
+                "type": "object",
+                "properties": {
+                    "name": { "type": "string" },
+                    "description": { "type": "string" },
+                    "criteria": {
+                        "type": "object",
+                        "properties": {
+                            "narrative": { "type": "string" },
+                            "id": { "type": "string" }
+                        }
+                    },
+                    "image": { "type": "string" },
+                    "achievementType": { "type": "string" },
+                    "tag": { "type": "string" }
+                }
+            }
+        }
+    });
+
+    let required_paths = open_badges_required_leaf_paths();
+    let mut expected_attrs = HashMap::new();
+    for key in [
+        "/achievement/name",
+        "/achievement/description",
+        "/achievement/criteria/narrative",
+        "/achievement/criteria/id",
+        "/achievement/image",
+        "/achievement/achievementType",
+        "/achievement/tag",
+    ] {
+        expected_attrs.insert(
+            key.to_string(),
+            PropertyAttribute {
+                selectively_disclosable: false,
+                non_removable: required_paths.contains(&key.to_string()),
+            },
+        );
+    }
+
+    let expected_schema = serde_json::json!({
+        "type": "object",
+        "required": ["achievement"],
+        "properties": {
+            "achievement": {
+                "type": "object",
+                "required": ["criteria", "description", "name"],
+                "properties": {
+                    "name": { "type": "string" },
+                    "description": { "type": "string" },
+                    "criteria": {
+                        "type": "object",
+                        "required": ["narrative"],
+                        "properties": {
+                            "narrative": { "type": "string" },
+                            "id": { "type": "string" }
+                        }
+                    },
+                    "image": { "type": "string" },
+                    "achievementType": { "type": "string" },
+                    "tag": { "type": "string" }
+                }
+            }
+        }
+    });
+
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::OpenBadges3_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(schema)),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_events(vec![TemplateEvent::TemplateCreated {
+            template_id,
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::OpenBadges3_0,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec!["VerifiableCredential".to_string(), "OpenBadgeCredential".to_string()],
+            schema: Box::new(Some(expected_schema)),
+            schema_properties_attributes: Some(expected_attrs),
+            holder_authorization: Authorization::default(),
+        }])
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_create_open_badges_template_preserves_dollar_schema_keyword(template_id: String) {
+    // Callers may include the standard `$schema` meta-schema keyword so their tooling
+    // (editors, validators) can validate credential data against the JSON Schema draft
+    // before sending it to the API.  The keyword must be accepted and round-tripped.
+    let schema = serde_json::json!({
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+            "achievement": {
+                "type": "object",
+                "properties": {
+                    "name": { "type": "string" },
+                    "description": { "type": "string" },
+                    "criteria": {
+                        "type": "object",
+                        "properties": {
+                            "narrative": { "type": "string" }
+                        }
+                    }
+                }
+            }
+        }
+    });
+
+    let required_paths = open_badges_required_leaf_paths();
+    let mut expected_attrs = HashMap::new();
+    for key in [
+        "/achievement/name",
+        "/achievement/description",
+        "/achievement/criteria/narrative",
+    ] {
+        expected_attrs.insert(
+            key.to_string(),
+            PropertyAttribute {
+                selectively_disclosable: false,
+                non_removable: required_paths.contains(&key.to_string()),
+            },
+        );
+    }
+
+    let expected_schema = serde_json::json!({
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "required": ["achievement"],
+        "properties": {
+            "achievement": {
+                "type": "object",
+                "required": ["criteria", "description", "name"],
+                "properties": {
+                    "name": { "type": "string" },
+                    "description": { "type": "string" },
+                    "criteria": {
+                        "type": "object",
+                        "required": ["narrative"],
+                        "properties": {
+                            "narrative": { "type": "string" }
+                        }
+                    }
+                }
+            }
+        }
+    });
+
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::OpenBadges3_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(schema)),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_events(vec![TemplateEvent::TemplateCreated {
+            template_id,
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::OpenBadges3_0,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec!["VerifiableCredential".to_string(), "OpenBadgeCredential".to_string()],
+            schema: Box::new(Some(expected_schema)),
+            schema_properties_attributes: Some(expected_attrs),
+            holder_authorization: Authorization::default(),
+        }])
+}
+
+// ── array-type rejection ─────────────────────────────────────────────────────
+
+#[rstest]
+#[serial_test::serial]
+async fn test_create_template_rejects_array_type(template_id: String) {
+    let schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "tags": { "type": "array", "items": { "type": "string" } }
+        }
+    });
+
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id,
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(schema)),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_error_message("Invalid JSON Schema: Array types are not supported in template schemas. Define only object and scalar fields.")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_update_schema_rejects_array_type(template_id: String) {
+    let schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "items": { "type": "array", "items": { "type": "string" } }
+        }
+    });
+
+    TemplateTestFramework::with(())
+        .given(vec![TemplateEvent::TemplateCreated {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec![],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: Authorization::default(),
+        }])
+        .when(TemplateCommand::UpdateSchema {
+            template_id,
+            schema,
+        })
+        .then_expect_error_message("Invalid JSON Schema: Array types are not supported in template schemas. Define only object and scalar fields.")
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_create_template_with_nested_schema_and_jp_attribute_key(template_id: String) {
+    // A nested schema should be addressable with JSON Pointer attribute keys (leaf only).
+    let schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "address": {
+                "type": "object",
+                "properties": {
+                    "city": { "type": "string" },
+                    "country": { "type": "string" }
+                }
+            }
+        }
+    });
+
+    let mut attrs = HashMap::new();
+    attrs.insert(
+        "/address/city".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: true,
+            non_removable: false,
+        },
+    );
+    attrs.insert(
+        "/address/country".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: false,
+            non_removable: false,
+        },
+    );
+
+    // The nested object `address` is stored as provided by the caller.
+    let expected_schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "address": {
+                "type": "object",
+                "properties": {
+                    "city": { "type": "string" },
+                    "country": { "type": "string" }
+                }
+            }
+        }
+    });
+
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id: template_id.clone(),
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(schema)),
+            schema_properties_attributes: Some(attrs.clone()),
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_events(vec![TemplateEvent::TemplateCreated {
+            template_id,
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            modified_at: test_utils::modified_at(),
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::default(),
+            description: None,
+            r#type: vec!["VerifiableCredential".to_string()],
+            schema: Box::new(Some(expected_schema)),
+            schema_properties_attributes: Some(attrs),
+            holder_authorization: Authorization::default(),
+        }])
+}
+
+#[rstest]
+#[serial_test::serial]
+async fn test_create_template_rejects_attribute_key_pointing_to_object_node(template_id: String) {
+    // The intermediate `address` node is not a leaf and must not be addressed.
+    let schema = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "address": {
+                "type": "object",
+                "properties": {
+                    "city": { "type": "string" }
+                }
+            }
+        }
+    });
+
+    let mut attrs = HashMap::new();
+    attrs.insert(
+        "/address".to_string(),
+        PropertyAttribute {
+            selectively_disclosable: true,
+            non_removable: false,
+        },
+    );
+
+    TemplateTestFramework::with(())
+        .given_no_previous_events()
+        .when(TemplateCommand::CreateNewTemplate {
+            template_id,
+            source_template_id: None,
+            title: "Test".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            tags: None,
+            status: Status::Draft,
+            visibility: Visibility::Private,
+            credential_expiration: None,
+            description: None,
+            r#type: vec![],
+            schema: Box::new(Some(schema)),
+            schema_properties_attributes: Some(attrs),
+            holder_authorization: Authorization::default(),
+        })
+        .then_expect_error_message("Invalid schema_properties_attributes key(s): The following keys do not match any field in schema.properties: [/address]")
+}
diff --git a/agent_library/src/template/command.rs b/agent_library/src/template/command.rs
index cff86786..cd7fbf01 100644
--- a/agent_library/src/template/command.rs
+++ b/agent_library/src/template/command.rs
@@ -1,26 +1,28 @@
 use std::collections::HashMap;
 
-pub use super::aggregate::{DataModel, Display, HolderType, PropertyAttribute, Status, Visibility};
+pub use super::aggregate::{DataModel, Display, Expiration, HolderType, PropertyAttribute, Status, Visibility};
+use agent_shared::config::Authorization;
 use serde::Deserialize;
 
 #[derive(Debug, Deserialize)]
 #[serde(untagged)]
 pub enum TemplateCommand {
-    CreateTemplate {
+    CreateNewTemplate {
         template_id: String,
         source_template_id: Option<String>,
-        title: Option<String>,
+        title: String,
         display: Box<Option<Display>>,
-        data_model: Option<DataModel>,
-        creator: Option<String>,
-        holder_type: Option<HolderType>,
-        tags: Vec<String>,
+        data_model: DataModel,
+        holder_type: HolderType,
+        tags: Option<Vec<String>>,
         status: Status,
         visibility: Visibility,
+        credential_expiration: Option<Expiration>,
         description: Option<String>,
         r#type: Vec<String>,
         schema: Box<Option<serde_json::Value>>,
         schema_properties_attributes: Option<HashMap<String, PropertyAttribute>>,
+        holder_authorization: Authorization,
     },
     UpdateTitle {
         template_id: String,
@@ -30,18 +32,6 @@ pub enum TemplateCommand {
         template_id: String,
         display: Display,
     },
-    UpdateDataModel {
-        template_id: String,
-        data_model: DataModel,
-    },
-    UpdateCreator {
-        template_id: String,
-        creator: String,
-    },
-    UpdateHolderType {
-        template_id: String,
-        holder_type: HolderType,
-    },
     UpdateTags {
         template_id: String,
         tags: Vec<String>,
@@ -70,6 +60,14 @@ pub enum TemplateCommand {
         template_id: String,
         schema_properties_attributes: HashMap<String, PropertyAttribute>,
     },
+    UpdateCredentialExpiration {
+        template_id: String,
+        credential_expiration: Expiration,
+    },
+    UpdateHolderAuthorization {
+        template_id: String,
+        holder_authorization: Authorization,
+    },
     DeleteTemplate {
         template_id: String,
     },
diff --git a/agent_library/src/template/error.rs b/agent_library/src/template/error.rs
index aa2851c6..7e3fd522 100644
--- a/agent_library/src/template/error.rs
+++ b/agent_library/src/template/error.rs
@@ -4,6 +4,42 @@ use thiserror::Error;
 pub enum TemplateError {
     #[error("Invalid JSON Schema: {0}")]
     InvalidSchema(String),
+    #[error("Invalid status transition: {0}")]
+    InvalidStatusTransition(String),
+    #[error("Invalid status on create: only Draft or Published are allowed")]
+    InvalidStatusOnCreate,
     #[error("Invalid schema_properties_attributes key(s): {0}")]
     InvalidSchemaPropertiesAttributes(String),
+    #[error("Cannot remove immutable schema properties: {0}")]
+    NonRemovablePropertyViolation(String),
+    #[error("Disallowed OpenBadges 3.0 schema properties: {0}")]
+    DisallowedOpenBadgesProperties(String),
+    #[error("Missing required OpenBadges 3.0 schema properties: {0}")]
+    MissingRequiredOpenBadgesProperties(String),
+    #[error("Invalid type for required OpenBadges 3.0 schema properties: {0}")]
+    InvalidRequiredPropertyType(String),
+    #[error("A title is required when creating or updating a template")]
+    MissingTitle,
+    #[error("Archived templates are immutable except for status changes")]
+    ArchivedTemplateImmutable,
+    #[error("Deleted templates are terminal and cannot be changed")]
+    DeletedTemplateTerminal,
+    #[error("Published templates must be archived before they can be deleted")]
+    ArchiveBeforeDeleteRequired,
+    #[error("Invalid expiration value: {0}")]
+    InvalidExpiration(String),
+    #[error("Invalid type: {0}")]
+    InvalidType(String),
+    #[error("schemaPropertiesAttributes are not allowed for W3C VC 1.1 templates")]
+    SchemaPropertiesAttributesNotAllowed,
+    #[error("Duplicate schemaPropertiesAttributes key after trimming: `{0}`")]
+    DuplicateSchemaPropertiesAttributeKey(String),
+    #[error("A template must not be in \"Draft\" stage when making it public")]
+    DraftTemplateCannotBePublic,
+    #[error("No Source Template found with id: `{0}`")]
+    SourceTemplateNotFound(String),
+    #[error("The `id` field is required to update a template.")]
+    TemplateIdMissing,
+    #[error("No Template found with id: `{0}`")]
+    TemplateNotFound(String),
 }
diff --git a/agent_library/src/template/event.rs b/agent_library/src/template/event.rs
index a7d74b76..a79f1566 100644
--- a/agent_library/src/template/event.rs
+++ b/agent_library/src/template/event.rs
@@ -1,6 +1,7 @@
 use std::collections::HashMap;
 
-pub use super::aggregate::{DataModel, Display, HolderType, PropertyAttribute, Status, Visibility};
+pub use super::aggregate::{DataModel, Display, Expiration, HolderType, PropertyAttribute, Status, Visibility};
+use agent_shared::config::Authorization;
 use cqrs_es::DomainEvent;
 use serde::{Deserialize, Serialize};
 use strum::Display;
@@ -11,20 +12,20 @@ pub enum TemplateEvent {
     TemplateCreated {
         template_id: String,
         source_template_id: Option<String>,
-        // TODO: Make this a required field.
-        title: Option<String>,
+        title: String,
         display: Box<Option<Display>>,
-        data_model: Option<DataModel>,
-        creator: Option<String>,
-        holder_type: Option<HolderType>,
+        data_model: DataModel,
+        holder_type: HolderType,
         modified_at: String,
-        tags: Vec<String>,
+        tags: Option<Vec<String>>,
         status: Status,
         visibility: Visibility,
+        credential_expiration: Expiration,
         description: Option<String>,
         r#type: Vec<String>,
         schema: Box<Option<serde_json::Value>>,
         schema_properties_attributes: Option<HashMap<String, PropertyAttribute>>,
+        holder_authorization: Authorization,
     },
     TitleUpdated {
         template_id: String,
@@ -36,21 +37,6 @@ pub enum TemplateEvent {
         display: Display,
         modified_at: String,
     },
-    DataModelUpdated {
-        template_id: String,
-        data_model: DataModel,
-        modified_at: String,
-    },
-    CreatorUpdated {
-        template_id: String,
-        creator: String,
-        modified_at: String,
-    },
-    HolderTypeUpdated {
-        template_id: String,
-        holder_type: HolderType,
-        modified_at: String,
-    },
     TagsUpdated {
         template_id: String,
         tags: Vec<String>,
@@ -86,6 +72,16 @@ pub enum TemplateEvent {
         schema_properties_attributes: HashMap<String, PropertyAttribute>,
         modified_at: String,
     },
+    CredentialExpirationUpdated {
+        template_id: String,
+        credential_expiration: Expiration,
+        modified_at: String,
+    },
+    HolderAuthorizationUpdated {
+        template_id: String,
+        holder_authorization: Authorization,
+        modified_at: String,
+    },
     TemplateDeleted {
         template_id: String,
     },
diff --git a/agent_library/src/template/mod.rs b/agent_library/src/template/mod.rs
index 7cbc4ed7..d1bfa8c3 100644
--- a/agent_library/src/template/mod.rs
+++ b/agent_library/src/template/mod.rs
@@ -2,4 +2,5 @@ pub mod aggregate;
 pub mod command;
 pub mod error;
 pub mod event;
+pub(crate) mod open_badges;
 pub mod views;
diff --git a/agent_library/src/template/open_badges.rs b/agent_library/src/template/open_badges.rs
new file mode 100644
index 00000000..a76e6cc3
--- /dev/null
+++ b/agent_library/src/template/open_badges.rs
@@ -0,0 +1,447 @@
+use super::error::TemplateError;
+
+fn ob_system_managed_fields() -> &'static [&'static str] {
+    &["id", "type"]
+}
+
+/// Dynamically builds the path → OB 3.0 `$def` name mapping by following `$ref` links
+/// in the OB JSON Schema, starting from `AchievementSubject`.
+///
+/// Covers all `$ref`-reachable defs at any nesting depth. Cycles are detected via a
+/// DFS stack that tracks def names currently being processed, preventing infinite
+/// recursion on circular references such as `Profile.parentOrg → Profile`.
+fn ob_build_path_to_def(defs: &serde_json::Map<String, serde_json::Value>) -> Vec<(String, String)> {
+    let mut result = Vec::new();
+    let mut def_stack = std::collections::HashSet::new();
+    ob_collect_path_to_def_recursive(defs, "AchievementSubject", "", &mut result, &mut def_stack);
+    result
+}
+
+fn ob_collect_path_to_def_recursive(
+    defs: &serde_json::Map<String, serde_json::Value>,
+    def_name: &str,
+    path: &str,
+    result: &mut Vec<(String, String)>,
+    def_stack: &mut std::collections::HashSet<String>,
+) {
+    if !def_stack.insert(def_name.to_string()) {
+        return; // Cycle detected — this def is already being processed in the current DFS path.
+    }
+
+    result.push((path.to_string(), def_name.to_string()));
+
+    if let Some(props) = defs
+        .get(def_name)
+        .and_then(|def| def.get("properties"))
+        .and_then(|p| p.as_object())
+    {
+        for (prop_name, prop_schema) in props {
+            if let Some(next_def) = prop_schema
+                .get("$ref")
+                .and_then(|r| r.as_str())
+                .and_then(|r| r.strip_prefix("#/$defs/"))
+            {
+                let child_path = if path.is_empty() {
+                    prop_name.clone()
+                } else {
+                    format!("{}/{}", path, prop_name)
+                };
+                ob_collect_path_to_def_recursive(defs, next_def, &child_path, result, def_stack);
+            }
+        }
+    }
+
+    def_stack.remove(def_name);
+}
+
+/// Derives the required child keys for each schema path from the OB 3.0 JSON Schema
+/// `$defs` `required` arrays, excluding system-managed fields.
+/// Returns a map of `schema_path → required_children`.
+fn ob_spec_required_by_path() -> std::collections::HashMap<String, Vec<String>> {
+    let ob_schema = ob_json_schema();
+    let Some(defs) = ob_schema.get("$defs").and_then(|d| d.as_object()) else {
+        return Default::default();
+    };
+    let system_managed = ob_system_managed_fields();
+    ob_build_path_to_def(defs)
+        .iter()
+        .filter_map(|(path, def_name)| {
+            let required: Vec<String> = defs
+                .get(def_name.as_str())
+                .and_then(|def| def.get("required"))
+                .and_then(|r| r.as_array())
+                .map(|arr| {
+                    arr.iter()
+                        .filter_map(|v| v.as_str())
+                        .filter(|k| !system_managed.contains(k))
+                        .map(|k| k.to_string())
+                        .collect()
+                })
+                .unwrap_or_default();
+            if required.is_empty() {
+                None
+            } else {
+                Some((path.clone(), required))
+            }
+        })
+        .collect()
+}
+
+/// Additional required child keys that go beyond the OB 3.0 specification.
+/// These are UniCore-opinionated requirements that guide API callers toward producing
+/// meaningful credentials without needing to know OB specifics themselves.
+///
+/// Adding an entry here is the single place to extend UniCore's required-field policy
+/// without touching validation, schema-injection, or `non_removable` logic.
+fn ob_opinionated_required_by_path() -> &'static [(&'static str, &'static [&'static str])] {
+    &[
+        // `narrative` is not required by the OB 3.0 spec (`Criteria.required = []`)
+        // but is required by UniCore so templates always guide callers to provide
+        // meaningful criteria text.
+        ("achievement/criteria", &["narrative"]),
+    ]
+}
+
+/// Returns the combined required child keys per schema path: OB 3.0 spec + UniCore extras.
+fn ob_combined_required_by_path() -> std::collections::HashMap<String, Vec<String>> {
+    let mut combined = ob_spec_required_by_path();
+    for (path, children) in ob_opinionated_required_by_path() {
+        let entry = combined.entry(path.to_string()).or_default();
+        for &child in *children {
+            let child = child.to_string();
+            if !entry.contains(&child) {
+                entry.push(child);
+            }
+        }
+    }
+    combined
+}
+
+/// Returns the set of paths in `combined` that are reachable from the root by following
+/// only required-child links. For these paths, absence from the template schema implies
+/// that required children are genuinely missing. For all other paths, required-field
+/// checking only applies when the path IS explicitly present in the schema.
+fn ob_required_reachable_paths(
+    combined: &std::collections::HashMap<String, Vec<String>>,
+) -> std::collections::HashSet<String> {
+    let mut reachable = std::collections::HashSet::new();
+    reachable.insert(String::new()); // root is always reachable
+    let mut queue = vec![String::new()];
+    while let Some(path) = queue.pop() {
+        if let Some(children) = combined.get(&path) {
+            for child in children {
+                let child_path = if path.is_empty() {
+                    child.clone()
+                } else {
+                    format!("{}/{}", path, child)
+                };
+                // Only follow into a child path if it also has required children itself.
+                if combined.contains_key(&child_path) && reachable.insert(child_path.clone()) {
+                    queue.push(child_path);
+                }
+            }
+        }
+    }
+    reachable
+}
+
+/// Returns the JSON Pointer paths (RFC 6901) of the required leaf fields for OB 3.0
+/// templates, derived from the combined spec + opinionated requirements.
+///
+/// A required child is a leaf if its property in the corresponding `$def` is not a
+/// `$ref` to another `$def` (i.e. it is a scalar or inline schema, not a nested object).
+/// Opinionated extras without a `$def` entry are always treated as leaves.
+///
+/// These paths are used to mark the corresponding `PropertyAttribute` entries as
+/// `non_removable = true`.
+pub fn open_badges_required_leaf_paths() -> Vec<String> {
+    let combined = ob_combined_required_by_path();
+    let ob_schema = ob_json_schema();
+    let defs = ob_schema.get("$defs").and_then(|d| d.as_object());
+
+    let path_to_def: std::collections::HashMap<String, String> = defs
+        .map(|d| ob_build_path_to_def(d).into_iter().collect())
+        .unwrap_or_default();
+
+    let mut leaf_paths: Vec<String> = combined
+        .iter()
+        .flat_map(|(path, children)| {
+            let def_name = path_to_def.get(path.as_str()).map(|d| d.as_str());
+            let def_props = def_name
+                .and_then(|n| defs.and_then(|d| d.get(n)))
+                .and_then(|def| def.get("properties"))
+                .and_then(|p| p.as_object());
+
+            children.iter().filter_map(move |child| {
+                // A property is an intermediate node when the spec $def references it via $ref.
+                let is_intermediate = def_props
+                    .and_then(|p| p.get(child.as_str()))
+                    .map(|prop_schema| prop_schema.get("$ref").is_some())
+                    .unwrap_or(false);
+
+                if is_intermediate {
+                    None
+                } else {
+                    let full_path = if path.is_empty() {
+                        format!("/{}", child)
+                    } else {
+                        format!("/{}/{}", path, child)
+                    };
+                    Some(full_path)
+                }
+            })
+        })
+        .collect();
+
+    leaf_paths.sort();
+    leaf_paths
+}
+
+/// Returns a lazily-initialised reference to the parsed OpenBadges 3.0 JSON Schema.
+fn ob_json_schema() -> &'static serde_json::Value {
+    static OB_SCHEMA: std::sync::OnceLock<serde_json::Value> = std::sync::OnceLock::new();
+    OB_SCHEMA.get_or_init(|| {
+        serde_json::from_str(include_str!("../json_schemas/OpenBadgeCredentialV3.json"))
+            .expect("OpenBadgeCredentialV3.json must be valid JSON")
+    })
+}
+
+/// Validates that the nested OB template schema only uses property names that are valid
+/// according to the OpenBadges 3.0 JSON Schema specification.
+///
+/// Starts at `AchievementSubject` and follows `$ref` links to determine the allowed
+/// property set at each nesting level. Any property not present in the resolved `$def`
+/// is rejected. Unknown nesting levels (no `$ref` in the parent def) are left open.
+pub(crate) fn validate_open_badges_schema_properties(schema: &serde_json::Value) -> Result<(), TemplateError> {
+    let ob_schema = ob_json_schema();
+    let defs = match ob_schema.get("$defs").and_then(|d| d.as_object()) {
+        Some(d) => d,
+        None => return Ok(()), // Cannot validate without defs; pass through.
+    };
+    let root_def = defs.get("AchievementSubject");
+    validate_ob_properties_recursive(schema, "", root_def, defs)
+}
+
+fn validate_ob_properties_recursive(
+    schema: &serde_json::Value,
+    current_path: &str,
+    current_def: Option<&serde_json::Value>,
+    defs: &serde_json::Map<String, serde_json::Value>,
+) -> Result<(), TemplateError> {
+    let properties = match schema.get("properties").and_then(|p| p.as_object()) {
+        Some(p) => p,
+        None => return Ok(()),
+    };
+
+    // Determine the set of allowed property names at this level from the current def.
+    let allowed: Option<std::collections::HashSet<&str>> = current_def
+        .and_then(|def| def.get("properties").and_then(|p| p.as_object()))
+        .map(|props| props.keys().map(|k| k.as_str()).collect());
+
+    let mut disallowed: Vec<&str> = Vec::new();
+
+    for (key, value) in properties {
+        if let Some(ref allowed_set) = allowed {
+            if !allowed_set.contains(key.as_str()) {
+                disallowed.push(key.as_str());
+            }
+        }
+
+        let child_path = if current_path.is_empty() {
+            key.to_string()
+        } else {
+            format!("{}/{}", current_path, key)
+        };
+
+        // Resolve the child def by following the $ref in the current def's properties.
+        let child_def = current_def
+            .and_then(|def| def.get("properties").and_then(|p| p.as_object()))
+            .and_then(|props| props.get(key.as_str()))
+            .and_then(|prop_schema| prop_schema.get("$ref").and_then(|r| r.as_str()))
+            .and_then(|r| r.strip_prefix("#/$defs/"))
+            .and_then(|def_name| defs.get(def_name));
+
+        validate_ob_properties_recursive(value, &child_path, child_def, defs)?;
+    }
+
+    if !disallowed.is_empty() {
+        disallowed.sort();
+        return Err(TemplateError::DisallowedOpenBadgesProperties(format!(
+            "The following properties are not allowed for OpenBadges 3.0 templates at path `/{current_path}`: [{}]",
+            disallowed.join(", ")
+        )));
+    }
+
+    Ok(())
+}
+
+/// Validates that all required OB 3.0 leaf fields (spec-required + UniCore opinionated)
+/// are present in the template schema, and that each leaf has `type: "string"` or a `const`.
+///
+/// Required fields are derived from `ob_combined_required_by_path()` so this function
+/// automatically reflects any changes to the spec JSON file or the opinionated extras list.
+pub(crate) fn validate_open_badges_required_properties(schema: &serde_json::Value) -> Result<(), TemplateError> {
+    // Navigate through `properties` segments to the properties map at `path`.
+    fn props_at_path<'a>(
+        schema: &'a serde_json::Value,
+        path: &str,
+    ) -> Option<&'a serde_json::Map<String, serde_json::Value>> {
+        let mut current = schema.get("properties")?.as_object()?;
+        for seg in path.split('/').filter(|s| !s.is_empty()) {
+            current = current.get(seg)?.get("properties")?.as_object()?;
+        }
+        Some(current)
+    }
+
+    let combined = ob_combined_required_by_path();
+    let required_reachable = ob_required_reachable_paths(&combined);
+    let leaf_paths: std::collections::HashSet<String> = open_badges_required_leaf_paths().into_iter().collect();
+
+    let mut missing: Vec<String> = Vec::new();
+    let mut wrong_type: Vec<String> = Vec::new();
+    // Tracks missing intermediate nodes so that their children are not cascade-reported.
+    let mut missing_nodes: std::collections::HashSet<String> = std::collections::HashSet::new();
+
+    let mut sorted: Vec<(String, Vec<String>)> = combined.into_iter().collect();
+    sorted.sort_by_key(|(p, _)| p.clone());
+
+    for (path, mut children) in sorted {
+        children.sort();
+
+        // Skip this path if any ancestor was already reported as missing.
+        let skip = {
+            let mut ancestor = String::new();
+            path.split('/').filter(|s| !s.is_empty()).any(|seg| {
+                if ancestor.is_empty() {
+                    ancestor = seg.to_string();
+                } else {
+                    ancestor = format!("{ancestor}/{seg}");
+                }
+                missing_nodes.contains(&ancestor)
+            })
+        };
+        if skip {
+            continue;
+        }
+
+        match props_at_path(schema, &path) {
+            None => {
+                if !required_reachable.contains(&path) {
+                    continue; // Optional path absent from template schema — skip silently.
+                }
+                // Required-reachable path absent — report each required child as missing.
+                for child in &children {
+                    let full = if path.is_empty() {
+                        format!("/{child}")
+                    } else {
+                        format!("/{path}/{child}")
+                    };
+                    missing.push(full);
+                    let node_path = if path.is_empty() {
+                        child.to_string()
+                    } else {
+                        format!("{path}/{child}")
+                    };
+                    missing_nodes.insert(node_path);
+                }
+            }
+            Some(props) => {
+                for child in &children {
+                    let full = if path.is_empty() {
+                        format!("/{child}")
+                    } else {
+                        format!("/{path}/{child}")
+                    };
+                    match props.get(child.as_str()) {
+                        None => {
+                            missing.push(full);
+                            let node_path = if path.is_empty() {
+                                child.to_string()
+                            } else {
+                                format!("{path}/{child}")
+                            };
+                            missing_nodes.insert(node_path);
+                        }
+                        Some(field) if leaf_paths.contains(&full) => {
+                            let has_string = field.get("type").and_then(|t| t.as_str()) == Some("string");
+                            let has_const = field.get("const").is_some();
+                            if !has_string && !has_const {
+                                wrong_type.push(full);
+                            }
+                        }
+                        _ => {} // Intermediate node — presence is sufficient.
+                    }
+                }
+            }
+        }
+    }
+
+    if !missing.is_empty() {
+        return Err(TemplateError::MissingRequiredOpenBadgesProperties(format!(
+            "The following required fields must be present in the schema for OpenBadges 3.0 templates: [{}]",
+            missing.join(", ")
+        )));
+    }
+    if !wrong_type.is_empty() {
+        return Err(TemplateError::InvalidRequiredPropertyType(format!(
+            "The following required fields must have type \"string\" or a \"const\" value: [{}]",
+            wrong_type.join(", ")
+        )));
+    }
+    Ok(())
+}
+
+/// Injects `required` arrays into the OB 3.0 template schema at every nesting level
+/// that has required children (spec-required + UniCore opinionated extras).
+///
+/// Only injects a key if the corresponding property already exists in the schema at
+/// that level — missing optional properties are not forced into `required`.
+pub(crate) fn ensure_schema_required_keys(schema: &mut serde_json::Value) {
+    fn add_if_absent(arr: &mut serde_json::Value, key: &str) {
+        if let Some(arr) = arr.as_array_mut() {
+            let v = serde_json::Value::String(key.to_string());
+            if !arr.contains(&v) {
+                arr.push(v);
+            }
+        }
+    }
+
+    // Navigate to a mutable node by following properties/segment pairs.
+    fn node_at_path_mut<'a>(schema: &'a mut serde_json::Value, path: &str) -> Option<&'a mut serde_json::Value> {
+        if path.is_empty() {
+            return Some(schema);
+        }
+        let mut current = schema;
+        for seg in path.split('/') {
+            current = current.get_mut("properties")?.get_mut(seg)?;
+        }
+        Some(current)
+    }
+
+    let combined = ob_combined_required_by_path();
+    let mut sorted: Vec<(String, Vec<String>)> = combined.into_iter().collect();
+    sorted.sort_by_key(|(p, _)| p.clone());
+
+    for (path, mut required_children) in sorted {
+        required_children.sort();
+        let Some(node) = node_at_path_mut(schema, &path) else {
+            continue;
+        };
+        // Only mark a child as required when it actually appears in the schema at this level.
+        let present: Vec<String> = required_children
+            .into_iter()
+            .filter(|k| node.get("properties").and_then(|p| p.get(k.as_str())).is_some())
+            .collect();
+        if present.is_empty() {
+            continue;
+        }
+        let required_entry = node
+            .as_object_mut()
+            .map(|o| o.entry("required").or_insert(serde_json::json!([])));
+        if let Some(r) = required_entry {
+            for key in &present {
+                add_if_absent(r, key);
+            }
+        }
+    }
+}
diff --git a/agent_library/src/template/views/mod.rs b/agent_library/src/template/views/mod.rs
index 1ac2e7a1..f4419e4f 100644
--- a/agent_library/src/template/views/mod.rs
+++ b/agent_library/src/template/views/mod.rs
@@ -17,40 +17,42 @@ impl View<Template> for Template {
                 title,
                 display,
                 data_model,
-                creator,
                 holder_type,
                 modified_at,
                 tags,
                 status,
                 visibility,
+                credential_expiration,
                 description,
                 r#type,
                 schema,
                 schema_properties_attributes,
+                holder_authorization,
             } => {
                 self.template_id.clone_from(template_id);
                 self.source_template_id.clone_from(source_template_id);
-                self.title.clone_from(title);
+                self.title = title.clone();
                 self.display.clone_from(display);
-                self.data_model.clone_from(data_model);
-                self.creator.clone_from(creator);
-                self.holder_type.clone_from(holder_type);
+                self.data_model = data_model.clone();
+                self.holder_type = holder_type.clone();
                 self.modified_at.replace(modified_at.clone());
-                self.tags.clone_from(tags);
+                self.tags = tags.clone();
                 self.status.clone_from(status);
                 self.visibility.clone_from(visibility);
+                self.credential_expiration = credential_expiration.clone();
                 self.description.clone_from(description);
                 self.r#type.clone_from(r#type);
                 self.schema.clone_from(schema);
                 self.schema_properties_attributes
                     .clone_from(schema_properties_attributes);
+                self.holder_authorization = holder_authorization.clone();
             }
             TitleUpdated {
                 template_id: _,
                 title,
                 modified_at,
             } => {
-                self.title.replace(title.clone());
+                self.title = title.clone();
                 self.modified_at.replace(modified_at.clone());
             }
             DisplayUpdated {
@@ -61,36 +63,12 @@ impl View<Template> for Template {
                 self.display.replace(display.clone());
                 self.modified_at.replace(modified_at.clone());
             }
-            DataModelUpdated {
-                template_id: _,
-                data_model,
-                modified_at,
-            } => {
-                self.data_model.replace(data_model.clone());
-                self.modified_at.replace(modified_at.clone());
-            }
-            CreatorUpdated {
-                template_id: _,
-                creator,
-                modified_at,
-            } => {
-                self.creator.replace(creator.clone());
-                self.modified_at.replace(modified_at.clone());
-            }
-            HolderTypeUpdated {
-                template_id: _,
-                holder_type,
-                modified_at,
-            } => {
-                self.holder_type.replace(holder_type.clone());
-                self.modified_at.replace(modified_at.clone());
-            }
             TagsUpdated {
                 template_id: _,
                 tags,
                 modified_at,
             } => {
-                self.tags.clone_from(tags);
+                self.tags = if tags.is_empty() { None } else { Some(tags.clone()) };
                 self.modified_at.replace(modified_at.clone());
             }
             StatusUpdated {
@@ -114,7 +92,11 @@ impl View<Template> for Template {
                 description,
                 modified_at,
             } => {
-                self.description.replace(description.clone());
+                self.description = if description.is_empty() {
+                    None
+                } else {
+                    Some(description.clone())
+                };
                 self.modified_at.replace(modified_at.clone());
             }
             TypeUpdated {
@@ -142,9 +124,120 @@ impl View<Template> for Template {
                     .replace(schema_properties_attributes.clone());
                 self.modified_at.replace(modified_at.clone());
             }
+            CredentialExpirationUpdated {
+                template_id: _,
+                credential_expiration,
+                modified_at,
+            } => {
+                self.credential_expiration = credential_expiration.clone();
+                self.modified_at.replace(modified_at.clone());
+            }
+            HolderAuthorizationUpdated {
+                template_id: _,
+                holder_authorization,
+                modified_at,
+            } => {
+                self.holder_authorization = holder_authorization.clone();
+                self.modified_at.replace(modified_at.clone());
+            }
             TemplateDeleted { template_id: _ } => {
                 self.status = Status::Deleted;
             }
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::template::aggregate::{DataModel, Visibility};
+    use crate::template::event::{Expiration, HolderType};
+    use std::collections::HashMap;
+
+    fn event(payload: TemplateEvent) -> EventEnvelope<Template> {
+        EventEnvelope {
+            aggregate_id: "template-id".to_string(),
+            sequence: 1,
+            payload,
+            metadata: HashMap::new(),
+        }
+    }
+
+    fn created_event() -> EventEnvelope<Template> {
+        event(TemplateEvent::TemplateCreated {
+            template_id: "template-id".to_string(),
+            source_template_id: None,
+            title: "Template".to_string(),
+            display: Box::new(None),
+            data_model: DataModel::W3CVcDataModelV2_0,
+            holder_type: HolderType::Individual,
+            modified_at: "2024-01-01T00:00:00Z".to_string(),
+            tags: Some(vec!["existing".to_string()]),
+            status: Status::Published,
+            visibility: Visibility::Private,
+            credential_expiration: Expiration::Never,
+            description: Some("existing description".to_string()),
+            r#type: vec!["VerifiableCredential".to_string()],
+            schema: Box::new(None),
+            schema_properties_attributes: None,
+            holder_authorization: agent_shared::config::Authorization::default(),
+        })
+    }
+
+    #[test]
+    fn tags_updated_with_empty_list_clears_tags() {
+        let mut view = Template::default();
+        view.update(&created_event());
+
+        view.update(&event(TemplateEvent::TagsUpdated {
+            template_id: "template-id".to_string(),
+            tags: vec![],
+            modified_at: "2024-01-02T00:00:00Z".to_string(),
+        }));
+
+        assert_eq!(view.tags, None);
+        assert_eq!(view.modified_at.as_deref(), Some("2024-01-02T00:00:00Z"));
+    }
+
+    #[test]
+    fn description_updated_with_empty_string_clears_description() {
+        let mut view = Template::default();
+        view.update(&created_event());
+
+        view.update(&event(TemplateEvent::DescriptionUpdated {
+            template_id: "template-id".to_string(),
+            description: String::new(),
+            modified_at: "2024-01-02T00:00:00Z".to_string(),
+        }));
+
+        assert_eq!(view.description, None);
+        assert_eq!(view.modified_at.as_deref(), Some("2024-01-02T00:00:00Z"));
+    }
+
+    #[test]
+    fn credential_expiration_updated_replaces_previous_value() {
+        let mut view = Template::default();
+        view.update(&created_event());
+
+        view.update(&event(TemplateEvent::CredentialExpirationUpdated {
+            template_id: "template-id".to_string(),
+            credential_expiration: Expiration::Duration("P30D".to_string()),
+            modified_at: "2024-01-02T00:00:00Z".to_string(),
+        }));
+
+        assert_eq!(view.credential_expiration, Expiration::Duration("P30D".to_string()));
+        assert_eq!(view.modified_at.as_deref(), Some("2024-01-02T00:00:00Z"));
+    }
+
+    #[test]
+    fn template_deleted_marks_status_deleted() {
+        let mut view = Template::default();
+        view.update(&created_event());
+
+        view.update(&event(TemplateEvent::TemplateDeleted {
+            template_id: "template-id".to_string(),
+        }));
+
+        assert_eq!(view.status, Status::Deleted);
+    }
+}
diff --git a/agent_shared/src/config/mod.rs b/agent_shared/src/config/mod.rs
index 130d20bc..ed3f99e9 100644
--- a/agent_shared/src/config/mod.rs
+++ b/agent_shared/src/config/mod.rs
@@ -21,14 +21,13 @@ use serde_json::json;
 use serde_with::{skip_serializing_none, SerializeDisplay};
 use std::{
     collections::HashMap,
-    path::PathBuf,
     sync::{RwLock, RwLockReadGuard},
 };
 use strum::VariantArray;
 use url::Url;
 
 use crate::{
-    config::openapi::{authorization, credential_metadata},
+    config::openapi::{credential_metadata, tx_code_constraints},
     error::SharedError,
     profile::ApplicationProfile,
 };
@@ -259,8 +258,6 @@ pub struct ApplicationConfiguration {
     pub credential_offer_by_value_enabled: bool,
     #[config(development_default = "SecretManagerConfig::development_default()")]
     pub secret_manager: SecretManagerConfig,
-    #[config(default)]
-    pub credential_configuration_file: Option<Box<PathBuf>>,
     #[config(default = "
         HashMap::from(
             [
@@ -551,15 +548,16 @@ pub struct CredentialConfiguration {
     #[schema(schema_with = credential_metadata)]
     #[serde(flatten)]
     pub credential_metadata: CredentialMetadata,
-    #[schema(schema_with = authorization)]
     #[serde(default)]
     pub authorization: Authorization,
 }
 
-#[derive(Deserialize, Serialize, Debug, Clone, PartialEq)]
+#[derive(Deserialize, Serialize, Debug, Clone, PartialEq, utoipa::ToSchema)]
+#[schema(as = HolderAuthorization)]
 pub struct Authorization {
     pub pre_authorized: bool,
     #[serde(skip_serializing_if = "Option::is_none")]
+    #[schema(schema_with = tx_code_constraints)]
     pub tx_code_constraints: Option<TxCodeConstraints>,
 }
 
@@ -721,15 +719,13 @@ pub enum TemplateEvent {
     TemplateCreated,
     TitleUpdated,
     DisplayUpdated,
-    DataModelUpdated,
-    CreatorUpdated,
-    HolderTypeUpdated,
     TagsUpdated,
     StatusUpdated,
     VisibilityUpdated,
     DescriptionUpdated,
     TypeUpdated,
     SchemaUpdated,
+    CredentialExpirationUpdated,
 }
 
 #[derive(Debug, Serialize, Deserialize, Clone, strum::Display)]
@@ -1496,9 +1492,6 @@ mod tests {
 
         // Some display information is set
         assert_eq!(config.display.len(), 1);
-
-        // The Credential Configuration file is set to `None`
-        assert!(config.credential_configuration_file.is_none());
     }
 
     #[test]
diff --git a/agent_shared/src/config/openapi.rs b/agent_shared/src/config/openapi.rs
index 13e78850..43c01f83 100644
--- a/agent_shared/src/config/openapi.rs
+++ b/agent_shared/src/config/openapi.rs
@@ -1,6 +1,6 @@
 use utoipa::openapi::{schema::SchemaType, Object, ObjectBuilder, Type};
 
-// TODO: type properly
+// TODO: incomplete type
 pub(crate) fn credential_metadata() -> Object {
     ObjectBuilder::new()
         .property("claims", ObjectBuilder::new().build())
@@ -8,16 +8,29 @@ pub(crate) fn credential_metadata() -> Object {
         .build()
 }
 
-// TODO: type properly
-pub(crate) fn authorization() -> Object {
+pub(crate) fn tx_code_constraints() -> Object {
     ObjectBuilder::new()
+        .schema_type(SchemaType::Type(Type::Object))
         .property(
-            "pre_authorized",
+            "input_mode",
             ObjectBuilder::new()
-                .schema_type(SchemaType::Type(Type::Boolean))
+                .schema_type(SchemaType::Type(Type::String))
+                .enum_values(Some(["numeric", "text"]))
+                .build(),
+        )
+        .property(
+            "length",
+            ObjectBuilder::new()
+                .schema_type(SchemaType::Type(Type::Integer))
+                .description(Some("Allows a pin-length of 0-255."))
+                .build(),
+        )
+        .property(
+            "description",
+            ObjectBuilder::new()
+                .schema_type(SchemaType::Type(Type::String))
+                .description(Some("The length of the string must not exceed 300 characters."))
                 .build(),
         )
-        .property("tx_code_constraints", ObjectBuilder::new().build())
-        .required("pre_authorized")
         .build()
 }
diff --git a/agent_shared/src/credential_status_checker.rs b/agent_shared/src/credential_status_checker.rs
index a441c87d..f90cfaa3 100644
--- a/agent_shared/src/credential_status_checker.rs
+++ b/agent_shared/src/credential_status_checker.rs
@@ -167,70 +167,87 @@ mod tests {
     use super::*;
 
     use agent_secret_manager::subject::Subject;
+    use serial_test::serial;
     use wiremock::{
         matchers::{method, path},
         Mock, MockServer, ResponseTemplate,
     };
 
-    #[tokio::test]
-    async fn test_check_jwt_status_claim() {
-        // A credential with no "status" claim should be considered valid.
-        let subject = Subject::test_subject().await;
-        let checker = CredentialStatusChecker {
-            verification_material_resolver: Arc::new(subject),
-        };
-
-        let result = checker.check_credential_status(serde_json::json!({})).await;
-
-        assert!(result.is_ok(), "Empty status claim should be gracefully skipped");
-
-        // A credential with a "status" claim that has an unrecognized status type should be considered valid (since we don't know how to check the status, we shouldn't fail the validation just because of that).
-        let result = checker
-            .check_credential_status(serde_json::json!({
-                "id": "https://example.com/status/123",
-                "type": "UnrecognizedStatusType"
-            }))
-            .await;
-
-        assert!(result.is_ok(), "Unrecognized status type should be gracefully skipped");
-
-        // Create a new mock server and retreive it's url.
-        let mock_server = MockServer::start().await;
-        let server_url = mock_server.uri();
-
-        let response_bytes: &[u8] = b"\x1f\x8b\x08\0\0\0\0\0\x02\xff-\x95\xdb\x92\xa3:\x12E\xff\xe8\x84$\x8cO\xf9\xb10\x88K\x19\xd1\x08]@/\x13\x80\xa8\xc6H`\xaaL\x97m\xbe~\xd4\x13\xf3\x9e\x11\x99{e\xee\x9d\xc3+\x03C\xfd~-\xae\xd9\xaec\x0ctM\xeemM\xc0\x07Z=}N\xef\xe9\x8c\xef\xea\x95\x1eS#\x0c\xc5$H\xaf\x8fk\x8b\xacI\xa7\xdbU\xc5\xd6\x14\xf3f\x07\xb6\x1e\x89\x81\xdf\n\xf0\x03\x89\xfc\x90\xd5\x01Q\x1c\x1f\n\xb9^\nIf\"z@\xf7qi\xe0\xcd\x1f\x12\xe1U\x8bJr\xc9=\r\xfc\xef\"\xdaB\xe5\x95\xd30)\xd2\"\x8d\x8b\x90\x16%\x80\x0f&E0\x84\xf6\xab\xda\xed\xa4&Q\x93\xa8?(D\xda\xa2\x1e\xa1\x06+\xa2;\xb6\xc4\xd3E\xbb\x8f\x97\x12i\x90.\xe0\x9f\xe1\xe54\xc8\xf4\xaf\x96\x9bN\xe8\xa3\xdfo?\x17\x04\xfd\x8b\xa4?\x9d\xc4kw\xf5\xed\x10\xe3\xad\x8f\x9f\xf62\x9f^\xeauZUM\xe7\x8b<\x8d\xba\xa6\xb7KM\x7fZ$\xfe\\\x9c\xfe\xa6\xa6\xb0\x7f\xc1\xff\xb1\xb8\xec\xef\xd7\xcb9[\x9b\xba\xbc\x16S\xe4\x91\xbd|\xe4!\xdf\t{\xbf\xa7\xcb\xffk\xe1\xe9\x7f\xb5\xe9\xb4\xfe\x9b\xce\xd9\xaa\x93\xdc\xd5\xfe\xe5\xf7\xdc\x1d\xc7c:\x8b\xa2CT\x8aZ\\JG\xb2\x12T\xd0\x90\x84J\xfe\xf6\xabZ\xdc\x94\xc0\xb6\x10\xa7\xbb\x0c\xb5d\x9c\x969V\x17\x81V\xd4\x87\xe3\xa4\x16,y\xa4\xb2\x9c\xbf\xc1\x1ab\"\xe3\xf4\xc5\xcf\x90vK\x16\x95W\xf8\xd1\xd7\xc4\x08\xbb\xbe\xba$\xf3/\x82C\xb6G\xa8\x91\xd4\xed\xc0/J+r-}$\x96\xfc\xa0\xc2\xe6\xa0\xa2\x065sv \xe0\x80dd\x9e\x14\xe1\xef\xa6^=\xe6\t5Hr\x90\x91:\x900h\x98\x1d\xef\xa4VP\xc8\xc6kv\xbcq+\xe6!\xda\x0e\x95\xa5M\x9f\xe0\x0f\xb2\x93s\r\x9e\xdf\xcd\x94\xbdr\xa6/\xcdTn|\xcf\xeed\xb7\xbf\xb4U\xcfKm#5\xe9\x83HJOG[\x9e/\xc1\xd6E\xdaS\xb5\xf1\xa5\xa1w2\xa9\xa3\x10\xd9wW\xa7\x1e\x89q\xc6\x17\xf2GM\xa3\xe8f\x1fh~BZ\x04\xa5\x9e)\x11\xbb\xfa\xd3\xd7Y\xc3B\x12)\x86\xe7.:\x15\xad\x17\xa4\x9aE\x0fjV\xe8\xb0A\xa7\xefJ&\x9bk\x1cP\xc2\x04/\x92,\xe8\x05\xbe\x08<\x9a\xca\xcd5\x98\xb1\xe8&E\x19\xba\x83\x06\xc0\xa3\x02\xa7o6\xd1\x94r<\x97\xfc\xf4\xd3\xc0,Rp\xcct2\xbe8\x87G\xcd\xca\x17G4\xa0q\xf6P2z\x12\x9e}\x14\xf2\xf1h\xac\x90\xc4<a\x07\xc5F&j;\xa9\x7f\x94yn<Q\xb6\x82\xe2U\x03q\x96\x89\xd3c\x1e\x8f\x9e\x8dM\xcfl\xd6N\xcar,\x90\x12A\\\xc2\x14\x95/\xb0\xf7\xf3\x88\xe5\x82\xe1\xa5\xd6\x1f\r\xf73!\xc5\xf1/\x07\x16\xd3_\xca\x92\xa2Z\xde\x11\r\xf1\xaa\xed\xfa\xc9\0-\xfa\x19>]=\xa8$v\x0c\x01\xe8\xa1])OQ>\xe9e\x08\xb3@%$\xa4R?(\x87_\xd5$~x\xa2\xd3V\xe8\xb1\x0f\xf9\xa6\xf9\xdb\xabZ\xb2]\xf1\xd3E\xec\xef>\x81\xe3\xdc9FR\x9e\xe8\xc0\xfd\xdd\xb1\x0e*\x96\x91j\xca\xc2Rf\x9e\x8e\xe9C%\xc1Q@\xb3q\xb9\xfe\x94\xd3\xfbc\x88\xc8L\x93\xf5\x17\xe1\xfcA\xe6\xdf\x87\x82\x05\x8a\x1a\xbb\x95\xc87\x17yx\xc9\x19\x93\xce\xa4{/\xb7\xa5\x88\x9f\x13\rs$<\x9a\xe7H\xd7\xfd\x9c\x95Th\\\xf1mS\xbbH\x8aP\0j0\xd1\xc0\xe2\x16\xe0\xb4t\xde!2:\xd4\xc8\x9e\xd9b\x8f\x95\xbc\xed5\xd4\x0b\r\x85\xcf\xc2@\\\xa4.\xf3\xf9D\x18\xeba%\xf0\xab\x99\"T\x1a\xdf6\x0b\xe6rV\x87\x1e\xdd\x80Jp #K\x18\x16\xce3p/jqlv[U\xb3 }\xa4\xbf:\x9e>)\xa7U/\x82_\xf2\n\0\x9b\xf9\xc6\xa2\xad\xe9\x80P\x82\xe3\xef\xb2\x1e\x05]V\xa7M[\x01\xd3\xbd\xbbBY\"\x95\xf7;\xae\x1d\x03\x9f\x001\x95\xc6\x9a.~6%\xb3?\x1d K\xc3iX\xf2\xdf\xd0y\x9fU\x1c_Z\x83\x8f\xc4\n\xdcM\xf4\x99/+\x1aB\x03\x1c\x97\\'+\x1fB\xfdQ\x19E\xaaY\x1f\x89G\x976$\x89\xcb\x80\x9b\x9be\x1bf\xff\xd2O\xeen*\xb0k\x04|\n\x03\xeb\xb22\xcaa@\xfbY\x04\xc4y\xa5M\xde\x91\xdb\x9b\x10P\xb72\x1e\x0b\xce\x9b\x03M\x82q0\xa7\xb3\x9a\xd5Vy\xfa(\x10\xae)\xd8>\x87\xd8\xb7\x04\xe2\xf2\xaf\xb7y,\xe2\x16\xebX\xef8 \xc9\xedP\xce\xd9\xdd\xddy\xd4\xcc\x9b\xd7\x874)\xe4\x18\xb7\xf1\xcdc@|\xeaE0-\xb1i\x99\xd88(\x1f\"\xb1\x8aF\xdb(8I\x99\xcd\xd1\xc0\xb3\x80Z\xfc\xc3\xec\xc9q\x1bww\x97\x9c\x18\xbf%&\xfb\xc9\xcf\xc0\x1b\xe2\x07\xc8c{\x18\x9c\xa7\x04\x0eL\x7f\x86\x1f\x1d\xd0\x8cE\xa3)\xc4\xfag\x98\xd5\x1f\x973\x86\xe3\xc6\xa3\xa0D%<}\xf6\x9e\x95\"\x14_,\xe1\x1eA$&Q\xfej\xf8\xb85\xfbxo\x19\xf7\xdb%\xcbu\x88I\xbb\x08\xbf\xac\xb3o\x1e\xdf\xa1\xcb\xa7\xb0Jp\xda\x9a\xa77\x18\x9c\xf4 \xdb\xb9\xc0~_\xeb\xe6\xc2F\xdc\xc8\xe7W\x89\xb0a\xb3\xbe\x88x]k\xa0\x1f<\x1cK\xb9\x10\xdb\t\xf2\xe3\xbc\xf05\xe0\x14\x92\xd0\xe6-\x80\xa0\x04\xe9#\x17\xa7\xb8\x14t\xa7\x90\xe6\x033\x0f\x86V\xa8\xac\xf6r\x90{z\x0f\x84\xb0\xd9\x9e'z\xab\xb8\xce\x14\xf2o\x04\xe0\xb6J\xecWcm\xe3<\x9f\x14x]J\x9e\xc5<\xcaV)u\xe1r\xc5\x946\x83%O\x1f\xad\xdb\x05\x93\xe3C\xbb\xbd\xb6a\xe3\x94SZ\x1aw\xa78\xf0s\xa6\x82\x8e\xb9\xdb\xad\xf55\x17\xc1q\xe0\xa2-m\x90+\x94\xfaN\xd3MD\xe4C\xce\xeb2H<\x93\xf8y\xed8<_\xe4xv\x8c?UH}io\x9b\xcb;\x94\xcb\x15:\xdf8\x9f\xda\xad\xe0\"\x92\xb3\x81\xe5\x14$\x94\xf5[\x85 n\xe71\xceA\xba\xd3\x98\xde\xbaI\xdb\x0e\xad1g\x99Q\xc0\xed%T[\xc7\x85\xcbB\xff\xbb\x9d\xfdE\xcf\xbf}\x8aFP!E\xfb\xbf\xbd\x049W\x8bM\x1c\x84\x94\"\xbdR1:\x1b\xbe\xf9|o\x1e<i\x1e\x82\x8b\xa41\xd9\xa1dY\xcc\x0cxu\xf3)uY\xe95\xf3\xf8\xf7\xe7^Y\xed\xbe4z{\xba\x1eY\x0b\x83\xa9A\xa7\x8c2\xe1\xb4f_zv\x1e\x83\x81i\xe3\xf5X\x85\"h\xe4jss\xca]Vp>\x95\x87\xde\x8e\x9f\x03\x16\xb42w\xd4\xb8~\x15\xd0Mc\xc6\xbb\xfb(\x98 ;\xf2\xc4e\x16\xb7\x17\x05\xed\xac\xf0mg&K\x1bAJ\r\xe0\xaf\xd2\x13\xb2\x8d\\Fs\xd1p\x97?\xa2\xfe\xfdP\xc0\xba~X\xa8x\xc5\xad\xbb\x89\xf6\x0c6\x8d\xb6s\x0fDI\xed\xfbS\\a\xdc\xc5*n\xbd\x0c6\xb6\xd9\xbae\xfd& Gj>]9\xbc=\xe9|R]\x98\xc3\xca<\xeb\xd2\x8e\xab0\xf0\xd6\xcd\xe2RY\xfb\x9d\xcb7\xe7w\xfa\xd9\xc7\x98\xb9\x19\xa9Jh3\x18\xe7udW\x1d\xe6\x07\x812\xd9\xa3\xfe\xfaY\x83\x7f\xeaq\x1c\x0e(4\x9f\xe5\xb5\x8b;\xf0o\xfa{\xc4\xf7a\xb9\x8d\xe4\xb4\xbe=?\xab\xdbCdd\xfex\xbby\xe97O\xb8?Z\xcf/o\xb7\x97\xf4\xba\xd1KL`\xcc\x9f\xff\x08k\xda\xf9\xf5\x9f\xde{\xfd\xf4\xdf\xd3{\xf6\xfe\xfb\xbfl\xc1\xd9\xa7\xca\t\0\0";
-        Mock::given(method("GET"))
-            .and(path("/status_list"))
-            .respond_with(
-                ResponseTemplate::new(200)
-                    .insert_header("Content-Encoding", "gzip")
-                    .set_body_raw(response_bytes, "application/statuslist+jwt"),
-            )
-            .mount(&mock_server)
-            .await;
-
-        // The index 123 is set to INVALID in the given mock response status list.
-        let result = checker
-            .check_credential_status(serde_json::json!({
-                "status_list": {
-                    "idx": 123,
-                    "uri": format!("{}/status_list", server_url),
-                }
-            }))
-            .await;
-
-        assert!(result.is_err(), "Invalid credential status should fail");
-
-        // The index 2 is set to VALID in the given mock response status list.
-        let result = checker
-            .check_credential_status(serde_json::json!({
-                "status_list": {
-                    "idx": 2,
-                    "uri": format!("{}/status_list", server_url),
-                }
-            }))
-            .await;
-
-        assert!(result.is_ok(), "Valid credential status should pass");
+    #[serial]
+    fn test_check_jwt_status_claim() {
+        temp_env::with_vars(
+            [
+                ("UNICORE__CONFIG_FILE", Some("../agent_shared/tests/test.config.yaml")),
+                ("UNICORE__PROFILE", Some("development")),
+            ],
+            || {
+                tokio::runtime::Builder::new_current_thread()
+                    .enable_all()
+                    .build()
+                    .expect("failed to build test runtime")
+                    .block_on(async {
+                        drop(crate::config::config());
+
+                        // A credential with no "status" claim should be considered valid.
+                        let subject = Subject::test_subject().await;
+                        let checker = CredentialStatusChecker {
+                            verification_material_resolver: Arc::new(subject),
+                        };
+
+                        let result = checker.check_credential_status(serde_json::json!({})).await;
+
+                        assert!(result.is_ok(), "Empty status claim should be gracefully skipped");
+
+                        // A credential with a "status" claim that has an unrecognized status type should be considered valid (since we don't know how to check the status, we shouldn't fail the validation just because of that).
+                        let result = checker
+                            .check_credential_status(serde_json::json!({
+                                "id": "https://example.com/status/123",
+                                "type": "UnrecognizedStatusType"
+                            }))
+                            .await;
+
+                        assert!(result.is_ok(), "Unrecognized status type should be gracefully skipped");
+
+                        // Create a new mock server and retreive it's url.
+                        let mock_server = MockServer::start().await;
+                        let server_url = mock_server.uri();
+
+                        let response_bytes: &[u8] = b"\x1f\x8b\x08\0\0\0\0\0\x02\xff-\x95\xdb\x92\xa3:\x12E\xff\xe8\x84$\x8cO\xf9\xb10\x88K\x19\xd1\x08]@/\x13\x80\xa8\xc6H`\xaaL\x97m\xbe~\xd4\x13\xf3\x9e\x11\x99{e\xee\x9d\xc3+\x03C\xfd~-\xae\xd9\xaec\x0ctM\xeemM\xc0\x07Z=}N\xef\xe9\x8c\xef\xea\x95\x1eS#\x0c\xc5$H\xaf\x8fk\x8b\xacI\xa7\xdbU\xc5\xd6\x14\xf3f\x07\xb6\x1e\x89\x81\xdf\n\xf0\x03\x89\xfc\x90\xd5\x01Q\x1c\x1f\n\xb9^\nIf\"z@\xf7qi\xe0\xcd\x1f\x12\xe1U\x8bJr\xc9=\r\xfc\xef\"\xdaB\xe5\x95\xd30)\xd2\"\x8d\x8b\x90\x16%\x80\x0f&E0\x84\xf6\xab\xda\xed\xa4&Q\x93\xa8?(D\xda\xa2\x1e\xa1\x06+\xa2;\xb6\xc4\xd3E\xbb\x8f\x97\x12i\x90.\xe0\x9f\xe1\xe54\xc8\xf4\xaf\x96\x9bN\xe8\xa3\xdfo?\x17\x04\xfd\x8b\xa4?\x9d\xc4kw\xf5\xed\x10\xe3\xad\x8f\x9f\xf62\x9f^\xeauZUM\xe7\x8b<\x8d\xba\xa6\xb7KM\x7fZ$\xfe\\\x9c\xfe\xa6\xa6\xb0\x7f\xc1\xff\xb1\xb8\xec\xef\xd7\xcb9[\x9b\xba\xbc\x16S\xe4\x91\xbd|\xe4!\xdf\t{\xbf\xa7\xcb\xffk\xe1\xe9\x7f\xb5\xe9\xb4\xfe\x9b\xce\xd9\xaa\x93\xdc\xd5\xfe\xe5\xf7\xdc\x1d\xc7c:\x8b\xa2CT\x8aZ\\JG\xb2\x12T\xd0\x90\x84J\xfe\xf6\xabZ\xdc\x94\xc0\xb6\x10\xa7\xbb\x0c\xb5d\x9c\x969V\x17\x81V\xd4\x87\xe3\xa4\x16,y\xa4\xb2\x9c\xbf\xc1\x1ab\"\xe3\xf4\xc5\xcf\x90vK\x16\x95W\xf8\xd1\xd7\xc4\x08\xbb\xbe\xba$\xf3/\x82C\xb6G\xa8\x91\xd4\xed\xc0/J+r-}$\x96\xfc\xa0\xc2\xe6\xa0\xa2\x065sv \xe0\x80dd\x9e\x14\xe1\xef\xa6^=\xe6\t5Hr\x90\x91:\x900h\x98\x1d\xef\xa4VP\xc8\xc6kv\xbcq+\xe6!\xda\x0e\x95\xa5M\x9f\xe0\x0f\xb2\x93s\r\x9e\xdf\xcd\x94\xbdr\xa6/\xcdTn|\xcf\xeed\xb7\xbf\xb4U\xcfKm#5\xe9\x83HJOG[\x9e/\xc1\xd6E\xdaS\xb5\xf1\xa5\xa1w2\xa9\xa3\x10\xd9wW\xa7\x1e\x89q\xc6\x17\xf2GM\xa3\xe8f\x1fh~BZ\x04\xa5\x9e)\x11\xbb\xfa\xd3\xd7Y\xc3B\x12)\x86\xe7.:\x15\xad\x17\xa4\x9aE\x0fjV\xe8\xb0A\xa7\xefJ&\x9bk\x1cP\xc2\x04/\x92,\xe8\x05\xbe\x08<\x9a\xca\xcd5\x98\xb1\xe8&E\x19\xba\x83\x06\xc0\xa3\x02\xa7o6\xd1\x94r<\x97\xfc\xf4\xd3\xc0,Rp\xcct2\xbe8\x87G\xcd\xca\x17G4\xa0q\xf6P2z\x12\x9e}\x14\xf2\xf1h\xac\x90\xc4<a\x07\xc5F&j;\xa9\x7f\x94yn<Q\xb6\x82\xe2U\x03q\x96\x89\xd3c\x1e\x8f\x9e\x8dM\xcfl\xd6N\xcar,\x90\x12A\\\xc2\x14\x95/\xb0\xf7\xf3\x88\xe5\x82\xe1\xa5\xd6\x1f\r\xf73!\xc5\xf1/\x07\x16\xd3_\xca\x92\xa2Z\xde\x11\r\xf1\xaa\xed\xfa\xc9\0-\xfa\x19>]=\xa8$v\x0c\x01\xe8\xa1])OQ>\xe9e\x08\xb3@%$\xa4R?(\x87_\xd5$~x\xa2\xd3V\xe8\xb1\x0f\xf9\xa6\xf9\xdb\xabZ\xb2]\xf1\xd3E\xec\xef>\x81\xe3\xdc9FR\x9e\xe8\xc0\xfd\xdd\xb1\x0e*\x96\x91j\xca\xc2Rf\x9e\x8e\xe9C%\xc1Q@\xb3q\xb9\xfe\x94\xd3\xfbc\x88\xc8L\x93\xf5\x17\xe1\xfcA\xe6\xdf\x87\x82\x05\x8a\x1a\xbb\x95\xc87\x17yx\xc9\x19\x93\xce\xa4{/\xb7\xa5\x88\x9f\x13\rs$<\x9a\xe7H\xd7\xfd\x9c\x95Th\\\xf1mS\xbbH\x8aP\0j0\xd1\xc0\xe2\x16\xe0\xb4t\xde!2:\xd4\xc8\x9e\xd9b\x8f\x95\xbc\xed5\xd4\x0b\r\x85\xcf\xc2@\\\xa4.\xf3\xf9D\x18\xeba%\xf0\xab\x99\"T\x1a\xdf6\x0b\xe6rV\x87\x1e\xdd\x80Jp #K\x18\x16\xce3p/jqlv[U\xb3 }\xa4\xbf:\x9e>)\xa7U/\x82_\xf2\n\0\x9b\xf9\xc6\xa2\xad\xe9\x80P\x82\xe3\xef\xb2\x1e\x05]V\xa7M[\x01\xd3\xbd\xbbBY\"\x95\xf7;\xae\x1d\x03\x9f\x001\x95\xc6\x9a.~6%\xb3?\x1d K\xc3iX\xf2\xdf\xd0y\x9fU\x1c_Z\x83\x8f\xc4\n\xdcM\xf4\x99/+\x1aB\x03\x1c\x97\\'+\x1fB\xfdQ\x19E\xaaY\x1f\x89G\x976$\x89\xcb\x80\x9b\x9be\x1bf\xff\xd2O\xeen*\xb0k\x04|\n\x03\xeb\xb22\xcaa@\xfbY\x04\xc4y\xa5M\xde\x91\xdb\x9b\x10P\xb72\x1e\x0b\xce\x9b\x03M\x82q0\xa7\xb3\x9a\xd5Vy\xfa(\x10\xae)\xd8>\x87\xd8\xb7\x04\xe2\xf2\xaf\xb7y,\xe2\x16\xebX\xef8 \xc9\xedP\xce\xd9\xdd\xddy\xd4\xcc\x9b\xd7\x874)\xe4\x18\xb7\xf1\xcdc@|\xeaE0-\xb1i\x99\xd88(\x1f\"\xb1\x8aF\xdb(8I\x99\xcd\xd1\xc0\xb3\x80Z\xfc\xc3\xec\xc9q\x1bww\x97\x9c\x18\xbf%&\xfb\xc9\xcf\xc0\x1b\xe2\x07\xc8c{\x18\x9c\xa7\x04\x0eL\x7f\x86\x1f\x1d\xd0\x8cE\xa3)\xc4\xfag\x98\xd5\x1f\x973\x86\xe3\xc6\xa3\xa0D%<}\xf6\x9e\x95\"\x14_,\xe1\x1eA$&Q\xfej\xf8\xb85\xfbxo\x19\xf7\xdb%\xcbu\x88I\xbb\x08\xbf\xac\xb3o\x1e\xdf\xa1\xcb\xa7\xb0Jp\xda\x9a\xa77\x18\x9c\xf4 \xdb\xb9\xc0~_\xeb\xe6\xc2F\xdc\xc8\xe7W\x89\xb0a\xb3\xbe\x88x]k\xa0\x1f<\x1cK\xb9\x10\xdb\t\xf2\xe3\xbc\xf05\xe0\x14\x92\xd0\xe6-\x80\xa0\x04\xe9#\x17\xa7\xb8\x14t\xa7\x90\xe6\x033\x0f\x86V\xa8\xac\xf6r\x90{z\x0f\x84\xb0\xd9\x9e'z\xab\xb8\xce\x14\xf2o\x04\xe0\xb6J\xecWcm\xe3<\x9f\x14x]J\x9e\xc5<\xcaV)u\xe1r\xc5\x946\x83%O\x1f\xad\xdb\x05\x93\xe3C\xbb\xbd\xb6a\xe3\x94SZ\x1aw\xa78\xf0s\xa6\x82\x8e\xb9\xdb\xad\xf55\x17\xc1q\xe0\xa2-m\x90+\x94\xfaN\xd3MD\xe4C\xce\xeb2H<\x93\xf8y\xed8<_\xe4xv\x8c?UH}io\x9b\xcb;\x94\xcb\x15:\xdf8\x9f\xda\xad\xe0\"\x92\xb3\x81\xe5\x14$\x94\xf5[\x85 n\xe71\xceA\xba\xd3\x98\xde\xbaI\xdb\x0e\xad1g\x99Q\xc0\xed%T[\xc7\x85\xcbB\xff\xbb\x9d\xfdE\xcf\xbf}\x8aFP!E\xfb\xbf\xbd\x049W\x8bM\x1c\x84\x94\"\xbdR1:\x1b\xbe\xf9|o\x1e<i\x1e\x82\x8b\xa41\xd9\xa1dY\xcc\x0cxu\xf3)uY\xe95\xf3\xf8\xf7\xe7^Y\xed\xbe4z{\xba\x1eY\x0b\x83\xa9A\xa7\x8c2\xe1\xb4f_zv\x1e\x83\x81i\xe3\xf5X\x85\"h\xe4jss\xca]Vp>\x95\x87\xde\x8e\x9f\x03\x16\xb42w\xd4\xb8~\x15\xd0Mc\xc6\xbb\xfb(\x98 ;\xf2\xc4e\x16\xb7\x17\x05\xed\xac\xf0mg&K\x1bAJ\r\xe0\xaf\xd2\x13\xb2\x8d\\Fs\xd1p\x97?\xa2\xfe\xfdP\xc0\xba~X\xa8x\xc5\xad\xbb\x89\xf6\x0c6\x8d\xb6s\x0fDI\xed\xfbS\\a\xdc\xc5*n\xbd\x0c6\xb6\xd9\xbae\xfd& Gj>]9\xbc=\xe9|R]\x98\xc3\xca<\xeb\xd2\x8e\xab0\xf0\xd6\xcd\xe2RY\xfb\x9d\xcb7\xe7w\xfa\xd9\xc7\x98\xb9\x19\xa9Jh3\x18\xe7udW\x1d\xe6\x07\x812\xd9\xa3\xfe\xfaY\x83\x7f\xeaq\x1c\x0e(4\x9f\xe5\xb5\x8b;\xf0o\xfa{\xc4\xf7a\xb9\x8d\xe4\xb4\xbe=?\xab\xdbCdd\xfex\xbby\xe97O\xb8?Z\xcf/o\xb7\x97\xf4\xba\xd1KL`\xcc\x9f\xff\x08k\xda\xf9\xf5\x9f\xde{\xfd\xf4\xdf\xd3{\xf6\xfe\xfb\xbfl\xc1\xd9\xa7\xca\t\0\0";
+                        Mock::given(method("GET"))
+                            .and(path("/status_list"))
+                            .respond_with(
+                                ResponseTemplate::new(200)
+                                    .insert_header("Content-Encoding", "gzip")
+                                    .set_body_raw(response_bytes, "application/statuslist+jwt"),
+                            )
+                            .mount(&mock_server)
+                            .await;
+
+                        // The index 123 is set to INVALID in the given mock response status list.
+                        let result = checker
+                            .check_credential_status(serde_json::json!({
+                                "status_list": {
+                                    "idx": 123,
+                                    "uri": format!("{}/status_list", server_url),
+                                }
+                            }))
+                            .await;
+
+                        assert!(result.is_err(), "Invalid credential status should fail");
+
+                        // The index 2 is set to VALID in the given mock response status list.
+                        let result = checker
+                            .check_credential_status(serde_json::json!({
+                                "status_list": {
+                                    "idx": 2,
+                                    "uri": format!("{}/status_list", server_url),
+                                }
+                            }))
+                            .await;
+
+                        assert!(result.is_ok(), "Valid credential status should pass");
+                    });
+            },
+        );
     }
 }
diff --git a/agent_shared/tests/test.config.yaml b/agent_shared/tests/test.config.yaml
index b0a58869..b0c75045 100644
--- a/agent_shared/tests/test.config.yaml
+++ b/agent_shared/tests/test.config.yaml
@@ -50,8 +50,6 @@ display:
       uri: https://www.impierce.com/external/impierce-icon.png
       alt_text: Impierce Icon
 
-credential_configuration_file: "../agent_shared/tests/test_credential_configurations.json"
-
 secret_manager:
   stronghold_path: ../agent_secret_manager/tests/res/test.stronghold.dat
   # stronghold_password: <defined in .env.test>
diff --git a/agent_shared/tests/test_credential_configurations.json b/agent_shared/tests/test_credential_configurations.json
deleted file mode 100644
index c55341c3..00000000
--- a/agent_shared/tests/test_credential_configurations.json
+++ /dev/null
@@ -1,38 +0,0 @@
-[
-  {
-    "credential_configuration_id": "001",
-    "format": "jwt_vc_json",
-    "type": ["VerifiableCredential"],
-    "display": [
-      {
-        "name": "Verifiable Credential",
-        "locale": "en",
-        "logo": {
-          "uri": "https://www.impierce.com/external/impierce-logo.png",
-          "alt_text": "Impierce Logo"
-        }
-      }
-    ],
-    "authorization": {
-      "pre_authorized": true
-    }
-  },
-  {
-    "credential_configuration_id": "002",
-    "format": "jwt_vc_json",
-    "type": ["VerifiableCredential"],
-    "display": [
-      {
-        "name": "Verifiable Credential",
-        "locale": "en",
-        "logo": {
-          "uri": "https://www.impierce.com/external/impierce-logo.png",
-          "alt_text": "Impierce Logo"
-        }
-      }
-    ],
-    "authorization": {
-      "pre_authorized": false
-    }
-  }
-]
diff --git a/agent_store/src/lib.rs b/agent_store/src/lib.rs
index 087ab2e5..f6dbd35c 100644
--- a/agent_store/src/lib.rs
+++ b/agent_store/src/lib.rs
@@ -226,7 +226,7 @@ pub async fn identity_state<CCB: CqrsComponentBuilder>(
 pub async fn library_state<CCB: CqrsComponentBuilder>(
     builder: &CCB,
     event_publishers: Vec<Box<dyn EventPublisher>>,
-    template_policies: Vec<Box<dyn Query<Template>>>,
+    template_queries: Vec<Box<dyn Query<Template>>>,
 ) -> LibraryState {
     // Partition the event_publishers into the different aggregates.
     let Partitions {
@@ -234,8 +234,8 @@ pub async fn library_state<CCB: CqrsComponentBuilder>(
         ..
     } = partition_event_publishers(event_publishers);
 
-    for policy in template_policies {
-        queries.push(policy);
+    for query in template_queries {
+        queries.push(query);
     }
 
     let (template_command_handler, template, all_templates) = builder
diff --git a/docs/README.md b/docs/README.md
index fab80dd2..48bffa2a 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -18,12 +18,14 @@ These markdown files are used as input for generating the official documentation
 - **[Ubiquitous Language](./glossary/ubiquitous-language.md)** - Shared domain terminology (implementation-free, publishable)
 - **[Introduction](./introduction/)** - Quick start and feature overview
 - **[Configuration](./configuration/)** - Setup and environment variables
+- **[Migration Guides](./migration-guides)** - Step-by-step version migration instructions
 - **[API Documentation](https://beta.docs.impierce.com/unicore/)** - OpenAPI specification
 
 ### For Developers & AI Agents
 
 - **[AI Context & Code Navigation](./glossary/CONTEXT.md)** - Architecture patterns and bounded context mapping
 - **[Glossary Overview](./glossary/)** - How to use ubiquitous language and AI context
+- **[Template Model](./template-model.md)** - Current template structure, reasoning, and data-model-specific behavior
 - **[Architecture Decision Records](./adr/)** - Why certain design choices were made
 - **[Deployment](./deployment/)** - Production deployment guides
 - **[Problem Details](./problem-details/)** - Troubleshooting and error handling
diff --git a/docs/adr/0001-schema-properties-attributes-as-separate-field.md b/docs/adr/0001-schema-properties-attributes-as-separate-field.md
new file mode 100644
index 00000000..d59cd5a3
--- /dev/null
+++ b/docs/adr/0001-schema-properties-attributes-as-separate-field.md
@@ -0,0 +1,108 @@
+# ADR 0001: Keep `schemaPropertiesAttributes` as a Separate Field
+
+**Status**: Accepted  
+**Date**: 2026-05-21  
+**Context**: `feat/enforce-templates` branch
+
+---
+
+## Context
+
+Templates contain a `schema` field that holds a standard JSON Schema document. This schema defines the input surface for credential issuance — what fields a caller must or may provide — and doubles as a client-side validation schema that external parties can use directly with off-the-shelf JSON Schema tooling.
+
+Templates also carry claim attribute metadata, currently stored in a separate `schemaPropertiesAttributes` field. Each entry associates a leaf field path with two boolean flags:
+
+- `selectivelyDisclosable` — whether the field may be selectively omitted by the holder in SD-JWT presentations
+- `nonRemovable` — whether the field is mandated by a credential standard and must remain present in the schema (system-controlled, not settable by callers)
+
+The question was: should this attribute metadata be embedded **inside** the JSON Schema using `x-` extension keywords (e.g. `"x-sd": true`, `"x-non-removable": true`), or kept as a **separate field alongside** the schema?
+
+---
+
+## Decision
+
+Keep `schemaPropertiesAttributes` as a **separate top-level field**, independent of the `schema` field.
+
+Address attribute entries by **JSON Pointer paths to leaf claims**, rather than by embedding metadata in object nodes or inventing a separate path syntax.
+
+---
+
+## Rationale
+
+### 1. External parties validate the schema directly
+
+The primary purpose of the `schema` field is to give API consumers and frontends a standards-compliant JSON Schema they can use to validate credential submissions before sending them to the API. This is an explicit product requirement.
+
+External parties are expected to parse and validate the schema using standard JSON Schema tooling (e.g. `ajv`, Python's `jsonschema`, browser-side validators). These tools follow the JSON Schema specification strictly. While the specification allows `x-` keywords to appear without breaking validation, many real-world tools emit warnings on unknown keywords, and some strict-mode validators may reject them. Embedding platform-specific metadata inside the schema would compromise this primary purpose.
+
+### 2. Separation of concerns
+
+The `schema` field describes **what data looks like** — it is a structural contract between the issuer and credential submitters. The `schemaPropertiesAttributes` field describes **how the platform should handle that data** — it is an operational policy used internally for SD-JWT disclosure and standard-conformance enforcement.
+
+Mixing these two concerns inside a single JSON document creates semantic confusion. A third-party developer reading the schema should not need to parse or understand platform-specific metadata to use the schema for its primary purpose.
+
+### 3. Deterministic claim addressing
+
+Claim metadata is meaningful at the level of actual claim values, not merely at the level of object containers. A nested object such as `address` or `achievement.criteria` is structure; the meaningful claim surface is the set of leaf values beneath it.
+
+Using JSON Pointer paths to leaf claims gives UniCore a standard, deterministic way to refer to those claims:
+
+- `/name`
+- `/address/city`
+- `/achievement/criteria/narrative`
+
+This choice avoids ambiguity in nested schemas, aligns with how frontends derive fields from the schema tree, and removes the need for a UniCore-specific path notation.
+
+### 4. Clean extensibility
+
+Adding new attribute flags in the future (e.g. a `mandatory` flag for required submission, or a `pattern` override hint) is straightforward when attributes live in their own field. Embedding these in the JSON Schema would require every consumer to understand and ignore an ever-growing set of `x-` keywords.
+
+### 5. Simpler schema storage and versioning
+
+JSON Schema documents are often stored, cached, or forwarded verbatim by tooling. A schema that contains only standard JSON Schema keywords is safe to store and forward without stripping. A schema with embedded `x-` metadata requires either stripping before forwarding or ensuring downstream consumers handle unknown keywords gracefully.
+
+---
+
+## Alternatives Considered
+
+### Embed as `x-` extension keywords
+
+```json
+{
+  "type": "object",
+  "properties": {
+    "name": {
+      "type": "string",
+      "x-sd": true,
+      "x-non-removable": false
+    }
+  }
+}
+```
+
+**Rejected because**: third-party JSON Schema tooling may warn or fail on unknown keywords, compromising the primary use case of the schema field as a client-side validation document.
+
+### Use JSON Schema `$comment` or `description` fields for metadata
+
+**Rejected because**: `$comment` and `description` are unstructured strings; parsing structured metadata out of them is fragile and non-standard.
+
+---
+
+## Consequences
+
+- The `schema` field remains a clean, standards-compliant JSON Schema document with no platform-specific extensions.
+- `schemaPropertiesAttributes` keys use **JSON Pointer** notation (RFC 6901) to address leaf fields within the nested schema, providing an unambiguous and standard path format.
+- Object container nodes are not directly addressable through `schemaPropertiesAttributes`; metadata is attached to leaf claims only.
+
+---
+
+## Note: No automatic `additionalProperties` injection
+
+An earlier implementation automatically injected `"additionalProperties": false` into every object node of the stored schema. This was removed in favour of simplicity and readability. The schema is now stored exactly as provided by the caller. Callers who want strict additional-property rejection may include `"additionalProperties": false` themselves.
+
+- Consumers who want to understand claim projection metadata must read both fields. This is an acceptable tradeoff given the audience (issuer-facing admin API, not credential holder tooling).
+- When displaying the schema in a frontend form builder, the UI layer is responsible for merging the two fields into a combined view if needed.
+
+## Related Documentation
+
+For the current shape and behavior of templates across supported data models, see [Template Model](../template-model.md).
diff --git a/docs/adr/README.md b/docs/adr/README.md
new file mode 100644
index 00000000..275fc32b
--- /dev/null
+++ b/docs/adr/README.md
@@ -0,0 +1,3 @@
+# Architecture Decision Records (ADR)
+
+This directory contains Architecture Decision Records (ADRs) for **UniCore**. ADRs are a way to document important architectural decisions, their context, rationale, and alternatives considered. They serve as a historical record of why certain design choices were made and can help future developers understand the reasoning behind the architecture.
diff --git a/docs/concepts/public-credential-offers.md b/docs/concepts/public-credential-offers.md
new file mode 100644
index 00000000..3e466fdd
--- /dev/null
+++ b/docs/concepts/public-credential-offers.md
@@ -0,0 +1,33 @@
+# Public Credential Offers
+
+## What this feature does
+
+Public Credential Offers let an issuer create a reusable credential offer link that anyone can use, without creating a new offer for each issuance.
+
+This enables "share once, issue many" use cases (public events, demos, testing environments).
+
+## Why this is useful
+
+- The resulting QR code can be embedded in portals, emails, landing pages without it having to be recreated for each issuance.
+
+## How it works (high level)
+
+1. An issuer creates a template which has no user-specific fields (such as a name, a grade or alike) and only constant values that are the same for each credential to be issued (such as the name of the event, the date of issuance, a logo).
+2. The public offer is created and can be taken online and offline by the operator. A public URL is created which the operator can share or show on a screen.
+3. Clients can scan the QR code and claim the credential in their identity wallets.
+4. The operator can track the amount of successful claims in the overview.
+5. Operators can take an offer offline, bring it back online, or delete it.
+
+## Built-in safeguards
+
+Public offers are intentionally restricted to static credentials:
+
+- The referenced template must exist.
+- Deleted templates are treated as unavailable.
+- The template schema must use const values for all fields.
+
+## Operational intent
+
+Use Public Credential Offers when you want controlled, repeatable issuance of predefined credentials at scale.
+
+Do not use this flow for credentials that require dynamic or user-specific claim values per issuance.
diff --git a/docs/concepts/templates/credential-templates.md b/docs/concepts/templates/credential-templates.md
new file mode 100644
index 00000000..da7e3e58
--- /dev/null
+++ b/docs/concepts/templates/credential-templates.md
@@ -0,0 +1,426 @@
+# Credential Templates
+
+> **Summary for AI indexing**: A credential template in UniCore is the central configuration object that governs how a verifiable credential is shaped, validated, and issued. It defines the data model, the credential's field structure (via JSON Schema), selective-disclosure behavior, expiration policy, and publication status. Only `Published` templates are issuable. Templates follow a strict lifecycle from `Draft` → `Published` → `Archived` → `Deleted`.
+
+---
+
+## What Is a Credential Template?
+
+A **credential template** is a reusable, policy-carrying definition that tells UniCore:
+
+- **what** credential data looks like (field structure, required fields, types)
+- **how** that credential should be issued (data model, expiration policy, credential type URIs)
+- **who** may receive it and in what context (holder type, visibility)
+- **which** fields may be selectively disclosed by the holder in SD-JWT presentations
+
+Every unsigned credential issuance request in UniCore must reference a template. The template acts as both a validation contract and an operational policy: before any credential is issued, UniCore checks that the submitted data conforms to the template schema and that the template is in a state that permits issuance.
+
+---
+
+## Template Fields at a Glance
+
+| Field                        | Required on create                          | Mutable                | Description                                                                 |
+| ---------------------------- | ------------------------------------------- | ---------------------- | --------------------------------------------------------------------------- |
+| `title`                      | Yes                                         | Yes (Draft, Published) | Human-readable name for the template                                        |
+| `dataModel`                  | Yes                                         | No                     | Credential data model (W3C VC 1.1, VC 2.0, OB 3.0, ELM 3.3)                 |
+| `holderType`                 | Yes                                         | No                     | Who the credential is issued to (`Individual` or `Organization`)            |
+| `schema`                     | Yes                                         | Yes (Draft, Published) | JSON Schema defining the issuance input surface                             |
+| `status`                     | No (defaults to `Draft`)                    | Yes (see lifecycle)    | Current lifecycle stage of the template                                     |
+| `type`                       | No (defaults to `["VerifiableCredential"]`) | Yes (Draft, Published) | Credential type URIs included in the issued credential                      |
+| `credentialExpiration`       | No (defaults to `P90D`)                     | Yes (Draft, Published) | Upper-bound expiration policy for issued credentials                        |
+| `display`                    | No                                          | Yes (Draft, Published) | Display metadata: name and optional logo                                    |
+| `description`                | No                                          | Yes (Draft, Published) | Free-text description for the template (not included in issued credentials) |
+| `tags`                       | No                                          | Yes (Draft, Published) | Organizational labels (not included in issued credentials)                  |
+| `visibility`                 | No (defaults to `Private`)                  | Yes (Draft, Published) | Whether the template appears in a future public listing endpoint            |
+| `schemaPropertiesAttributes` | No                                          | Yes (Draft, Published) | Per-field SD-JWT and system-policy metadata for schema leaf fields          |
+| `modifiedAt`                 | System-managed                              | —                      | Timestamp of the last state-changing mutation                               |
+
+---
+
+## Template Lifecycle
+
+Templates follow a **one-directional lifecycle** with four stages. Each stage has distinct visibility, mutability, and issuability rules.
+
+```
+Draft ──► Published ──► Archived ──► Deleted
+  │                        ▲              (terminal)
+  │                        │
+  └───────────────────────►┘
+  │
+  └──────────────────────────────────────► Deleted
+```
+
+### Allowed Transitions
+
+| From        | To                                 |
+| ----------- | ---------------------------------- |
+| `Draft`     | `Published`, `Archived`, `Deleted` |
+| `Published` | `Archived`                         |
+| `Archived`  | `Published`, `Deleted`             |
+| `Deleted`   | _(none — terminal)_                |
+
+> **Note**: Deleting a `Published` template is not allowed directly. The template must first be `Archived`.
+
+### Draft
+
+A template starts as a `Draft` when created without an explicit status. Drafts are:
+
+- **visible** to authenticated users via the template API
+- **not issuable** — a draft template cannot be used for issuance or offers
+- **mutable** — all fields except `dataModel` and `holderType` may be changed
+- **structurally validated** — drafts must satisfy all schema validity rules even though they are not yet published; invalid drafts cannot be saved
+
+### Published
+
+A `Published` template is the live, operational state:
+
+- **visible** to authenticated users
+- **issuable** — the template may be used for credential issuance and offers
+- **has a credential configuration** — UniCore automatically derives and maintains a credential configuration from the template's fields; this configuration is what wallets discover during the OID4VCI flow
+- **mutable in place** — fields may still be changed while published, but every update must leave the template in a valid, publishable state
+- cannot transition back to `Draft`
+
+### Archived
+
+An archived template is retained for reference but removed from active issuance:
+
+- **visible** to authenticated users
+- **not issuable** — cannot be used for new issuance or new offers
+- **no credential configuration** — the credential configuration is removed when a template is archived
+- **immutable** — only `status` may change while archived
+- **outstanding offers** may already exist; their redemption will fail once the template is archived
+
+### Deleted
+
+A deleted template is permanently retired:
+
+- **hidden** from list results and behaves as "not found" on direct lookup
+- **terminal** — no further changes are possible
+- retained internally for audit purposes (soft delete)
+
+---
+
+## Data Models
+
+Each template is tied to exactly one **credential data model**, set at creation time and immutable thereafter. The data model controls which credential format is used when a credential is issued from this template.
+
+| Data Model                  | Key                  | Notes                                              |
+| --------------------------- | -------------------- | -------------------------------------------------- |
+| W3C VC Data Model 1.1       | `W3CVcDataModelV1_1` | Classic JWT-based VCs; no selective disclosure     |
+| W3C VC Data Model 2.0       | `W3CVcDataModelV2_0` | SD-JWT-based VCs with selective disclosure support |
+| Open Badges 3.0             | `OpenBadges3_0`      | IMS Open Badges; see OB-specific rules below       |
+| European Learning Model 3.3 | `ElmV3_3`            | EU digital credentials                             |
+
+> W3C VC 1.1 templates do not support `schemaPropertiesAttributes`. Attempting to set claim attributes on a VC 1.1 template returns an error.
+
+> **ELM V3.3 note**: European Learning Model 3.3 templates currently accept a caller-defined schema with no field-level standard enforcement beyond valid JSON Schema. ELM-specific field validation is planned to be tightened in a future iteration, following the same approach as OB 3.0.
+
+---
+
+## The `schema` Field
+
+The `schema` field is a **JSON Schema document** that defines the _input surface_ for credential issuance. It describes the exact shape of the data a caller must submit when requesting a credential from this template.
+
+### Purpose
+
+1. **Input validation** — UniCore validates every unsigned issuance request against the template schema before issuing the credential. Requests that do not conform are rejected.
+2. **Client-side validation** — API consumers and frontends can use the schema directly with any standard JSON Schema library to validate data before sending it to the server.
+3. **Claim projection** — the schema's leaf fields determine which claims appear in the issued credential's claim set and are eligible for selective disclosure.
+
+### Shape Rules
+
+- The top-level type must always be `"object"` with a `"properties"` map.
+- The schema uses **real nested JSON Schema objects** — dotted flat keys are not supported.
+- **Array types are rejected**. Any schema that contains a field with `"type": "array"` at any nesting level is invalid. Array-type support will be designed separately when needed.
+- Dots in property names are allowed but have no special meaning; they are treated as literal characters.
+
+### Canonicalization
+
+UniCore **canonicalizes** the schema on write for OB 3.0 templates only. Canonicalization:
+
+- injects OB-mandated `"required"` arrays at the appropriate nesting levels
+
+This means callers do not need to manage `required` arrays for OB mandatory fields themselves — the system injects them. For all other aspects of the schema (including `additionalProperties`), the schema is stored exactly as provided.
+
+### Example: W3C VC Schema
+
+The schema is stored exactly as provided by the caller:
+
+```json
+{
+  "type": "object",
+  "properties": {
+    "firstName": { "type": "string" },
+    "dateOfBirth": { "type": "string" },
+    "address": {
+      "type": "object",
+      "properties": {
+        "city": { "type": "string" },
+        "country": { "type": "string" }
+      }
+    }
+  }
+}
+```
+
+Callers may include `"additionalProperties": false` themselves if strict validation is desired.
+
+---
+
+## Open Badges 3.0 Schema Rules
+
+Open Badges 3.0 templates have additional constraints on top of the general schema rules, because OB 3.0 is a structured standard with required and allowed fields.
+
+### Nested Schema Shape
+
+OB schemas must follow the nested JSON Schema format. The credential subject structure mirrors the OB 3.0 specification:
+
+```json
+{
+  "type": "object",
+  "properties": {
+    "achievement": {
+      "type": "object",
+      "properties": {
+        "name": { "type": "string" },
+        "description": { "type": "string" },
+        "criteria": {
+          "type": "object",
+          "properties": {
+            "narrative": { "type": "string" }
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+### Property Validation
+
+Property names at each nesting level are validated against the **OB 3.0 JSON Schema specification** embedded in UniCore. Fields not present in the OB 3.0 spec are rejected. This means:
+
+- properties at the root level must be valid `AchievementSubject` fields
+- properties under `achievement` must be valid `Achievement` fields
+- properties under `achievement.criteria` must be valid `Criteria` fields
+- etc.
+
+### Required Fields
+
+The following three leaf fields are **mandatory** in every OB 3.0 template schema:
+
+| JSON Pointer                      | Path in schema                       | Type constraint                 |
+| --------------------------------- | ------------------------------------ | ------------------------------- |
+| `/achievement/name`               | `achievement → name`                 | `"string"` or a `"const"` value |
+| `/achievement/description`        | `achievement → description`          | `"string"` or a `"const"` value |
+| `/achievement/criteria/narrative` | `achievement → criteria → narrative` | `"string"` or a `"const"` value |
+
+If any of these fields are absent from the schema, the template create or schema-update request is rejected.
+
+These fields are also automatically marked `nonRemovable: true` in `schemaPropertiesAttributes` (see below).
+
+### Issuance
+
+Callers submit credential data as nested JSON matching the schema. No flat-to-nested mapping is performed by UniCore. The submitted `credentialSubject` data must follow the nested structure of the schema directly.
+
+---
+
+## `schemaPropertiesAttributes`
+
+`schemaPropertiesAttributes` is an optional map that attaches per-field behavioral metadata to the schema's **leaf fields**. It is stored alongside (not inside) the schema.
+
+### Key Format: JSON Pointer (RFC 6901)
+
+Keys must be **JSON Pointer** paths (RFC 6901) pointing to leaf fields in the schema:
+
+| Field location                   | Key                               |
+| -------------------------------- | --------------------------------- |
+| Top-level field `name`           | `/name`                           |
+| Nested field under `achievement` | `/achievement/name`               |
+| Deeply nested field              | `/achievement/criteria/narrative` |
+
+Keys must point to **leaf fields only**. Intermediate object nodes (e.g. `/achievement`) are not valid targets and are rejected. Keys pointing to non-existent schema paths are also rejected.
+
+### Attribute Flags
+
+Each entry in `schemaPropertiesAttributes` carries two boolean flags:
+
+| Flag                     | Caller-settable  | Description                                                                                                                                                                  |
+| ------------------------ | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `selectivelyDisclosable` | Yes              | When `true`, the holder may selectively omit this field when presenting the credential in SD-JWT format                                                                      |
+| `nonRemovable`           | No (system-only) | When `true`, this leaf field must remain present in the schema and cannot be removed by the caller. Set automatically for standard-mandated fields (e.g. OB required fields) |
+
+### Auto-Population
+
+When creating an OB 3.0 template, UniCore automatically populates `schemaPropertiesAttributes` for all leaf fields in the schema. The three OB-required fields receive `nonRemovable: true`; all other fields receive `nonRemovable: false`. `selectivelyDisclosable` defaults to `false` for all fields.
+
+Callers may override `selectivelyDisclosable` but cannot change `nonRemovable`.
+
+### Auto-Pruning
+
+When a schema update removes leaf fields, UniCore automatically removes the corresponding entries from `schemaPropertiesAttributes`. Entries for fields that no longer exist in the schema are pruned silently.
+
+### Schema Updates and `nonRemovable`
+
+Updating the schema to remove a leaf field that is marked `nonRemovable: true` is **rejected**. This protects standard-mandated fields from being accidentally dropped.
+
+### W3C VC 1.1 Restriction
+
+W3C VC 1.1 templates do not support selective disclosure (`jwt_vc_json` format does not expose claim metadata). Setting `schemaPropertiesAttributes` on a VC 1.1 template returns an error.
+
+---
+
+## Credential Expiration Policy
+
+The `credentialExpiration` field sets an **upper-bound policy** for how long issued credentials remain valid. It applies to every credential issued from this template.
+
+### Supported Values
+
+| Value                | Meaning                                                                                  |
+| -------------------- | ---------------------------------------------------------------------------------------- |
+| `Never`              | Issued credentials do not expire                                                         |
+| `Duration(ISO 8601)` | Issued credentials expire after this duration from issuance time (e.g. `P90D` = 90 days) |
+| `DateTime(ISO 8601)` | Issued credentials expire at this fixed point in time                                    |
+
+### Override Semantics
+
+Callers may **shorten** the expiration at request time, but may not lengthen it beyond the template policy:
+
+- If the template says `Duration(P90D)`, a caller may request an expiry of `P30D` or earlier — but not `P180D`.
+- If the template says `DateTime(2027-01-01)`, a caller may request any earlier date — but not a later one.
+- If the template says `Never`, a caller may still request a finite expiry.
+- If the caller does not specify an expiry, the template value is used as-is.
+
+---
+
+## Credential Type (`type`)
+
+The `type` field contains the list of credential type URIs included in every credential issued from this template. UniCore normalizes and validates this list.
+
+### General Rules
+
+- `VerifiableCredential` must always be present.
+- If the caller omits `type` or provides an empty list, it defaults to `["VerifiableCredential"]`.
+- Type values are case-sensitive. Incorrectly cased values are rejected.
+- Blank entries are silently dropped during normalization.
+
+### Open Badges 3.0 Rules
+
+OB 3.0 templates have stricter type requirements:
+
+- Must include `VerifiableCredential`.
+- Must include exactly one of `OpenBadgeCredential` or `AchievementCredential`.
+- May not include both badge-specific types simultaneously.
+- May not include extra custom types.
+- Default (empty input): `["VerifiableCredential", "OpenBadgeCredential"]`.
+
+---
+
+## Credential Configurations
+
+When a template transitions to `Published`, UniCore automatically **derives a credential configuration** from it. This configuration is the technical descriptor that wallets read during the OpenID for Verifiable Credential Issuance (OID4VCI) discovery flow.
+
+The credential configuration is kept **in sync** with the template. Any change to a published template that affects issuer metadata (title, display, type, schema, schemaPropertiesAttributes) triggers an automatic resync of the credential configuration. This update is **strongly consistent**: the template write is not considered successful until the derived configuration has been updated.
+
+When a template is archived or deleted, the credential configuration is removed.
+
+> API consumers should never need to manage credential configurations directly; they are fully derived from and owned by the template.
+
+---
+
+## Duplication
+
+Any template in `Draft`, `Published`, or `Archived` status may be duplicated. Duplicates:
+
+- start as `Draft`
+- inherit all content fields from the source template
+- receive a system-generated `template_id`
+- have `visibility` reset to `Private`
+- receive an automatic `Copy`-style suffix appended to the title
+
+The lineage link (source template ID) is retained internally but is not exposed in the API response.
+
+---
+
+## Visibility
+
+The `visibility` field controls whether the template appears in a future **unauthenticated public template listing** endpoint. It has no effect on authenticated API access or on whether a credential configuration exists.
+
+| Value     | Effect                                                            |
+| --------- | ----------------------------------------------------------------- |
+| `Private` | Template does not appear in the public listing                    |
+| `Public`  | Template appears in the public listing (only if also `Published`) |
+
+---
+
+## Update Request Semantics
+
+Template update requests follow consistent field-level semantics:
+
+- **Omitted field** — the field is left unchanged. Omitting a field does not clear it.
+- **`null` for a clearable field** — clears the field back to absent. Clearable fields are: `display`, `description`, `tags`, `schemaPropertiesAttributes`.
+- **`null` for a non-clearable field** — rejected as invalid. Non-clearable fields include `title`, `schema`, `type`, etc.
+- **Empty collections** (`[]` or `{}`) — treated identically to `null`. `tags: []` and `tags: null` both clear tags; `schemaPropertiesAttributes: {}` and `schemaPropertiesAttributes: null` both clear the attributes.
+- **Empty or whitespace-only string for a clearable field** — treated as `null` (clears the field). Applies to `description`.
+- **Empty or whitespace-only string for a non-clearable field** — rejected. Applies to `title`.
+- **All string values** — trimmed of leading and trailing whitespace before validation and storage.
+
+---
+
+## Offer Behavior
+
+Offers always reference a `template_id`. UniCore resolves the corresponding credential configuration internally; callers do not specify credential configuration IDs.
+
+Offers use the **live template state at redemption time**, not a snapshot taken when the offer was created. If the template's schema or type changes between offer creation and wallet redemption, the current state applies.
+
+Archiving or deleting a template does **not** automatically invalidate outstanding offers. Any attempt to redeem an offer against a template that is no longer `Published` will fail at redemption time.
+
+---
+
+## Pre-signed Credentials
+
+Pre-signed credential issuance follows a different validation contract from unsigned issuance. The signed payload is trusted as-is — UniCore only checks that the template exists, is `Published`, and that the format is compatible with the credential configuration.
+
+| Rule                                       | Unsigned issuance | Pre-signed issuance |
+| ------------------------------------------ | ----------------- | ------------------- |
+| Template must be `Published`               | Yes               | Yes                 |
+| Format must match credential configuration | Yes               | Yes                 |
+| Payload validated against template schema  | Yes               | **No**              |
+| `type` verified against template           | Yes               | **No**              |
+| `credentialExpiration` enforced            | Yes               | **No**              |
+| `expiresAt` in request honoured            | Yes               | **No (ignored)**    |
+
+Content correctness is the caller's responsibility. If the template is no longer `Published` at redemption time, offer redemption fails. Holder-facing metadata uses the current live credential configuration; the signed content may diverge from the live template state, and this divergence is intentional and accepted.
+
+---
+
+## Validation Error Codes
+
+Template API operations return two distinct HTTP error codes for input problems:
+
+| Code                       | When to expect it                                                                                                                                                                                                                |
+| -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `400 Bad Request`          | Malformed JSON, deserialization failure, or other transport-level structural error                                                                                                                                               |
+| `422 Unprocessable Entity` | Business rule violation — the request is structurally valid JSON but violates a domain constraint (e.g. invalid schema, forbidden status transition, missing required fields for publication, non-clearable field set to `null`) |
+
+Business-rule failures fail fast rather than aggregating multiple errors into a single response.
+
+---
+
+## Practical Summary for New Integrators
+
+1. **Create a template** with `status: Draft` and define the `schema` for your credential type.
+2. **Test your schema** — UniCore validates schemas on write, so submission errors are caught early.
+3. **Set `schemaPropertiesAttributes`** if you need selective disclosure (SD-JWT data models only).
+4. **Publish the template** (`status: Published`) when it is ready for issuance.
+5. **Issue credentials** by referencing the `templateId` in issuance requests. UniCore validates the submitted data against the template schema before issuing.
+6. **Archive the template** when you want to stop new issuance without deleting history.
+7. **Delete the template** (after archiving) if you want to permanently retire it.
+
+---
+
+## Related Documentation
+
+- [Credential Issuance Features](../introduction/features/issuance.md)
+- [ADR 0001: Keep `schemaPropertiesAttributes` as a Separate Field](../adr/0001-schema-properties-attributes-as-separate-field.md)
+- [Configuration Reference](../configuration/CONFIGURATION.md)
diff --git a/docs/concepts/templates/examples/open-badges-3-0.md b/docs/concepts/templates/examples/open-badges-3-0.md
new file mode 100644
index 00000000..9711be06
--- /dev/null
+++ b/docs/concepts/templates/examples/open-badges-3-0.md
@@ -0,0 +1,106 @@
+# Open Badges 3.0 — Example
+
+This example shows how to create a template and issue a credential using the
+[Open Badges 3.0](https://www.imsglobal.org/spec/ob/v3p0/) format.
+
+---
+
+## 1. Create a template
+
+The template schema for Open Badges 3.0 must include the required achievement fields defined
+by the IMS Global specification. UniCore enforces the following as non-removable (they must
+always be present in the schema):
+
+- `/achievement/name`
+- `/achievement/description`
+- `/achievement/criteria/narrative` _(UniCore requirement)_
+
+```http
+POST /v0/create-new-template
+Content-Type: application/json
+```
+
+```json
+{
+  "title": "Teamwork Badge",
+  "dataModel": "open_badges_3-0",
+  "holderType": "individual",
+  "status": "published",
+  "visibility": "private",
+  "type": [],
+  "schema": {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "type": "object",
+    "properties": {
+      "achievement": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "description": {
+            "type": "string"
+          },
+          "criteria": {
+            "type": "object",
+            "properties": {
+              "narrative": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+> The `id` returned in the response is used as `templateId` in the next step.
+
+---
+
+## 2. Issue a credential
+
+The `credential` field carries the credential data. Nest the subject properties under
+`credentialSubject` — the template schema describes exactly that shape.
+
+```http
+POST /v0/credentials
+Content-Type: application/json
+```
+
+```json
+{
+  "templateId": "<template-id-from-step-1>",
+  "offerId": "my-offer-001",
+  "credential": {
+    "credentialSubject": {
+      "type": ["AchievementSubject"],
+      "achievement": {
+        "type": ["Achievement"],
+        "name": "Teamwork Badge",
+        "description": "Awarded for exceptional collaboration within a team environment.",
+        "criteria": {
+          "narrative": "Nominated by peers and recognised by management for outstanding teamwork."
+        }
+      }
+    }
+  }
+}
+```
+
+UniCore automatically injects the following fields before signing:
+
+| Field                        | Value                                                                                |
+| ---------------------------- | ------------------------------------------------------------------------------------ |
+| `@context`                   | `["https://www.w3.org/ns/credentials/v2", "https://purl.imsglobal.org/spec/ob/..."]` |
+| `type`                       | `["VerifiableCredential", "AchievementCredential"]`                                  |
+| `id`                         | URN derived from the internal credential UUID                                        |
+| `name`                       | `"OpenBadge Credential"` (default if not provided)                                   |
+| `issuer.id`                  | DID of the issuer (from configuration)                                               |
+| `issuer.name`                | Display name (from configuration)                                                    |
+| `issuer.type`                | `"Profile"`                                                                          |
+| `credentialSubject.id`       | DID of the holder (set at presentation)                                              |
+| `validFrom` / `issuanceDate` | Timestamp of credential creation                                                     |
+| `credentialStatus`           | Status list entry                                                                    |
diff --git a/docs/concepts/templates/examples/w3c-vc-2-0.md b/docs/concepts/templates/examples/w3c-vc-2-0.md
new file mode 100644
index 00000000..26a6afc7
--- /dev/null
+++ b/docs/concepts/templates/examples/w3c-vc-2-0.md
@@ -0,0 +1,83 @@
+# W3C Verifiable Credentials Data Model 2.0 — Example
+
+This example shows how to create a template and issue a credential using the W3C Verifiable Credentials Data Model 2.0 format.
+
+---
+
+## 1. Create a template
+
+The template defines the structure and validation rules for the credential. The `schema` describes
+the shape of the **credential subject data** — the properties that the issuer and the holder
+care about (not the W3C envelope fields; those are injected automatically).
+
+```http
+POST /v0/create-new-template
+Content-Type: application/json
+```
+
+```json
+{
+  "title": "Employee ID",
+  "dataModel": "w3c_vc_data_model_v2-0",
+  "holderType": "individual",
+  "status": "published",
+  "visibility": "private",
+  "type": [],
+  "schema": {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "type": "object",
+    "properties": {
+      "name": {
+        "type": "string"
+      },
+      "department": {
+        "type": "string"
+      }
+    },
+    "required": ["name", "department"]
+  },
+  "schemaPropertiesAttributes": {
+    "/name": { "selectivelyDisclosable": false },
+    "/department": { "selectivelyDisclosable": true }
+  }
+}
+```
+
+> The `id` returned in the response is used as `templateId` in the next step.
+
+---
+
+## 2. Issue a credential
+
+When issuing a credential, the `credential` field carries the credential data. Nest the subject
+properties under `credentialSubject` — the template schema describes exactly that shape.
+
+```http
+POST /v0/credentials
+Content-Type: application/json
+```
+
+```json
+{
+  "templateId": "<template-id-from-step-1>",
+  "offerId": "my-offer-001",
+  "credential": {
+    "credentialSubject": {
+      "name": "Jane Smith",
+      "department": "Engineering"
+    }
+  }
+}
+```
+
+UniCore automatically injects the following fields before signing:
+
+| Field                        | Value                                      |
+| ---------------------------- | ------------------------------------------ |
+| `@context`                   | `["https://www.w3.org/ns/credentials/v2"]` |
+| `type`                       | `["VerifiableCredential", ...]`            |
+| `issuer.id`                  | DID of the issuer (from configuration)     |
+| `issuer.name`                | Display name (from configuration)          |
+| `credentialSubject.id`       | DID of the holder (set at presentation)    |
+| `validFrom` / `issuanceDate` | Timestamp of credential creation           |
+| `credentialStatus`           | Status list entry                          |
diff --git a/docs/migration-guides/Migrating templates to beta.19.md b/docs/migration-guides/Migrating templates to beta.19.md
new file mode 100644
index 00000000..a27a6f22
--- /dev/null
+++ b/docs/migration-guides/Migrating templates to beta.19.md	
@@ -0,0 +1,111 @@
+# Migrating Guide to `beta.19`
+
+This guide is for developers who want to migrate to the `beta.19` release of the UniCore API. Some breaking changes have been made to the templates API which are outlined below.
+
+## Improvements
+
+- **Stronger template enforcement**: Fields like `dataModel`, `holderType`, and `credentialExpiration` are more strictly validated.
+- **No more manual credential configurations**: There is no need to manage the "credential configurations" manually to go in sync with the template you created. Credential configurations are automatically kept in sync with the template.
+- **Clearer endpoint names**: template routes now follow a "command-style" naming convention and are flat under `/v0` paths without paths such as `/v0/templates/`.
+
+---
+
+## 1. Rename template endpoints
+
+All template routes have moved from `/v0/templates/*` to `/v0/*` paths and changed their names slightly.
+
+| Previous                                | New                               |
+| --------------------------------------- | --------------------------------- |
+| `GET /v0/templates/get-all-templates`   | `GET /v0/list-all-templates`      |
+| `GET /v0/templates/{template_id}`       | `GET /v0/get-template-by-id/{id}` |
+| `POST /v0/templates/create-template`    | `POST /v0/create-new-template`    |
+| `POST /v0/templates/update-template`    | `POST /v0/update-template`        |
+| `POST /v0/templates/duplicate-template` | `POST /v0/duplicate-template`     |
+| `POST /v0/templates/delete-template`    | `POST /v0/delete-template`        |
+
+---
+
+## 2. Remove credential configuration calls
+
+The management of **credential configurations** is no longer required and you can remove any calls to `POST /v0/credential-configurations`. When you create or update a template, UniCore automatically derives and publishes the matching credential configuration.
+
+---
+
+## 3. Update template creation requests
+
+The `create-new-template` request body has changed:
+
+- `creator` field removed.
+- `credentialExpiration` added (optional). Accepts `never`, `duration` (ISO 8601), or `date-time` (ISO 8601). The default value is **90 days** if not stated explicitly.
+- `dataModel` defaults to `w3c_vc_data_model_v2-0` if omitted and can not be changed after initial creation.
+- `schema` is more restrictive when the `dataModel` is following a standard such as **Open Badges 3.0**.
+- `schemaPropertiesAttributes` is optional, but only required if some fields in the schema should be selectively disclosable.
+- `holderType` defaults to `individual` if omitted and can not be changed after initial creation.
+
+**Before:**
+
+```http
+POST /v0/templates/create-template
+Content-Type: application/json
+
+{
+  "title": "Employee ID Credential",
+  "dataModel": "w3c_vc_data_model_v1-1",
+  "holderType": "individual",
+  "creator": "acme-corp"
+}
+```
+
+**After:**
+
+```http
+POST /v0/create-new-template
+Content-Type: application/json
+
+{
+  "title": "Employee ID Credential",
+  "dataModel": "w3c_vc_data_model_v1-1",
+  "holderType": "individual",
+  "credentialExpiration": { "type": "duration", "value": "P1Y" },
+  "schema": {
+    "type": "object",
+    "properties": {
+      "name": { "type": "string" },
+      "employeeId": { "type": "string" }
+    }
+  }
+}
+```
+
+---
+
+## 4. Update credential creation requests
+
+`POST /v0/credentials` no longer accepts `credentialConfigurationId`. Replace it with `templateId`, which is the `id` returned when you created the template. Credential expiration is now determined by the template's `credentialExpiration` field, but can be overridden by specifying `expiresAt` during issuance (as long as it does not exceed the template limit).
+
+**Before:**
+
+```http
+POST /v0/credentials
+Content-Type: application/json
+
+{
+  "offerId": "...",
+  "credentialConfigurationId": "employee-id-credential",
+  "expiresAt": "2027-01-01T00:00:00Z",
+  "credential": { ... }
+}
+```
+
+**After:**
+
+```http
+POST /v0/credentials
+Content-Type: application/json
+
+{
+  "offerId": "...",
+  "templateId": "550e8400-e29b-41d4-a716-446655440000",
+  "credential": { ... }
+}
+```
diff --git a/docs/problem-details/issuance.md b/docs/problem-details/issuance.md
index 2b830165..30bb64f5 100644
--- a/docs/problem-details/issuance.md
+++ b/docs/problem-details/issuance.md
@@ -24,15 +24,12 @@ Review your request payload to confirm that the credential type aligns with thes
 
 ## No Credential Configuration Found
 
-This error is raised when the system cannot find a credential configuration that matches the provided `credentialConfigurationId`. This indicates that either the specified configuration does not exist or it has not been properly set up in the server's settings.
+This error is raised when the system cannot find a credential configuration. The credential configurations are derived from the templates. This error indicates that either the template does not exist, is not in a usable state, or its derived credential configuration is unavailable. If you believe this is an unexpected error, please consider opening an [issue on GitHub](https://github.com/impierce/ssi-agent/issues).
 
 ### Resolution
 
-- **Verify the Identifier:**  
-  Ensure that the `credentialConfigurationId` in your request is correct.
-
-- **Review Server Configuration:**  
-  Verify that the desired credential configuration is defined in the `credential_configurations` section of your `config.yaml` file. Ensure that the `credentialConfigurationId` provided in your request exactly matches the `credential_configuration_id` of the intended configuration.
+- **Review Template State:**  
+  Verify that the target template exists and is `Published` before issuing credentials or creating offers.
 
 ## Unsupported Credential Format
 
@@ -45,76 +42,7 @@ typically occurs when the credential configuration’s `format` does not match a
 
 ### Resolution
 
-Currently
-UniCore only supports the `jwt_vc_json` format. This configuration needs to be set through the
-`credential_configurations` property in the `config.yaml` file, e.g.:
-
-```yaml
-credential_configurations:
-  - credential_configuration_id: my-credential-configuration-id
-    format: jwt_vc_json
-    credential_definition:
-      type:
-        - VerifiableCredential
-```
-
-## Unsupported Credential Type
-
-This error is raised when UniCore encounters a credential type that is not recognized or supported by the current
-implementation. In practice, it means that none of the credential types provided in the configuration match any of the types UniCore is configured to process. For example, supported types might include `VerifiableCredential`, `AchievementCredential`, or `OpenBadgeCredential`.
-
-### Resolution
-
-<!-- TODO: We need a dedicated documentation page explaining Credential Configurations and link to it here. Related issue: https://github.com/impierce/ssi-agent/issues/136 -->
-
-<!-- TODO: Once issue https://github.com/impierce/ssi-agent/issues/136 is fixed this error type can probalably be removed because the credential configuration can be done during startup (from configuration) or during creating CredentialConfiguration aggregate instances through the API -->
-
-UniCore supports three primary credential models:
-
-- **Generic [W3C Verifiable Credentials Data Model v1.1](https://www.w3.org/TR/vc-data-model/)**
-- **[Open Badges 3.0](https://www.imsglobal.org/spec/ob/v3p0)**
-- **Custom W3C Verifiable Credentials**
-
-For all models, the credential type must be declared in the `credential_definition` property of your credential
-configuration (in the `config.yaml` file). Ensure that the configuration includes the base type `VerifiableCredential` along with
-any additional types required by your credential model.
-
-For example:
-
-**For W3C Verifiable Credentials:**
-
-```yaml
-credential_configurations:
-  - credential_configuration_id: my-w3c-vc-configuration-id
-    format: jwt_vc_json
-    credential_definition:
-      type:
-        - VerifiableCredential
-```
-
-**For OpenBadgeV3 Credentials:**
-
-```yaml
-credential_configurations:
-  - credential_configuration_id: my-obv3-configuration-id
-    format: jwt_vc_json
-    credential_definition:
-      type:
-        - VerifiableCredential
-        - OpenBadgeCredential
-```
-
-**For Custom W3C Verifiable Credentials:**
-
-```yaml
-credential_configurations:
-  - credential_configuration_id: my-custom-w3c-vc-configuration-id
-    format: jwt_vc_json
-    credential_definition:
-      type:
-        - VerifiableCredential
-        - MyCustomCredential
-```
+Since credential configurations and formats are not manually managed through the API, please consider opening an issue on GitHub if you believe this is an unexpected error.
 
 ## Invalid Credential Payload
 
@@ -126,7 +54,8 @@ This error occurs when the credential data inside the payload provided during cr
 
 While the `credentialSubject` is generally a JSON object that can contain arbitrary data, specific credential types may impose stricter requirements on its structure and content. For example, **OpenBadgeV3** credentials require a more defined schema (see [OpenBadgeV3 Achievement Credential Specification](https://www.imsglobal.org/spec/ob/v3p0#achievementcredential)).
 
-To resolve this error, ensure that the `credentialSubject` conforms exactly to the expected structure as defined in the credential configuration corresponding to the submitted `credentialConfigurationId`.
+To resolve this error, ensure that `credentialSubject` conforms exactly to the schema defined by the target Template
+(or by the referenced provisioned credential configuration, if you are using provisioned mode).
 
 ## Invalid Identifier Error
 
@@ -219,3 +148,102 @@ This error occurs when the `format` specified in a credential configuration is n
 ### Resolution
 
 Ensure that the `format` field in the credential configuration is set to a supported value. Supported values include: `jwt_vc_json` and `dc+sd-jwt`.
+
+## Missing Template ID
+
+This error occurs when a credential issuance request omits the `templateId` field or provides it as an empty string. Issuance requires exactly one template so the API can resolve the template state, schema, and derived credential configuration.
+
+### Resolution
+
+Set `templateId` to the identifier of an existing template.
+
+## Missing Template IDs
+
+This error occurs when an offer creation request omits the `templateIds` field, provides an empty array, or includes empty template identifiers. Offer creation requires at least one valid template identifier.
+
+### Resolution
+
+Provide a non-empty `templateIds` array and ensure every element is a non-empty template identifier.
+
+## Template Not Found
+
+This error occurs when the request references a template identifier that does not exist or refers to a template that has already been deleted. UniCore cannot issue credentials or create offers without first resolving the backing template.
+
+### Resolution
+
+- Verify that the requested template still exists.
+- Ensure the template identifier is spelled correctly.
+- If the template was deleted, create a new template or use a different published template.
+
+## Template Not Published
+
+This error occurs when a request references a template that exists but is not in the `Published` state. UniCore only allows published templates to be used for credential issuance and offer generation.
+
+### Resolution
+
+- Publish the template before using it in issuance or offers.
+- If the template is intentionally in `Draft` or `Archived`, switch to a published template instead.
+
+## Invalid Signed Credential Format
+
+This error occurs when a signed credential payload is structurally invalid for the expected signed-credential parsing flow. Typical causes include malformed JWTs, invalid base64url segments, invalid JSON in JWT segments, a missing `vc` claim for `jwt_vc_json`, or an SD-JWT with an unsupported `typ` header.
+
+### Resolution
+
+- Ensure the signed credential is a syntactically valid JWT or SD-JWT.
+- For `jwt_vc_json`, include a `vc` claim in the JWT payload.
+- For SD-JWT formats, set the issuer JWT header `typ` to `vc+sd-jwt` or `dc+sd-jwt`.
+
+## Signed Credential Format Mismatch
+
+This error occurs when the signed credential supplied in the request uses a different format than the format derived from the selected template's credential configuration. For example, supplying a `jwt_vc_json` credential for a template that resolves to `vc+sd-jwt` will trigger this error.
+
+### Resolution
+
+- Use a signed credential whose format matches the selected template's credential configuration.
+- If the wrong template was selected, retry with the template that matches the signed credential format.
+
+## Unsupported Credential Configuration Format
+
+This error occurs when UniCore derives a credential configuration from a template, but that derived configuration uses a credential format the signed-credential validation pipeline does not support.
+
+### Resolution
+
+This indicates a server-side inconsistency. Review the template and derived credential configuration, and update them to use a supported format.
+
+## Expiration Exceeds Template Limit
+
+This error occurs when the `expiresAt` value requested for a credential exceeds the expiration defined by the template. For example, requesting `never` or a later timestamp than the template allows will be rejected.
+
+### Resolution
+
+- Omit `expiresAt` to use the template default.
+- If you provide `expiresAt`, ensure it is not later than the template's allowed deadline.
+
+## Invalid Template Schema
+
+This error occurs when a template contains a `schema` value that is not itself a valid JSON Schema. In that case UniCore cannot validate incoming credential data against it.
+
+### Resolution
+
+- Fix the template schema so it is valid JSON Schema.
+- Re-publish or update the template before retrying issuance.
+
+## Credential Schema Validation Failed
+
+This error occurs when the credential data in the request does not satisfy the template's JSON Schema. UniCore validates unsigned credential payloads against the template schema before creating the credential and returns the list of schema violations in the error detail.
+
+### Resolution
+
+- Inspect the reported validation violations.
+- Update the credential payload so it satisfies the template schema.
+- When using a schema for credential-subject fields, ensure the request data under `credential.credentialSubject` matches that schema.
+
+## Template Not Eligible For Public Offer
+
+This error occurs when a template is used for a public offer but its schema contains non-constant leaf values. Public offers are only allowed for templates whose schema fully constrains leaf values with `const`, so the resulting credential content is predetermined.
+
+### Resolution
+
+- Restrict the template schema to constant leaf values only.
+- If the credential content must remain dynamic, use a regular offer flow instead of a public offer.
diff --git a/docs/problem-details/library.md b/docs/problem-details/library.md
index a6c8ca33..fd96d6e2 100644
--- a/docs/problem-details/library.md
+++ b/docs/problem-details/library.md
@@ -9,3 +9,67 @@ This error arises when the template `id` field is left empty in the request body
 ## Template Not Found
 
 This error arises when the given `id` does not match any existing template in the library.
+
+## Invalid Status Transition
+
+This error occurs when a template is moved to a status that is not allowed from its current status (such as moving an `Archived` template back to `Draft`).
+
+## Invalid Schema Properties Attributes
+
+This error occurs when one or more keys in `schemaPropertiesAttributes` are invalid for the current schema.
+
+## Non-removable Property Violation
+
+This error occurs when an update tries to remove schema properties that are marked as non-removable/immutable.
+
+## Disallowed Open-Badges Properties
+
+This error occurs when an OpenBadges 3.0 template schema contains properties that are not part of the specification.
+
+## Missing Required Open-Badges Properties
+
+This error occurs when an OpenBadges 3.0 template schema is missing mandatory properties as defined in the specification.
+
+## Invalid Required Property Type
+
+This error occurs when required OpenBadges 3.0 properties are present but use an invalid type.
+
+## Missing Title
+
+This error occurs when a template create or update request omits the required `title`.
+
+## Archived Template Immutable
+
+This error occurs when attempting to mutate an archived template in a way that is not permitted.
+
+## Deleted Template Terminal
+
+This error occurs when attempting to mutate a template that is already in the deleted terminal state.
+
+## Archive Before Delete Required
+
+This error occurs when trying to delete a published template before archiving it first.
+
+## Invalid Expiration
+
+This error occurs when a template expiration value is malformed or unsupported.
+
+## Invalid Type
+
+This error occurs when the template `type` content is invalid for the selected data model or constraints.
+
+## Invalid Status On Create
+
+This error occurs when a new template is created with a disallowed initial status.
+
+## Schema Properties Attributes Not Allowed
+
+This error occurs when `schemaPropertiesAttributes` are provided for template variants where they are not supported.
+
+## Duplicate Schema Properties Attribute Key
+
+This error occurs when `schemaPropertiesAttributes` contains duplicate keys after normalization/trimming.
+
+## Draft Template Cannot Be Public
+
+This error occurs when a template in `Draft` stage is made public.
diff --git a/docs/problem-details/templates.md b/docs/problem-details/templates.md
index 06b9c4fb..392c6e71 100644
--- a/docs/problem-details/templates.md
+++ b/docs/problem-details/templates.md
@@ -1,3 +1,68 @@
+## Missing Title
+
+A title is required for the template.
+
 ## Invalid Schema Properties Attributes
 
 The provided attribute keys (`schema_properties_attributes`) do not match the properties defined in the JSON Schema (`schema.properties`).
+
+## Invalid Required Property Type
+
+The type of the required property must be `string` or `const`.
+
+## Missing Required Open Badges Properties
+
+The provided properties do not include all required properties as defined in the Open Badges specification.
+Currently, the following properties are required:
+
+- **achievement.name**
+- **achievement.description**
+- **achievement.criteria.narrative**
+
+## Disallowed Open Badges Properties
+
+At least one of the provided properties is not part of the Open Badges specification.
+
+## Non-removable Property Violation
+
+This property can not be removed from the template.
+
+## Invalid Status Transition
+
+The template's status cannot transition to the requested state. Refer to the template lifecycle for valid transitions.
+
+## Archived Template Immutable
+
+An archived template is immutable and cannot be modified, except to change its status.
+
+## Deleted Template Terminal
+
+A deleted template is in a terminal state and cannot be modified in any way.
+
+## Archive Before Delete Required
+
+A published template must first be archived before it can be deleted.
+
+## Invalid Expiration
+
+The provided `credentialExpiration` value is not a valid ISO 8601 duration (e.g. `P90D`) or datetime (e.g. `2026-12-31T23:59:59Z`).
+
+## Invalid Type
+
+The provided `type` value is not a valid credential type string.
+
+## Invalid Status On Create
+
+Only `draft` or `published` are valid statuses when creating a template.
+
+## Schema Properties Attributes Not Allowed
+
+`schemaPropertiesAttributes` is not supported for W3C VC 1.1 templates.
+
+## Duplicate Schema Properties Attribute Key
+
+Two or more entries in `schemaPropertiesAttributes` resolve to the same path after normalisation (trimming leading/trailing slashes).
+
+## Draft Template Cannot Be Public
+
+A template with `visibility: public` must not be in `draft` status.
diff --git a/docs/template-model.md b/docs/template-model.md
new file mode 100644
index 00000000..1b39fb50
--- /dev/null
+++ b/docs/template-model.md
@@ -0,0 +1,269 @@
+# Template Model
+
+This document describes how templates are modeled today in UniCore, why they are structured this way, and which parts are deliberate design choices versus current implementation limitations.
+
+This is not a frozen public contract. It describes the current template model as implemented in the codebase so contributors, frontend developers, and API consumers can understand the representation and its trade-offs.
+
+For the architectural decision behind keeping claim metadata separate from the JSON Schema, see [ADR 0001](./adr/0001-schema-properties-attributes-as-separate-field.md).
+
+## Overview
+
+A template is modeled as three coupled parts:
+
+1. `schema`: the structural shape of credential input data
+2. `schemaPropertiesAttributes`: metadata for individual claim fields
+3. `dataModel` and `type`: model-specific rules that change what is accepted and how it is normalized
+
+The important point is that these parts are not independent. A schema may be valid JSON Schema and still be rejected because its claim metadata does not match the schema structure, or because its selected data model imposes stricter rules.
+
+## Why Templates Are Modeled This Way
+
+Templates serve two audiences at the same time:
+
+- API callers and frontends need a machine-readable description of what data they may or must submit.
+- UniCore itself needs extra metadata about how individual claims behave during issuance and selective disclosure.
+
+The template model therefore separates structural data shape from platform-specific claim behavior.
+
+### Design choice: JSON Schema as the structural surface
+
+The `schema` field uses standard JSON Schema because it gives callers a well-known format that can be validated with off-the-shelf tooling before the API is called.
+
+This keeps the submission surface legible and interoperable. A caller can reason about the required input fields without first learning UniCore-specific semantics.
+
+### Design choice: claim metadata is outside the schema
+
+The `schemaPropertiesAttributes` field exists because selective-disclosure behavior and similar platform concerns are not part of standard JSON Schema semantics.
+
+Keeping that metadata outside the schema avoids mixing two different concerns:
+
+- what the credential input looks like
+- how UniCore should treat particular claims
+
+### Design choice: metadata targets leaf claims
+
+Claim metadata is attached to leaf fields rather than object container nodes. That choice reflects how claim values are actually issued and disclosed.
+
+Objects provide structure, but the meaningful claim surface is the set of leaf values such as `/name`, `/address/city`, or `/achievement/criteria/narrative`.
+
+### Design choice: JSON Pointer as the path format
+
+`schemaPropertiesAttributes` keys use RFC 6901 JSON Pointer. This gives a standard, unambiguous way to refer to nested claims and avoids inventing a UniCore-specific path syntax.
+
+It also keeps frontend and backend mapping deterministic because nested claim paths can be derived directly from the schema tree.
+
+## Core Structure
+
+## `schema`
+
+The `schema` field describes the structure of credential input data.
+
+A typical schema looks like this:
+
+```json
+{
+  "type": "object",
+  "properties": {
+    "name": { "type": "string" },
+    "address": {
+      "type": "object",
+      "properties": {
+        "city": { "type": "string" }
+      }
+    }
+  }
+}
+```
+
+### Current behavior
+
+- Root object schemas are supported.
+- Nested object properties are supported.
+- Scalar leaf fields such as `string`, `integer`, `number`, and `boolean` are supported.
+- Standard JSON Schema keywords such as `$schema`, `format`, and `const` are accepted when the JSON Schema validator accepts them.
+- For some data models, `schema` may be omitted entirely.
+
+### Current limitation
+
+Arrays are not currently supported anywhere in template schemas. This is an implementation limitation, not a conceptual statement that credentials can never contain repeatable values.
+
+The current model avoids arrays because claim metadata and disclosure addressing are defined in terms of stable leaf paths, and array item addressing has not yet been introduced into that model.
+
+## `schemaPropertiesAttributes`
+
+The `schemaPropertiesAttributes` field stores metadata for individual claim fields.
+
+Example:
+
+```json
+{
+  "/name": {
+    "selectivelyDisclosable": true,
+    "nonRemovable": false
+  },
+  "/address/city": {
+    "selectivelyDisclosable": false,
+    "nonRemovable": false
+  }
+}
+```
+
+Each entry contains:
+
+- `selectivelyDisclosable`: whether the claim may later be omitted during selective disclosure
+- `nonRemovable`: whether the claim is treated as system-protected and must remain present once marked immutable
+
+### Why it is structured this way
+
+This field is separate because the metadata is operational policy, not structural validation. It tells UniCore how to treat claims, not what JSON shape a caller must submit.
+
+### Why keys point only to leaf fields
+
+Metadata is attached only to leaf claims because those are the values that are actually issued, validated, and selectively disclosed. Container objects are organizational structure, not claims in their own right.
+
+### Current behavior
+
+- Keys must be RFC 6901 JSON Pointer paths.
+- Keys must point to existing leaf fields in `schema.properties`.
+- Keys that point to intermediate object nodes are rejected.
+- Keys that do not match the schema are rejected.
+- Keys are trimmed during update validation, and collisions after trimming are rejected.
+
+### Current limitation
+
+Because arrays are unsupported, there is no array-item addressing model in `schemaPropertiesAttributes` yet.
+
+## Relationship Between `schema` and `schemaPropertiesAttributes`
+
+The two fields are intentionally separate but must stay aligned.
+
+- `schema` defines which leaf claims exist.
+- `schemaPropertiesAttributes` may only describe those leaf claims.
+
+In practice, this means schema changes can invalidate attribute keys, and some schema updates may prune attributes or reject removal of immutable claims.
+
+## Data Model Variants
+
+The template model is shared across all data models, but each data model applies different constraints.
+
+## W3C VC 1.1
+
+### Current structure
+
+- `schema` may be present or omitted.
+- `type` is normalized to include `VerifiableCredential`.
+
+### Design choice
+
+W3C VC 1.1 templates do not expose claim-level metadata through `schemaPropertiesAttributes`.
+
+### Current behavior
+
+- `schemaPropertiesAttributes` is not allowed.
+
+## W3C VC 2.0
+
+### Current structure
+
+- `schema` may describe nested object-based claim structures.
+- `schemaPropertiesAttributes` may describe leaf claims.
+
+### Design choice
+
+This model exposes both structure and claim behavior because it is intended to support richer selective-disclosure-aware credential modeling.
+
+### Current behavior
+
+- `type` is normalized so `VerifiableCredential` is present and ordered first.
+- Duplicate type entries are removed.
+- `schemaPropertiesAttributes` must match leaf schema paths.
+
+## Open Badges 3.0
+
+### Current structure
+
+Open Badges 3.0 uses the shared template representation, but imposes stricter schema and type rules.
+
+A minimal acceptable structure looks like this:
+
+```json
+{
+  "type": "object",
+  "properties": {
+    "achievement": {
+      "type": "object",
+      "properties": {
+        "name": { "type": "string" },
+        "description": { "type": "string" },
+        "criteria": {
+          "type": "object",
+          "properties": {
+            "narrative": { "type": "string" }
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+### Design choice
+
+Open Badges templates are stricter because the model is anchored to a specific credential standard. UniCore uses that stricter model to keep template authors aligned with the required Open Badges shape and to guarantee the presence of standard-mandated claims.
+
+### Current behavior
+
+- `type` must resolve to either `["VerifiableCredential", "OpenBadgeCredential"]` or `["VerifiableCredential", "AchievementCredential"]`.
+- Extra Open Badges types are rejected.
+- Required achievement fields must be present.
+- Disallowed Open Badges schema properties are rejected.
+- Required paths are marked non-removable by the backend.
+- The stored schema is normalized with injected `required` arrays for required paths.
+
+### Current limitation
+
+Some of the Open Badges handling is current implementation behavior rather than a generalized template mechanism. In particular, required-field injection and auto-population of required claim metadata are current normalization steps performed specifically for this model.
+
+## European Learning Model 3.3
+
+### Current structure
+
+- `schema` may describe nested object-based claim structures.
+- `schemaPropertiesAttributes` may describe leaf claims.
+
+### Current behavior
+
+- `type` is normalized to include `VerifiableCredential`.
+- `schemaPropertiesAttributes` follows the same leaf-path model as W3C VC 2.0.
+
+## Normalization Behavior
+
+The backend may normalize parts of a submitted template before storing or returning it.
+
+### Current behavior
+
+- `type` entries are trimmed, deduplicated, and canonically ordered.
+- Tags are trimmed and deduplicated.
+- Open Badges schemas may gain required lists.
+- Open Badges attributes may be auto-populated and required fields marked non-removable.
+- Empty attribute maps may be normalized away.
+
+### Practical consequence
+
+Callers should treat the backend response as the canonical saved representation instead of assuming the submitted payload is preserved byte-for-byte.
+
+## Current Limitations Summary
+
+The most important current limitations are:
+
+- arrays are unsupported in template schemas
+- claim metadata is defined only for leaf paths
+- some model-specific normalization, especially for Open Badges, is implemented as backend behavior rather than exposed as a more general template-policy layer
+
+These limitations are documented here because they materially affect how templates behave today. They should not be read as promises about the final long-term shape of the model.
+
+## Relationship to ADR 0001
+
+ADR 0001 explains the architectural decision to keep `schemaPropertiesAttributes` separate from `schema`, and why leaf claims are addressed using JSON Pointer.
+
+This document explains how that decision is applied in the current template model, including data-model-specific constraints, normalization behavior, and present-day limitations.
diff --git a/features/public-credential-offers/README.md b/features/public-credential-offers/README.md
deleted file mode 100644
index a96275c9..00000000
--- a/features/public-credential-offers/README.md
+++ /dev/null
@@ -1,47 +0,0 @@
-# Public Credential Offers
-
-## What this feature does
-
-Public Credential Offers let an issuer publish a reusable credential offer link that anyone can use, without creating a new one-off offer each time.
-
-This enables "share once, issue many" use cases.
-
-## Why this is useful
-
-- It reduces manual work for teams issuing the same static credential repeatedly.
-- It gives a stable entry point that can be embedded in portals, emails, landing pages, or QR codes.
-- It allows operators to pause, resume, or retire an offer without changing the original credential template.
-
-## How it works (high level)
-
-1. An issuer creates a normal offer and links it to a template to create a public offer.
-2. The public offer is stored with a lifecycle status (active or inactive).
-3. Clients can discover public offers and see how many successful issuances happened.
-4. Operators can take an offer offline, bring it back online, or delete it.
-
-## Built-in safeguards
-
-Public offers are intentionally restricted to static credentials:
-
-- The referenced template must exist.
-- Deleted templates are treated as unavailable.
-- The template schema must use const values for all leaf fields.
-
-If a template is missing, creation fails with not found.
-If a template schema contains non-const leaf fields, creation fails with a business validation error.
-
-## API capabilities
-
-This feature currently provides route-level capabilities to:
-
-- Create a public offer mapping
-- List all public offers
-- Take a public offer offline
-- Take a public offer online
-- Delete a public offer
-
-## Operational intent
-
-Use Public Credential Offers when you want controlled, repeatable issuance of predefined credentials at scale.
-
-Do not use this flow for credentials that require dynamic or user-specific claim values per issuance.

From b3ea66342adccc95b77ea85345d0d235c1f8c031 Mon Sep 17 00:00:00 2001
From: Daniel Mader <daniel.mader@impierce.com>
Date: Tue, 30 Jun 2026 16:25:40 +0200
Subject: [PATCH 21/34] feat: migrate `cqrs-es` to `0.5.0` (#364)

---
 Cargo.lock                                    |  80 +++----
 Cargo.toml                                    |   3 +-
 agent_api_http/Cargo.toml                     |   1 +
 agent_api_http/src/handlers.rs                |   5 +-
 agent_authorization/Cargo.toml                |   1 +
 .../src/domain/access_token/aggregate.rs      |  21 +-
 .../domain/authorization_code/aggregate.rs    |  21 +-
 .../src/domain/client/aggregate.rs            |  21 +-
 .../oauth2_authorization_request/aggregate.rs |  23 +-
 agent_authorization/src/state.rs              |  18 +-
 agent_holder/Cargo.toml                       |   1 +
 agent_holder/src/credential/aggregate.rs      |  23 +-
 agent_holder/src/offer/aggregate.rs           |  23 +-
 agent_holder/src/presentation/aggregate.rs    |  23 +-
 agent_holder/src/state.rs                     |  26 +--
 agent_identity/Cargo.toml                     |   1 +
 agent_identity/src/connection/aggregate.rs    |  23 +-
 agent_identity/src/document/aggregate.rs      | 205 +++++++++---------
 agent_identity/src/profile/aggregate.rs       |  21 +-
 agent_identity/src/service/aggregate.rs       |  23 +-
 agent_identity/src/state.rs                   |  31 +--
 agent_issuance/Cargo.toml                     |   1 +
 .../credential_configuration_projection.rs    |   4 +-
 agent_issuance/src/credential/aggregate.rs    |  29 ++-
 agent_issuance/src/nonce/aggregate.rs         |  21 +-
 agent_issuance/src/offer/aggregate.rs         |  26 ++-
 agent_issuance/src/public_offer/aggregate.rs  |  39 ++--
 agent_issuance/src/server_config/aggregate.rs |  21 +-
 agent_issuance/src/state.rs                   |  42 ++--
 agent_issuance/src/status_list/aggregate.rs   |  21 +-
 agent_library/Cargo.toml                      |   1 +
 agent_library/src/state.rs                    |   8 +-
 agent_library/src/template/aggregate.rs       |  21 +-
 agent_shared/Cargo.toml                       |   2 +
 agent_shared/src/handlers.rs                  |   8 +-
 agent_store/Cargo.toml                        |   5 +-
 agent_store/src/in_memory.rs                  |   9 +-
 agent_store/src/lib.rs                        |   5 +-
 agent_store/src/mongodb.rs                    |  11 +-
 agent_store/src/postgres.rs                   |  15 +-
 agent_verification/Cargo.toml                 |   1 +
 .../src/authorization_request/aggregate.rs    |  23 +-
 agent_verification/src/state.rs               |  10 +-
 .../verification-authorization/Cargo.toml     |   3 +-
 infrastructure/stores/mongodb/Cargo.toml      |   2 +-
 45 files changed, 509 insertions(+), 413 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 6d8f99c6..335fe407 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -82,7 +82,7 @@ dependencies = [
  "axum-macros",
  "base64 0.22.1",
  "chrono",
- "cqrs-es 0.4.12",
+ "cqrs-es",
  "futures",
  "http 1.4.1",
  "http-api-problem",
@@ -111,6 +111,7 @@ dependencies = [
  "serde_urlencoded",
  "serde_with 3.21.0",
  "serial_test",
+ "shared-kernel",
  "siopv2",
  "thiserror 1.0.69",
  "tokio",
@@ -168,7 +169,7 @@ dependencies = [
  "async-std",
  "async-trait",
  "chrono",
- "cqrs-es 0.4.12",
+ "cqrs-es",
  "jsonwebtoken",
  "lazy_static",
  "mockall",
@@ -179,6 +180,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serial_test",
+ "shared-kernel",
  "strum 0.26.3",
  "strum_macros 0.26.4",
  "thiserror 1.0.69",
@@ -204,7 +206,7 @@ dependencies = [
  "agent_verification",
  "anyhow",
  "async-trait",
- "cqrs-es 0.4.12",
+ "cqrs-es",
  "http-serde",
  "reqwest 0.12.28",
  "serde",
@@ -226,7 +228,7 @@ dependencies = [
  "async-nats",
  "async-trait",
  "cloudevents-sdk",
- "cqrs-es 0.4.12",
+ "cqrs-es",
  "futures",
  "serde",
  "serde_json",
@@ -251,7 +253,7 @@ dependencies = [
  "async-trait",
  "axum 0.8.9",
  "base64 0.22.1",
- "cqrs-es 0.4.12",
+ "cqrs-es",
  "identity_core",
  "identity_credential",
  "jsonwebtoken",
@@ -266,6 +268,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serial_test",
+ "shared-kernel",
  "strum 0.26.3",
  "strum_macros 0.26.4",
  "temp-env",
@@ -295,7 +298,7 @@ dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
  "chrono",
- "cqrs-es 0.4.12",
+ "cqrs-es",
  "derivative",
  "did-jwk",
  "did-method-key",
@@ -321,6 +324,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serial_test",
+ "shared-kernel",
  "ssi-dids 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "ssi-jwk 0.1.2 (registry+https://github.com/rust-lang/crates.io-index)",
  "strum 0.26.3",
@@ -352,7 +356,7 @@ dependencies = [
  "async-trait",
  "base64 0.22.1",
  "chrono",
- "cqrs-es 0.4.12",
+ "cqrs-es",
  "derivative",
  "identity_core",
  "identity_credential",
@@ -370,6 +374,7 @@ dependencies = [
  "serde_json",
  "serde_with 3.21.0",
  "serial_test",
+ "shared-kernel",
  "strum 0.26.3",
  "strum_macros 0.26.4",
  "thiserror 1.0.69",
@@ -390,7 +395,7 @@ dependencies = [
  "async-std",
  "async-trait",
  "chrono",
- "cqrs-es 0.4.12",
+ "cqrs-es",
  "iso8601",
  "jsonschema 0.46.5",
  "lazy_static",
@@ -399,6 +404,7 @@ dependencies = [
  "serde_json",
  "serde_with 3.21.0",
  "serial_test",
+ "shared-kernel",
  "strum 0.26.3",
  "strum_macros 0.26.4",
  "thiserror 1.0.69",
@@ -461,7 +467,7 @@ dependencies = [
  "base64 0.22.1",
  "chrono",
  "config",
- "cqrs-es 0.4.12",
+ "cqrs-es",
  "dotenvy",
  "http-serde",
  "identity_core",
@@ -479,6 +485,7 @@ dependencies = [
  "serde_json",
  "serde_with 3.21.0",
  "serial_test",
+ "shared-kernel",
  "strum 0.26.3",
  "temp-env",
  "thiserror 1.0.69",
@@ -503,10 +510,11 @@ dependencies = [
  "agent_shared",
  "agent_verification",
  "async-trait",
- "cqrs-es 0.4.12",
- "mongo-es 0.3.0",
+ "cqrs-es",
+ "mongo-es",
  "postgres-es",
  "serde_json",
+ "shared-kernel",
  "sqlx",
  "tokio",
 ]
@@ -522,7 +530,7 @@ dependencies = [
  "async-std",
  "async-trait",
  "chrono",
- "cqrs-es 0.4.12",
+ "cqrs-es",
  "did-key",
  "futures",
  "identity_core",
@@ -538,6 +546,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serial_test",
+ "shared-kernel",
  "siopv2",
  "strum 0.26.3",
  "strum_macros 0.26.4",
@@ -2440,19 +2449,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "cqrs-es"
-version = "0.4.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5da025e9082adb74e8bb2b7e93feed51c711aa6c384cc18ad03b463ed776db64"
-dependencies = [
- "async-trait",
- "serde",
- "serde_json",
- "thiserror 1.0.69",
- "tokio",
-]
-
 [[package]]
 name = "cqrs-es"
 version = "0.5.0"
@@ -7665,27 +7661,11 @@ dependencies = [
 
 [[package]]
 name = "mongo-es"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79e2cc82dfc3e6742f467c41b83cadfcf8f26049c92e46093d43223815733baf"
-dependencies = [
- "async-trait",
- "cqrs-es 0.4.12",
- "futures",
- "log",
- "mongodb 3.7.0",
- "serde",
- "serde_json",
- "tokio",
-]
-
-[[package]]
-name = "mongo-es"
-version = "0.4.0"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fdf1bf9c46e9766dcae6daf77d8b7d8308cf96a62d8bb3b63530498f05c8316"
+checksum = "3d6354a3fbbbc3079c89597e87481de282c3b7bd6400f66999eabc5a5bcf8971"
 dependencies = [
- "cqrs-es 0.5.0",
+ "cqrs-es",
  "futures",
  "log",
  "mongodb 3.7.0",
@@ -7716,7 +7696,7 @@ checksum = "224484c5d09285a7b8cb0a0c117e847ebd14cb6e4470ecf68cdb89c503b0edb9"
 name = "mongodb"
 version = "0.1.0"
 dependencies = [
- "mongo-es 0.4.0",
+ "mongo-es",
  "shared-kernel",
  "thiserror 1.0.69",
 ]
@@ -9479,16 +9459,16 @@ checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
 
 [[package]]
 name = "postgres-es"
-version = "0.4.12"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a380c092ccb97e081e4e418b20f8a7f1a717a30dc38e4096f56a0dd8b0c077c"
+checksum = "2e91abcdbccb940b5eb4ddce60ec993d7675058ad26703ae8389cb5ba997e885"
 dependencies = [
- "async-trait",
- "cqrs-es 0.4.12",
+ "cqrs-es",
  "futures",
  "serde",
  "serde_json",
  "sqlx",
+ "thiserror 2.0.18",
  "tokio",
 ]
 
@@ -11587,7 +11567,7 @@ dependencies = [
  "async-trait",
  "chrono",
  "convert_case 0.11.0",
- "cqrs-es 0.5.0",
+ "cqrs-es",
  "serde",
  "slug",
  "strum 0.28.0",
diff --git a/Cargo.toml b/Cargo.toml
index 060a106d..2922d144 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -50,7 +50,7 @@ async-trait = "0.1"
 axum = "0.8"
 base64 = "0.22"
 chrono = { version = "0.4", features = ["serde"] }
-cqrs-es = "0.4.12"
+cqrs-es = "0.5.0"
 derivative = "2.2"
 futures = "0.3"
 mockall = "0.14"
@@ -78,6 +78,7 @@ jsonschema = "0.46"
 jsonwebtoken = "9.3"
 lazy_static = "1.4"
 mime = { version = "0.3" }
+mongo-es = "0.4.1"
 oauth_tsl = { git = "https://github.com/impierce/oauth-token-status-list", rev = "0aa0228" }
 once_cell = { version = "1.19" }
 product_common = { git = "https://github.com/iotaledger/product-core", tag = "v0.8.16", package = "product_common", features = [
diff --git a/agent_api_http/Cargo.toml b/agent_api_http/Cargo.toml
index dd6d0fb3..42ebe86c 100644
--- a/agent_api_http/Cargo.toml
+++ b/agent_api_http/Cargo.toml
@@ -14,6 +14,7 @@ agent_library = { path = "../agent_library" }
 agent_secret_manager = { path = "../agent_secret_manager" }
 agent_shared = { path = "../agent_shared" }
 agent_verification = { path = "../agent_verification" }
+shared-kernel.workspace = true
 
 anyhow.workspace = true
 askama = "0.14"
diff --git a/agent_api_http/src/handlers.rs b/agent_api_http/src/handlers.rs
index 336d0b71..2f626d8f 100644
--- a/agent_api_http/src/handlers.rs
+++ b/agent_api_http/src/handlers.rs
@@ -1,5 +1,6 @@
 use crate::error::ErrorWrapper;
-use cqrs_es::{persist::ViewRepository, Aggregate, View};
+use cqrs_es::{Aggregate, View};
+use shared_kernel::view_repository::DynViewRepository;
 use std::sync::Arc;
 
 /// Wrapping the `command_handler` function from the `agent_shared` crate to handle errors.
@@ -20,7 +21,7 @@ where
 // Wrapping the `query_handler` function from the `agent_shared` crate to handle errors.
 pub async fn query_handler<A, V>(
     view_id: &str,
-    state: &Arc<dyn ViewRepository<V, A>>,
+    state: &Arc<dyn DynViewRepository<V, A>>,
 ) -> Result<Option<V>, ErrorWrapper<A::Error>>
 where
     A: Aggregate,
diff --git a/agent_authorization/Cargo.toml b/agent_authorization/Cargo.toml
index 6f110829..945ed7d9 100644
--- a/agent_authorization/Cargo.toml
+++ b/agent_authorization/Cargo.toml
@@ -9,6 +9,7 @@ publish.workspace = true
 agent_issuance = { path = "../agent_issuance" }
 agent_shared = { path = "../agent_shared" }
 agent_secret_manager = { path = "../agent_secret_manager" }
+shared-kernel.workspace = true
 
 anyhow.workspace = true
 async-trait.workspace = true
diff --git a/agent_authorization/src/domain/access_token/aggregate.rs b/agent_authorization/src/domain/access_token/aggregate.rs
index 0f914f20..1fc5f5a2 100644
--- a/agent_authorization/src/domain/access_token/aggregate.rs
+++ b/agent_authorization/src/domain/access_token/aggregate.rs
@@ -1,8 +1,7 @@
 use super::command::AccessTokenCommand;
 use super::error::AccessTokenError;
 use super::event::AccessTokenEvent;
-use async_trait::async_trait;
-use cqrs_es::Aggregate;
+use cqrs_es::{event_sink::EventSink, Aggregate};
 use serde::{Deserialize, Serialize};
 use tracing::{debug, info};
 
@@ -19,28 +18,26 @@ pub struct AccessToken {
     pub issuer_state: Option<String>,
 }
 
-#[async_trait]
 impl Aggregate for AccessToken {
     type Command = AccessTokenCommand;
     type Event = AccessTokenEvent;
     type Error = AccessTokenError;
     type Services = ();
 
-    fn aggregate_type() -> String {
-        "access_token".to_string()
-    }
+    const TYPE: &'static str = "access_token";
 
     async fn handle(
-        &self,
+        &mut self,
         command: Self::Command,
         _services: &Self::Services,
-    ) -> Result<Vec<Self::Event>, Self::Error> {
+        sink: &EventSink<Self>,
+    ) -> Result<(), Self::Error> {
         use AccessTokenCommand::*;
         use AccessTokenEvent::*;
 
         info!("Handling command: {:?}", command);
 
-        match command {
+        let events: Vec<Self::Event> = match command {
             IssueAccessToken {
                 access_token_id,
                 user_id,
@@ -69,7 +66,13 @@ impl Aggregate for AccessToken {
                     issuer_state,
                 }])
             }
+        }?;
+
+        for event in events {
+            sink.write(event, self).await;
         }
+
+        Ok(())
     }
 
     fn apply(&mut self, event: Self::Event) {
diff --git a/agent_authorization/src/domain/authorization_code/aggregate.rs b/agent_authorization/src/domain/authorization_code/aggregate.rs
index c606dcac..95441a14 100644
--- a/agent_authorization/src/domain/authorization_code/aggregate.rs
+++ b/agent_authorization/src/domain/authorization_code/aggregate.rs
@@ -1,8 +1,7 @@
 use super::command::AuthorizationCodeCommand;
 use super::error::AuthorizationCodeError;
 use super::event::AuthorizationCodeEvent;
-use async_trait::async_trait;
-use cqrs_es::Aggregate;
+use cqrs_es::{event_sink::EventSink, Aggregate};
 use oid4vci::{authorization_request::CodeChallengeMethod, pkce};
 use serde::{Deserialize, Serialize};
 use tracing::{debug, info};
@@ -21,29 +20,27 @@ pub struct AuthorizationCode {
     pub is_redeemed: bool,
 }
 
-#[async_trait]
 impl Aggregate for AuthorizationCode {
     type Command = AuthorizationCodeCommand;
     type Event = AuthorizationCodeEvent;
     type Error = AuthorizationCodeError;
     type Services = ();
 
-    fn aggregate_type() -> String {
-        "authorization_code".to_string()
-    }
+    const TYPE: &'static str = "authorization_code";
 
     async fn handle(
-        &self,
+        &mut self,
         command: Self::Command,
         _services: &Self::Services,
-    ) -> Result<Vec<Self::Event>, Self::Error> {
+        sink: &EventSink<Self>,
+    ) -> Result<(), Self::Error> {
         use AuthorizationCodeCommand::*;
         use AuthorizationCodeError::*;
         use AuthorizationCodeEvent::*;
 
         info!("Handling command: {:?}", command);
 
-        match command {
+        let events: Vec<Self::Event> = match command {
             CreateAuthorizationCode {
                 authorization_code_id,
                 client_id,
@@ -114,7 +111,13 @@ impl Aggregate for AuthorizationCode {
                     redeemed: true,
                 }])
             }
+        }?;
+
+        for event in events {
+            sink.write(event, self).await;
         }
+
+        Ok(())
     }
 
     fn apply(&mut self, event: Self::Event) {
diff --git a/agent_authorization/src/domain/client/aggregate.rs b/agent_authorization/src/domain/client/aggregate.rs
index 4362d6c5..159a7531 100644
--- a/agent_authorization/src/domain/client/aggregate.rs
+++ b/agent_authorization/src/domain/client/aggregate.rs
@@ -1,8 +1,7 @@
 use super::command::ClientCommand;
 use super::error::ClientError;
 use super::event::ClientEvent;
-use async_trait::async_trait;
-use cqrs_es::Aggregate;
+use cqrs_es::{event_sink::EventSink, Aggregate};
 use oid4vci::authorization_request::CodeChallengeMethod;
 use serde::{Deserialize, Serialize};
 use tracing::{debug, info};
@@ -44,28 +43,26 @@ pub struct Client {
     pub require_pushed_authorization_request: bool,
 }
 
-#[async_trait]
 impl Aggregate for Client {
     type Command = ClientCommand;
     type Event = ClientEvent;
     type Error = ClientError;
     type Services = ();
 
-    fn aggregate_type() -> String {
-        "client".to_string()
-    }
+    const TYPE: &'static str = "client";
 
     async fn handle(
-        &self,
+        &mut self,
         command: Self::Command,
         _services: &Self::Services,
-    ) -> Result<Vec<Self::Event>, Self::Error> {
+        sink: &EventSink<Self>,
+    ) -> Result<(), Self::Error> {
         use ClientCommand::*;
         use ClientEvent::*;
 
         info!("Handling command: {:?}", command);
 
-        match command {
+        let events: Vec<Self::Event> = match command {
             RegisterClient {
                 client_id,
                 client_secret,
@@ -99,7 +96,13 @@ impl Aggregate for Client {
                     require_pushed_authorization_request,
                 }])
             }
+        }?;
+
+        for event in events {
+            sink.write(event, self).await;
         }
+
+        Ok(())
     }
 
     fn apply(&mut self, event: Self::Event) {
diff --git a/agent_authorization/src/domain/oauth2_authorization_request/aggregate.rs b/agent_authorization/src/domain/oauth2_authorization_request/aggregate.rs
index a2b3d8cc..eb9a6575 100644
--- a/agent_authorization/src/domain/oauth2_authorization_request/aggregate.rs
+++ b/agent_authorization/src/domain/oauth2_authorization_request/aggregate.rs
@@ -3,8 +3,7 @@ use crate::services::OAuth2AuthorizationRequestDomainServices;
 use super::command::OAuth2AuthorizationRequestCommand;
 use super::error::OAuth2AuthorizationRequestError;
 use super::event::OAuth2AuthorizationRequestEvent;
-use async_trait::async_trait;
-use cqrs_es::Aggregate;
+use cqrs_es::{event_sink::EventSink, Aggregate};
 use oid4vci::{
     authorization_details::AuthorizationDetailsObject, authorization_request::CodeChallengeMethod, InteractionType,
 };
@@ -49,25 +48,27 @@ pub struct OAuth2AuthorizationRequest {
     pub openid4vp_request: Option<serde_json::Value>,
 }
 
-#[async_trait]
 impl Aggregate for OAuth2AuthorizationRequest {
     type Command = OAuth2AuthorizationRequestCommand;
     type Event = OAuth2AuthorizationRequestEvent;
     type Error = OAuth2AuthorizationRequestError;
     type Services = OAuth2AuthorizationRequestDomainServices;
 
-    fn aggregate_type() -> String {
-        "oauth2_authorization_request".to_string()
-    }
+    const TYPE: &'static str = "oauth2_authorization_request";
 
-    async fn handle(&self, command: Self::Command, services: &Self::Services) -> Result<Vec<Self::Event>, Self::Error> {
+    async fn handle(
+        &mut self,
+        command: Self::Command,
+        services: &Self::Services,
+        sink: &EventSink<Self>,
+    ) -> Result<(), Self::Error> {
         use OAuth2AuthorizationRequestCommand::*;
         use OAuth2AuthorizationRequestError::*;
         use OAuth2AuthorizationRequestEvent::*;
 
         info!("Handling command: {:?}", command);
 
-        match command {
+        let events: Vec<Self::Event> = match command {
             CreateOAuth2AuthorizationRequest {
                 oauth2_authorization_request_id,
                 pushed_authorization_request,
@@ -155,7 +156,13 @@ impl Aggregate for OAuth2AuthorizationRequest {
                     }])
                 }
             }
+        }?;
+
+        for event in events {
+            sink.write(event, self).await;
         }
+
+        Ok(())
     }
 
     fn apply(&mut self, event: Self::Event) {
diff --git a/agent_authorization/src/state.rs b/agent_authorization/src/state.rs
index e5b1d6ca..8b73af0c 100644
--- a/agent_authorization/src/state.rs
+++ b/agent_authorization/src/state.rs
@@ -1,8 +1,8 @@
 use agent_shared::application_state::CommandHandler;
 use agent_shared::handlers::{command_handler, query_handler};
-use cqrs_es::persist::ViewRepository;
 use oid4vc_core::Sign;
 use oid4vci::authorization_request::CodeChallengeMethod;
+use shared_kernel::view_repository::DynViewRepository;
 use std::sync::Arc;
 use tracing::{debug, info};
 
@@ -44,18 +44,18 @@ pub struct CommandHandlers {
 /// that any type of repository that implements the `ViewRepository` trait can be used, but the corresponding `View` and
 /// `Aggregate` types must be the same.
 type Queries = ViewRepositories<
-    dyn ViewRepository<ClientView, Client>,
-    dyn ViewRepository<OAuth2AuthorizationRequestView, OAuth2AuthorizationRequest>,
-    dyn ViewRepository<AuthorizationCodeView, AuthorizationCode>,
-    dyn ViewRepository<AccessTokenView, AccessToken>,
+    dyn DynViewRepository<ClientView, Client>,
+    dyn DynViewRepository<OAuth2AuthorizationRequestView, OAuth2AuthorizationRequest>,
+    dyn DynViewRepository<AuthorizationCodeView, AuthorizationCode>,
+    dyn DynViewRepository<AccessTokenView, AccessToken>,
 >;
 
 pub struct ViewRepositories<C, OAR, AC, AT>
 where
-    C: ViewRepository<ClientView, Client> + ?Sized,
-    OAR: ViewRepository<OAuth2AuthorizationRequestView, OAuth2AuthorizationRequest> + ?Sized,
-    AC: ViewRepository<AuthorizationCodeView, AuthorizationCode> + ?Sized,
-    AT: ViewRepository<AccessTokenView, AccessToken> + ?Sized,
+    C: DynViewRepository<ClientView, Client> + ?Sized,
+    OAR: DynViewRepository<OAuth2AuthorizationRequestView, OAuth2AuthorizationRequest> + ?Sized,
+    AC: DynViewRepository<AuthorizationCodeView, AuthorizationCode> + ?Sized,
+    AT: DynViewRepository<AccessTokenView, AccessToken> + ?Sized,
 {
     pub client: Arc<C>,
     pub oauth2_authorization_request: Arc<OAR>,
diff --git a/agent_holder/Cargo.toml b/agent_holder/Cargo.toml
index 30f2bfa6..54eab9e8 100644
--- a/agent_holder/Cargo.toml
+++ b/agent_holder/Cargo.toml
@@ -8,6 +8,7 @@ publish.workspace = true
 [dependencies]
 agent_shared = { path = "../agent_shared" }
 agent_secret_manager = { path = "../agent_secret_manager" }
+shared-kernel.workspace = true
 
 async-trait.workspace = true
 base64.workspace = true
diff --git a/agent_holder/src/credential/aggregate.rs b/agent_holder/src/credential/aggregate.rs
index 37b52699..299329cb 100644
--- a/agent_holder/src/credential/aggregate.rs
+++ b/agent_holder/src/credential/aggregate.rs
@@ -3,8 +3,7 @@ use crate::credential::error::CredentialError::{self};
 use crate::credential::event::CredentialEvent;
 use crate::services::HolderServices;
 use agent_shared::credential_status_checker::CredentialStatusChecker;
-use async_trait::async_trait;
-use cqrs_es::Aggregate;
+use cqrs_es::{event_sink::EventSink, Aggregate};
 use identity_credential::credential::Jwt;
 use oid4vc_core::credential_status_verifier::CredentialStatusVerifier;
 use oid4vc_core::utils::jwt::get_unverified_jwt_claims;
@@ -28,25 +27,27 @@ pub struct Credential {
     pub data: Option<Data>,
 }
 
-#[async_trait]
 impl Aggregate for Credential {
     type Command = CredentialCommand;
     type Event = CredentialEvent;
     type Error = CredentialError;
     type Services = Arc<HolderServices>;
 
-    fn aggregate_type() -> String {
-        "holder_credential".to_string()
-    }
+    const TYPE: &'static str = "holder_credential";
 
-    async fn handle(&self, command: Self::Command, services: &Self::Services) -> Result<Vec<Self::Event>, Self::Error> {
+    async fn handle(
+        &mut self,
+        command: Self::Command,
+        services: &Self::Services,
+        sink: &EventSink<Self>,
+    ) -> Result<(), Self::Error> {
         use CredentialCommand::*;
         use CredentialError::*;
         use CredentialEvent::*;
 
         info!("Handling command: {:?}", command);
 
-        match command {
+        let events: Vec<Self::Event> = match command {
             AddCredential {
                 holder_credential_id,
                 received_offer_id,
@@ -75,7 +76,13 @@ impl Aggregate for Credential {
                     data: Data { raw: raw_credential },
                 }])
             }
+        }?;
+
+        for event in events {
+            sink.write(event, self).await;
         }
+
+        Ok(())
     }
 
     fn apply(&mut self, event: Self::Event) {
diff --git a/agent_holder/src/offer/aggregate.rs b/agent_holder/src/offer/aggregate.rs
index b97588d6..b683793e 100644
--- a/agent_holder/src/offer/aggregate.rs
+++ b/agent_holder/src/offer/aggregate.rs
@@ -2,8 +2,7 @@ use crate::offer::command::OfferCommand;
 use crate::offer::error::OfferError;
 use crate::offer::event::OfferEvent;
 use crate::services::HolderServices;
-use async_trait::async_trait;
-use cqrs_es::Aggregate;
+use cqrs_es::{event_sink::EventSink, Aggregate};
 use identity_credential::credential::Jwt;
 use oid4vci::credential_issuer::credential_configurations_supported::CredentialConfigurationsSupportedObject;
 use oid4vci::credential_offer::{CredentialOffer, CredentialOfferParameters, Grants};
@@ -53,25 +52,27 @@ pub struct Offer {
     pub credentials: Vec<OfferCredential>,
 }
 
-#[async_trait]
 impl Aggregate for Offer {
     type Command = OfferCommand;
     type Event = OfferEvent;
     type Error = OfferError;
     type Services = Arc<HolderServices>;
 
-    fn aggregate_type() -> String {
-        "received_offer".to_string()
-    }
+    const TYPE: &'static str = "received_offer";
 
-    async fn handle(&self, command: Self::Command, services: &Self::Services) -> Result<Vec<Self::Event>, Self::Error> {
+    async fn handle(
+        &mut self,
+        command: Self::Command,
+        services: &Self::Services,
+        sink: &EventSink<Self>,
+    ) -> Result<(), Self::Error> {
         use OfferCommand::*;
         use OfferError::*;
         use OfferEvent::*;
 
         info!("Handling command: {:?}", command);
 
-        match command {
+        let events: Vec<Self::Event> = match command {
             ReceiveCredentialOffer {
                 received_offer_id,
                 credential_offer,
@@ -284,7 +285,13 @@ impl Aggregate for Offer {
                     status: Status::Rejected,
                 }])
             }
+        }?;
+
+        for event in events {
+            sink.write(event, self).await;
         }
+
+        Ok(())
     }
 
     fn apply(&mut self, event: Self::Event) {
diff --git a/agent_holder/src/presentation/aggregate.rs b/agent_holder/src/presentation/aggregate.rs
index ea617480..e179fcba 100644
--- a/agent_holder/src/presentation/aggregate.rs
+++ b/agent_holder/src/presentation/aggregate.rs
@@ -1,9 +1,8 @@
 use super::{command::PresentationCommand, error::PresentationError, event::PresentationEvent};
 use crate::services::HolderServices;
 use agent_shared::config::{get_preferred_did_method, get_preferred_signing_algorithm};
-use async_trait::async_trait;
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
-use cqrs_es::Aggregate;
+use cqrs_es::{event_sink::EventSink, Aggregate};
 use identity_core::convert::ToJson;
 use identity_credential::{credential::Jwt, presentation::JwtPresentationOptions};
 use jsonwebtoken::Header;
@@ -19,25 +18,27 @@ pub struct Presentation {
     pub signed: Option<Jwt>,
 }
 
-#[async_trait]
 impl Aggregate for Presentation {
     type Command = PresentationCommand;
     type Event = PresentationEvent;
     type Error = PresentationError;
     type Services = Arc<HolderServices>;
 
-    fn aggregate_type() -> String {
-        "presentation".to_string()
-    }
+    const TYPE: &'static str = "presentation";
 
-    async fn handle(&self, command: Self::Command, services: &Self::Services) -> Result<Vec<Self::Event>, Self::Error> {
+    async fn handle(
+        &mut self,
+        command: Self::Command,
+        services: &Self::Services,
+        sink: &EventSink<Self>,
+    ) -> Result<(), Self::Error> {
         use PresentationCommand::*;
         use PresentationError::*;
         use PresentationEvent::*;
 
         info!("Handling command: {:?}", command);
 
-        match command {
+        let events: Vec<Self::Event> = match command {
             CreatePresentation {
                 presentation_id,
                 signed_credentials,
@@ -111,7 +112,13 @@ impl Aggregate for Presentation {
                     signed_presentation: Jwt::from(message),
                 }])
             }
+        }?;
+
+        for event in events {
+            sink.write(event, self).await;
         }
+
+        Ok(())
     }
 
     fn apply(&mut self, event: Self::Event) {
diff --git a/agent_holder/src/state.rs b/agent_holder/src/state.rs
index d9ac3d8c..e9067530 100644
--- a/agent_holder/src/state.rs
+++ b/agent_holder/src/state.rs
@@ -1,5 +1,5 @@
 use agent_shared::application_state::CommandHandler;
-use cqrs_es::persist::ViewRepository;
+use shared_kernel::view_repository::DynViewRepository;
 use std::sync::Arc;
 
 use crate::credential::aggregate::Credential;
@@ -30,22 +30,22 @@ pub struct CommandHandlers {
 /// that any type of repository that implements the `ViewRepository` trait can be used, but the corresponding `View` and
 /// `Aggregate` types must be the same.
 type Queries = ViewRepositories<
-    dyn ViewRepository<HolderCredentialView, Credential>,
-    dyn ViewRepository<AllHolderCredentialsView, Credential>,
-    dyn ViewRepository<PresentationView, Presentation>,
-    dyn ViewRepository<AllPresentationsView, Presentation>,
-    dyn ViewRepository<ReceivedOfferView, Offer>,
-    dyn ViewRepository<AllReceivedOffersView, Offer>,
+    dyn DynViewRepository<HolderCredentialView, Credential>,
+    dyn DynViewRepository<AllHolderCredentialsView, Credential>,
+    dyn DynViewRepository<PresentationView, Presentation>,
+    dyn DynViewRepository<AllPresentationsView, Presentation>,
+    dyn DynViewRepository<ReceivedOfferView, Offer>,
+    dyn DynViewRepository<AllReceivedOffersView, Offer>,
 >;
 
 pub struct ViewRepositories<C1, C2, P1, P2, O1, O2>
 where
-    C1: ViewRepository<HolderCredentialView, Credential> + ?Sized,
-    C2: ViewRepository<AllHolderCredentialsView, Credential> + ?Sized,
-    P1: ViewRepository<PresentationView, Presentation> + ?Sized,
-    P2: ViewRepository<AllPresentationsView, Presentation> + ?Sized,
-    O1: ViewRepository<ReceivedOfferView, Offer> + ?Sized,
-    O2: ViewRepository<AllReceivedOffersView, Offer> + ?Sized,
+    C1: DynViewRepository<HolderCredentialView, Credential> + ?Sized,
+    C2: DynViewRepository<AllHolderCredentialsView, Credential> + ?Sized,
+    P1: DynViewRepository<PresentationView, Presentation> + ?Sized,
+    P2: DynViewRepository<AllPresentationsView, Presentation> + ?Sized,
+    O1: DynViewRepository<ReceivedOfferView, Offer> + ?Sized,
+    O2: DynViewRepository<AllReceivedOffersView, Offer> + ?Sized,
 {
     pub holder_credential: Arc<C1>,
     pub all_holder_credentials: Arc<C2>,
diff --git a/agent_identity/Cargo.toml b/agent_identity/Cargo.toml
index bfa8b0c0..781d1629 100644
--- a/agent_identity/Cargo.toml
+++ b/agent_identity/Cargo.toml
@@ -8,6 +8,7 @@ publish.workspace = true
 [dependencies]
 agent_shared = { path = "../agent_shared" }
 agent_secret_manager = { path = "../agent_secret_manager" }
+shared-kernel.workspace = true
 
 anyhow.workspace = true
 async-trait.workspace = true
diff --git a/agent_identity/src/connection/aggregate.rs b/agent_identity/src/connection/aggregate.rs
index 4eae9d23..8bf6bb3f 100644
--- a/agent_identity/src/connection/aggregate.rs
+++ b/agent_identity/src/connection/aggregate.rs
@@ -1,7 +1,6 @@
 use crate::services::IdentityServices;
-use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use cqrs_es::Aggregate;
+use cqrs_es::{event_sink::EventSink, Aggregate};
 use identity_core::common::Url;
 use identity_did::DIDUrl;
 use oid4vci::credential_issuer::credential_issuer_metadata::CredentialIssuerMetadata;
@@ -74,24 +73,26 @@ pub struct LogoProperties {
     pub alt_text: Option<String>,
 }
 
-#[async_trait]
 impl Aggregate for Connection {
     type Command = ConnectionCommand;
     type Event = ConnectionEvent;
     type Error = ConnectionError;
     type Services = Arc<IdentityServices>;
 
-    fn aggregate_type() -> String {
-        "connection".to_string()
-    }
+    const TYPE: &'static str = "connection";
 
-    async fn handle(&self, command: Self::Command, services: &Self::Services) -> Result<Vec<Self::Event>, Self::Error> {
+    async fn handle(
+        &mut self,
+        command: Self::Command,
+        services: &Self::Services,
+        sink: &EventSink<Self>,
+    ) -> Result<(), Self::Error> {
         use ConnectionCommand::*;
         use ConnectionEvent::*;
 
         info!("Handling command: {:?}", command);
 
-        match command {
+        let events: Vec<Self::Event> = match command {
             AddConnection { connection_id, url } => {
                 let metadata = services.fetch_credential_issuer_metadata(&url).await?;
                 let connection_display_properties = get_display_from_metadata(metadata.clone());
@@ -175,7 +176,13 @@ impl Aggregate for Connection {
                 None => Ok(vec![]),
             },
             RemoveConnection { connection_id } => Ok(vec![ConnectionRemoved { connection_id }]),
+        }?;
+
+        for event in events {
+            sink.write(event, self).await;
         }
+
+        Ok(())
     }
 
     fn apply(&mut self, event: Self::Event) {
diff --git a/agent_identity/src/document/aggregate.rs b/agent_identity/src/document/aggregate.rs
index 2e657437..7f7dc0f8 100644
--- a/agent_identity/src/document/aggregate.rs
+++ b/agent_identity/src/document/aggregate.rs
@@ -4,8 +4,7 @@ use crate::services::IdentityServices;
 use agent_secret_manager::subject::StorageKey;
 use agent_shared::config::{config, get_all_enabled_signing_algorithms_supported};
 use agent_shared::config::{config_mut, SupportedDidMethod};
-use async_trait::async_trait;
-use cqrs_es::Aggregate;
+use cqrs_es::{event_sink::EventSink, Aggregate};
 use identity_did::{CoreDID, DIDUrl, DID as _};
 use identity_document::document::CoreDocument;
 use identity_iota::iota::rebased::client::{get_object_id_from_did, IdentityClient, PublishDidDocument};
@@ -77,28 +76,30 @@ pub struct Document {
     pub status: Status,
 }
 
-#[async_trait]
 impl Aggregate for Document {
     type Command = DocumentCommand;
     type Event = DocumentEvent;
     type Error = DocumentError;
     type Services = Arc<IdentityServices>;
 
-    fn aggregate_type() -> String {
-        "document".to_string()
-    }
+    const TYPE: &'static str = "document";
 
     // TODO: Most of how these commands are handled is not Domain logic, but rather Application logic, so it should be moved
     // to the Application layer. The Aggregate should only handle the Domain logic, such as creating a new Document, updating public keys, etc.
     // The Application layer should handle the specifics of how to create a Document based on the DID method, how to publish it, etc.
-    async fn handle(&self, command: Self::Command, services: &Self::Services) -> Result<Vec<Self::Event>, Self::Error> {
+    async fn handle(
+        &mut self,
+        command: Self::Command,
+        services: &Self::Services,
+        sink: &EventSink<Self>,
+    ) -> Result<(), Self::Error> {
         use DocumentCommand::*;
         use DocumentError::*;
         use DocumentEvent::*;
 
         info!("Handling command: {:?}", command);
 
-        match command {
+        let events: Vec<Self::Event> = match command {
             CreateDocument {
                 document_id,
                 did_method,
@@ -303,7 +304,7 @@ impl Aggregate for Document {
                     || did_method == SupportedDidMethod::IotaTest)
                     .then_some(iota_metadata);
 
-                Ok(vec![DocumentCreated {
+                Ok::<Vec<Self::Event>, Self::Error>(vec![DocumentCreated {
                     document_id,
                     did_method,
                     status,
@@ -473,7 +474,7 @@ impl Aggregate for Document {
 
                     if published_document.core_document() == document.core_document() {
                         info!("Document instance does not contain any updates, skipping publishing.");
-                        return Ok(vec![]);
+                        return Ok(());
                     }
                 }
 
@@ -501,109 +502,115 @@ impl Aggregate for Document {
 
                     let document = CoreDocument::from(IotaDocument::new_with_id(did));
 
-                    return Ok(vec![DocumentDeleted {
+                    Ok(vec![DocumentDeleted {
                         document_id: self.document_id.clone(),
                         document,
-                    }]);
-                }
-
-                let mut iota_metadata = self.iota_metadata.clone().unwrap_or_default();
-
-                if !iota_metadata.is_published {
-                    info!("Publishing DID Document for the first time...");
-
-                    document = publish_did_document(
-                        &identity_client,
-                        document.clone(),
-                        wallet_address,
-                        MIN_GAS_BUDGET,
-                        &iota_sponsoring_service_url,
-                        iota_sponsoring_service_auth.as_deref(),
-                    )
-                    .await?;
-
-                    iota_metadata.is_published = true;
-                    iota_metadata.created_at = document.metadata.created.map(|created| created.to_string());
+                    }])
                 } else {
-                    info!("Updating existing DID Document...");
-
-                    // Update the existing DID Document.
-                    match self.status {
-                        // This status indicates that the DID Document update is ready to be published to the IOTA ledger.
-                        Status::SignAndValidate => {
-                            info!("Updating DID Document with status: SignAndValidate");
-
-                            update_did_document(
-                                &identity_client,
-                                document.clone(),
-                                MIN_GAS_BUDGET,
-                                &iota_sponsoring_service_url,
-                                iota_sponsoring_service_auth.as_deref(),
-                            )
-                            .await?;
-
-                            iota_metadata.is_deactivated = false;
-                        }
-                        Status::Disabled => {
-                            // This status indicates that the DID Document should be deactivated.
-
-                            info!("Deactivating DID Document with status: Disabled");
-
-                            deactivate_did(
-                                &identity_client,
-                                document.clone(),
-                                MIN_GAS_BUDGET,
-                                &iota_sponsoring_service_url,
-                                iota_sponsoring_service_auth.as_deref(),
-                            )
-                            .await?;
+                    let mut iota_metadata = self.iota_metadata.clone().unwrap_or_default();
+
+                    if !iota_metadata.is_published {
+                        info!("Publishing DID Document for the first time...");
+
+                        document = publish_did_document(
+                            &identity_client,
+                            document.clone(),
+                            wallet_address,
+                            MIN_GAS_BUDGET,
+                            &iota_sponsoring_service_url,
+                            iota_sponsoring_service_auth.as_deref(),
+                        )
+                        .await?;
 
-                            iota_metadata.is_deactivated = true;
-                        }
-                    };
-                };
+                        iota_metadata.is_published = true;
+                        iota_metadata.created_at = document.metadata.created.map(|created| created.to_string());
+                    } else {
+                        info!("Updating existing DID Document...");
+
+                        // Update the existing DID Document.
+                        match self.status {
+                            // This status indicates that the DID Document update is ready to be published to the IOTA ledger.
+                            Status::SignAndValidate => {
+                                info!("Updating DID Document with status: SignAndValidate");
+
+                                update_did_document(
+                                    &identity_client,
+                                    document.clone(),
+                                    MIN_GAS_BUDGET,
+                                    &iota_sponsoring_service_url,
+                                    iota_sponsoring_service_auth.as_deref(),
+                                )
+                                .await?;
+
+                                iota_metadata.is_deactivated = false;
+                            }
+                            Status::Disabled => {
+                                // This status indicates that the DID Document should be deactivated.
 
-                let document = identity_client
-                    .resolve_did(document.id())
-                    .await
-                    .map_err(|err| GenericError(err.to_string()))?;
+                                info!("Deactivating DID Document with status: Disabled");
 
-                info!("DID Document after publishing: {document:#?}");
+                                deactivate_did(
+                                    &identity_client,
+                                    document.clone(),
+                                    MIN_GAS_BUDGET,
+                                    &iota_sponsoring_service_url,
+                                    iota_sponsoring_service_auth.as_deref(),
+                                )
+                                .await?;
 
-                let balance = iota_client
-                    .coin_read_api()
-                    .get_balance(wallet_address, None)
-                    .await
-                    .map_err(|err| GenericError(err.to_string()))?
-                    .total_balance;
+                                iota_metadata.is_deactivated = true;
+                            }
+                        };
+                    };
 
-                iota_metadata.is_funded = balance > MIN_GAS_BUDGET as u128;
-                iota_metadata.balance = balance as u64;
-                iota_metadata.updated_at = document.metadata.updated.map(|updated| updated.to_string());
+                    let document = identity_client
+                        .resolve_did(document.id())
+                        .await
+                        .map_err(|err| GenericError(err.to_string()))?;
 
-                info!("Updated IOTA Metadata: {iota_metadata:#?}");
+                    info!("DID Document after publishing: {document:#?}");
 
-                iota_metadata.explorer_url = Some(format!(
-                    "https://explorer.iota.org/object/{}?network={}",
-                    document.id().tag_str(),
-                    if did_method == SupportedDidMethod::IotaDev {
-                        "devnet"
-                    } else if did_method == SupportedDidMethod::IotaTest {
-                        "testnet"
-                    } else {
-                        "mainnet"
-                    }
-                ));
+                    let balance = iota_client
+                        .coin_read_api()
+                        .get_balance(wallet_address, None)
+                        .await
+                        .map_err(|err| GenericError(err.to_string()))?
+                        .total_balance;
+
+                    iota_metadata.is_funded = balance > MIN_GAS_BUDGET as u128;
+                    iota_metadata.balance = balance as u64;
+                    iota_metadata.updated_at = document.metadata.updated.map(|updated| updated.to_string());
+
+                    info!("Updated IOTA Metadata: {iota_metadata:#?}");
+
+                    iota_metadata.explorer_url = Some(format!(
+                        "https://explorer.iota.org/object/{}?network={}",
+                        document.id().tag_str(),
+                        if did_method == SupportedDidMethod::IotaDev {
+                            "devnet"
+                        } else if did_method == SupportedDidMethod::IotaTest {
+                            "testnet"
+                        } else {
+                            "mainnet"
+                        }
+                    ));
 
-                info!("Explorer URL: {:?}", iota_metadata.explorer_url);
+                    info!("Explorer URL: {:?}", iota_metadata.explorer_url);
 
-                Ok(vec![DocumentPublished {
-                    document_id: self.document_id.clone(),
-                    document: CoreDocument::from(document),
-                    iota_metadata: Some(iota_metadata),
-                }])
+                    Ok(vec![DocumentPublished {
+                        document_id: self.document_id.clone(),
+                        document: CoreDocument::from(document),
+                        iota_metadata: Some(iota_metadata),
+                    }])
+                }
             }
+        }?;
+
+        for event in events {
+            sink.write(event, self).await;
         }
+
+        Ok(())
     }
 
     fn apply(&mut self, event: Self::Event) {
diff --git a/agent_identity/src/profile/aggregate.rs b/agent_identity/src/profile/aggregate.rs
index f2a9b967..8675499f 100644
--- a/agent_identity/src/profile/aggregate.rs
+++ b/agent_identity/src/profile/aggregate.rs
@@ -1,6 +1,5 @@
 use agent_shared::config::Logo;
-use async_trait::async_trait;
-use cqrs_es::Aggregate;
+use cqrs_es::{event_sink::EventSink, Aggregate};
 use serde::{Deserialize, Serialize};
 use std::sync::Arc;
 use tracing::{debug, info};
@@ -29,28 +28,26 @@ pub struct Profile {
     pub source: Source,
 }
 
-#[async_trait]
 impl Aggregate for Profile {
     type Command = ProfileCommand;
     type Event = ProfileEvent;
     type Error = ProfileError;
     type Services = Arc<IdentityServices>;
 
-    fn aggregate_type() -> String {
-        "profile".to_string()
-    }
+    const TYPE: &'static str = "profile";
 
     async fn handle(
-        &self,
+        &mut self,
         command: Self::Command,
         _services: &Self::Services,
-    ) -> Result<Vec<Self::Event>, Self::Error> {
+        sink: &EventSink<Self>,
+    ) -> Result<(), Self::Error> {
         use ProfileCommand::*;
         use ProfileEvent::*;
 
         info!("Handling command: {:?}", command);
 
-        match command {
+        let events: Vec<Self::Event> = match command {
             CreateProfile {
                 profile_id,
                 display_name,
@@ -115,7 +112,13 @@ impl Aggregate for Profile {
 
                 Ok(vec![ProfileEvent::SourceUpdated { source }])
             }
+        }?;
+
+        for event in events {
+            sink.write(event, self).await;
         }
+
+        Ok(())
     }
 
     fn apply(&mut self, event: Self::Event) {
diff --git a/agent_identity/src/service/aggregate.rs b/agent_identity/src/service/aggregate.rs
index 8d727ea0..cae73b20 100644
--- a/agent_identity/src/service/aggregate.rs
+++ b/agent_identity/src/service/aggregate.rs
@@ -1,9 +1,8 @@
 use super::{command::ServiceCommand, error::ServiceError, event::ServiceEvent};
 use crate::services::IdentityServices;
 use agent_shared::config::config;
-use async_trait::async_trait;
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
-use cqrs_es::Aggregate;
+use cqrs_es::{event_sink::EventSink, Aggregate};
 use identity_core::{
     common::{Duration, OrderedSet, Timestamp},
     convert::{FromJson, ToJson},
@@ -36,25 +35,27 @@ pub struct Service {
     pub is_deleted: bool,
 }
 
-#[async_trait]
 impl Aggregate for Service {
     type Command = ServiceCommand;
     type Event = ServiceEvent;
     type Error = ServiceError;
     type Services = Arc<IdentityServices>;
 
-    fn aggregate_type() -> String {
-        "service".to_string()
-    }
+    const TYPE: &'static str = "service";
 
-    async fn handle(&self, command: Self::Command, services: &Self::Services) -> Result<Vec<Self::Event>, Self::Error> {
+    async fn handle(
+        &mut self,
+        command: Self::Command,
+        services: &Self::Services,
+        sink: &EventSink<Self>,
+    ) -> Result<(), Self::Error> {
         use ServiceCommand::*;
         use ServiceError::*;
         use ServiceEvent::*;
 
         info!("Handling command: {:?}", command);
 
-        match command {
+        let events: Vec<Self::Event> = match command {
             CreateDomainLinkageService {
                 service_id,
                 verification_methods,
@@ -213,7 +214,13 @@ impl Aggregate for Service {
                     service,
                 }])
             }
+        }?;
+
+        for event in events {
+            sink.write(event, self).await;
         }
+
+        Ok(())
     }
 
     fn apply(&mut self, event: Self::Event) {
diff --git a/agent_identity/src/state.rs b/agent_identity/src/state.rs
index 4305ca46..465507e1 100644
--- a/agent_identity/src/state.rs
+++ b/agent_identity/src/state.rs
@@ -17,9 +17,10 @@ use agent_shared::config::{
 };
 use agent_shared::handlers::command_handler;
 use agent_shared::{application_state::CommandHandler, handlers::query_handler};
-use cqrs_es::persist::{PersistenceError, ViewRepository};
+use cqrs_es::persist::PersistenceError;
 use itertools::iproduct;
 use jsonwebtoken::Algorithm;
+use shared_kernel::view_repository::DynViewRepository;
 use std::collections::HashMap;
 use std::sync::Arc;
 use tracing::{info, warn};
@@ -49,24 +50,24 @@ pub struct CommandHandlers {
 /// that any type of repository that implements the `ViewRepository` trait can be used, but the corresponding `View` and
 /// `Aggregate` types must be the same.
 type Queries = ViewRepositories<
-    dyn ViewRepository<ConnectionView, Connection>,
-    dyn ViewRepository<AllConnectionsView, Connection>,
-    dyn ViewRepository<DocumentView, Document>,
-    dyn ViewRepository<AllDocumentsView, Document>,
-    dyn ViewRepository<ProfileView, Profile>,
-    dyn ViewRepository<ServiceView, Service>,
-    dyn ViewRepository<AllServicesView, Service>,
+    dyn DynViewRepository<ConnectionView, Connection>,
+    dyn DynViewRepository<AllConnectionsView, Connection>,
+    dyn DynViewRepository<DocumentView, Document>,
+    dyn DynViewRepository<AllDocumentsView, Document>,
+    dyn DynViewRepository<ProfileView, Profile>,
+    dyn DynViewRepository<ServiceView, Service>,
+    dyn DynViewRepository<AllServicesView, Service>,
 >;
 
 pub struct ViewRepositories<C1, C2, D1, D2, P, S1, S2>
 where
-    C1: ViewRepository<ConnectionView, Connection> + ?Sized,
-    C2: ViewRepository<AllConnectionsView, Connection> + ?Sized,
-    D1: ViewRepository<DocumentView, Document> + ?Sized,
-    D2: ViewRepository<AllDocumentsView, Document> + ?Sized,
-    P: ViewRepository<ProfileView, Profile> + ?Sized,
-    S1: ViewRepository<ServiceView, Service> + ?Sized,
-    S2: ViewRepository<AllServicesView, Service> + ?Sized,
+    C1: DynViewRepository<ConnectionView, Connection> + ?Sized,
+    C2: DynViewRepository<AllConnectionsView, Connection> + ?Sized,
+    D1: DynViewRepository<DocumentView, Document> + ?Sized,
+    D2: DynViewRepository<AllDocumentsView, Document> + ?Sized,
+    P: DynViewRepository<ProfileView, Profile> + ?Sized,
+    S1: DynViewRepository<ServiceView, Service> + ?Sized,
+    S2: DynViewRepository<AllServicesView, Service> + ?Sized,
 {
     pub connection: Arc<C1>,
     pub all_connections: Arc<C2>,
diff --git a/agent_issuance/Cargo.toml b/agent_issuance/Cargo.toml
index c4c57268..7ad81037 100644
--- a/agent_issuance/Cargo.toml
+++ b/agent_issuance/Cargo.toml
@@ -9,6 +9,7 @@ publish.workspace = true
 agent_library = { path = "../agent_library" }
 agent_shared = { path = "../agent_shared" }
 agent_secret_manager = { path = "../agent_secret_manager" }
+shared-kernel.workspace = true
 
 anyhow.workspace = true
 async-trait.workspace = true
diff --git a/agent_issuance/src/application/credential_configuration_projection.rs b/agent_issuance/src/application/credential_configuration_projection.rs
index ebf9a95b..1346bfc4 100644
--- a/agent_issuance/src/application/credential_configuration_projection.rs
+++ b/agent_issuance/src/application/credential_configuration_projection.rs
@@ -5,19 +5,19 @@ use agent_library::template::views::TemplateView;
 use agent_shared::config::CredentialConfiguration;
 use agent_shared::handlers::{command_handler, query_handler};
 use async_trait::async_trait;
-use cqrs_es::persist::ViewRepository;
 use cqrs_es::{EventEnvelope, Query};
 use oid4vc_core::claim_path_pointer::{ClaimPathElement, ClaimPathPointer};
 use oid4vci::credential_issuer::credential_configurations_supported::{
     ClaimDescription, CredentialConfigurationsSupportedDisplay, CredentialMetadata, Logo as OidcLogo,
 };
+use shared_kernel::view_repository::DynViewRepository;
 use std::{
     collections::HashMap,
     sync::{Arc, OnceLock},
 };
 use tracing::warn;
 
-type TemplateViewHandle = Arc<OnceLock<Arc<dyn ViewRepository<TemplateView, Template>>>>;
+type TemplateViewHandle = Arc<OnceLock<Arc<dyn DynViewRepository<TemplateView, Template>>>>;
 
 pub struct CredentialConfigurationProjection {
     issuance_state: Arc<IssuanceState>,
diff --git a/agent_issuance/src/credential/aggregate.rs b/agent_issuance/src/credential/aggregate.rs
index 74582a2f..48c95d1c 100644
--- a/agent_issuance/src/credential/aggregate.rs
+++ b/agent_issuance/src/credential/aggregate.rs
@@ -7,9 +7,8 @@ use crate::services::IssuanceServices;
 use agent_library::json_schema_validation::{CredentialType, JsonSchemaError};
 use agent_shared::config::{config, get_preferred_did_method, get_preferred_signing_algorithm, AlgorithmExt};
 use agent_shared::serde_json_value_ext::SerdeJsonValueExt;
-use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use cqrs_es::Aggregate;
+use cqrs_es::{event_sink::EventSink, Aggregate};
 use identity_core::common::Timestamp;
 use identity_core::convert::FromJson;
 use identity_credential::sd_jwt_vc::{self, SdJwtVcBuilder, SdJwtVcClaims, StatusListRef, StatusMechanism};
@@ -99,25 +98,27 @@ pub struct Credential {
     pub expires_at: Option<DateTime<Utc>>,
 }
 
-#[async_trait]
 impl Aggregate for Credential {
     type Command = CredentialCommand;
     type Event = CredentialEvent;
     type Error = CredentialError;
     type Services = Arc<IssuanceServices>;
 
-    fn aggregate_type() -> String {
-        "credential".to_string()
-    }
+    const TYPE: &'static str = "credential";
 
-    async fn handle(&self, command: Self::Command, services: &Self::Services) -> Result<Vec<Self::Event>, Self::Error> {
+    async fn handle(
+        &mut self,
+        command: Self::Command,
+        services: &Self::Services,
+        sink: &EventSink<Self>,
+    ) -> Result<(), Self::Error> {
         use CredentialCommand::*;
         use CredentialError::*;
         use CredentialEvent::*;
 
         info!("Handling command: {:?}", command);
 
-        match command {
+        let events: Vec<Self::Event> = match command {
             CreateUnsignedCredential {
                 credential_id,
                 data,
@@ -204,14 +205,14 @@ impl Aggregate for Credential {
                     }
                 };
 
-                return Ok(vec![UnsignedCredentialCreated {
+                Ok(vec![UnsignedCredentialCreated {
                     credential_id,
                     notification_id: Some(notification_id),
                     data: Data { raw: credential_data },
                     credential_configuration,
                     created_at: Some(created_at),
                     expires_at,
-                }]);
+                }])
             }
 
             CreateSignedCredential {
@@ -238,7 +239,7 @@ impl Aggregate for Credential {
                 index,
             } => {
                 if self.signed.is_some() && !overwrite {
-                    return Ok(vec![]);
+                    return Ok(());
                 }
 
                 // Create/collect claims needed for the signed (SD-)JWT
@@ -501,7 +502,13 @@ impl Aggregate for Credential {
                 credential_id,
                 credential_status,
             }]),
+        }?;
+
+        for event in events {
+            sink.write(event, self).await;
         }
+
+        Ok(())
     }
 
     fn apply(&mut self, event: Self::Event) {
diff --git a/agent_issuance/src/nonce/aggregate.rs b/agent_issuance/src/nonce/aggregate.rs
index 063f50ac..22b65d16 100644
--- a/agent_issuance/src/nonce/aggregate.rs
+++ b/agent_issuance/src/nonce/aggregate.rs
@@ -2,8 +2,7 @@ use crate::nonce::command::NonceCommand;
 use crate::nonce::error::NonceError;
 use crate::nonce::event::NonceEvent;
 use crate::services::IssuanceServices;
-use async_trait::async_trait;
-use cqrs_es::Aggregate;
+use cqrs_es::{event_sink::EventSink, Aggregate};
 use serde::{Deserialize, Serialize};
 use std::sync::Arc;
 use tracing::{debug, info};
@@ -14,22 +13,20 @@ pub struct Nonce {
     pub is_redeemed: bool,
 }
 
-#[async_trait]
 impl Aggregate for Nonce {
     type Command = NonceCommand;
     type Event = NonceEvent;
     type Error = NonceError;
     type Services = Arc<IssuanceServices>;
 
-    fn aggregate_type() -> String {
-        "nonce".to_string()
-    }
+    const TYPE: &'static str = "nonce";
 
     async fn handle(
-        &self,
+        &mut self,
         command: Self::Command,
         _services: &Self::Services,
-    ) -> Result<Vec<Self::Event>, Self::Error> {
+        sink: &EventSink<Self>,
+    ) -> Result<(), Self::Error> {
         use NonceCommand::*;
         use NonceEvent::*;
         // TODO: add proper errors within NonceError
@@ -37,7 +34,7 @@ impl Aggregate for Nonce {
 
         info!("Handling command: {:?}", command);
 
-        match command {
+        let events: Vec<Self::Event> = match command {
             GenerateNonce { c_nonce } => Ok(vec![NonceGenerated {
                 c_nonce,
                 is_redeemed: false,
@@ -46,7 +43,13 @@ impl Aggregate for Nonce {
                 c_nonce,
                 is_redeemed: true,
             }]),
+        }?;
+
+        for event in events {
+            sink.write(event, self).await;
         }
+
+        Ok(())
     }
 
     fn apply(&mut self, event: Self::Event) {
diff --git a/agent_issuance/src/offer/aggregate.rs b/agent_issuance/src/offer/aggregate.rs
index 0da16354..87333aec 100644
--- a/agent_issuance/src/offer/aggregate.rs
+++ b/agent_issuance/src/offer/aggregate.rs
@@ -1,6 +1,5 @@
 use agent_shared::config::config;
-use async_trait::async_trait;
-use cqrs_es::Aggregate;
+use cqrs_es::{event_sink::EventSink, Aggregate};
 use oid4vc_core::Validator;
 use oid4vci::credential_issuer::CredentialIssuer;
 use oid4vci::credential_offer::{
@@ -78,24 +77,26 @@ pub enum DeliveryMethod {
     },
 }
 
-#[async_trait]
 impl Aggregate for Offer {
     type Command = OfferCommand;
     type Event = OfferEvent;
     type Error = OfferError;
     type Services = Arc<IssuanceServices>;
 
-    fn aggregate_type() -> String {
-        "offer".to_string()
-    }
+    const TYPE: &'static str = "offer";
 
-    async fn handle(&self, command: Self::Command, services: &Self::Services) -> Result<Vec<Self::Event>, Self::Error> {
+    async fn handle(
+        &mut self,
+        command: Self::Command,
+        services: &Self::Services,
+        sink: &EventSink<Self>,
+    ) -> Result<(), Self::Error> {
         use OfferCommand::*;
         use OfferEvent::*;
 
         info!("Handling command: {:?}", command);
 
-        match command {
+        let events: Vec<Self::Event> = match command {
             CreateCredentialOffer {
                 offer_id,
                 grant_types,
@@ -348,7 +349,13 @@ impl Aggregate for Offer {
                     status: Status::Issued,
                 }])
             }
+        }?;
+
+        for event in events {
+            sink.write(event, self).await;
         }
+
+        Ok(())
     }
 
     fn apply(&mut self, event: Self::Event) {
@@ -441,7 +448,7 @@ pub mod tests {
     type OfferTestFramework = TestFramework<Offer>;
 
     // The test `test_verify_credential_response` requires a larger stack size (32 MiB).
-    #[expect(dead_code)]
+    // TODO: refactor test
     fn run_with_large_stack<F>(test: F)
     where
         F: FnOnce() + Send + 'static,
@@ -579,6 +586,7 @@ pub mod tests {
     // outside the test function body, before entering run_with_large_stack. This would cause a stack
     // overflow before the large stack is available. Instead, all fixture setup is done manually inside
     // the large-stack wrapper using the test helper functions directly.
+    #[rstest]
     #[serial_test::serial]
     fn test_verify_credential_response() {
         run_with_large_stack(move || {
diff --git a/agent_issuance/src/public_offer/aggregate.rs b/agent_issuance/src/public_offer/aggregate.rs
index 731bab7e..ad60da6c 100644
--- a/agent_issuance/src/public_offer/aggregate.rs
+++ b/agent_issuance/src/public_offer/aggregate.rs
@@ -1,7 +1,6 @@
 use crate::public_offer::{command::PublicOfferCommand, error::PublicOfferError, event::PublicOfferEvent};
 use crate::services::IssuanceServices;
-use async_trait::async_trait;
-use cqrs_es::Aggregate;
+use cqrs_es::{event_sink::EventSink, Aggregate};
 use serde::{Deserialize, Serialize};
 use std::sync::Arc;
 
@@ -16,23 +15,21 @@ pub struct PublicOffer {
     pub created_at: Option<chrono::DateTime<chrono::Utc>>,
 }
 
-#[async_trait]
 impl Aggregate for PublicOffer {
     type Command = PublicOfferCommand;
     type Event = PublicOfferEvent;
     type Error = PublicOfferError;
     type Services = Arc<IssuanceServices>;
 
-    fn aggregate_type() -> String {
-        "public_offer".to_string()
-    }
+    const TYPE: &'static str = "public_offer";
 
     async fn handle(
-        &self,
+        &mut self,
         command: Self::Command,
         _services: &Self::Services,
-    ) -> Result<Vec<Self::Event>, Self::Error> {
-        match command {
+        sink: &EventSink<Self>,
+    ) -> Result<(), Self::Error> {
+        let events: Vec<Self::Event> = match command {
             PublicOfferCommand::Create { offer_id, template_id } => {
                 if !self.id.is_empty() && !self.deleted {
                     return Err(PublicOfferError::AlreadyExists);
@@ -49,7 +46,7 @@ impl Aggregate for PublicOffer {
                     return Err(PublicOfferError::NotFound);
                 }
                 if !self.active {
-                    return Ok(vec![]);
+                    return Ok(());
                 }
 
                 Ok(vec![PublicOfferEvent::TakenOffline { offer_id }])
@@ -59,7 +56,7 @@ impl Aggregate for PublicOffer {
                     return Err(PublicOfferError::NotFound);
                 }
                 if self.active {
-                    return Ok(vec![]);
+                    return Ok(());
                 }
 
                 Ok(vec![PublicOfferEvent::TakenOnline { offer_id }])
@@ -71,7 +68,13 @@ impl Aggregate for PublicOffer {
 
                 Ok(vec![PublicOfferEvent::Deleted { offer_id }])
             }
+        }?;
+
+        for event in events {
+            sink.write(event, self).await;
         }
+
+        Ok(())
     }
 
     fn apply(&mut self, event: Self::Event) {
@@ -108,7 +111,7 @@ pub mod tests {
     use super::*;
     use crate::services::IssuanceServices;
     use agent_secret_manager::service::Service;
-    use cqrs_es::test::TestFramework;
+    use cqrs_es::{event_sink::EventSink, test::TestFramework};
     use rstest::rstest;
 
     type PublicOfferTestFramework = TestFramework<PublicOffer>;
@@ -121,17 +124,20 @@ pub mod tests {
 
         let issuance_services = IssuanceServices::default().await;
 
-        let aggregate = PublicOffer::default();
-        let events = aggregate
+        let mut aggregate = PublicOffer::default();
+        let sink = EventSink::default();
+        aggregate
             .handle(
                 PublicOfferCommand::Create {
                     offer_id: offer_id.clone(),
                     template_id: template_id.clone(),
                 },
                 &issuance_services,
+                &sink,
             )
             .await
             .expect("create command should succeed");
+        let events = sink.collect().await;
 
         assert_eq!(events.len(), 1);
         match &events[0] {
@@ -185,16 +191,19 @@ pub mod tests {
             offer_id: offer_id.clone(),
         });
 
-        let events = aggregate
+        let sink = EventSink::default();
+        aggregate
             .handle(
                 PublicOfferCommand::Create {
                     offer_id: offer_id.clone(),
                     template_id: new_template_id.clone(),
                 },
                 &issuance_services,
+                &sink,
             )
             .await
             .expect("recreate command should succeed after delete");
+        let events = sink.collect().await;
 
         assert_eq!(events.len(), 1);
         match &events[0] {
diff --git a/agent_issuance/src/server_config/aggregate.rs b/agent_issuance/src/server_config/aggregate.rs
index 35cc5ecd..38440dbd 100644
--- a/agent_issuance/src/server_config/aggregate.rs
+++ b/agent_issuance/src/server_config/aggregate.rs
@@ -1,8 +1,7 @@
 use agent_shared::config::{config, Authorization};
 use agent_shared::UrlAppendHelpers as _;
-use async_trait::async_trait;
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
-use cqrs_es::Aggregate;
+use cqrs_es::{event_sink::EventSink, Aggregate};
 use identity_core::convert::ToJson;
 use jsonwebtoken::Algorithm;
 use oid4vci::credential_format_profiles::vc_jose_cose::vc_sd_jwt;
@@ -70,29 +69,27 @@ pub struct ServerConfig {
     pub signing_algorithms_supported: Vec<Algorithm>,
 }
 
-#[async_trait]
 impl Aggregate for ServerConfig {
     type Command = ServerConfigCommand;
     type Event = ServerConfigEvent;
     type Error = ServerConfigError;
     type Services = Arc<IssuanceServices>;
 
-    fn aggregate_type() -> String {
-        "server_config".to_string()
-    }
+    const TYPE: &'static str = "server_config";
 
     async fn handle(
-        &self,
+        &mut self,
         command: Self::Command,
         _services: &Self::Services,
-    ) -> Result<Vec<Self::Event>, Self::Error> {
+        sink: &EventSink<Self>,
+    ) -> Result<(), Self::Error> {
         use ServerConfigCommand::*;
         use ServerConfigError::*;
         use ServerConfigEvent::*;
 
         info!("Handling command: {:?}", command);
 
-        match command {
+        let events: Vec<Self::Event> = match command {
             InitializeServerMetadata {
                 authorization_server_metadata,
                 credential_issuer_metadata,
@@ -305,7 +302,13 @@ impl Aggregate for ServerConfig {
                     credential_configurations,
                 }])
             }
+        }?;
+
+        for event in events {
+            sink.write(event, self).await;
         }
+
+        Ok(())
     }
 
     fn apply(&mut self, event: Self::Event) {
diff --git a/agent_issuance/src/state.rs b/agent_issuance/src/state.rs
index e772d8f2..cef1823d 100644
--- a/agent_issuance/src/state.rs
+++ b/agent_issuance/src/state.rs
@@ -3,9 +3,9 @@ use agent_shared::application_state::CommandHandler;
 use agent_shared::config::{config, get_all_enabled_did_methods, get_all_enabled_signing_algorithms_supported};
 use agent_shared::handlers::{command_handler, query_handler};
 use agent_shared::UrlAppendHelpers;
-use cqrs_es::persist::ViewRepository;
 use oid4vci::credential_issuer::authorization_server_metadata::AuthorizationServerMetadata;
 use oid4vci::credential_issuer::credential_issuer_metadata::CredentialIssuerMetadata;
+use shared_kernel::view_repository::DynViewRepository;
 use std::sync::Arc;
 use tracing::{debug, info};
 
@@ -57,30 +57,30 @@ pub struct CommandHandlers {
 /// that any type of repository that implements the `ViewRepository` trait can be used, but the corresponding `View` and
 /// `Aggregate` types must be the same.
 type Queries = ViewRepositories<
-    dyn ViewRepository<ServerConfigView, ServerConfig>,
-    dyn ViewRepository<CredentialView, Credential>,
-    dyn ViewRepository<AllCredentialsView, Credential>,
-    dyn ViewRepository<OfferView, Offer>,
-    dyn ViewRepository<AllOffersView, Offer>,
-    dyn ViewRepository<NonceView, Nonce>,
-    dyn ViewRepository<StatusListView, StatusListAggregate>,
-    dyn ViewRepository<AllStatusListsView, StatusListAggregate>,
-    dyn ViewRepository<PublicOfferView, PublicOffer>,
-    dyn ViewRepository<AllPublicOffersView, PublicOffer>,
+    dyn DynViewRepository<ServerConfigView, ServerConfig>,
+    dyn DynViewRepository<CredentialView, Credential>,
+    dyn DynViewRepository<AllCredentialsView, Credential>,
+    dyn DynViewRepository<OfferView, Offer>,
+    dyn DynViewRepository<AllOffersView, Offer>,
+    dyn DynViewRepository<NonceView, Nonce>,
+    dyn DynViewRepository<StatusListView, StatusListAggregate>,
+    dyn DynViewRepository<AllStatusListsView, StatusListAggregate>,
+    dyn DynViewRepository<PublicOfferView, PublicOffer>,
+    dyn DynViewRepository<AllPublicOffersView, PublicOffer>,
 >;
 
 pub struct ViewRepositories<SC, C, C1, O, O1, N, SL, SL1, PO, PO1>
 where
-    SC: ViewRepository<ServerConfigView, ServerConfig> + ?Sized,
-    C: ViewRepository<CredentialView, Credential> + ?Sized,
-    C1: ViewRepository<AllCredentialsView, Credential> + ?Sized,
-    O: ViewRepository<OfferView, Offer> + ?Sized,
-    O1: ViewRepository<AllOffersView, Offer> + ?Sized,
-    N: ViewRepository<NonceView, Nonce> + ?Sized,
-    SL: ViewRepository<StatusListView, StatusListAggregate> + ?Sized,
-    SL1: ViewRepository<AllStatusListsView, StatusListAggregate> + ?Sized,
-    PO: ViewRepository<PublicOfferView, PublicOffer> + ?Sized,
-    PO1: ViewRepository<AllPublicOffersView, PublicOffer> + ?Sized,
+    SC: DynViewRepository<ServerConfigView, ServerConfig> + ?Sized,
+    C: DynViewRepository<CredentialView, Credential> + ?Sized,
+    C1: DynViewRepository<AllCredentialsView, Credential> + ?Sized,
+    O: DynViewRepository<OfferView, Offer> + ?Sized,
+    O1: DynViewRepository<AllOffersView, Offer> + ?Sized,
+    N: DynViewRepository<NonceView, Nonce> + ?Sized,
+    SL: DynViewRepository<StatusListView, StatusListAggregate> + ?Sized,
+    SL1: DynViewRepository<AllStatusListsView, StatusListAggregate> + ?Sized,
+    PO: DynViewRepository<PublicOfferView, PublicOffer> + ?Sized,
+    PO1: DynViewRepository<AllPublicOffersView, PublicOffer> + ?Sized,
 {
     pub server_config: Arc<SC>,
     pub credential: Arc<C>,
diff --git a/agent_issuance/src/status_list/aggregate.rs b/agent_issuance/src/status_list/aggregate.rs
index f132d9c7..8a45a17f 100644
--- a/agent_issuance/src/status_list/aggregate.rs
+++ b/agent_issuance/src/status_list/aggregate.rs
@@ -1,8 +1,7 @@
 #[cfg(feature = "test_utils")]
 use agent_shared::config::TESTINDEX;
 use agent_shared::config::{BITS_PER_STATUS, STATUS_LIST_BYTES_AMOUNT};
-use async_trait::async_trait;
-use cqrs_es::Aggregate;
+use cqrs_es::{event_sink::EventSink, Aggregate};
 use oauth_tsl::status_list::{Bits, StatusList};
 use serde::{Deserialize, Serialize};
 use std::sync::Arc;
@@ -18,26 +17,24 @@ pub struct StatusListAggregate {
     pub used_indices: Vec<usize>,
 }
 
-#[async_trait]
 impl Aggregate for StatusListAggregate {
     type Command = StatusListCommand;
     type Event = StatusListEvent;
     type Error = StatusListError;
     type Services = Arc<IssuanceServices>;
 
-    fn aggregate_type() -> String {
-        "status_list".to_string()
-    }
+    const TYPE: &'static str = "status_list";
 
     async fn handle(
-        &self,
+        &mut self,
         command: Self::Command,
         _services: &Self::Services,
-    ) -> Result<Vec<Self::Event>, Self::Error> {
+        sink: &EventSink<Self>,
+    ) -> Result<(), Self::Error> {
         use StatusListCommand::*;
         use StatusListEvent::*;
 
-        match command {
+        let events: Vec<Self::Event> = match command {
             CreateStatusList { id } => Ok(vec![StatusListCreated {
                 id,
                 status_list: StatusList {
@@ -99,7 +96,13 @@ impl Aggregate for StatusListAggregate {
                     status,
                 }])
             }
+        }?;
+
+        for event in events {
+            sink.write(event, self).await;
         }
+
+        Ok(())
     }
 
     fn apply(&mut self, event: Self::Event) {
diff --git a/agent_library/Cargo.toml b/agent_library/Cargo.toml
index 2e06981c..30ce0a62 100644
--- a/agent_library/Cargo.toml
+++ b/agent_library/Cargo.toml
@@ -7,6 +7,7 @@ publish.workspace = true
 
 [dependencies]
 agent_shared = { path = "../agent_shared" }
+shared-kernel.workspace = true
 
 async-trait.workspace = true
 chrono.workspace = true
diff --git a/agent_library/src/state.rs b/agent_library/src/state.rs
index f7026b0b..1d319791 100644
--- a/agent_library/src/state.rs
+++ b/agent_library/src/state.rs
@@ -1,5 +1,5 @@
 use agent_shared::application_state::CommandHandler;
-use cqrs_es::persist::ViewRepository;
+use shared_kernel::view_repository::DynViewRepository;
 use std::sync::Arc;
 
 use crate::template::{
@@ -23,12 +23,12 @@ pub struct CommandHandlers {
 /// that any type of repository that implements the `ViewRepository` trait can be used, but the corresponding `View` and
 /// `Aggregate` types must be the same.
 type Queries =
-    ViewRepositories<dyn ViewRepository<TemplateView, Template>, dyn ViewRepository<AllTemplatesView, Template>>;
+    ViewRepositories<dyn DynViewRepository<TemplateView, Template>, dyn DynViewRepository<AllTemplatesView, Template>>;
 
 pub struct ViewRepositories<T1, T2>
 where
-    T1: ViewRepository<TemplateView, Template> + ?Sized,
-    T2: ViewRepository<AllTemplatesView, Template> + ?Sized,
+    T1: DynViewRepository<TemplateView, Template> + ?Sized,
+    T2: DynViewRepository<AllTemplatesView, Template> + ?Sized,
 {
     pub template: Arc<T1>,
     pub all_templates: Arc<T2>,
diff --git a/agent_library/src/template/aggregate.rs b/agent_library/src/template/aggregate.rs
index e007ca3a..81ecc13a 100644
--- a/agent_library/src/template/aggregate.rs
+++ b/agent_library/src/template/aggregate.rs
@@ -1,8 +1,7 @@
 use std::collections::HashMap;
 
 use agent_shared::config::Authorization;
-use async_trait::async_trait;
-use cqrs_es::Aggregate;
+use cqrs_es::{event_sink::EventSink, Aggregate};
 use serde::{Deserialize, Serialize};
 use serde_with::skip_serializing_none;
 use tracing::{debug, info};
@@ -148,28 +147,26 @@ pub struct Template {
     pub holder_authorization: Authorization,
 }
 
-#[async_trait]
 impl Aggregate for Template {
     type Command = TemplateCommand;
     type Event = TemplateEvent;
     type Error = TemplateError;
     type Services = ();
 
-    fn aggregate_type() -> String {
-        "template".to_string()
-    }
+    const TYPE: &'static str = "template";
 
     async fn handle(
-        &self,
+        &mut self,
         command: Self::Command,
         _services: &Self::Services,
-    ) -> Result<Vec<Self::Event>, Self::Error> {
+        sink: &EventSink<Self>,
+    ) -> Result<(), Self::Error> {
         use TemplateCommand::*;
         use TemplateEvent::*;
 
         info!("Handling command: {:?}", command);
 
-        match command {
+        let events: Vec<Self::Event> = match command {
             CreateNewTemplate {
                 template_id,
                 source_template_id,
@@ -556,7 +553,13 @@ impl Aggregate for Template {
                     modified_at,
                 }])
             }
+        }?;
+
+        for event in events {
+            sink.write(event, self).await;
         }
+
+        Ok(())
     }
 
     fn apply(&mut self, event: Self::Event) {
diff --git a/agent_shared/Cargo.toml b/agent_shared/Cargo.toml
index 6c832fdc..fccba331 100644
--- a/agent_shared/Cargo.toml
+++ b/agent_shared/Cargo.toml
@@ -7,6 +7,8 @@ publish.workspace = true
 
 [dependencies]
 agent_macros = { path = "../agent_macros" }
+shared-kernel.workspace = true
+
 async-trait.workspace = true
 base64.workspace = true
 chrono.workspace = true
diff --git a/agent_shared/src/handlers.rs b/agent_shared/src/handlers.rs
index dd1636fa..93c345ae 100644
--- a/agent_shared/src/handlers.rs
+++ b/agent_shared/src/handlers.rs
@@ -1,7 +1,5 @@
-use cqrs_es::{
-    persist::{PersistenceError, ViewRepository},
-    Aggregate, AggregateError, View,
-};
+use cqrs_es::{persist::PersistenceError, Aggregate, AggregateError, View};
+use shared_kernel::view_repository::DynViewRepository;
 use std::{collections::HashMap, sync::Arc};
 use time::format_description::well_known::Rfc3339;
 use tracing::{debug, error, info};
@@ -11,7 +9,7 @@ use crate::application_state::CommandHandler;
 /// The `query_handler` function is used to query the view repository for a specific view.
 pub async fn query_handler<A, V>(
     view_id: &str,
-    state: &Arc<dyn ViewRepository<V, A>>,
+    state: &Arc<dyn DynViewRepository<V, A>>,
 ) -> Result<Option<V>, PersistenceError>
 where
     A: Aggregate,
diff --git a/agent_store/Cargo.toml b/agent_store/Cargo.toml
index f5fc0b90..1de2d7c3 100644
--- a/agent_store/Cargo.toml
+++ b/agent_store/Cargo.toml
@@ -13,11 +13,12 @@ agent_issuance = { path = "../agent_issuance" }
 agent_library = { path = "../agent_library" }
 agent_shared = { path = "../agent_shared" }
 agent_verification = { path = "../agent_verification" }
+shared-kernel.workspace = true
 
 async-trait.workspace = true
 cqrs-es.workspace = true
-mongo-es = "0.3"
-postgres-es = "0.4.12"
+mongo-es.workspace = true
+postgres-es = "0.5.0"
 serde_json.workspace = true
 sqlx = { version = "0.8", features = [
     "postgres",
diff --git a/agent_store/src/in_memory.rs b/agent_store/src/in_memory.rs
index 3b90f135..231f673b 100644
--- a/agent_store/src/in_memory.rs
+++ b/agent_store/src/in_memory.rs
@@ -1,11 +1,11 @@
 use crate::{AggregateHandler, CqrsComponentBuilder};
 use agent_shared::application_state::Command;
-use async_trait::async_trait;
 use cqrs_es::{
     mem_store::MemStore,
     persist::{PersistenceError, ViewContext, ViewRepository},
     Aggregate, CqrsFramework, Query, View,
 };
+use shared_kernel::view_repository::DynViewRepository;
 use std::{collections::HashMap, sync::Arc};
 use tokio::sync::Mutex;
 
@@ -15,7 +15,6 @@ struct MemRepository<V: View<A>, A: Aggregate> {
     _phantom: std::marker::PhantomData<(V, A)>,
 }
 
-#[async_trait]
 impl<V, A> ViewRepository<V, A> for MemRepository<V, A>
 where
     V: View<A>,
@@ -66,13 +65,13 @@ impl CqrsComponentBuilder for InMemory {
         event_publishers: Vec<Box<dyn Query<A>>>,
     ) -> (
         Arc<dyn Command<A> + Send + Sync>,
-        Arc<dyn ViewRepository<V, A>>,
-        Arc<dyn ViewRepository<AV, A>>,
+        Arc<dyn DynViewRepository<V, A>>,
+        Arc<dyn DynViewRepository<AV, A>>,
     )
     where
         <A as Aggregate>::Command: Send + Sync,
     {
-        let all_aggregates_name = format!("all_{}s", A::aggregate_type());
+        let all_aggregates_name = format!("all_{}s", A::TYPE);
 
         // Initialize the in-memory repositories.
         let aggregate: Arc<MemRepository<V, A>> = Arc::new(MemRepository::default());
diff --git a/agent_store/src/lib.rs b/agent_store/src/lib.rs
index f6dbd35c..e47649dd 100644
--- a/agent_store/src/lib.rs
+++ b/agent_store/src/lib.rs
@@ -59,6 +59,7 @@ use agent_verification::state::VerificationState;
 use async_trait::async_trait;
 use cqrs_es::persist::ViewRepository;
 use cqrs_es::{Aggregate, CqrsFramework, EventStore, Query, View};
+use shared_kernel::view_repository::DynViewRepository;
 use std::collections::HashMap;
 use std::sync::Arc;
 
@@ -156,8 +157,8 @@ where
 /// and the all-instances view repository.
 pub type CqrsComponents<A, V, AV> = (
     Arc<dyn Command<A> + Send + Sync>,
-    Arc<dyn ViewRepository<V, A>>,
-    Arc<dyn ViewRepository<AV, A>>,
+    Arc<dyn DynViewRepository<V, A>>,
+    Arc<dyn DynViewRepository<AV, A>>,
 );
 
 /// A trait for building the command and query infrastructure for a given aggregate.
diff --git a/agent_store/src/mongodb.rs b/agent_store/src/mongodb.rs
index a713ea08..9af4aa8c 100644
--- a/agent_store/src/mongodb.rs
+++ b/agent_store/src/mongodb.rs
@@ -1,8 +1,9 @@
 use crate::{AggregateHandler, CqrsComponentBuilder};
 use agent_shared::{application_state::Command, config::config};
 use cqrs_es::{persist::PersistedEventStore, CqrsFramework};
-use cqrs_es::{persist::ViewRepository, Aggregate, Query, View};
+use cqrs_es::{Aggregate, Query, View};
 use mongo_es::{default_mongo_client, Client, MongoEventRepository, MongoViewRepository};
+use shared_kernel::view_repository::DynViewRepository;
 use std::sync::Arc;
 
 impl<A> AggregateHandler<A, PersistedEventStore<MongoEventRepository, A>>
@@ -42,17 +43,17 @@ impl CqrsComponentBuilder for MongoDB {
         event_publishers: Vec<Box<dyn Query<A>>>,
     ) -> (
         Arc<dyn Command<A> + Send + Sync>,
-        Arc<dyn ViewRepository<V, A>>,
-        Arc<dyn ViewRepository<AV, A>>,
+        Arc<dyn DynViewRepository<V, A>>,
+        Arc<dyn DynViewRepository<AV, A>>,
     )
     where
         <A as Aggregate>::Command: Send + Sync,
     {
-        let all_aggregates_name = format!("all_{}s", A::aggregate_type());
+        let all_aggregates_name = format!("all_{}s", A::TYPE);
 
         // Initialize the MongoDB repositories.
         let aggregate: Arc<MongoViewRepository<V, A>> =
-            Arc::new(MongoViewRepository::new(&A::aggregate_type(), self.client.clone()));
+            Arc::new(MongoViewRepository::new(A::TYPE, self.client.clone()));
         let all_aggregates: Arc<MongoViewRepository<AV, A>> =
             Arc::new(MongoViewRepository::new(&all_aggregates_name, self.client.clone()));
 
diff --git a/agent_store/src/postgres.rs b/agent_store/src/postgres.rs
index 1ec152c5..2e6e5bd3 100644
--- a/agent_store/src/postgres.rs
+++ b/agent_store/src/postgres.rs
@@ -1,8 +1,9 @@
 use crate::{AggregateHandler, CqrsComponentBuilder};
 use agent_shared::{application_state::Command, config::config};
 use cqrs_es::persist::PersistedEventStore;
-use cqrs_es::{persist::ViewRepository, Aggregate, Query, View};
+use cqrs_es::{Aggregate, Query, View};
 use postgres_es::{default_postgress_pool, PostgresEventRepository, PostgresViewRepository};
+use shared_kernel::view_repository::DynViewRepository;
 use sqlx::Pool;
 use std::sync::Arc;
 
@@ -39,19 +40,17 @@ impl CqrsComponentBuilder for Postgres {
         event_publishers: Vec<Box<dyn Query<A>>>,
     ) -> (
         Arc<dyn Command<A> + Send + Sync>,
-        Arc<dyn ViewRepository<V, A>>,
-        Arc<dyn ViewRepository<AV, A>>,
+        Arc<dyn DynViewRepository<V, A>>,
+        Arc<dyn DynViewRepository<AV, A>>,
     )
     where
         <A as Aggregate>::Command: Send + Sync,
     {
-        let all_aggregates_name = format!("all_{}s", A::aggregate_type());
+        let all_aggregates_name = format!("all_{}s", A::TYPE);
 
         // Initialize the postgres repositories.
-        let aggregate: Arc<PostgresViewRepository<V, A>> = Arc::new(PostgresViewRepository::<V, A>::new(
-            &A::aggregate_type(),
-            self.pool.clone(),
-        ));
+        let aggregate: Arc<PostgresViewRepository<V, A>> =
+            Arc::new(PostgresViewRepository::<V, A>::new(A::TYPE, self.pool.clone()));
         let all_aggregates: Arc<PostgresViewRepository<AV, A>> = Arc::new(PostgresViewRepository::<AV, A>::new(
             &all_aggregates_name,
             self.pool.clone(),
diff --git a/agent_verification/Cargo.toml b/agent_verification/Cargo.toml
index 1eeb6c36..6b843f7e 100644
--- a/agent_verification/Cargo.toml
+++ b/agent_verification/Cargo.toml
@@ -8,6 +8,7 @@ publish.workspace = true
 [dependencies]
 agent_secret_manager = { path = "../agent_secret_manager" }
 agent_shared = { path = "../agent_shared" }
+shared-kernel.workspace = true
 
 anyhow.workspace = true
 async-trait.workspace = true
diff --git a/agent_verification/src/authorization_request/aggregate.rs b/agent_verification/src/authorization_request/aggregate.rs
index 84bbf418..68be3f8e 100644
--- a/agent_verification/src/authorization_request/aggregate.rs
+++ b/agent_verification/src/authorization_request/aggregate.rs
@@ -7,8 +7,7 @@ use crate::{
     services::VerificationServices,
 };
 use agent_shared::config::{config, get_preferred_signing_algorithm};
-use async_trait::async_trait;
-use cqrs_es::Aggregate;
+use cqrs_es::{event_sink::EventSink, Aggregate};
 use oid4vc_core::{authorization_request::ByReference, scope::Scope, verifier::SignatureVerifier};
 use oid4vc_core::{client_metadata::ClientMetadataResource, Subject as _};
 use oid4vp::token::vp_token_validator::VpTokenValidator;
@@ -29,25 +28,27 @@ pub struct AuthorizationRequest {
     pub validated: bool,
 }
 
-#[async_trait]
 impl Aggregate for AuthorizationRequest {
     type Command = AuthorizationRequestCommand;
     type Event = AuthorizationRequestEvent;
     type Error = AuthorizationRequestError;
     type Services = Arc<VerificationServices>;
 
-    fn aggregate_type() -> String {
-        "authorization_request".to_string()
-    }
+    const TYPE: &'static str = "authorization_request";
 
-    async fn handle(&self, command: Self::Command, services: &Self::Services) -> Result<Vec<Self::Event>, Self::Error> {
+    async fn handle(
+        &mut self,
+        command: Self::Command,
+        services: &Self::Services,
+        sink: &EventSink<Self>,
+    ) -> Result<(), Self::Error> {
         use AuthorizationRequestCommand::*;
         use AuthorizationRequestError::*;
         use AuthorizationRequestEvent::*;
 
         info!("Handling command: {:?}", command);
 
-        match command {
+        let events: Vec<Self::Event> = match command {
             CreateAuthorizationRequest {
                 state,
                 nonce,
@@ -241,7 +242,13 @@ impl Aggregate for AuthorizationRequest {
                     }
                 }
             }
+        }?;
+
+        for event in events {
+            sink.write(event, self).await;
         }
+
+        Ok(())
     }
 
     fn apply(&mut self, event: Self::Event) {
diff --git a/agent_verification/src/state.rs b/agent_verification/src/state.rs
index 09ed29be..2662c680 100644
--- a/agent_verification/src/state.rs
+++ b/agent_verification/src/state.rs
@@ -1,5 +1,5 @@
 use agent_shared::application_state::CommandHandler;
-use cqrs_es::persist::ViewRepository;
+use shared_kernel::view_repository::DynViewRepository;
 use std::sync::Arc;
 
 use crate::authorization_request::aggregate::AuthorizationRequest;
@@ -21,14 +21,14 @@ pub struct CommandHandlers {
 /// that any type of repository that implements the `ViewRepository` trait can be used, but the corresponding `View` and
 /// `Aggregate` types must be the same.
 type Queries = ViewRepositories<
-    dyn ViewRepository<AuthorizationRequestView, AuthorizationRequest>,
-    dyn ViewRepository<AllAuthorizationRequestsView, AuthorizationRequest>,
+    dyn DynViewRepository<AuthorizationRequestView, AuthorizationRequest>,
+    dyn DynViewRepository<AllAuthorizationRequestsView, AuthorizationRequest>,
 >;
 
 pub struct ViewRepositories<AR1, AR2>
 where
-    AR1: ViewRepository<AuthorizationRequestView, AuthorizationRequest> + ?Sized,
-    AR2: ViewRepository<AllAuthorizationRequestsView, AuthorizationRequest> + ?Sized,
+    AR1: DynViewRepository<AuthorizationRequestView, AuthorizationRequest> + ?Sized,
+    AR2: DynViewRepository<AllAuthorizationRequestsView, AuthorizationRequest> + ?Sized,
 {
     pub authorization_request: Arc<AR1>,
     pub all_authorization_requests: Arc<AR2>,
diff --git a/infrastructure/adapters/verification-authorization/Cargo.toml b/infrastructure/adapters/verification-authorization/Cargo.toml
index 7bd48450..c48bc501 100644
--- a/infrastructure/adapters/verification-authorization/Cargo.toml
+++ b/infrastructure/adapters/verification-authorization/Cargo.toml
@@ -9,11 +9,12 @@ publish.workspace = true
 agent_authorization = { path = "../../../agent_authorization" }
 agent_shared = { path = "../../../agent_shared" }
 agent_verification = { path = "../../../agent_verification" }
+shared-kernel.workspace = true
+
 anyhow.workspace = true
 async-trait.workspace = true
 oid4vp.workspace = true
 serde_json.workspace = true
-shared-kernel.workspace = true
 
 [lints]
 workspace = true
diff --git a/infrastructure/stores/mongodb/Cargo.toml b/infrastructure/stores/mongodb/Cargo.toml
index f4d8634f..fa70ed7b 100644
--- a/infrastructure/stores/mongodb/Cargo.toml
+++ b/infrastructure/stores/mongodb/Cargo.toml
@@ -8,7 +8,7 @@ publish.workspace = true
 [dependencies]
 shared-kernel.workspace = true
 
-mongo-es = "0.4.0"
+mongo-es.workspace = true
 thiserror.workspace = true
 
 [lints]

From 1c22ce174f3cf525e7065cb5471003729f6497aa Mon Sep 17 00:00:00 2001
From: Oran Dan <53859531+Oran-Dan@users.noreply.github.com>
Date: Thu, 2 Jul 2026 16:16:30 +0200
Subject: [PATCH 22/34] fix: enforce credential id and `jti` claim (#365)

BREAKING CHANGE: credential root ID's can no longer be provided via the `/v0/credentials`, any provided IDs will always be overwritten.
---
 .../issuance/credential_issuer/credential.rs  |  4 +-
 agent_api_http/src/v0/issuance/credentials.rs |  1 +
 agent_issuance/src/credential/aggregate.rs    | 53 +++++++++----------
 3 files changed, 28 insertions(+), 30 deletions(-)

diff --git a/agent_api_http/src/v0/issuance/credential_issuer/credential.rs b/agent_api_http/src/v0/issuance/credential_issuer/credential.rs
index 0bd4d474..959e2121 100644
--- a/agent_api_http/src/v0/issuance/credential_issuer/credential.rs
+++ b/agent_api_http/src/v0/issuance/credential_issuer/credential.rs
@@ -233,8 +233,8 @@ pub mod tests {
         Mock, MockServer, ResponseTemplate,
     };
 
-    const CREDENTIAL_JWT: &str = "eyJ0eXAiOiJKV1QiLCJhbGciOiJFZERTQSIsImtpZCI6ImRpZDprZXk6ejZNa2dFODROQ01wTWVBeDlqSzljZjVXNEc4Z2NaOXh1d0p2RzFlN3dOazhLQ2d0I3o2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCJ9.eyJpc3MiOiJkaWQ6a2V5Ono2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCIsInN1YiI6ImRpZDprZXk6ejZNa2lpZXlvTE1TVnNKQVp2N0pqZTV3V1NrREV5bVVna3lGOGtiY3JqWnBYM3FkIiwibmJmIjoxMjYyMzA0MDAwLCJpYXQiOjEyNjIzMDQwMDAsInZjIjp7ImNyZWRlbnRpYWxTdWJqZWN0Ijp7ImZpcnN0X25hbWUiOiJGZXJyaXMiLCJsYXN0X25hbWUiOiJSdXN0YWNlYW4iLCJpZCI6ImRpZDprZXk6ejZNa2lpZXlvTE1TVnNKQVp2N0pqZTV3V1NrREV5bVVna3lGOGtiY3JqWnBYM3FkIn0sInR5cGUiOlsiVmVyaWZpYWJsZUNyZWRlbnRpYWwiXSwibmFtZSI6IlZlcmlmaWFibGUgQ3JlZGVudGlhbCIsImlzc3VlciI6eyJuYW1lIjoiVW5pQ29yZSIsImlkIjoiZGlkOmtleTp6Nk1rZ0U4NE5DTXBNZUF4OWpLOWNmNVc0RzhnY1o5eHV3SnZHMWU3d05rOEtDZ3QifSwiQGNvbnRleHQiOlsiaHR0cHM6Ly93d3cudzMub3JnLzIwMTgvY3JlZGVudGlhbHMvdjEiXSwiaXNzdWFuY2VEYXRlIjoiMjAxMC0wMS0wMVQwMDowMDowMFoiLCJ2YWxpZEZyb20iOiIyMDEwLTAxLTAxVDAwOjAwOjAwWiIsImNyZWRlbnRpYWxTdGF0dXMiOnsidHlwZSI6InN0YXR1c2xpc3Qrand0IiwiaWQiOiJodHRwczovL215LWRvbWFpbi5leGFtcGxlLm9yZy9pZXRmLW9hdXRoLXRva2VuLXN0YXR1cy1saXN0LzAiLCJ1cmkiOiJodHRwczovL215LWRvbWFpbi5leGFtcGxlLm9yZy9pZXRmLW9hdXRoLXRva2VuLXN0YXR1cy1saXN0LzAiLCJpZHgiOjEyM319LCJzdGF0dXMiOnsic3RhdHVzX2xpc3QiOnsidXJpIjoiaHR0cHM6Ly9teS1kb21haW4uZXhhbXBsZS5vcmcvaWV0Zi1vYXV0aC10b2tlbi1zdGF0dXMtbGlzdC8wIiwiaWR4IjoxMjN9fX0.Osw5UpYXtsHoomEeeJ9qz6St5b4SmpBGZL8zFmvIsBfWW114BDuQQyVwUpfvZBRuG_oxlyd-uhSRJvmJbmM6DQ";
-    const ANONYMOUS_CREDENTIAL_JWT: &str = "eyJ0eXAiOiJKV1QiLCJhbGciOiJFZERTQSIsImtpZCI6ImRpZDprZXk6ejZNa2dFODROQ01wTWVBeDlqSzljZjVXNEc4Z2NaOXh1d0p2RzFlN3dOazhLQ2d0I3o2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCJ9.eyJpc3MiOiJkaWQ6a2V5Ono2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCIsIm5iZiI6MTI2MjMwNDAwMCwiaWF0IjoxMjYyMzA0MDAwLCJ2YyI6eyJjcmVkZW50aWFsU3ViamVjdCI6eyJmaXJzdF9uYW1lIjoiRmVycmlzIiwibGFzdF9uYW1lIjoiUnVzdGFjZWFuIn0sInR5cGUiOlsiVmVyaWZpYWJsZUNyZWRlbnRpYWwiXSwibmFtZSI6IlZlcmlmaWFibGUgQ3JlZGVudGlhbCIsImlzc3VlciI6eyJuYW1lIjoiVW5pQ29yZSIsImlkIjoiZGlkOmtleTp6Nk1rZ0U4NE5DTXBNZUF4OWpLOWNmNVc0RzhnY1o5eHV3SnZHMWU3d05rOEtDZ3QifSwiQGNvbnRleHQiOlsiaHR0cHM6Ly93d3cudzMub3JnLzIwMTgvY3JlZGVudGlhbHMvdjEiXSwiaXNzdWFuY2VEYXRlIjoiMjAxMC0wMS0wMVQwMDowMDowMFoiLCJ2YWxpZEZyb20iOiIyMDEwLTAxLTAxVDAwOjAwOjAwWiIsImNyZWRlbnRpYWxTdGF0dXMiOnsidHlwZSI6InN0YXR1c2xpc3Qrand0IiwiaWQiOiJodHRwczovL215LWRvbWFpbi5leGFtcGxlLm9yZy9pZXRmLW9hdXRoLXRva2VuLXN0YXR1cy1saXN0LzAiLCJ1cmkiOiJodHRwczovL215LWRvbWFpbi5leGFtcGxlLm9yZy9pZXRmLW9hdXRoLXRva2VuLXN0YXR1cy1saXN0LzAiLCJpZHgiOjEyM319LCJzdGF0dXMiOnsic3RhdHVzX2xpc3QiOnsidXJpIjoiaHR0cHM6Ly9teS1kb21haW4uZXhhbXBsZS5vcmcvaWV0Zi1vYXV0aC10b2tlbi1zdGF0dXMtbGlzdC8wIiwiaWR4IjoxMjN9fX0.WpEgTuLz4ql25ohV4bcUU_qkopcS9PK4x3AieDJR0e_9zVNmjYrts_NFH_6GvoyfgFjvO4_IrOzIxmqRfdn0DA";
+    const CREDENTIAL_JWT: &str = "eyJ0eXAiOiJKV1QiLCJhbGciOiJFZERTQSIsImtpZCI6ImRpZDprZXk6ejZNa2dFODROQ01wTWVBeDlqSzljZjVXNEc4Z2NaOXh1d0p2RzFlN3dOazhLQ2d0I3o2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCJ9.eyJpc3MiOiJkaWQ6a2V5Ono2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCIsInN1YiI6ImRpZDprZXk6ejZNa2lpZXlvTE1TVnNKQVp2N0pqZTV3V1NrREV5bVVna3lGOGtiY3JqWnBYM3FkIiwibmJmIjoxMjYyMzA0MDAwLCJpYXQiOjEyNjIzMDQwMDAsImp0aSI6InVybjp1dWlkOjEyM2U0NTY3LWU4OWItMTJkMy1hNDU2LTQyNjYxNDE3NDAwMCIsInZjIjp7ImNyZWRlbnRpYWxTdWJqZWN0Ijp7ImZpcnN0X25hbWUiOiJGZXJyaXMiLCJsYXN0X25hbWUiOiJSdXN0YWNlYW4iLCJpZCI6ImRpZDprZXk6ejZNa2lpZXlvTE1TVnNKQVp2N0pqZTV3V1NrREV5bVVna3lGOGtiY3JqWnBYM3FkIn0sInR5cGUiOlsiVmVyaWZpYWJsZUNyZWRlbnRpYWwiXSwiaWQiOiJ1cm46dXVpZDoxMjNlNDU2Ny1lODliLTEyZDMtYTQ1Ni00MjY2MTQxNzQwMDAiLCJuYW1lIjoiVmVyaWZpYWJsZSBDcmVkZW50aWFsIiwiaXNzdWVyIjp7Im5hbWUiOiJVbmlDb3JlIiwiaWQiOiJkaWQ6a2V5Ono2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCJ9LCJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvMjAxOC9jcmVkZW50aWFscy92MSJdLCJpc3N1YW5jZURhdGUiOiIyMDEwLTAxLTAxVDAwOjAwOjAwWiIsInZhbGlkRnJvbSI6IjIwMTAtMDEtMDFUMDA6MDA6MDBaIiwiY3JlZGVudGlhbFN0YXR1cyI6eyJ0eXBlIjoic3RhdHVzbGlzdCtqd3QiLCJpZCI6Imh0dHBzOi8vbXktZG9tYWluLmV4YW1wbGUub3JnL2lldGYtb2F1dGgtdG9rZW4tc3RhdHVzLWxpc3QvMCIsInVyaSI6Imh0dHBzOi8vbXktZG9tYWluLmV4YW1wbGUub3JnL2lldGYtb2F1dGgtdG9rZW4tc3RhdHVzLWxpc3QvMCIsImlkeCI6MTIzfX0sInN0YXR1cyI6eyJzdGF0dXNfbGlzdCI6eyJ1cmkiOiJodHRwczovL215LWRvbWFpbi5leGFtcGxlLm9yZy9pZXRmLW9hdXRoLXRva2VuLXN0YXR1cy1saXN0LzAiLCJpZHgiOjEyM319fQ.NjctbzbfBef2Qsrb3LKCb24RXWAgPKBJk9--DIbuC6VkAV5xPtoXx0JyeKuBoxQgaakpanev_dB41lYrIFbABw";
+    const ANONYMOUS_CREDENTIAL_JWT: &str = "eyJ0eXAiOiJKV1QiLCJhbGciOiJFZERTQSIsImtpZCI6ImRpZDprZXk6ejZNa2dFODROQ01wTWVBeDlqSzljZjVXNEc4Z2NaOXh1d0p2RzFlN3dOazhLQ2d0I3o2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCJ9.eyJpc3MiOiJkaWQ6a2V5Ono2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCIsIm5iZiI6MTI2MjMwNDAwMCwiaWF0IjoxMjYyMzA0MDAwLCJqdGkiOiJ1cm46dXVpZDoxMjNlNDU2Ny1lODliLTEyZDMtYTQ1Ni00MjY2MTQxNzQwMDAiLCJ2YyI6eyJjcmVkZW50aWFsU3ViamVjdCI6eyJmaXJzdF9uYW1lIjoiRmVycmlzIiwibGFzdF9uYW1lIjoiUnVzdGFjZWFuIn0sInR5cGUiOlsiVmVyaWZpYWJsZUNyZWRlbnRpYWwiXSwiaWQiOiJ1cm46dXVpZDoxMjNlNDU2Ny1lODliLTEyZDMtYTQ1Ni00MjY2MTQxNzQwMDAiLCJuYW1lIjoiVmVyaWZpYWJsZSBDcmVkZW50aWFsIiwiaXNzdWVyIjp7Im5hbWUiOiJVbmlDb3JlIiwiaWQiOiJkaWQ6a2V5Ono2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCJ9LCJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvMjAxOC9jcmVkZW50aWFscy92MSJdLCJpc3N1YW5jZURhdGUiOiIyMDEwLTAxLTAxVDAwOjAwOjAwWiIsInZhbGlkRnJvbSI6IjIwMTAtMDEtMDFUMDA6MDA6MDBaIiwiY3JlZGVudGlhbFN0YXR1cyI6eyJ0eXBlIjoic3RhdHVzbGlzdCtqd3QiLCJpZCI6Imh0dHBzOi8vbXktZG9tYWluLmV4YW1wbGUub3JnL2lldGYtb2F1dGgtdG9rZW4tc3RhdHVzLWxpc3QvMCIsInVyaSI6Imh0dHBzOi8vbXktZG9tYWluLmV4YW1wbGUub3JnL2lldGYtb2F1dGgtdG9rZW4tc3RhdHVzLWxpc3QvMCIsImlkeCI6MTIzfX0sInN0YXR1cyI6eyJzdGF0dXNfbGlzdCI6eyJ1cmkiOiJodHRwczovL215LWRvbWFpbi5leGFtcGxlLm9yZy9pZXRmLW9hdXRoLXRva2VuLXN0YXR1cy1saXN0LzAiLCJpZHgiOjEyM319fQ.fpHN8vN4T6n2UcZI4f4u-j-ljSm8CnhfgGoyJoSrJFHiRV1k1ibai-6ulK8fAOCG2uhg2UeX0WT_vPLtvttdAQ";
     const DEFAULT_EXTERNAL_SERVER_RESPONSE_TIMEOUT_MS: u64 = 1000;
     pub const TEST_NONCE: &str = "7e03ad3f76cb3338c3a5642fe7634476aa3ad93fa1d584011ba2150d9da47133";
 
diff --git a/agent_api_http/src/v0/issuance/credentials.rs b/agent_api_http/src/v0/issuance/credentials.rs
index 2de1a385..d72ff846 100644
--- a/agent_api_http/src/v0/issuance/credentials.rs
+++ b/agent_api_http/src/v0/issuance/credentials.rs
@@ -620,6 +620,7 @@ pub mod tests {
         // This test credential is tested after creation but before signing, therefore it misses a few last fields which are set during signing.
         // Please look at the comments in agent_issuance/src/credential/aggregate.rs `SignCredential` for more information.
         pub static ref VC_DM_1_1_CREDENTIAL: serde_json::Value = json!({
+            "id": "urn:uuid:123e4567-e89b-12d3-a456-426614174000",
             "@context": [ "https://www.w3.org/2018/credentials/v1" ],
             "type": [ "VerifiableCredential" ],
             "name": "Verifiable Credential",
diff --git a/agent_issuance/src/credential/aggregate.rs b/agent_issuance/src/credential/aggregate.rs
index 48c95d1c..832bb038 100644
--- a/agent_issuance/src/credential/aggregate.rs
+++ b/agent_issuance/src/credential/aggregate.rs
@@ -687,7 +687,7 @@ fn build_signed_w3c_credential_data(
 /// This function sets the following fields if applicable for the specific Credential Data Model:
 /// - `@context`, if not already set
 /// - `name`, if not already set
-/// - `id`, if not already set, and for OBv3/ELM set to urn based on the aggregate credential_id
+/// - `id`, set to the aggregate credential_id as a URN. This means it's non-configurable by API users. Main reason for this is our reliance on the credential id to be equal to the aggregate id for the public link flow.
 /// - `issuer.name`, reflecting the UniCore configuration
 /// - `credentialStatus`, if not already set, according to the IETF OAuth Token Status List specification in combination with the DIIP profile.
 /// - `expirationDate`, if expires_at is provided
@@ -699,6 +699,21 @@ fn build_unsigned_w3c_credential_data(
     credential_id: &str,
     expires_at: Option<chrono::DateTime<chrono::Utc>>,
 ) -> Result<serde_json::Value, CredentialError> {
+    // Set to the aggregate credential_id as a URN, because this needs to be a valid URL by spec. This means it's non-configurable by API users. Main reason for this is our reliance on the credential id to be equal to the aggregate id for the public link flow.
+
+    #[allow(unused_variables)]
+    // Allow because this simply is a bug on how the test_utils is interpreted by the compiler.
+    let root_id = uuid::Uuid::parse_str(credential_id)
+        .map_err(|e| BuildCredentialError(format!("Failed to parse credential_id as UUID: {}", e)))?;
+    #[cfg(feature = "test_utils")]
+    let root_id = uuid::Uuid::parse_str(test_utils::CREDENTIAL_ID).expect("Static test UUID should always parse");
+
+    credential_data
+        .insert_at_path(&["id"], json!(root_id.urn()))
+        .ok_or(BuildCredentialError(
+            "Failed to enter the id into the credential".to_string(),
+        ))?;
+
     let credential_name = credential_configuration
         .credential_metadata
         .as_ref()
@@ -790,19 +805,6 @@ fn build_unsigned_w3c_credential_data(
                         "Failed to enter the @context into the credential".to_string(),
                     ))?;
 
-                // If no root id is provided, convert the aggregate credential_id to an urn as sensible default.
-                let root_id = uuid::Uuid::parse_str(credential_id).map_err(|e| {
-                    BuildCredentialError(format!(
-                        "Failed to parse credential_id `{credential_id}` as UUID: {}",
-                        e
-                    ))
-                })?;
-                credential_data
-                    .insert_if_none(&["id"], json!(root_id.urn()))
-                    .ok_or(BuildCredentialError(
-                        "Failed to enter the id into the credential".to_string(),
-                    ))?;
-
                 credential_data
                     .insert_at_path(&["issuer", "type"], json!("Profile"))
                     .ok_or(BuildCredentialError(
@@ -845,15 +847,6 @@ fn build_unsigned_w3c_credential_data(
                         "Failed to enter the @context into the credential".to_string(),
                     ))?;
 
-                // If no root id is provided, convert the aggregate credential_id to an urn as sensible default.
-                let root_id = uuid::Uuid::parse_str(credential_id)
-                    .map_err(|e| BuildCredentialError(format!("Failed to parse credential_id as UUID: {}", e)))?;
-                credential_data
-                    .insert_if_none(&["id"], json!(root_id.urn()))
-                    .ok_or(BuildCredentialError(
-                        "Failed to enter the id into the credential".to_string(),
-                    ))?;
-
                 // No fields in credentialProfiles are actually required by the ELM schema.
                 // Since we do not fully understand the use of this property yet, we enter an empty object.
                 credential_data
@@ -1159,6 +1152,8 @@ pub mod test_utils {
     use serde_json::json;
     use std::collections::HashMap;
 
+    pub const CREDENTIAL_ID: &str = "123e4567-e89b-12d3-a456-426614174000";
+
     #[fixture]
     pub fn notification_id() -> String {
         "notification_id".to_string()
@@ -1172,11 +1167,11 @@ pub mod test_utils {
     // Test ID must still be parsable to a valid urn UUID.
     #[fixture]
     pub fn credential_id() -> String {
-        "123e4567-e89b-12d3-a456-426614174000".to_string()
+        CREDENTIAL_ID.to_string()
     }
 
-    pub const JWT_VC_JSON_VC1_1_JWT: &str = "eyJ0eXAiOiJKV1QiLCJhbGciOiJFZERTQSIsImtpZCI6ImRpZDprZXk6ejZNa2dFODROQ01wTWVBeDlqSzljZjVXNEc4Z2NaOXh1d0p2RzFlN3dOazhLQ2d0I3o2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCJ9.eyJpc3MiOiJkaWQ6a2V5Ono2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCIsInN1YiI6ImRpZDprZXk6ejZNa2dFODROQ01wTWVBeDlqSzljZjVXNEc4Z2NaOXh1d0p2RzFlN3dOazhLQ2d0IiwibmJmIjoxMjYyMzA0MDAwLCJpYXQiOjEyNjIzMDQwMDAsInZjIjp7IkBjb250ZXh0IjpbImh0dHBzOi8vd3d3LnczLm9yZy8yMDE4L2NyZWRlbnRpYWxzL3YxIl0sInR5cGUiOlsiVmVyaWZpYWJsZUNyZWRlbnRpYWwiXSwiY3JlZGVudGlhbFN1YmplY3QiOnsiZmlyc3RfbmFtZSI6IkZlcnJpcyIsImxhc3RfbmFtZSI6IlJ1c3RhY2VhbiIsImlkIjoiZGlkOmtleTp6Nk1rZ0U4NE5DTXBNZUF4OWpLOWNmNVc0RzhnY1o5eHV3SnZHMWU3d05rOEtDZ3QifSwiaXNzdWVyIjp7Im5hbWUiOiJVbmlDb3JlIiwiaWQiOiJkaWQ6a2V5Ono2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCJ9LCJuYW1lIjoiVmVyaWZpYWJsZSBDcmVkZW50aWFsIiwiaXNzdWFuY2VEYXRlIjoiMjAxMC0wMS0wMVQwMDowMDowMFoiLCJ2YWxpZEZyb20iOiIyMDEwLTAxLTAxVDAwOjAwOjAwWiIsImNyZWRlbnRpYWxTdGF0dXMiOnsidHlwZSI6InN0YXR1c2xpc3Qrand0IiwiaWQiOiJodHRwczovL215LWRvbWFpbi5leGFtcGxlLm9yZy9pZXRmLW9hdXRoLXRva2VuLXN0YXR1cy1saXN0LzAiLCJ1cmkiOiJodHRwczovL215LWRvbWFpbi5leGFtcGxlLm9yZy9pZXRmLW9hdXRoLXRva2VuLXN0YXR1cy1saXN0LzAiLCJpZHgiOjEyM319LCJzdGF0dXMiOnsic3RhdHVzX2xpc3QiOnsidXJpIjoiaHR0cHM6Ly9teS1kb21haW4uZXhhbXBsZS5vcmcvaWV0Zi1vYXV0aC10b2tlbi1zdGF0dXMtbGlzdC8wIiwiaWR4IjoxMjN9fX0.BJ9w-_EUtWzeNwAZO3_LIWK21aBP1AjYk8KM7owxARrX27M299-T8oCkUYBm6P6V6_t-ek5LtLcAkbhOysucAg";
-    pub const JWT_VC_JSON_OBV3_JWT: &str = "eyJ0eXAiOiJKV1QiLCJhbGciOiJFZERTQSIsImtpZCI6ImRpZDprZXk6ejZNa2dFODROQ01wTWVBeDlqSzljZjVXNEc4Z2NaOXh1d0p2RzFlN3dOazhLQ2d0I3o2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCJ9.eyJpc3MiOiJkaWQ6a2V5Ono2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCIsInN1YiI6ImRpZDprZXk6ejZNa2dFODROQ01wTWVBeDlqSzljZjVXNEc4Z2NaOXh1d0p2RzFlN3dOazhLQ2d0IiwibmJmIjoxMjYyMzA0MDAwLCJpYXQiOjEyNjIzMDQwMDAsImp0aSI6Imh0dHBzOi8vZXhhbXBsZS5jb20vY3JlZGVudGlhbHMvMzUyNyIsInZjIjp7IkBjb250ZXh0IjpbImh0dHBzOi8vd3d3LnczLm9yZy9ucy9jcmVkZW50aWFscy92MiIsImh0dHBzOi8vcHVybC5pbXNnbG9iYWwub3JnL3NwZWMvb2IvdjNwMC9jb250ZXh0LTMuMC4zLmpzb24iXSwiaWQiOiJodHRwczovL2V4YW1wbGUuY29tL2NyZWRlbnRpYWxzLzM1MjciLCJ0eXBlIjpbIlZlcmlmaWFibGVDcmVkZW50aWFsIiwiT3BlbkJhZGdlQ3JlZGVudGlhbCJdLCJpc3N1ZXIiOnsidHlwZSI6IlByb2ZpbGUiLCJuYW1lIjoiVW5pQ29yZSIsImlkIjoiZGlkOmtleTp6Nk1rZ0U4NE5DTXBNZUF4OWpLOWNmNVc0RzhnY1o5eHV3SnZHMWU3d05rOEtDZ3QifSwibmFtZSI6IlRlYW13b3JrIEJhZGdlIiwiY3JlZGVudGlhbFN1YmplY3QiOnsidHlwZSI6WyJBY2hpZXZlbWVudFN1YmplY3QiXSwiYWNoaWV2ZW1lbnQiOnsiaWQiOiJodHRwczovL2V4YW1wbGUuY29tL2FjaGlldmVtZW50cy8yMXN0LWNlbnR1cnktc2tpbGxzL3RlYW13b3JrIiwidHlwZSI6IkFjaGlldmVtZW50IiwiY3JpdGVyaWEiOnsibmFycmF0aXZlIjoiVGVhbSBtZW1iZXJzIGFyZSBub21pbmF0ZWQgZm9yIHRoaXMgYmFkZ2UgYnkgdGhlaXIgcGVlcnMgYW5kIHJlY29nbml6ZWQgdXBvbiByZXZpZXcgYnkgRXhhbXBsZSBDb3JwIG1hbmFnZW1lbnQuIn0sImRlc2NyaXB0aW9uIjoiVGhpcyBiYWRnZSByZWNvZ25pemVzIHRoZSBkZXZlbG9wbWVudCBvZiB0aGUgY2FwYWNpdHkgdG8gY29sbGFib3JhdGUgd2l0aGluIGEgZ3JvdXAgZW52aXJvbm1lbnQuIiwibmFtZSI6IlRlYW13b3JrIn0sImlkIjoiZGlkOmtleTp6Nk1rZ0U4NE5DTXBNZUF4OWpLOWNmNVc0RzhnY1o5eHV3SnZHMWU3d05rOEtDZ3QifSwiaXNzdWFuY2VEYXRlIjoiMjAxMC0wMS0wMVQwMDowMDowMFoiLCJ2YWxpZEZyb20iOiIyMDEwLTAxLTAxVDAwOjAwOjAwWiIsImNyZWRlbnRpYWxTdGF0dXMiOnsidHlwZSI6InN0YXR1c2xpc3Qrand0IiwiaWQiOiJodHRwczovL215LWRvbWFpbi5leGFtcGxlLm9yZy9pZXRmLW9hdXRoLXRva2VuLXN0YXR1cy1saXN0LzAiLCJ1cmkiOiJodHRwczovL215LWRvbWFpbi5leGFtcGxlLm9yZy9pZXRmLW9hdXRoLXRva2VuLXN0YXR1cy1saXN0LzAiLCJpZHgiOjEyM319LCJzdGF0dXMiOnsic3RhdHVzX2xpc3QiOnsidXJpIjoiaHR0cHM6Ly9teS1kb21haW4uZXhhbXBsZS5vcmcvaWV0Zi1vYXV0aC10b2tlbi1zdGF0dXMtbGlzdC8wIiwiaWR4IjoxMjN9fX0.hFbTGNUCIn_qDd4N3ZlREyLXIvWr8DJyMD998sayz0DbacGmAQ5XUl0ub07U96lOzfk5yDQS5qj3Xer_HI8YAw";
+    pub const JWT_VC_JSON_VC1_1_JWT: &str = "eyJ0eXAiOiJKV1QiLCJhbGciOiJFZERTQSIsImtpZCI6ImRpZDprZXk6ejZNa2dFODROQ01wTWVBeDlqSzljZjVXNEc4Z2NaOXh1d0p2RzFlN3dOazhLQ2d0I3o2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCJ9.eyJpc3MiOiJkaWQ6a2V5Ono2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCIsInN1YiI6ImRpZDprZXk6ejZNa2dFODROQ01wTWVBeDlqSzljZjVXNEc4Z2NaOXh1d0p2RzFlN3dOazhLQ2d0IiwibmJmIjoxMjYyMzA0MDAwLCJpYXQiOjEyNjIzMDQwMDAsImp0aSI6InVybjp1dWlkOjEyM2U0NTY3LWU4OWItMTJkMy1hNDU2LTQyNjYxNDE3NDAwMCIsInZjIjp7IkBjb250ZXh0IjpbImh0dHBzOi8vd3d3LnczLm9yZy8yMDE4L2NyZWRlbnRpYWxzL3YxIl0sImlkIjoidXJuOnV1aWQ6MTIzZTQ1NjctZTg5Yi0xMmQzLWE0NTYtNDI2NjE0MTc0MDAwIiwidHlwZSI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCJdLCJjcmVkZW50aWFsU3ViamVjdCI6eyJmaXJzdF9uYW1lIjoiRmVycmlzIiwibGFzdF9uYW1lIjoiUnVzdGFjZWFuIiwiaWQiOiJkaWQ6a2V5Ono2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCJ9LCJpc3N1ZXIiOnsibmFtZSI6IlVuaUNvcmUiLCJpZCI6ImRpZDprZXk6ejZNa2dFODROQ01wTWVBeDlqSzljZjVXNEc4Z2NaOXh1d0p2RzFlN3dOazhLQ2d0In0sIm5hbWUiOiJWZXJpZmlhYmxlIENyZWRlbnRpYWwiLCJpc3N1YW5jZURhdGUiOiIyMDEwLTAxLTAxVDAwOjAwOjAwWiIsInZhbGlkRnJvbSI6IjIwMTAtMDEtMDFUMDA6MDA6MDBaIiwiY3JlZGVudGlhbFN0YXR1cyI6eyJ0eXBlIjoic3RhdHVzbGlzdCtqd3QiLCJpZCI6Imh0dHBzOi8vbXktZG9tYWluLmV4YW1wbGUub3JnL2lldGYtb2F1dGgtdG9rZW4tc3RhdHVzLWxpc3QvMCIsInVyaSI6Imh0dHBzOi8vbXktZG9tYWluLmV4YW1wbGUub3JnL2lldGYtb2F1dGgtdG9rZW4tc3RhdHVzLWxpc3QvMCIsImlkeCI6MTIzfX0sInN0YXR1cyI6eyJzdGF0dXNfbGlzdCI6eyJ1cmkiOiJodHRwczovL215LWRvbWFpbi5leGFtcGxlLm9yZy9pZXRmLW9hdXRoLXRva2VuLXN0YXR1cy1saXN0LzAiLCJpZHgiOjEyM319fQ.RLSGdmQ8PBZQzXIcwrjZafmBmo2gDf0UEIUfARSY6J1xkIcIjCVnEZU7Xs2HQUIZz_-_4VO0UZFRvDClN5ZJAQ";
+    pub const JWT_VC_JSON_OBV3_JWT: &str = "eyJ0eXAiOiJKV1QiLCJhbGciOiJFZERTQSIsImtpZCI6ImRpZDprZXk6ejZNa2dFODROQ01wTWVBeDlqSzljZjVXNEc4Z2NaOXh1d0p2RzFlN3dOazhLQ2d0I3o2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCJ9.eyJpc3MiOiJkaWQ6a2V5Ono2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCIsInN1YiI6ImRpZDprZXk6ejZNa2dFODROQ01wTWVBeDlqSzljZjVXNEc4Z2NaOXh1d0p2RzFlN3dOazhLQ2d0IiwibmJmIjoxMjYyMzA0MDAwLCJpYXQiOjEyNjIzMDQwMDAsImp0aSI6InVybjp1dWlkOjEyM2U0NTY3LWU4OWItMTJkMy1hNDU2LTQyNjYxNDE3NDAwMCIsInZjIjp7IkBjb250ZXh0IjpbImh0dHBzOi8vd3d3LnczLm9yZy9ucy9jcmVkZW50aWFscy92MiIsImh0dHBzOi8vcHVybC5pbXNnbG9iYWwub3JnL3NwZWMvb2IvdjNwMC9jb250ZXh0LTMuMC4zLmpzb24iXSwiaWQiOiJ1cm46dXVpZDoxMjNlNDU2Ny1lODliLTEyZDMtYTQ1Ni00MjY2MTQxNzQwMDAiLCJ0eXBlIjpbIlZlcmlmaWFibGVDcmVkZW50aWFsIiwiT3BlbkJhZGdlQ3JlZGVudGlhbCJdLCJpc3N1ZXIiOnsidHlwZSI6IlByb2ZpbGUiLCJuYW1lIjoiVW5pQ29yZSIsImlkIjoiZGlkOmtleTp6Nk1rZ0U4NE5DTXBNZUF4OWpLOWNmNVc0RzhnY1o5eHV3SnZHMWU3d05rOEtDZ3QifSwibmFtZSI6IlRlYW13b3JrIEJhZGdlIiwiY3JlZGVudGlhbFN1YmplY3QiOnsidHlwZSI6WyJBY2hpZXZlbWVudFN1YmplY3QiXSwiYWNoaWV2ZW1lbnQiOnsiaWQiOiJodHRwczovL2V4YW1wbGUuY29tL2FjaGlldmVtZW50cy8yMXN0LWNlbnR1cnktc2tpbGxzL3RlYW13b3JrIiwidHlwZSI6IkFjaGlldmVtZW50IiwiY3JpdGVyaWEiOnsibmFycmF0aXZlIjoiVGVhbSBtZW1iZXJzIGFyZSBub21pbmF0ZWQgZm9yIHRoaXMgYmFkZ2UgYnkgdGhlaXIgcGVlcnMgYW5kIHJlY29nbml6ZWQgdXBvbiByZXZpZXcgYnkgRXhhbXBsZSBDb3JwIG1hbmFnZW1lbnQuIn0sImRlc2NyaXB0aW9uIjoiVGhpcyBiYWRnZSByZWNvZ25pemVzIHRoZSBkZXZlbG9wbWVudCBvZiB0aGUgY2FwYWNpdHkgdG8gY29sbGFib3JhdGUgd2l0aGluIGEgZ3JvdXAgZW52aXJvbm1lbnQuIiwibmFtZSI6IlRlYW13b3JrIn0sImlkIjoiZGlkOmtleTp6Nk1rZ0U4NE5DTXBNZUF4OWpLOWNmNVc0RzhnY1o5eHV3SnZHMWU3d05rOEtDZ3QifSwiaXNzdWFuY2VEYXRlIjoiMjAxMC0wMS0wMVQwMDowMDowMFoiLCJ2YWxpZEZyb20iOiIyMDEwLTAxLTAxVDAwOjAwOjAwWiIsImNyZWRlbnRpYWxTdGF0dXMiOnsidHlwZSI6InN0YXR1c2xpc3Qrand0IiwiaWQiOiJodHRwczovL215LWRvbWFpbi5leGFtcGxlLm9yZy9pZXRmLW9hdXRoLXRva2VuLXN0YXR1cy1saXN0LzAiLCJ1cmkiOiJodHRwczovL215LWRvbWFpbi5leGFtcGxlLm9yZy9pZXRmLW9hdXRoLXRva2VuLXN0YXR1cy1saXN0LzAiLCJpZHgiOjEyM319LCJzdGF0dXMiOnsic3RhdHVzX2xpc3QiOnsidXJpIjoiaHR0cHM6Ly9teS1kb21haW4uZXhhbXBsZS5vcmcvaWV0Zi1vYXV0aC10b2tlbi1zdGF0dXMtbGlzdC8wIiwiaWR4IjoxMjN9fX0.oMaZSWsVZGcRyOZ-LalOuyUiQGmoo-Ur6dUfjOAMbAofW5ZISCyJaeLliQsacyxHEuEcxnD7v_QKrCRbeYL0DA";
     pub const JWT_VC_JSON_ELM_JWT: &str = "eyJ0eXAiOiJKV1QiLCJhbGciOiJFZERTQSIsImtpZCI6ImRpZDprZXk6ejZNa2dFODROQ01wTWVBeDlqSzljZjVXNEc4Z2NaOXh1d0p2RzFlN3dOazhLQ2d0I3o2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCJ9.eyJpc3MiOiJkaWQ6a2V5Ono2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCIsInN1YiI6ImRpZDprZXk6ejZNa2dFODROQ01wTWVBeDlqSzljZjVXNEc4Z2NaOXh1d0p2RzFlN3dOazhLQ2d0IiwibmJmIjoxMjYyMzA0MDAwLCJpYXQiOjEyNjIzMDQwMDAsImp0aSI6InVybjp1dWlkOjEyM2U0NTY3LWU4OWItMTJkMy1hNDU2LTQyNjYxNDE3NDAwMCIsInZjIjp7IkBjb250ZXh0IjpbImh0dHBzOi8vd3d3LnczLm9yZy8yMDE4L2NyZWRlbnRpYWxzL3YxIiwiaHR0cHM6Ly93d3cudzMub3JnL25zL2NyZWRlbnRpYWxzL3YyIl0sInR5cGUiOlsiVmVyaWZpYWJsZUNyZWRlbnRpYWwiLCJFdXJvcGVhbkRpZ2l0YWxDcmVkZW50aWFsIl0sImlkIjoidXJuOnV1aWQ6MTIzZTQ1NjctZTg5Yi0xMmQzLWE0NTYtNDI2NjE0MTc0MDAwIiwiY3JlZGVudGlhbFN1YmplY3QiOnsiZmlyc3RfbmFtZSI6IkZlcnJpcyIsImxhc3RfbmFtZSI6IlJ1c3RhY2VhbiIsImlkIjoiZGlkOmtleTp6Nk1rZ0U4NE5DTXBNZUF4OWpLOWNmNVc0RzhnY1o5eHV3SnZHMWU3d05rOEtDZ3QifSwiaXNzdWVyIjp7Im5hbWUiOiJVbmlDb3JlIiwiaWQiOiJkaWQ6a2V5Ono2TWtnRTg0TkNNcE1lQXg5aks5Y2Y1VzRHOGdjWjl4dXdKdkcxZTd3Tms4S0NndCJ9LCJuYW1lIjoiRXVyb3BlYW4gRGlnaXRhbCBDcmVkZW50aWFsIiwiY3JlZGVudGlhbFByb2ZpbGVzIjp7fSwiZGlzcGxheVBhcmFtZXRlciI6eyJ0aXRsZSI6eyJlbiI6IkV1cm9wZWFuIERpZ2l0YWwgQ3JlZGVudGlhbCJ9LCJwcmltYXJ5TGFuZ3VhZ2UiOnt9LCJsYW5ndWFnZSI6e30sImluZGl2aWR1YWxEaXNwbGF5Ijp7Imxhbmd1YWdlIjp7fSwiZGlzcGxheURldGFpbCI6eyJwYWdlIjoxLCJpbWFnZSI6eyJjb250ZW50IjoiW1BMQUNFSE9MREVSXSIsImNvbnRlbnRFbmNvZGluZyI6e30sImNvbnRlbnRUeXBlIjp7fX19fX0sImNyZWRlbnRpYWxTY2hlbWEiOnsiaWQiOiJodHRwczovL2V1ZGl3Lm9yZy9jcmVkZW50aWFscy9zY2hlbWFzL0V1cm9wZWFuRGlnaXRhbENyZWRlbnRpYWxWM18zLmpzb24iLCJ0eXBlIjoiSnNvblNjaGVtYSJ9LCJpc3N1YW5jZURhdGUiOiIyMDEwLTAxLTAxVDAwOjAwOjAwWiIsInZhbGlkRnJvbSI6IjIwMTAtMDEtMDFUMDA6MDA6MDBaIiwiY3JlZGVudGlhbFN0YXR1cyI6eyJ0eXBlIjoiQ3JlZGVudGlhbFN0YXR1cyIsImlkIjoiaHR0cHM6Ly9teS1kb21haW4uZXhhbXBsZS5vcmcvaWV0Zi1vYXV0aC10b2tlbi1zdGF0dXMtbGlzdC8wIiwidXJpIjoiaHR0cHM6Ly9teS1kb21haW4uZXhhbXBsZS5vcmcvaWV0Zi1vYXV0aC10b2tlbi1zdGF0dXMtbGlzdC8wIiwiaWR4IjoxMjN9LCJpc3N1ZWQiOiIyMDEwLTAxLTAxVDAwOjAwOjAwWiJ9LCJzdGF0dXMiOnsic3RhdHVzX2xpc3QiOnsidXJpIjoiaHR0cHM6Ly9teS1kb21haW4uZXhhbXBsZS5vcmcvaWV0Zi1vYXV0aC10b2tlbi1zdGF0dXMtbGlzdC8wIiwiaWR4IjoxMjN9fX0.vc3rJjPdCIDGuLfBN0ZCXqLUl45LIjS1MC1HpGHa4ohjGxc2GPe5pMBLKWpksc_C-xf199vGFuWKYDZPncl2CQ";
 
     // TODO: enable sd-jwt testing, since the salts change everytime we need to come up with an alternative to `assert_eq!`
@@ -1483,7 +1478,7 @@ pub mod test_utils {
             "https://www.w3.org/ns/credentials/v2",
             "https://purl.imsglobal.org/spec/ob/v3p0/context-3.0.3.json"
           ],
-          "id": "https://example.com/credentials/3527",
+                    "id": format!("urn:uuid:{CREDENTIAL_ID}"),
           "type": ["VerifiableCredential", "OpenBadgeCredential"],
           "issuer": {
             "type": "Profile",
@@ -1494,6 +1489,7 @@ pub mod test_utils {
         });
         pub static ref UNSIGNED_VC1_1_CREDENTIAL: serde_json::Value = json!({
           "@context": [ "https://www.w3.org/2018/credentials/v1" ],
+                    "id": format!("urn:uuid:{CREDENTIAL_ID}"),
           "type": [ "VerifiableCredential" ],
           "credentialSubject": BASIC_CREDENTIAL_SUBJECT["credentialSubject"].clone(),
           "issuer": {
@@ -1508,6 +1504,7 @@ pub mod test_utils {
         });
         pub static ref UNSIGNED_VC2_SD_JWT_CREDENTIAL: serde_json::Value = json!({
           "@context": [ "https://www.w3.org/ns/credentials/v2" ],
+                    "id": format!("urn:uuid:{CREDENTIAL_ID}"),
           "type": [ "VerifiableCredential" ],
           "credentialSubject": BASIC_CREDENTIAL_SUBJECT["credentialSubject"].clone(),
           "issuer": {
@@ -1524,7 +1521,7 @@ pub mod test_utils {
                 "VerifiableCredential",
                 "EuropeanDigitalCredential"
             ],
-            "id": "urn:uuid:123e4567-e89b-12d3-a456-426614174000",
+            "id": format!("urn:uuid:{CREDENTIAL_ID}"),
             "credentialSubject": {
                 "first_name": "Ferris",
                 "last_name": "Rustacean"

From 4b5f2b9d385db2d134097a6551f56cc808b46e81 Mon Sep 17 00:00:00 2001
From: Floris Hafkenscheid
 <120176014+florishafkenscheid@users.noreply.github.com>
Date: Mon, 6 Jul 2026 13:04:49 +0200
Subject: [PATCH 23/34] feat(shared-kernel): extract request actor, add
 authorization hook (#340)

---
 .env.example                                  |   1 +
 Cargo.lock                                    | 648 +++++++-----------
 agent_api_http/Cargo.toml                     |   1 +
 agent_api_http/src/error.rs                   | 130 ++++
 agent_api_http/src/extractors.rs              |  22 +
 agent_api_http/src/handlers.rs                |  52 +-
 agent_api_http/src/lib.rs                     | 204 +++++-
 .../authorization_server/token.rs             |   2 +-
 .../src/v0/holder/holder/credentials/mod.rs   |  58 +-
 .../src/v0/holder/holder/offers/accept.rs     |  64 +-
 .../src/v0/holder/holder/offers/mod.rs        |  43 +-
 .../src/v0/holder/holder/offers/reject.rs     |  11 +-
 .../src/v0/holder/holder/presentations/mod.rs |  67 +-
 .../presentations/presentation_signed.rs      |   5 +-
 .../src/v0/holder/openid4vci/mod.rs           |  11 +-
 .../src/v0/identity/connections/mod.rs        | 128 ++--
 .../src/v0/identity/documents/mod.rs          |  51 +-
 .../src/v0/identity/profiles/mod.rs           |  80 ++-
 .../src/v0/identity/services/linked_vp.rs     | 113 +--
 .../src/v0/identity/services/mod.rs           |  33 +-
 .../src/v0/identity/well_known/did.rs         |   5 +-
 .../identity/well_known/did_configuration.rs  |   5 +-
 .../v0/issuance/credential_configurations.rs  |  47 ++
 .../issuance/credential_issuer/credential.rs  |  51 +-
 .../credential_issuer/credential_offer.rs     |   4 +-
 .../credential_issuer/notification.rs         |   6 +-
 .../credential_issuer/token_status_list.rs    |  12 +-
 .../well_known/oauth_authorization_server.rs  |   5 +-
 .../well_known/openid_credential_issuer.rs    |   5 +-
 agent_api_http/src/v0/issuance/credentials.rs | 209 ++++--
 .../src/v0/issuance/ietf_oauth_sd_jwt_vc.rs   |   4 +-
 agent_api_http/src/v0/issuance/nonce/mod.rs   |   4 +-
 agent_api_http/src/v0/issuance/offers/mod.rs  | 110 ++-
 agent_api_http/src/v0/issuance/offers/send.rs |  21 +-
 .../src/v0/issuance/public_offers.rs          |  97 ++-
 agent_api_http/src/v0/templates/mod.rs        | 304 +++++---
 .../v0/verification/authorization_requests.rs |  93 ++-
 .../v0/verification/relying_party/redirect.rs |   4 +-
 .../v0/verification/relying_party/request.rs  |   5 +-
 agent_application/Cargo.toml                  |   1 +
 agent_application/src/lib.rs                  |  21 +-
 .../src/application/consent_query_service.rs  |  13 +-
 .../src/application/consent_service.rs        |   6 +-
 .../interactive_authorization_service.rs      |  14 +-
 .../oauth2_authorization_service.rs           |   6 +-
 .../pushed_authorization_service.rs           |   6 +-
 .../src/application/token_issuance_service.rs |  16 +-
 agent_authorization/src/state.rs              |  15 +-
 agent_holder/src/offer/aggregate.rs           |   2 +-
 agent_holder/src/state.rs                     |   2 +
 agent_identity/src/state.rs                   | 169 ++++-
 .../credential_configuration_projection.rs    |  34 +-
 .../application/nonce_validation_service.rs   |  16 +-
 agent_issuance/src/state.rs                   |  55 +-
 .../application/token_status_list_service.rs  |   4 +-
 .../credential_configuration_projection.rs    |   2 +-
 agent_library/src/state.rs                    |   2 +
 agent_macros/src/lib.rs                       |   3 +-
 agent_shared/src/config/mod.rs                |  88 +++
 agent_shared/src/handlers.rs                  | 296 +++++++-
 agent_shared/src/profile.rs                   |   2 +-
 agent_store/src/lib.rs                        |   7 +
 agent_verification/src/state.rs               |   2 +
 docs/configuration/profiles.md                |  13 +
 docs/problem-details/authorization.md         |  19 +
 .../verification-authorization/src/lib.rs     |   6 +
 shared-kernel/src/application_service.rs      | 277 +++++++-
 shared-kernel/src/authorization.rs            | 116 ++++
 shared-kernel/src/lib.rs                      |   2 +
 shared-kernel/src/service_registry.rs         | 165 ++++-
 70 files changed, 3098 insertions(+), 997 deletions(-)
 create mode 100644 agent_api_http/src/extractors.rs
 create mode 100644 agent_api_http/src/v0/issuance/credential_configurations.rs
 create mode 100644 docs/problem-details/authorization.md
 create mode 100644 shared-kernel/src/authorization.rs

diff --git a/.env.example b/.env.example
index 9f5971e2..8c9e56ac 100644
--- a/.env.example
+++ b/.env.example
@@ -1,4 +1,5 @@
 UNICORE__PROFILE=development
+UNICORE__DEV__API_KEY="change-me-local-dev-key"
 
 UNICORE__LOG_FORMAT=text
 UNICORE__APPLICATION_URL="http://localhost:3033"
diff --git a/Cargo.lock b/Cargo.lock
index 335fe407..73a958cd 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -77,6 +77,7 @@ dependencies = [
  "agent_verification",
  "anyhow",
  "askama",
+ "async-trait",
  "axum 0.8.9",
  "axum-auth 0.8.1",
  "axum-macros",
@@ -84,7 +85,7 @@ dependencies = [
  "chrono",
  "cqrs-es",
  "futures",
- "http 1.4.1",
+ "http 1.4.2",
  "http-api-problem",
  "http-body-util",
  "hyper 1.10.1",
@@ -92,7 +93,7 @@ dependencies = [
  "identity_credential",
  "identity_did",
  "iso8601",
- "jsonschema 0.46.5",
+ "jsonschema 0.46.6",
  "jsonwebtoken",
  "lazy_static",
  "metrics",
@@ -150,6 +151,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_with 3.21.0",
+ "shared-kernel",
  "tokio",
  "tower-http 0.6.11",
  "tracing",
@@ -397,7 +399,7 @@ dependencies = [
  "chrono",
  "cqrs-es",
  "iso8601",
- "jsonschema 0.46.5",
+ "jsonschema 0.46.6",
  "lazy_static",
  "rstest",
  "serde",
@@ -419,7 +421,7 @@ version = "0.1.0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -448,7 +450,7 @@ dependencies = [
  "oid4vc-core",
  "p256 0.13.2",
  "ring",
- "rustls 0.23.40",
+ "rustls 0.23.41",
  "sd-jwt-payload",
  "serde",
  "serde_json",
@@ -623,7 +625,7 @@ dependencies = [
  "ed25519 2.2.3",
  "futures",
  "hex",
- "http 1.4.1",
+ "http 1.4.2",
  "matchit 0.5.0",
  "pin-project-lite",
  "pkcs8 0.10.2",
@@ -632,7 +634,7 @@ dependencies = [
  "rand 0.8.6",
  "rcgen",
  "ring",
- "rustls 0.23.40",
+ "rustls 0.23.41",
  "rustls-webpki 0.103.13",
  "serde",
  "serde_json",
@@ -716,9 +718,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
 
 [[package]]
 name = "anymap"
@@ -728,9 +730,9 @@ checksum = "33954243bd79057c2de7338850b85983a44588021f8a5fee574a8888c6de4344"
 
 [[package]]
 name = "ar_archive_writer"
-version = "0.5.1"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7eb93bbb63b9c227414f6eb3a0adfddca591a8ce1e9b60661bb08969b87e340b"
+checksum = "4087686b4b0a3427190bae57a1d9a478dbb2d40c5dc1bd6e2b6d797913bdd348"
 dependencies = [
  "object",
 ]
@@ -943,9 +945,9 @@ checksum = "76a2e8124351fda1ef8aaaa3bbd7ebbcb486bbcd4225aca0aa0d84bb2db8fecb"
 
 [[package]]
 name = "arrayvec"
-version = "0.7.6"
+version = "0.7.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
+checksum = "f02882884d3e1bc524fb12c79f107f6ad0e1cfd498c536ffb494301740995dfe"
 
 [[package]]
 name = "askama"
@@ -974,7 +976,7 @@ dependencies = [
  "rustc-hash 2.1.2",
  "serde",
  "serde_derive",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -1013,7 +1015,7 @@ checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
  "synstructure",
 ]
 
@@ -1025,7 +1027,7 @@ checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -1212,7 +1214,7 @@ checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -1229,7 +1231,7 @@ checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -1362,7 +1364,7 @@ dependencies = [
  "bytes",
  "form_urlencoded",
  "futures-util",
- "http 1.4.1",
+ "http 1.4.2",
  "http-body 1.0.1",
  "http-body-util",
  "hyper 1.10.1",
@@ -1407,7 +1409,7 @@ checksum = "93495037c01c639b198ecb926b58f7f1c0d61ae663edcd61b2dd679f2a0bffe6"
 dependencies = [
  "axum-core 0.5.6",
  "base64 0.22.1",
- "http 1.4.1",
+ "http 1.4.2",
 ]
 
 [[package]]
@@ -1435,7 +1437,7 @@ checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.4.1",
+ "http 1.4.2",
  "http-body 1.0.1",
  "http-body-util",
  "mime",
@@ -1454,7 +1456,7 @@ checksum = "7aa268c23bfbbd2c4363b9cd302a4f504fb2a9dfe7e3451d66f35dd392e20aca"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -1467,12 +1469,12 @@ dependencies = [
  "bytes",
  "either",
  "fs-err",
- "http 1.4.1",
+ "http 1.4.2",
  "http-body 1.0.1",
  "hyper 1.10.1",
  "hyper-util",
  "pin-project-lite",
- "rustls 0.23.40",
+ "rustls 0.23.41",
  "rustls-pki-types",
  "tokio",
  "tokio-rustls 0.26.4",
@@ -1717,9 +1719,9 @@ dependencies = [
 
 [[package]]
 name = "bitvec"
-version = "1.0.1"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bc2832c24239b0141d5674bb9174f9d68a8b5b3f2753311927c172ca46f7e9c"
+checksum = "ddcec3d12c579d40898fe0a9a358a803c23e9c52ca3c425707f81c9436211837"
 dependencies = [
  "funty 2.0.0",
  "radium 0.7.0",
@@ -1915,7 +1917,7 @@ checksum = "7969a9ba84b0ff843813e7249eed1678d9b6607ce5a3b8f0a47af3fcf7978e6e"
 dependencies = [
  "ahash 0.8.12",
  "base64 0.22.1",
- "bitvec 1.0.1",
+ "bitvec 1.1.1",
  "getrandom 0.2.17",
  "getrandom 0.3.4",
  "hex",
@@ -1962,9 +1964,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.11.1"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+checksum = "8ae3f5d315924270530207e2a68396c3cc547f6dca3fbdca317cfb1a51edb593"
 dependencies = [
  "serde",
 ]
@@ -1980,9 +1982,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.63"
+version = "1.2.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "556e016178bb5662a08681bbe0f00f8e17631781a4dfc8c45e466e4b185ec27f"
+checksum = "e228eec9be7c17ccb640b59b36a5cd805ea2a564a4c5e162c2f659fea30d3b96"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -2021,9 +2023,9 @@ dependencies = [
 
 [[package]]
 name = "chacha20"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
@@ -2127,7 +2129,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -2350,7 +2352,7 @@ dependencies = [
  "did_key",
  "did_web",
  "identity_iota",
- "rustls 0.23.40",
+ "rustls 0.23.41",
  "shared",
  "signature 2.2.0",
  "tokio",
@@ -2673,7 +2675,7 @@ checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -2768,7 +2770,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim 0.11.1",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -2781,7 +2783,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim 0.11.1",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -2814,7 +2816,7 @@ checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
 dependencies = [
  "darling_core 0.20.11",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -2825,7 +2827,7 @@ checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
 dependencies = [
  "darling_core 0.23.0",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -2870,7 +2872,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccc2776f0c61eca1ca32528f85548abd1a4be8fb53d1b21c013e4f18da1e7090"
 dependencies = [
  "data-encoding",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -2905,7 +2907,7 @@ checksum = "51aac4c99b2e6775164b412ea33ae8441b2fde2dbf05a20bc0052a63d08c475b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -2967,7 +2969,6 @@ version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
 dependencies = [
- "powerfmt",
  "serde_core",
 ]
 
@@ -3001,7 +3002,7 @@ checksum = "d65d7ce8132b7c0e54497a4d9a55a1c2a0912a0d786cf894472ba818fba45762"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -3012,7 +3013,7 @@ checksum = "d08b3a0bcc0d079199cd476b2cae8435016ec11d1c0986c6901c5ac223041534"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -3050,7 +3051,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustc_version",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -3079,7 +3080,7 @@ checksum = "cb7330aeadfbe296029522e6c40f315320aba36fc43a5b3632f3795348f3bd22"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
  "unicode-xid",
 ]
 
@@ -3093,7 +3094,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustc_version",
- "syn 2.0.117",
+ "syn 2.0.118",
  "unicode-xid",
 ]
 
@@ -3194,7 +3195,7 @@ dependencies = [
  "identity_stronghold",
  "iota-sdk 1.22.0-alpha",
  "log",
- "rustls 0.23.40",
+ "rustls 0.23.41",
  "shared",
  "tokio",
 ]
@@ -3382,7 +3383,7 @@ checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -3620,7 +3621,7 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -3877,7 +3878,7 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d013fc25338cc558c5c2cfbad646908fb23591e2404481826742b651c9af7160"
 dependencies = [
- "bitvec 1.0.1",
+ "bitvec 1.1.1",
  "rand_core 0.6.4",
  "subtle",
 ]
@@ -3888,7 +3889,7 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
 dependencies = [
- "bitvec 1.0.1",
+ "bitvec 1.1.1",
  "byteorder",
  "ff_derive",
  "rand_core 0.6.4",
@@ -4150,7 +4151,7 @@ checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -4244,28 +4245,25 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.4.2"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
  "libc",
  "r-efi 6.0.0",
  "rand_core 0.10.1",
- "wasip2",
- "wasip3",
 ]
 
 [[package]]
 name = "getset"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cf0fc11e47561d47397154977bc219f4cf809b2974facc3ccb3b89e2436f912"
+checksum = "6cf442baaabe4213ce7d1239afc26c039180b6456da2cededa316ae2c8a77a77"
 dependencies = [
- "proc-macro-error2",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -4294,7 +4292,7 @@ dependencies = [
  "futures-core",
  "futures-sink",
  "gloo-utils",
- "http 1.4.1",
+ "http 1.4.2",
  "js-sys",
  "pin-project",
  "serde",
@@ -4419,16 +4417,16 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.14"
+version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "171fefbc92fe4a4de27e0698d6a5b392d6a0e333506bc49133760b3bcf948733"
+checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
 dependencies = [
  "atomic-waker",
  "bytes",
  "fnv",
  "futures-core",
  "futures-sink",
- "http 1.4.1",
+ "http 1.4.2",
  "indexmap 2.14.0",
  "slab",
  "tokio",
@@ -4755,9 +4753,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "1.4.1"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8be7462df143984c4598a256ef469b251d7d7f9e271135073e78fc535414f3d0"
+checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
 dependencies = [
  "bytes",
  "itoa",
@@ -4770,7 +4768,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "000bed434eb9b5dfb8ea5ed904f02ffc63aa0ac7ac034d480dc24fbb97b748d8"
 dependencies = [
  "axum-core 0.5.6",
- "http 1.4.1",
+ "http 1.4.2",
  "http-api-problem-derive",
  "serde",
  "serde_json",
@@ -4803,7 +4801,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
 dependencies = [
  "bytes",
- "http 1.4.1",
+ "http 1.4.2",
 ]
 
 [[package]]
@@ -4814,7 +4812,7 @@ checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.4.1",
+ "http 1.4.2",
  "http-body 1.0.1",
  "pin-project-lite",
 ]
@@ -4831,7 +4829,7 @@ version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0f056c8559e3757392c8d091e796416e4649d8e49e88b8d76df6c002f05027fd"
 dependencies = [
- "http 1.4.1",
+ "http 1.4.2",
  "serde",
 ]
 
@@ -4887,8 +4885,8 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-core",
- "h2 0.4.14",
- "http 1.4.1",
+ "h2 0.4.15",
+ "http 1.4.2",
  "http-body 1.0.1",
  "httparse",
  "httpdate",
@@ -4919,16 +4917,16 @@ version = "0.27.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
- "http 1.4.1",
+ "http 1.4.2",
  "hyper 1.10.1",
  "hyper-util",
  "log",
- "rustls 0.23.40",
+ "rustls 0.23.41",
  "rustls-native-certs 0.8.4",
  "tokio",
  "tokio-rustls 0.26.4",
  "tower-service",
- "webpki-roots 1.0.7",
+ "webpki-roots 1.0.8",
 ]
 
 [[package]]
@@ -4954,7 +4952,7 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "http 1.4.1",
+ "http 1.4.2",
  "http-body 1.0.1",
  "hyper 1.10.1",
  "ipnet",
@@ -5073,12 +5071,6 @@ dependencies = [
  "zerovec",
 ]
 
-[[package]]
-name = "id-arena"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
-
 [[package]]
 name = "ident_case"
 version = "1.0.1"
@@ -5435,7 +5427,7 @@ checksum = "a0eb5a3343abf848c0984fe4604b2b105da9539376e24fc0a3b0007411ae4fd9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -5485,9 +5477,9 @@ dependencies = [
 
 [[package]]
 name = "insta"
-version = "1.47.2"
+version = "1.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b4a6248eb93a4401ed2f37dfe8ea592d3cf05b7cf4f8efa867b6895af7e094e"
+checksum = "86f0f8fee8c926415c58d6ae43a08523a26faccb2323f5e6b644fe7dd4ef6b82"
 dependencies = [
  "console",
  "once_cell",
@@ -5665,7 +5657,7 @@ version = "1.22.0-alpha"
 source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "bytes",
- "http 1.4.1",
+ "http 1.4.2",
  "http-body 1.0.1",
  "http-body-util",
  "hyper 1.10.1",
@@ -5857,7 +5849,7 @@ dependencies = [
  "bytes",
  "eyre",
  "futures",
- "http 1.4.1",
+ "http 1.4.2",
  "http-body 1.0.1",
  "hyper-rustls 0.27.9",
  "hyper-util",
@@ -5925,7 +5917,7 @@ dependencies = [
  "msim-macros",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -6023,7 +6015,7 @@ dependencies = [
  "jsonrpsee",
  "move-core-types",
  "reqwest 0.12.28",
- "rustls 0.23.40",
+ "rustls 0.23.41",
  "serde",
  "serde_json",
  "serde_with 3.21.0",
@@ -6070,7 +6062,7 @@ dependencies = [
  "pkcs8 0.10.2",
  "rcgen",
  "reqwest 0.12.28",
- "rustls 0.23.40",
+ "rustls 0.23.41",
  "rustls-webpki 0.103.13",
  "tokio",
  "tokio-rustls 0.26.4",
@@ -6453,7 +6445,7 @@ dependencies = [
  "quote",
  "rustc_version",
  "simd_cesu8",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -6481,7 +6473,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
 dependencies = [
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -6772,10 +6764,10 @@ dependencies = [
  "futures-channel",
  "futures-util",
  "gloo-net",
- "http 1.4.1",
+ "http 1.4.2",
  "jsonrpsee-core",
  "pin-project",
- "rustls 0.23.40",
+ "rustls 0.23.41",
  "rustls-pki-types",
  "rustls-platform-verifier 0.5.3",
  "soketto",
@@ -6797,7 +6789,7 @@ dependencies = [
  "bytes",
  "futures-timer",
  "futures-util",
- "http 1.4.1",
+ "http 1.4.2",
  "http-body 1.0.1",
  "http-body-util",
  "jsonrpsee-types",
@@ -6828,7 +6820,7 @@ dependencies = [
  "hyper-util",
  "jsonrpsee-core",
  "jsonrpsee-types",
- "rustls 0.23.40",
+ "rustls 0.23.41",
  "rustls-platform-verifier 0.5.3",
  "serde",
  "serde_json",
@@ -6849,7 +6841,7 @@ dependencies = [
  "proc-macro-crate 3.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -6859,7 +6851,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c625c78b8d545478370b6e7a2a191b0d921f831a9eef38dc1e7efb57e7a5472f"
 dependencies = [
  "futures-util",
- "http 1.4.1",
+ "http 1.4.2",
  "http-body 1.0.1",
  "http-body-util",
  "hyper 1.10.1",
@@ -6885,7 +6877,7 @@ version = "0.24.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "41d86fc943f81dab0ecdd6c0240b6e0f55ad57a2ea9ad8ad7efe8456fb9cc7a4"
 dependencies = [
- "http 1.4.1",
+ "http 1.4.2",
  "serde",
  "serde_json",
  "thiserror 1.0.69",
@@ -6908,7 +6900,7 @@ version = "0.24.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9df5bd5c38c0906a6e8b3a38c8c22cc8525fda25fd1a03a3fe010686aea66b70"
 dependencies = [
- "http 1.4.1",
+ "http 1.4.2",
  "jsonrpsee-client-transport",
  "jsonrpsee-core",
  "jsonrpsee-types",
@@ -6945,9 +6937,9 @@ dependencies = [
 
 [[package]]
 name = "jsonschema"
-version = "0.46.5"
+version = "0.46.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a5fe5206f06e589caf25e79fc05ccdf91fca745685fe9fe1a13bbdfb479a631"
+checksum = "8374249b1bdce1c1773a09fa294347e19e4bfeb86d845c2d8ebaf8a8dbf11233"
 dependencies = [
  "ahash 0.8.12",
  "bytecount",
@@ -6965,7 +6957,7 @@ dependencies = [
  "regex",
  "regex-syntax",
  "reqwest 0.13.4",
- "rustls 0.23.40",
+ "rustls 0.23.41",
  "serde",
  "serde_json",
  "unicode-general-category",
@@ -7054,7 +7046,7 @@ dependencies = [
  "convert_case 0.6.0",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -7098,15 +7090,9 @@ dependencies = [
 
 [[package]]
 name = "leb128"
-version = "0.2.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cc46bac87ef8093eed6f272babb833b6443374399985ac8ed28471ee0918545"
-
-[[package]]
-name = "leb128fmt"
-version = "0.1.0"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+checksum = "c83bff1d572d6b9aeef67ddfc8448e4a3737909cb28e81f97c791b9018703e52"
 
 [[package]]
 name = "lexical"
@@ -7373,9 +7359,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.32"
+version = "0.4.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "953f07c43838f8e6f9758cab68bf5bed85465e7587ebe0b823f1bcd81978ad3a"
+checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 dependencies = [
  "serde_core",
  "value-bag",
@@ -7418,7 +7404,7 @@ dependencies = [
  "macro_magic_core",
  "macro_magic_macros",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -7432,7 +7418,7 @@ dependencies = [
  "macro_magic_core_macros",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -7443,7 +7429,7 @@ checksum = "b02abfe41815b5bd98dbd4260173db2c116dda171dc0fe7838cb206333b83308"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -7454,7 +7440,7 @@ checksum = "73ea28ee64b88876bf45277ed9a5817c1817df061a74f2b988971a12570e5869"
 dependencies = [
  "macro_magic_core",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -7465,7 +7451,7 @@ checksum = "757aee279b8bdbb9f9e676796fd459e4207a1f986e87886700abf589f5abf771"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -7507,9 +7493,9 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.8.1"
+version = "2.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b947ae49db0d222b1dbc6b113ce7248a3fc3a6ca21b696717bfc000ba4484d8"
+checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
 
 [[package]]
 name = "memoffset"
@@ -7639,7 +7625,7 @@ dependencies = [
  "cfg-if",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -7728,7 +7714,7 @@ dependencies = [
  "percent-encoding",
  "rand 0.9.4",
  "rustc_version_runtime",
- "rustls 0.23.40",
+ "rustls 0.23.41",
  "serde",
  "serde_bytes",
  "serde_with 3.21.0",
@@ -7744,7 +7730,7 @@ dependencies = [
  "tokio-util",
  "typed-builder",
  "uuid",
- "webpki-roots 1.0.7",
+ "webpki-roots 1.0.8",
 ]
 
 [[package]]
@@ -7756,7 +7742,7 @@ dependencies = [
  "macro_magic",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -7778,7 +7764,7 @@ checksum = "e4db6d5580af57bf992f59068d4ea26fd518574ff48d7639b255a36f9de6e7e9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -8042,7 +8028,7 @@ version = "0.1.0"
 source = "git+https://github.com/iotaledger/iota?rev=96196f0da231883ec69cda04892c600ef6afa982#96196f0da231883ec69cda04892c600ef6afa982"
 dependencies = [
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -8452,7 +8438,7 @@ checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -8492,7 +8478,7 @@ version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e238432a7881ec7164503ccc516c014bf009be7984cde1ba56837862543bdec3"
 dependencies = [
- "bitvec 1.0.1",
+ "bitvec 1.1.1",
  "either",
  "lru",
  "num-bigint 0.4.6",
@@ -8553,7 +8539,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustc_version",
- "syn 2.0.117",
+ "syn 2.0.118",
  "urlencoding",
 ]
 
@@ -8594,7 +8580,7 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
- "http 1.4.1",
+ "http 1.4.2",
  "http-body-util",
  "httparse",
  "humantime",
@@ -8703,7 +8689,7 @@ dependencies = [
  "chrono",
  "derivative",
  "getset",
- "http 1.4.1",
+ "http 1.4.2",
  "jsonwebtoken",
  "lazy_static",
  "nutype",
@@ -8834,7 +8820,7 @@ dependencies = [
  "proc-macro-error",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -8897,7 +8883,7 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "36b29691432cc9eff8b282278473b63df73bea49bc3ec5e67f31a3ae9c3ec190"
 dependencies = [
- "bitvec 1.0.1",
+ "bitvec 1.1.1",
  "packed_struct_codegen",
  "serde",
 ]
@@ -8963,7 +8949,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "799781ae679d79a948e13d4824a40970bfa500058d245760dd857301059810fa"
 dependencies = [
  "arrayvec",
- "bitvec 1.0.1",
+ "bitvec 1.1.1",
  "byte-slice-cast",
  "const_format",
  "impl-trait-for-tuples",
@@ -8993,7 +8979,7 @@ dependencies = [
  "proc-macro-crate 3.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -9208,7 +9194,7 @@ dependencies = [
  "pest_meta",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -9271,7 +9257,7 @@ dependencies = [
  "phf_shared",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -9300,7 +9286,7 @@ checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -9553,16 +9539,6 @@ dependencies = [
  "ryu_floating_decimal",
 ]
 
-[[package]]
-name = "prettyplease"
-version = "0.2.37"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
-dependencies = [
- "proc-macro2",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "primeorder"
 version = "0.13.6"
@@ -9649,28 +9625,6 @@ dependencies = [
  "version_check",
 ]
 
-[[package]]
-name = "proc-macro-error-attr2"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96de42df36bb9bba5542fe9f1a054b8cc87e172759a1868aa05c1f3acc89dfc5"
-dependencies = [
- "proc-macro2",
- "quote",
-]
-
-[[package]]
-name = "proc-macro-error2"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11ec05c52be0a07b08061f7dd003e7d7092e0472bc731b4af7bb1ef876109802"
-dependencies = [
- "proc-macro-error-attr2",
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "proc-macro2"
 version = "1.0.106"
@@ -9775,7 +9729,7 @@ dependencies = [
  "itertools 0.14.0",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -9844,9 +9798,9 @@ dependencies = [
 
 [[package]]
 name = "quinn"
-version = "0.11.9"
+version = "0.11.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8"
 dependencies = [
  "bytes",
  "cfg_aliases",
@@ -9855,7 +9809,7 @@ dependencies = [
  "quinn-proto",
  "quinn-udp",
  "rustc-hash 2.1.2",
- "rustls 0.23.40",
+ "rustls 0.23.41",
  "socket2 0.6.4",
  "thiserror 2.0.18",
  "tokio",
@@ -9875,7 +9829,7 @@ dependencies = [
  "rand 0.9.4",
  "ring",
  "rustc-hash 2.1.2",
- "rustls 0.23.40",
+ "rustls 0.23.41",
  "rustls-pki-types",
  "slab",
  "thiserror 2.0.18",
@@ -9900,9 +9854,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.45"
+version = "1.0.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
 dependencies = [
  "proc-macro2",
 ]
@@ -9971,8 +9925,8 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
 dependencies = [
- "chacha20 0.10.0",
- "getrandom 0.4.2",
+ "chacha20 0.10.1",
+ "getrandom 0.4.3",
  "rand_core 0.10.1",
 ]
 
@@ -10147,7 +10101,7 @@ checksum = "f2a62d85ed81ca5305dc544bd42c8804c5060b78ffa5ad3c64b0fb6a8c13d062"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -10205,14 +10159,14 @@ checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
 name = "referencing"
-version = "0.46.5"
+version = "0.46.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69e4e17ef386c5383591d07623d3de49cbc601156e7582973e6db98d66a57de2"
+checksum = "65a910f9d63351f9c9d7dc3053d02b214ea3a005917140c70087d7b59cbc5bb1"
 dependencies = [
  "ahash 0.8.12",
  "fluent-uri",
@@ -10227,9 +10181,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.12.3"
+version = "1.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
+checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -10250,9 +10204,9 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.10"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
 [[package]]
 name = "relative-path"
@@ -10313,8 +10267,8 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
- "h2 0.4.14",
- "http 1.4.1",
+ "h2 0.4.15",
+ "http 1.4.2",
  "http-body 1.0.1",
  "http-body-util",
  "hyper 1.10.1",
@@ -10325,7 +10279,7 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "quinn",
- "rustls 0.23.40",
+ "rustls 0.23.41",
  "rustls-native-certs 0.8.4",
  "rustls-pki-types",
  "serde",
@@ -10343,7 +10297,7 @@ dependencies = [
  "wasm-bindgen-futures",
  "wasm-streams",
  "web-sys",
- "webpki-roots 1.0.7",
+ "webpki-roots 1.0.8",
 ]
 
 [[package]]
@@ -10357,8 +10311,8 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
- "h2 0.4.14",
- "http 1.4.1",
+ "h2 0.4.15",
+ "http 1.4.2",
  "http-body 1.0.1",
  "http-body-util",
  "hyper 1.10.1",
@@ -10368,7 +10322,7 @@ dependencies = [
  "log",
  "percent-encoding",
  "pin-project-lite",
- "rustls 0.23.40",
+ "rustls 0.23.41",
  "rustls-pki-types",
  "rustls-platform-verifier 0.7.0",
  "serde",
@@ -10636,7 +10590,7 @@ dependencies = [
  "regex",
  "relative-path",
  "rustc_version",
- "syn 2.0.117",
+ "syn 2.0.118",
  "unicode-ident",
 ]
 
@@ -10756,9 +10710,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.40"
+version = "0.23.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
+checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -10846,7 +10800,7 @@ dependencies = [
  "jni 0.21.1",
  "log",
  "once_cell",
- "rustls 0.23.40",
+ "rustls 0.23.41",
  "rustls-native-certs 0.8.4",
  "rustls-platform-verifier-android",
  "rustls-webpki 0.103.13",
@@ -10867,13 +10821,13 @@ dependencies = [
  "jni 0.22.4",
  "log",
  "once_cell",
- "rustls 0.23.40",
+ "rustls 0.23.41",
  "rustls-native-certs 0.8.4",
  "rustls-platform-verifier-android",
  "rustls-webpki 0.103.13",
  "security-framework 3.7.0",
  "security-framework-sys",
- "webpki-root-certs 1.0.7",
+ "webpki-root-certs 1.0.8",
  "windows-sys 0.61.2",
 ]
 
@@ -11012,7 +10966,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "serde_derive_internals",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -11278,7 +11232,7 @@ checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -11289,7 +11243,7 @@ checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -11358,7 +11312,7 @@ checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -11427,7 +11381,7 @@ dependencies = [
  "darling 0.20.11",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -11439,7 +11393,7 @@ dependencies = [
  "darling 0.23.0",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -11486,7 +11440,7 @@ checksum = "94e153fc76e1c6a068703d6d29c508a0b15c061c4b7e43da59cc097bc342673c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -11768,9 +11722,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.15.1"
+version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
 dependencies = [
  "serde",
 ]
@@ -11793,7 +11747,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -11831,7 +11785,7 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "futures",
- "http 1.4.1",
+ "http 1.4.2",
  "httparse",
  "log",
  "rand 0.8.6",
@@ -11922,7 +11876,7 @@ dependencies = [
  "memchr",
  "once_cell",
  "percent-encoding",
- "rustls 0.23.40",
+ "rustls 0.23.41",
  "serde",
  "serde_json",
  "sha2 0.10.9",
@@ -11945,7 +11899,7 @@ dependencies = [
  "quote",
  "sqlx-core",
  "sqlx-macros-core",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -11968,7 +11922,7 @@ dependencies = [
  "sqlx-mysql",
  "sqlx-postgres",
  "sqlx-sqlite",
- "syn 2.0.117",
+ "syn 2.0.118",
  "tokio",
  "url",
 ]
@@ -12497,7 +12451,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -12510,7 +12464,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -12522,7 +12476,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -12534,7 +12488,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -12562,9 +12516,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.117"
+version = "2.0.118"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -12594,7 +12548,7 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -12731,7 +12685,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.4.2",
+ "getrandom 0.4.3",
  "once_cell",
  "rustix",
  "windows-sys 0.61.2",
@@ -12788,7 +12742,7 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -12799,7 +12753,7 @@ checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -12822,12 +12776,11 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.47"
+version = "0.3.51"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
+checksum = "85c17d80feb7334b40c484e45ed1a5273dfd8bfda537c3be2e74a06a6686f327"
 dependencies = [
  "deranged 0.5.8",
- "itoa",
  "num-conv",
  "powerfmt",
  "serde_core",
@@ -12837,15 +12790,15 @@ dependencies = [
 
 [[package]]
 name = "time-core"
-version = "0.1.8"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
 
 [[package]]
 name = "time-macros"
-version = "0.2.27"
+version = "0.2.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
+checksum = "dcef1a61bdb119096e153208ec5cbec23944ce8bca13be5c7f60c634f7403935"
 dependencies = [
  "num-conv",
  "time-core",
@@ -12929,7 +12882,7 @@ checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -12948,7 +12901,7 @@ version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
 dependencies = [
- "rustls 0.23.40",
+ "rustls 0.23.41",
  "tokio",
 ]
 
@@ -13001,7 +12954,7 @@ dependencies = [
  "bytes",
  "futures-core",
  "futures-sink",
- "http 1.4.1",
+ "http 1.4.2",
  "httparse",
  "rand 0.8.6",
  "ring",
@@ -13104,8 +13057,8 @@ dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
  "bytes",
- "h2 0.4.14",
- "http 1.4.1",
+ "h2 0.4.15",
+ "http 1.4.2",
  "http-body 1.0.1",
  "http-body-util",
  "hyper 1.10.1",
@@ -13214,7 +13167,7 @@ checksum = "1e9cd434a998747dd2c4276bc96ee2e0c7a2eadf3cae88e52be55a05fa9053f5"
 dependencies = [
  "bitflags 2.13.0",
  "bytes",
- "http 1.4.1",
+ "http 1.4.2",
  "http-body 1.0.1",
  "http-body-util",
  "pin-project-lite",
@@ -13233,7 +13186,7 @@ dependencies = [
  "bitflags 2.13.0",
  "bytes",
  "futures-util",
- "http 1.4.1",
+ "http 1.4.2",
  "http-body 1.0.1",
  "pin-project-lite",
  "tower 0.5.3",
@@ -13275,7 +13228,7 @@ checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -13348,7 +13301,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ad06847b7afb65c7866a36664b75c40b895e318cea4f71299f013fb22965329d"
 dependencies = [
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -13415,7 +13368,7 @@ checksum = "6c01152af293afb9c7c2a57e4b559c5620b421f6d133261c60dd2d0cdb38e6b8"
 dependencies = [
  "bytes",
  "data-encoding",
- "http 1.4.1",
+ "http 1.4.2",
  "httparse",
  "log",
  "rand 0.9.4",
@@ -13440,7 +13393,7 @@ checksum = "0e48cea23f68d1f78eb7bc092881b6bb88d3d6b5b7e6234f6f9c911da1ffb221"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -13489,7 +13442,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "621963e302416b389a1ec177397e9e62de849a78bd8205d428608553def75350"
 dependencies = [
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -13627,7 +13580,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e994ba84b0bd1b1b0cf92878b7ef898a5c1760108fe7b6010327e274917a808c"
 dependencies = [
  "base64 0.22.1",
- "http 1.4.1",
+ "http 1.4.2",
  "httparse",
  "log",
 ]
@@ -13703,17 +13656,17 @@ dependencies = [
  "proc-macro2",
  "quote",
  "regex",
- "syn 2.0.117",
+ "syn 2.0.118",
  "url",
 ]
 
 [[package]]
 name = "uuid"
-version = "1.23.2"
+version = "1.23.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d258b83ceec21034727ecee8c382cfa6c3e133699b0742c64571814fb420c9f7"
+checksum = "bf80a72845275afea99e7f2b434723d3bc7e38470fcd1c7ed39a599c73319a53"
 dependencies = [
- "getrandom 0.4.2",
+ "getrandom 0.4.3",
  "js-sys",
  "rand 0.10.1",
  "serde_core",
@@ -13751,7 +13704,7 @@ checksum = "a1935e10c6f04d22688d07c0790f2fc0e1b1c5c2c55bc0cc87ed67656e587dd8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -13835,20 +13788,11 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "wasip2"
-version = "1.0.3+wasi-0.2.9"
+version = "1.0.4+wasi-0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
 dependencies = [
- "wit-bindgen 0.57.1",
-]
-
-[[package]]
-name = "wasip3"
-version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
-dependencies = [
- "wit-bindgen 0.51.0",
+ "wit-bindgen",
 ]
 
 [[package]]
@@ -13905,7 +13849,7 @@ dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
  "wasm-bindgen-shared",
 ]
 
@@ -13918,28 +13862,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "wasm-encoder"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
-dependencies = [
- "leb128fmt",
- "wasmparser",
-]
-
-[[package]]
-name = "wasm-metadata"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
-dependencies = [
- "anyhow",
- "indexmap 2.14.0",
- "wasm-encoder",
- "wasmparser",
-]
-
 [[package]]
 name = "wasm-streams"
 version = "0.4.2"
@@ -13968,18 +13890,6 @@ dependencies = [
  "web-sys",
 ]
 
-[[package]]
-name = "wasmparser"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
-dependencies = [
- "bitflags 2.13.0",
- "hashbrown 0.15.5",
- "indexmap 2.14.0",
- "semver",
-]
-
 [[package]]
 name = "web-sys"
 version = "0.3.85"
@@ -14006,14 +13916,14 @@ version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75c7f0ef91146ebfb530314f5f1d24528d7f0767efbfd31dce919275413e393e"
 dependencies = [
- "webpki-root-certs 1.0.7",
+ "webpki-root-certs 1.0.8",
 ]
 
 [[package]]
 name = "webpki-root-certs"
-version = "1.0.7"
+version = "1.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f31141ce3fc3e300ae89b78c0dd67f9708061d1d2eda54b8209346fd6be9a92c"
+checksum = "0d46a5a140e6f7afeccd8eae97eff335163939eac8b929834875168b29b3d267"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -14030,14 +13940,14 @@ version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
 dependencies = [
- "webpki-roots 1.0.7",
+ "webpki-roots 1.0.8",
 ]
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.7"
+version = "1.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52f5ee44c96cf55f1b349600768e3ece3a8f26010c05265ab73f945bb1a2eb9d"
+checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -14145,7 +14055,7 @@ checksum = "9107ddc059d5b6fbfbffdfa7a7fe3e22a226def0b2608f72e9d552763d3e1ad7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -14156,7 +14066,7 @@ checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -14167,7 +14077,7 @@ checksum = "29bee4b38ea3cde66011baa44dba677c432a78593e202392d1e9070cf2a7fca7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -14178,7 +14088,7 @@ checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -14599,7 +14509,7 @@ dependencies = [
  "base64 0.22.1",
  "deadpool",
  "futures",
- "http 1.4.1",
+ "http 1.4.2",
  "http-body-util",
  "hyper 1.10.1",
  "hyper-util",
@@ -14612,100 +14522,12 @@ dependencies = [
  "url",
 ]
 
-[[package]]
-name = "wit-bindgen"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
-dependencies = [
- "wit-bindgen-rust-macro",
-]
-
 [[package]]
 name = "wit-bindgen"
 version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
-[[package]]
-name = "wit-bindgen-core"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
-dependencies = [
- "anyhow",
- "heck 0.5.0",
- "wit-parser",
-]
-
-[[package]]
-name = "wit-bindgen-rust"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
-dependencies = [
- "anyhow",
- "heck 0.5.0",
- "indexmap 2.14.0",
- "prettyplease",
- "syn 2.0.117",
- "wasm-metadata",
- "wit-bindgen-core",
- "wit-component",
-]
-
-[[package]]
-name = "wit-bindgen-rust-macro"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
-dependencies = [
- "anyhow",
- "prettyplease",
- "proc-macro2",
- "quote",
- "syn 2.0.117",
- "wit-bindgen-core",
- "wit-bindgen-rust",
-]
-
-[[package]]
-name = "wit-component"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
-dependencies = [
- "anyhow",
- "bitflags 2.13.0",
- "indexmap 2.14.0",
- "log",
- "serde",
- "serde_derive",
- "serde_json",
- "wasm-encoder",
- "wasm-metadata",
- "wasmparser",
- "wit-parser",
-]
-
-[[package]]
-name = "wit-parser"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
-dependencies = [
- "anyhow",
- "id-arena",
- "indexmap 2.14.0",
- "log",
- "semver",
- "serde",
- "serde_derive",
- "serde_json",
- "unicode-xid",
- "wasmparser",
-]
-
 [[package]]
 name = "writeable"
 version = "0.6.3"
@@ -14844,28 +14666,28 @@ checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
  "synstructure",
 ]
 
 [[package]]
 name = "zerocopy"
-version = "0.8.50"
+version = "0.8.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b065d4f0e55f82fae73202e189638116a87c55ab6b8e6c2721e13dd9d854ad1"
+checksum = "ce1022995ff5ff5d841ad7d994facc23098cd40152f2c1d11cd607c6f530653f"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.50"
+version = "0.8.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b631b19d36a892ab55420c92dbc83ccd79274f25be714855d3074aa71cab639"
+checksum = "1ae7f38b72ec2a254e2b87ef277cf2cd4fb97cbebf944faa6f33354da0867930"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -14885,15 +14707,15 @@ checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
  "synstructure",
 ]
 
 [[package]]
 name = "zeroize"
-version = "1.8.2"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 dependencies = [
  "serde",
  "zeroize_derive",
@@ -14901,13 +14723,13 @@ dependencies = [
 
 [[package]]
 name = "zeroize_derive"
-version = "1.4.3"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85a5b4158499876c763cb03bc4e49185d3cccbabb15b33c627f7884f43db852e"
+checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -14940,7 +14762,7 @@ checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -14979,9 +14801,9 @@ dependencies = [
 
 [[package]]
 name = "zlib-rs"
-version = "0.6.3"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3be3d40e40a133f9c916ee3f9f4fa2d9d63435b5fbe1bfc6d9dae0aa0ada1513"
+checksum = "977347db8caa080403f6b6b7c1cda9479a8e869316f7e13a59b19076a40f94e3"
 
 [[package]]
 name = "zmij"
diff --git a/agent_api_http/Cargo.toml b/agent_api_http/Cargo.toml
index 42ebe86c..7d80b1d8 100644
--- a/agent_api_http/Cargo.toml
+++ b/agent_api_http/Cargo.toml
@@ -75,6 +75,7 @@ agent_verification = { path = "../agent_verification", features = [
 ] }
 verification-authorization = { path = "../infrastructure/adapters/verification-authorization" }
 
+async-trait.workspace = true
 futures.workspace = true
 jsonwebtoken.workspace = true
 lazy_static.workspace = true
diff --git a/agent_api_http/src/error.rs b/agent_api_http/src/error.rs
index c023d667..2bad1e8f 100644
--- a/agent_api_http/src/error.rs
+++ b/agent_api_http/src/error.rs
@@ -1,13 +1,17 @@
 use crate::v0::issuance::error::{IntoPublicError, PublicError};
 use crate::DOCUMENTATION_URL;
+use agent_shared::handlers::{CommandHandlerError, QueryHandlerError};
 use cqrs_es::{persist::PersistenceError, AggregateError};
 use http_api_problem::ApiError;
 use hyper::StatusCode;
+use shared_kernel::authorization::AuthorizationError;
 
 /// Wraps errors from the `cqrs_es` crate to be returned as API errors.
 #[derive(Debug)]
 pub enum ErrorWrapper<T: std::error::Error> {
     AggregateError(AggregateError<T>),
+    CommandHandlerError(CommandHandlerError<T>),
+    QueryHandlerError(QueryHandlerError),
     PersistenceError(PersistenceError),
 }
 
@@ -23,6 +27,8 @@ where
     fn into_api_error(self) -> ApiError {
         match self {
             ErrorWrapper::AggregateError(error) => error.into_api_error(),
+            ErrorWrapper::CommandHandlerError(error) => error.into_api_error(),
+            ErrorWrapper::QueryHandlerError(error) => error.into_api_error(),
             ErrorWrapper::PersistenceError(error) => error.into_api_error(),
         }
     }
@@ -38,10 +44,36 @@ impl IntoApiErrorExt for ApiError {
     }
 }
 
+impl IntoApiErrorExt for AuthorizationError {
+    fn into_api_error(self) -> ApiError {
+        match self {
+            AuthorizationError::Unauthorized => ApiError::builder(StatusCode::UNAUTHORIZED)
+                .title("Unauthorized")
+                .type_url(type_url("authorization#unauthorized"))
+                .message("Authentication is required")
+                .finish(),
+            AuthorizationError::Forbidden => ApiError::builder(StatusCode::FORBIDDEN)
+                .title("Forbidden")
+                .type_url(type_url("authorization#forbidden"))
+                .message("The request is not authorized")
+                .finish(),
+        }
+    }
+}
+
 impl<T: std::error::Error + IntoPublicError> From<ErrorWrapper<T>> for PublicError {
     fn from(err: ErrorWrapper<T>) -> Self {
         match err {
             ErrorWrapper::AggregateError(error) => PublicError::from(error),
+            ErrorWrapper::CommandHandlerError(error) => match error {
+                CommandHandlerError::Authorization(_) => PublicError::InternalServerError,
+                CommandHandlerError::Aggregate(error) => PublicError::from(error),
+            },
+            ErrorWrapper::QueryHandlerError(error) => match error {
+                QueryHandlerError::Authorization(_) | QueryHandlerError::Persistence(_) => {
+                    PublicError::InternalServerError
+                }
+            },
             ErrorWrapper::PersistenceError(error) => PublicError::from(error),
         }
     }
@@ -88,6 +120,27 @@ where
     }
 }
 
+impl<T: IntoApiErrorExt> IntoApiErrorExt for CommandHandlerError<T>
+where
+    T: Send + Sync + 'static,
+{
+    fn into_api_error(self) -> ApiError {
+        match self {
+            CommandHandlerError::Authorization(error) => error.into_api_error(),
+            CommandHandlerError::Aggregate(error) => error.into_api_error(),
+        }
+    }
+}
+
+impl IntoApiErrorExt for QueryHandlerError {
+    fn into_api_error(self) -> ApiError {
+        match self {
+            QueryHandlerError::Authorization(error) => error.into_api_error(),
+            QueryHandlerError::Persistence(error) => error.into_api_error(),
+        }
+    }
+}
+
 impl IntoApiErrorExt for PersistenceError {
     fn into_api_error(self) -> ApiError {
         AggregateError::<ApiError>::from(self).into_api_error()
@@ -104,7 +157,9 @@ impl From<PersistenceError> for PublicError {
 pub mod tests {
     use super::*;
     use axum::response::Response;
+    use http_api_problem::IntoApiError;
     use serde_json::json;
+    use std::{error::Error, fmt};
 
     pub async fn into_json_value(response: Response) -> serde_json::Value {
         let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
@@ -173,4 +228,79 @@ pub mod tests {
             }),
         );
     }
+
+    #[tokio::test]
+    async fn command_handler_errors_successfully_convert_to_problem_details() {
+        assert_eq!(
+            into_json_value(
+                ErrorWrapper::<ApiError>::CommandHandlerError(CommandHandlerError::Authorization(
+                    AuthorizationError::Forbidden
+                ))
+                .into_api_error()
+                .into_axum_response()
+            )
+            .await,
+            json!({
+                "type": format!("{DOCUMENTATION_URL}problem-details/authorization#forbidden"),
+                "title": "Forbidden",
+                "status": 403,
+                "detail": "The request is not authorized"
+            }),
+        );
+
+        assert_eq!(
+            into_json_value(
+                ErrorWrapper::CommandHandlerError(CommandHandlerError::Aggregate(AggregateError::UserError(
+                    ApiError::builder(StatusCode::BAD_REQUEST)
+                        .title("Invalid Command")
+                        .type_url(type_url("test#invalid-command"))
+                        .message("The command is invalid")
+                        .finish(),
+                )))
+                .into_api_error()
+                .into_axum_response()
+            )
+            .await,
+            json!({
+                "type": format!("{DOCUMENTATION_URL}problem-details/test#invalid-command"),
+                "title": "Invalid Command",
+                "status": 400,
+                "detail": "The command is invalid"
+            }),
+        );
+    }
+
+    #[test]
+    fn command_handler_errors_successfully_convert_to_public_errors() {
+        assert!(matches!(
+            PublicError::from(ErrorWrapper::<TestPublicError>::CommandHandlerError(
+                CommandHandlerError::Authorization(AuthorizationError::Forbidden)
+            )),
+            PublicError::InternalServerError
+        ));
+
+        assert!(matches!(
+            PublicError::from(ErrorWrapper::CommandHandlerError(CommandHandlerError::Aggregate(
+                AggregateError::UserError(TestPublicError)
+            ))),
+            PublicError::NotFoundError
+        ));
+    }
+
+    #[derive(Debug)]
+    struct TestPublicError;
+
+    impl fmt::Display for TestPublicError {
+        fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+            f.write_str("test public error")
+        }
+    }
+
+    impl Error for TestPublicError {}
+
+    impl IntoPublicError for TestPublicError {
+        fn into_public_error(self) -> PublicError {
+            PublicError::NotFoundError
+        }
+    }
 }
diff --git a/agent_api_http/src/extractors.rs b/agent_api_http/src/extractors.rs
new file mode 100644
index 00000000..7474f442
--- /dev/null
+++ b/agent_api_http/src/extractors.rs
@@ -0,0 +1,22 @@
+use std::convert::Infallible;
+
+use axum::extract::FromRequestParts;
+use shared_kernel::authorization::Actor;
+
+/// Optional actor extracted from request extensions.
+///
+/// The actor extraction middleware stores an `Actor` in request extensions when
+/// one is available. Handlers can use this extractor to receive that value as an
+/// `Option<Actor>` without depending on Axum's `Extension` wrapper directly.
+pub struct RequestActor(pub Option<Actor>);
+
+impl<S> FromRequestParts<S> for RequestActor
+where
+    S: Send + Sync,
+{
+    type Rejection = Infallible;
+
+    async fn from_request_parts(parts: &mut http::request::Parts, _state: &S) -> Result<Self, Self::Rejection> {
+        Ok(Self(parts.extensions.get::<Actor>().cloned()))
+    }
+}
diff --git a/agent_api_http/src/handlers.rs b/agent_api_http/src/handlers.rs
index 2f626d8f..3cb88733 100644
--- a/agent_api_http/src/handlers.rs
+++ b/agent_api_http/src/handlers.rs
@@ -1,10 +1,15 @@
 use crate::error::ErrorWrapper;
 use cqrs_es::{Aggregate, View};
+use shared_kernel::authorization::{Actor, AllowAllAuthorizationChecker, AuthorizationChecker};
 use shared_kernel::view_repository::DynViewRepository;
 use std::sync::Arc;
 
+static ALLOW_ALL_AUTHORIZATION_CHECKER: std::sync::OnceLock<Arc<dyn AuthorizationChecker>> = std::sync::OnceLock::new();
+
 /// Wrapping the `command_handler` function from the `agent_shared` crate to handle errors.
 pub async fn command_handler<A>(
+    authorization_checker: Arc<dyn AuthorizationChecker>,
+    actor: Option<Actor>,
     aggregate_id: &str,
     state: &agent_shared::application_state::CommandHandler<A>,
     command: <A as cqrs_es::Aggregate>::Command,
@@ -13,13 +18,52 @@ where
     A: Aggregate,
     <A as Aggregate>::Command: Send + Sync + std::fmt::Debug,
 {
-    agent_shared::handlers::command_handler(aggregate_id, state, command)
+    agent_shared::handlers::command_handler(authorization_checker, actor, aggregate_id, state, command)
         .await
-        .map_err(ErrorWrapper::AggregateError)
+        .map_err(ErrorWrapper::CommandHandlerError)
+}
+
+/// Executes a command for public protocol endpoints that are authorized by protocol-specific checks.
+pub async fn public_command_handler<A>(
+    aggregate_id: &str,
+    state: &agent_shared::application_state::CommandHandler<A>,
+    command: <A as cqrs_es::Aggregate>::Command,
+) -> Result<(), ErrorWrapper<A::Error>>
+where
+    A: Aggregate,
+    <A as Aggregate>::Command: Send + Sync + std::fmt::Debug,
+{
+    agent_shared::handlers::command_handler(
+        ALLOW_ALL_AUTHORIZATION_CHECKER
+            .get_or_init(|| Arc::new(AllowAllAuthorizationChecker))
+            .clone(),
+        None,
+        aggregate_id,
+        state,
+        command,
+    )
+    .await
+    .map_err(ErrorWrapper::CommandHandlerError)
+}
+
+/// Executes a query for public protocol endpoints that are authorized by protocol-specific checks.
+pub async fn public_query_handler<A, V>(
+    view_id: &str,
+    state: &Arc<dyn DynViewRepository<V, A>>,
+) -> Result<Option<V>, ErrorWrapper<A::Error>>
+where
+    A: Aggregate,
+    V: View<A>,
+{
+    agent_shared::handlers::public_query_handler(view_id, state)
+        .await
+        .map_err(ErrorWrapper::PersistenceError)
 }
 
 // Wrapping the `query_handler` function from the `agent_shared` crate to handle errors.
 pub async fn query_handler<A, V>(
+    authorization_checker: Arc<dyn AuthorizationChecker>,
+    actor: Option<Actor>,
     view_id: &str,
     state: &Arc<dyn DynViewRepository<V, A>>,
 ) -> Result<Option<V>, ErrorWrapper<A::Error>>
@@ -27,7 +71,7 @@ where
     A: Aggregate,
     V: View<A>,
 {
-    agent_shared::handlers::query_handler(view_id, state)
+    agent_shared::handlers::query_handler(authorization_checker, actor, view_id, state)
         .await
-        .map_err(ErrorWrapper::PersistenceError)
+        .map_err(ErrorWrapper::QueryHandlerError)
 }
diff --git a/agent_api_http/src/lib.rs b/agent_api_http/src/lib.rs
index 93c543fb..a6d099af 100644
--- a/agent_api_http/src/lib.rs
+++ b/agent_api_http/src/lib.rs
@@ -2,6 +2,7 @@ pub mod public;
 pub mod v0;
 
 pub mod error;
+pub mod extractors;
 pub mod handlers;
 pub mod metrics;
 pub mod utils;
@@ -15,14 +16,15 @@ use agent_shared::config::config;
 use agent_verification::state::VerificationState;
 use axum::{
     body::{Body, Bytes},
-    extract::{MatchedPath, Request},
-    middleware,
-    middleware::Next,
+    extract::{MatchedPath, Request, State},
+    middleware::{self, Next},
     response::{IntoResponse, Response},
     Router,
 };
+use http::HeaderMap;
 use http_body_util::BodyExt as _;
 use hyper::StatusCode;
+use shared_kernel::authorization::{Actor, ActorExtractor, ToActor};
 use std::{sync::Arc, time::Duration};
 use tower::ServiceBuilder;
 use tower_http::trace::TraceLayer;
@@ -42,7 +44,13 @@ pub struct ApplicationState {
     pub verification_state: Option<Arc<VerificationState>>,
 }
 
-pub fn app(
+/// Build the top-level API router.
+///
+/// This merges the routers for each bounded context that has state available,
+/// installs actor extraction middleware, and attaches request tracing/logging.
+/// When the configured application URL includes a non-root base path, the
+/// router is nested under that path.
+pub fn app<E>(
     ApplicationState {
         identity_state,
         library_state,
@@ -51,7 +59,11 @@ pub fn app(
         holder_state,
         verification_state,
     }: ApplicationState,
-) -> Router {
+    actor_extractor: Arc<E>,
+) -> Router
+where
+    E: ActorExtractor,
+{
     let app = Router::new()
         .merge(identity_state.map(v0::identity::router).unwrap_or_default())
         .merge(library_state.clone().map(v0::library::router).unwrap_or_default())
@@ -73,6 +85,7 @@ pub fn app(
         .merge(holder_state.map(v0::holder::router).unwrap_or_default())
         .merge(verification_state.map(v0::verification::router).unwrap_or_default())
         .merge(public::router())
+        .layer(middleware::from_fn_with_state(actor_extractor, extract_actor::<E>))
         // Trace layers
         .layer(
             ServiceBuilder::new()
@@ -146,15 +159,85 @@ async fn buffer_request_body(request: Request) -> Result<Request, Response> {
     Ok(Request::from_parts(parts, Body::from(bytes)))
 }
 
+/// Adapter that lets the actor extractor read values from HTTP headers.
+struct HttpActorInput<'a> {
+    headers: &'a HeaderMap,
+}
+
+impl<'a> HttpActorInput<'a> {
+    /// Create a header-backed actor input used by the actor extractor.
+    fn from_headers(headers: &'a HeaderMap) -> Self {
+        Self { headers }
+    }
+}
+
+impl ToActor for HttpActorInput<'_> {
+    /// Raw HTTP credentials are not stable actor identifiers.
+    ///
+    /// Actor extractors should read credentials with [`ToActor::auth_value`] and map them to a
+    /// non-sensitive subject before returning an [`Actor`].
+    fn to_actor(&self) -> Option<Actor> {
+        None
+    }
+
+    /// Read the header identified by `key` as a UTF-8 string slice.
+    fn auth_value(&self, key: &str) -> Option<&str> {
+        self.headers.get(key).and_then(|value| value.to_str().ok())
+    }
+}
+
+/// Extract an optional actor from the request headers and store it in the request extensions when present.
+pub async fn extract_actor<E>(State(actor_extractor): State<Arc<E>>, mut request: Request, next: Next) -> Response
+where
+    E: ActorExtractor,
+{
+    let input = HttpActorInput::from_headers(request.headers());
+
+    if let Some(actor) = actor_extractor.extract_actor(&input).await {
+        request.extensions_mut().insert(actor);
+    }
+
+    next.run(request).await
+}
+
+/// Require a valid actor in the request headers, returning `401 Unauthorized` when none is present.
+///
+/// When an actor is found, it is inserted into the request extensions before the request is forwarded to the next handler.
+pub async fn require_actor<E>(
+    State(actor_extractor): State<Arc<E>>,
+    mut request: Request,
+    next: Next,
+) -> Result<Response, StatusCode>
+where
+    E: ActorExtractor,
+{
+    let input = HttpActorInput::from_headers(request.headers());
+
+    if let Some(actor) = actor_extractor.extract_actor(&input).await {
+        request.extensions_mut().insert(actor);
+    } else {
+        return Err(StatusCode::UNAUTHORIZED);
+    }
+
+    Ok(next.run(request).await)
+}
+
 #[cfg(test)]
 mod tests {
+    use super::*;
+    use crate::extractors::RequestActor;
     use agent_shared::config::config;
+    use axum::{body::Body, routing::get};
+    use http::header::AUTHORIZATION;
+    use http::Request;
     use oid4vci::credential_issuer::{
         credential_configurations_supported::CredentialConfigurationsSupportedObject,
         credential_issuer_metadata::CredentialIssuerMetadata,
     };
     use serde_json::json;
+    use shared_kernel::authorization::NoActorExtractor;
     use std::collections::HashMap;
+    use tower::ServiceExt;
 
     pub const OFFER_ID: &str = "00000000-0000-0000-0000-000000000000";
     pub const TEMPLATE_ID: &str = "001";
@@ -219,4 +302,115 @@ mod tests {
             ..Default::default()
         };
     }
+
+    #[derive(Clone)]
+    struct MappingActorExtractor;
+
+    #[async_trait::async_trait]
+    impl ActorExtractor for MappingActorExtractor {
+        async fn extract_actor(&self, input: &dyn ToActor) -> Option<Actor> {
+            input
+                .bearer_token()
+                .filter(|token| *token == "valid-token")
+                .map(|_| Actor {
+                    subject: "user@example.test".to_string(),
+                })
+        }
+    }
+
+    #[derive(Clone)]
+    struct CustomHeaderActorExtractor;
+
+    #[async_trait::async_trait]
+    impl ActorExtractor for CustomHeaderActorExtractor {
+        async fn extract_actor(&self, input: &dyn ToActor) -> Option<Actor> {
+            input
+                .auth_value("x-custom-actor-token")
+                .filter(|token| *token == "valid-token")
+                .map(|_| Actor {
+                    subject: "custom@example.test".to_string(),
+                })
+        }
+    }
+
+    async fn actor_subject(RequestActor(actor): RequestActor) -> String {
+        actor
+            .map(|actor| actor.subject)
+            .unwrap_or_else(|| "anonymous".to_string())
+    }
+
+    #[tokio::test]
+    async fn actor_extraction_middleware_stores_mapped_actor_in_request_extensions() {
+        let app = Router::new()
+            .route("/", get(actor_subject))
+            .layer(middleware::from_fn_with_state(
+                Arc::new(MappingActorExtractor),
+                extract_actor::<MappingActorExtractor>,
+            ));
+
+        let response = app
+            .oneshot(
+                Request::builder()
+                    .uri("/")
+                    .header(AUTHORIZATION, "Bearer valid-token")
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+
+        assert_eq!(body.as_ref(), b"user@example.test");
+    }
+
+    #[tokio::test]
+    async fn actor_extractor_can_read_custom_auth_values() {
+        let app = Router::new()
+            .route("/", get(actor_subject))
+            .layer(middleware::from_fn_with_state(
+                Arc::new(CustomHeaderActorExtractor),
+                extract_actor::<CustomHeaderActorExtractor>,
+            ));
+
+        let response = app
+            .oneshot(
+                Request::builder()
+                    .uri("/")
+                    .header("x-custom-actor-token", "valid-token")
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+
+        assert_eq!(body.as_ref(), b"custom@example.test");
+    }
+
+    #[tokio::test]
+    async fn no_actor_extractor_stores_anonymous_actor_extension() {
+        let app = Router::new()
+            .route("/", get(actor_subject))
+            .layer(middleware::from_fn_with_state(
+                Arc::new(NoActorExtractor),
+                extract_actor::<NoActorExtractor>,
+            ));
+
+        let response = app
+            .oneshot(
+                Request::builder()
+                    .uri("/")
+                    .header(AUTHORIZATION, "Bearer valid-token")
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX).await.unwrap();
+
+        assert_eq!(body.as_ref(), b"anonymous");
+    }
 }
diff --git a/agent_api_http/src/v0/authorization/authorization_server/token.rs b/agent_api_http/src/v0/authorization/authorization_server/token.rs
index 19828f60..77372c0a 100644
--- a/agent_api_http/src/v0/authorization/authorization_server/token.rs
+++ b/agent_api_http/src/v0/authorization/authorization_server/token.rs
@@ -50,7 +50,7 @@ pub mod tests {
     use agent_issuance::public_offer::command::PublicOfferCommand;
     use agent_issuance::services::IssuanceServices;
     use agent_secret_manager::service::Service;
-    use agent_shared::handlers::command_handler;
+    use agent_shared::handlers::public_command_handler as command_handler;
     use agent_store::{authorization_state, in_memory::InMemory, issuance_state};
     use axum::{
         body::Body,
diff --git a/agent_api_http/src/v0/holder/holder/credentials/mod.rs b/agent_api_http/src/v0/holder/holder/credentials/mod.rs
index 74e4251b..59b1f133 100644
--- a/agent_api_http/src/v0/holder/holder/credentials/mod.rs
+++ b/agent_api_http/src/v0/holder/holder/credentials/mod.rs
@@ -1,3 +1,4 @@
+use crate::extractors::RequestActor;
 use crate::handlers::{command_handler, query_handler};
 use agent_holder::{
     credential::{aggregate::Credential, command::CredentialCommand},
@@ -27,11 +28,19 @@ use std::sync::Arc;
     )
 )]
 #[axum_macros::debug_handler]
-pub(crate) async fn credentials(State(state): State<Arc<HolderState>>) -> Result<Response, ApiError> {
-    let all_credentials = query_handler("all_holder_credentials", &state.query.all_holder_credentials)
-        .await?
-        .map(|all_credentials_view| all_credentials_view.credentials.into_values().collect::<Vec<_>>())
-        .unwrap_or_default();
+pub(crate) async fn credentials(
+    State(state): State<Arc<HolderState>>,
+    RequestActor(actor): RequestActor,
+) -> Result<Response, ApiError> {
+    let all_credentials = query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        "all_holder_credentials",
+        &state.query.all_holder_credentials,
+    )
+    .await?
+    .map(|all_credentials_view| all_credentials_view.credentials.into_values().collect::<Vec<_>>())
+    .unwrap_or_default();
 
     Ok((StatusCode::OK, Json(all_credentials)).into_response())
 }
@@ -45,6 +54,7 @@ pub struct HolderCredentialsEndpointRequest {
 #[axum_macros::debug_handler]
 pub(crate) async fn post_credentials(
     State(state): State<Arc<HolderState>>,
+    RequestActor(actor): RequestActor,
     Json(HolderCredentialsEndpointRequest { credential }): Json<HolderCredentialsEndpointRequest>,
 ) -> Result<Response, ApiError> {
     let holder_credential_id = uuid::Uuid::new_v4().to_string();
@@ -55,13 +65,25 @@ pub(crate) async fn post_credentials(
         credential,
     };
 
-    command_handler(&holder_credential_id, &state.command.credential, command).await?;
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &holder_credential_id,
+        &state.command.credential,
+        command,
+    )
+    .await?;
 
-    query_handler(&holder_credential_id, &state.query.holder_credential)
-        .await?
-        .map(|holder_credential_view| (StatusCode::CREATED, Json(holder_credential_view)).into_response())
-        // TODO: this *should* be an impossible error, what should we return here?
-        .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &holder_credential_id,
+        &state.query.holder_credential,
+    )
+    .await?
+    .map(|holder_credential_view| (StatusCode::CREATED, Json(holder_credential_view)).into_response())
+    // TODO: this *should* be an impossible error, what should we return here?
+    .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
 }
 
 /// Get credential by ID
@@ -80,10 +102,16 @@ pub(crate) async fn post_credentials(
 #[axum_macros::debug_handler]
 pub(crate) async fn credential(
     State(state): State<Arc<HolderState>>,
+    RequestActor(actor): RequestActor,
     Path(holder_credential_id): Path<String>,
 ) -> Result<Response, ApiError> {
-    query_handler(&holder_credential_id, &state.query.holder_credential)
-        .await?
-        .map(|holder_credential_view| (StatusCode::OK, Json(holder_credential_view)).into_response())
-        .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &holder_credential_id,
+        &state.query.holder_credential,
+    )
+    .await?
+    .map(|holder_credential_view| (StatusCode::OK, Json(holder_credential_view)).into_response())
+    .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
 }
diff --git a/agent_api_http/src/v0/holder/holder/offers/accept.rs b/agent_api_http/src/v0/holder/holder/offers/accept.rs
index 97682e21..c1825f58 100644
--- a/agent_api_http/src/v0/holder/holder/offers/accept.rs
+++ b/agent_api_http/src/v0/holder/holder/offers/accept.rs
@@ -1,3 +1,4 @@
+use crate::extractors::RequestActor;
 use crate::handlers::{command_handler, query_handler};
 use agent_holder::{
     credential::command::CredentialCommand,
@@ -33,6 +34,7 @@ use std::sync::Arc;
 #[axum_macros::debug_handler]
 pub(crate) async fn accept(
     State(state): State<Arc<HolderState>>,
+    RequestActor(actor): RequestActor,
     Path(received_offer_id): Path<String>,
 ) -> Result<Response, ApiError> {
     // TODO: General note that also applies to other endpoints: currently we are using Application Layer logic in the
@@ -41,25 +43,51 @@ pub(crate) async fn accept(
     // Furthermore, the Application Layer (not implemented yet) should be kept very thin as well. See: https://github.com/impierce/ssi-agent/issues/114
 
     // Check if the Credential Offer exists.
-    query_handler(&received_offer_id, &state.query.received_offer)
-        .await?
-        .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))?;
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &received_offer_id,
+        &state.query.received_offer,
+    )
+    .await?
+    .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))?;
 
     let command = OfferCommand::AcceptCredentialOffer {
         received_offer_id: received_offer_id.clone(),
     };
 
     // Accept the Credential Offer
-    command_handler(&received_offer_id, &state.command.offer, command).await?;
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &received_offer_id,
+        &state.command.offer,
+        command,
+    )
+    .await?;
 
     let command = OfferCommand::SendCredentialRequest {
         received_offer_id: received_offer_id.clone(),
     };
 
     // Send the Credential Request
-    command_handler(&received_offer_id, &state.command.offer, command).await?;
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &received_offer_id,
+        &state.command.offer,
+        command,
+    )
+    .await?;
 
-    let credentials = match query_handler(&received_offer_id, &state.query.received_offer).await? {
+    let credentials = match query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &received_offer_id,
+        &state.query.received_offer,
+    )
+    .await?
+    {
         Some(ReceivedOfferView { credentials, .. }) => credentials,
         // TODO: this *should* be an impossible error, what should we return here?
         _ => return Err(ApiError::new(StatusCode::INTERNAL_SERVER_ERROR)),
@@ -77,12 +105,24 @@ pub(crate) async fn accept(
         };
 
         // Add the Credential to the state.
-        command_handler(&holder_credential_id, &state.command.credential, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            &holder_credential_id,
+            &state.command.credential,
+            command,
+        )
+        .await?;
     }
 
-    query_handler(&received_offer_id, &state.query.received_offer)
-        .await?
-        .map(|received_offer_view| (StatusCode::CREATED, Json(received_offer_view)).into_response())
-        // TODO: this *should* be an impossible error, what should we return here?
-        .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &received_offer_id,
+        &state.query.received_offer,
+    )
+    .await?
+    .map(|received_offer_view| (StatusCode::CREATED, Json(received_offer_view)).into_response())
+    // TODO: this *should* be an impossible error, what should we return here?
+    .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
 }
diff --git a/agent_api_http/src/v0/holder/holder/offers/mod.rs b/agent_api_http/src/v0/holder/holder/offers/mod.rs
index cbde2137..dafabfba 100644
--- a/agent_api_http/src/v0/holder/holder/offers/mod.rs
+++ b/agent_api_http/src/v0/holder/holder/offers/mod.rs
@@ -1,6 +1,7 @@
 pub mod accept;
 pub mod reject;
 
+use crate::extractors::RequestActor;
 use crate::handlers::query_handler;
 use agent_holder::{offer::aggregate::Offer, state::HolderState};
 use axum::{
@@ -25,16 +26,24 @@ use std::sync::Arc;
     )
 )]
 #[axum_macros::debug_handler]
-pub(crate) async fn offers(State(state): State<Arc<HolderState>>) -> Result<Response, ApiError> {
-    let all_received_offers = query_handler("all_received_offers", &state.query.all_received_offers)
-        .await?
-        .map(|all_received_offers_view| {
-            all_received_offers_view
-                .received_offers
-                .into_values()
-                .collect::<Vec<_>>()
-        })
-        .unwrap_or_default();
+pub(crate) async fn offers(
+    State(state): State<Arc<HolderState>>,
+    RequestActor(actor): RequestActor,
+) -> Result<Response, ApiError> {
+    let all_received_offers = query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        "all_received_offers",
+        &state.query.all_received_offers,
+    )
+    .await?
+    .map(|all_received_offers_view| {
+        all_received_offers_view
+            .received_offers
+            .into_values()
+            .collect::<Vec<_>>()
+    })
+    .unwrap_or_default();
 
     Ok((StatusCode::OK, Json(all_received_offers)).into_response())
 }
@@ -55,10 +64,16 @@ pub(crate) async fn offers(State(state): State<Arc<HolderState>>) -> Result<Resp
 #[axum_macros::debug_handler]
 pub(crate) async fn offer(
     State(state): State<Arc<HolderState>>,
+    RequestActor(actor): RequestActor,
     Path(received_offer_id): Path<String>,
 ) -> Result<Response, ApiError> {
-    query_handler(&received_offer_id, &state.query.received_offer)
-        .await?
-        .map(|received_offer_view| (StatusCode::OK, Json(received_offer_view)).into_response())
-        .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &received_offer_id,
+        &state.query.received_offer,
+    )
+    .await?
+    .map(|received_offer_view| (StatusCode::OK, Json(received_offer_view)).into_response())
+    .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
 }
diff --git a/agent_api_http/src/v0/holder/holder/offers/reject.rs b/agent_api_http/src/v0/holder/holder/offers/reject.rs
index 66c398ca..a81fa684 100644
--- a/agent_api_http/src/v0/holder/holder/offers/reject.rs
+++ b/agent_api_http/src/v0/holder/holder/offers/reject.rs
@@ -1,3 +1,4 @@
+use crate::extractors::RequestActor;
 use crate::handlers::command_handler;
 use agent_holder::{offer::command::OfferCommand, state::HolderState};
 use axum::{
@@ -23,6 +24,7 @@ use std::sync::Arc;
 #[axum_macros::debug_handler]
 pub(crate) async fn reject(
     State(state): State<Arc<HolderState>>,
+    RequestActor(actor): RequestActor,
     Path(received_offer_id): Path<String>,
 ) -> Result<Response, ApiError> {
     let command = OfferCommand::RejectCredentialOffer {
@@ -30,7 +32,14 @@ pub(crate) async fn reject(
     };
 
     // Remove the Credential Offer from the state.
-    command_handler(&received_offer_id, &state.command.offer, command).await?;
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &received_offer_id,
+        &state.command.offer,
+        command,
+    )
+    .await?;
 
     Ok(StatusCode::NO_CONTENT.into_response())
 }
diff --git a/agent_api_http/src/v0/holder/holder/presentations/mod.rs b/agent_api_http/src/v0/holder/holder/presentations/mod.rs
index 3129e779..ea414e8b 100644
--- a/agent_api_http/src/v0/holder/holder/presentations/mod.rs
+++ b/agent_api_http/src/v0/holder/holder/presentations/mod.rs
@@ -1,5 +1,6 @@
 pub mod presentation_signed;
 
+use crate::extractors::RequestActor;
 use crate::handlers::{command_handler, query_handler};
 use agent_holder::{
     credential::queries::HolderCredentialView, presentation::command::PresentationCommand, state::HolderState,
@@ -15,11 +16,19 @@ use serde::{Deserialize, Serialize};
 use std::sync::Arc;
 
 #[axum_macros::debug_handler]
-pub(crate) async fn get_presentations(State(state): State<Arc<HolderState>>) -> Result<Response, ApiError> {
-    let all_presentations = query_handler("all_presentations", &state.query.all_presentations)
-        .await?
-        .map(|all_presentations_view| all_presentations_view.presentations.into_values().collect::<Vec<_>>())
-        .unwrap_or_default();
+pub(crate) async fn get_presentations(
+    State(state): State<Arc<HolderState>>,
+    RequestActor(actor): RequestActor,
+) -> Result<Response, ApiError> {
+    let all_presentations = query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        "all_presentations",
+        &state.query.all_presentations,
+    )
+    .await?
+    .map(|all_presentations_view| all_presentations_view.presentations.into_values().collect::<Vec<_>>())
+    .unwrap_or_default();
 
     Ok((StatusCode::OK, Json(all_presentations)).into_response())
 }
@@ -27,12 +36,18 @@ pub(crate) async fn get_presentations(State(state): State<Arc<HolderState>>) ->
 #[axum_macros::debug_handler]
 pub(crate) async fn presentation(
     State(state): State<Arc<HolderState>>,
+    RequestActor(actor): RequestActor,
     Path(presentation_id): Path<String>,
 ) -> Result<Response, ApiError> {
-    query_handler(&presentation_id, &state.query.presentation)
-        .await?
-        .map(|presentation_view| (StatusCode::OK, Json(presentation_view)).into_response())
-        .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &presentation_id,
+        &state.query.presentation,
+    )
+    .await?
+    .map(|presentation_view| (StatusCode::OK, Json(presentation_view)).into_response())
+    .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
 }
 
 #[derive(Deserialize, Serialize)]
@@ -44,13 +59,21 @@ pub struct PresentationsEndpointRequest {
 #[axum_macros::debug_handler]
 pub(crate) async fn post_presentations(
     State(state): State<Arc<HolderState>>,
+    RequestActor(actor): RequestActor,
     Json(PresentationsEndpointRequest { credential_ids }): Json<PresentationsEndpointRequest>,
 ) -> Result<Response, ApiError> {
     let mut credentials = vec![];
 
     // Get all the credentials.
     for credential_id in credential_ids {
-        match query_handler(&credential_id, &state.query.holder_credential).await? {
+        match query_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            &credential_id,
+            &state.query.holder_credential,
+        )
+        .await?
+        {
             Some(HolderCredentialView {
                 signed: Some(credential),
                 ..
@@ -69,11 +92,23 @@ pub(crate) async fn post_presentations(
     };
 
     // Create the presentation.
-    command_handler(&presentation_id, &state.command.presentation, command).await?;
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &presentation_id,
+        &state.command.presentation,
+        command,
+    )
+    .await?;
 
-    query_handler(&presentation_id, &state.query.presentation)
-        .await?
-        .map(|presentation_view| (StatusCode::CREATED, Json(presentation_view)).into_response())
-        // TODO: this *should* be an impossible error, what should we return here?
-        .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &presentation_id,
+        &state.query.presentation,
+    )
+    .await?
+    .map(|presentation_view| (StatusCode::CREATED, Json(presentation_view)).into_response())
+    // TODO: this *should* be an impossible error, what should we return here?
+    .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
 }
diff --git a/agent_api_http/src/v0/holder/holder/presentations/presentation_signed.rs b/agent_api_http/src/v0/holder/holder/presentations/presentation_signed.rs
index 9ffe6bbb..819a05c5 100644
--- a/agent_api_http/src/v0/holder/holder/presentations/presentation_signed.rs
+++ b/agent_api_http/src/v0/holder/holder/presentations/presentation_signed.rs
@@ -1,4 +1,3 @@
-use crate::handlers::query_handler;
 use agent_holder::{presentation::aggregate::Presentation, state::HolderState};
 use axum::{
     extract::{Path, State},
@@ -8,12 +7,14 @@ use http_api_problem::ApiError;
 use hyper::{header, StatusCode};
 use std::sync::Arc;
 
+use crate::handlers::public_query_handler;
+
 #[axum_macros::debug_handler]
 pub(crate) async fn presentation_signed(
     State(state): State<Arc<HolderState>>,
     Path(presentation_id): Path<String>,
 ) -> Result<Response, ApiError> {
-    match query_handler(&presentation_id, &state.query.presentation).await? {
+    match public_query_handler(&presentation_id, &state.query.presentation).await? {
         Some(Presentation {
             signed: Some(signed_presentation),
             ..
diff --git a/agent_api_http/src/v0/holder/openid4vci/mod.rs b/agent_api_http/src/v0/holder/openid4vci/mod.rs
index ea9ef526..98a89e82 100644
--- a/agent_api_http/src/v0/holder/openid4vci/mod.rs
+++ b/agent_api_http/src/v0/holder/openid4vci/mod.rs
@@ -1,3 +1,4 @@
+use crate::extractors::RequestActor;
 use crate::handlers::command_handler;
 use agent_holder::{offer::command::OfferCommand, state::HolderState};
 use axum::{
@@ -15,6 +16,7 @@ use tracing::info;
 #[axum_macros::debug_handler]
 pub(crate) async fn offers_params(
     State(state): State<Arc<HolderState>>,
+    RequestActor(actor): RequestActor,
     // TODO: Can this be changed to `StringifiedForm`?
     Form(payload): Form<serde_json::Value>,
 ) -> Result<Response, ApiError> {
@@ -43,7 +45,14 @@ pub(crate) async fn offers_params(
     };
 
     // Add the Credential Offer to the state.
-    command_handler(&received_offer_id, &state.command.offer, command).await?;
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &received_offer_id,
+        &state.command.offer,
+        command,
+    )
+    .await?;
 
     Ok(StatusCode::OK.into_response())
 }
diff --git a/agent_api_http/src/v0/identity/connections/mod.rs b/agent_api_http/src/v0/identity/connections/mod.rs
index 8e8e7dfb..02502e11 100644
--- a/agent_api_http/src/v0/identity/connections/mod.rs
+++ b/agent_api_http/src/v0/identity/connections/mod.rs
@@ -1,5 +1,6 @@
 use std::sync::Arc;
 
+use crate::extractors::RequestActor;
 use crate::handlers::{command_handler, query_handler};
 use crate::API_VERSION;
 use agent_identity::{
@@ -44,6 +45,7 @@ pub struct AddConnectionEndpointRequest {
 #[axum_macros::debug_handler]
 pub(crate) async fn post_connection(
     State(state): State<Arc<IdentityState>>,
+    RequestActor(actor): RequestActor,
     Json(AddConnectionEndpointRequest { url }): Json<AddConnectionEndpointRequest>,
 ) -> Result<Response, ApiError> {
     let connection_id = uuid::Uuid::new_v4().to_string();
@@ -54,21 +56,33 @@ pub(crate) async fn post_connection(
         url,
     };
 
-    command_handler(&connection_id, &state.command.connection, command).await?;
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &connection_id,
+        &state.command.connection,
+        command,
+    )
+    .await?;
 
     // Return the connection.
-    query_handler(&connection_id, &state.query.connection)
-        .await?
-        .map(|connection_view| {
-            (
-                StatusCode::CREATED,
-                [(header::LOCATION, &format!("{API_VERSION}/connections/{connection_id}"))],
-                Json(connection_view),
-            )
-                .into_response()
-        })
-        // TODO: this *should* be an impossible error, what should we return here?
-        .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &connection_id,
+        &state.query.connection,
+    )
+    .await?
+    .map(|connection_view| {
+        (
+            StatusCode::CREATED,
+            [(header::LOCATION, &format!("{API_VERSION}/connections/{connection_id}"))],
+            Json(connection_view),
+        )
+            .into_response()
+    })
+    // TODO: this *should* be an impossible error, what should we return here?
+    .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
 }
 
 #[derive(Deserialize, Serialize, utoipa::ToSchema)]
@@ -99,26 +113,32 @@ pub struct GetConnectionsEndpointRequest {
 #[axum_macros::debug_handler]
 pub(crate) async fn get_connections(
     State(state): State<Arc<IdentityState>>,
+    RequestActor(actor): RequestActor,
     Form(GetConnectionsEndpointRequest { display, url, did }): Form<GetConnectionsEndpointRequest>,
 ) -> Result<Response, ApiError> {
-    let filtered_connections = query_handler("all_connections", &state.query.all_connections)
-        .await?
-        .map(|all_connections_view| {
-            let filtered_connections: Vec<_> = all_connections_view
-                .connections
-                .into_values()
-                .filter(|connection| {
-                    display
-                        .as_ref()
-                        .map_or(true, |display| connection.display.as_ref() == Some(display))
-                        && url.as_ref().map_or(true, |url| *url == connection.url)
-                        && did.as_ref().map_or(true, |did| connection.dids.contains(did))
-                })
-                .collect();
-
-            filtered_connections
-        })
-        .unwrap_or_default();
+    let filtered_connections = query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        "all_connections",
+        &state.query.all_connections,
+    )
+    .await?
+    .map(|all_connections_view| {
+        let filtered_connections: Vec<_> = all_connections_view
+            .connections
+            .into_values()
+            .filter(|connection| {
+                display
+                    .as_ref()
+                    .map_or(true, |display| connection.display.as_ref() == Some(display))
+                    && url.as_ref().map_or(true, |url| *url == connection.url)
+                    && did.as_ref().map_or(true, |did| connection.dids.contains(did))
+            })
+            .collect();
+
+        filtered_connections
+    })
+    .unwrap_or_default();
 
     Ok((StatusCode::OK, Json(filtered_connections)).into_response())
 }
@@ -138,13 +158,19 @@ pub(crate) async fn get_connections(
 #[axum_macros::debug_handler]
 pub(crate) async fn get_connection(
     State(state): State<Arc<IdentityState>>,
+    RequestActor(actor): RequestActor,
     Path(id): Path<String>,
 ) -> Result<Response, ApiError> {
-    query_handler(&id, &state.query.connection)
-        .await?
-        .filter(|view| !view.deleted)
-        .map(|connection_view| (StatusCode::OK, Json(connection_view)).into_response())
-        .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &id,
+        &state.query.connection,
+    )
+    .await?
+    .filter(|view| !view.deleted)
+    .map(|connection_view| (StatusCode::OK, Json(connection_view)).into_response())
+    .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
 }
 
 #[derive(Deserialize, Serialize, utoipa::ToSchema)]
@@ -168,12 +194,20 @@ pub struct SyncConnectionRequest {
 #[axum_macros::debug_handler]
 pub(crate) async fn sync_connection(
     State(state): State<Arc<IdentityState>>,
+    RequestActor(actor): RequestActor,
     Json(SyncConnectionRequest { id }): Json<SyncConnectionRequest>,
 ) -> Result<Response, ApiError> {
     let command = ConnectionCommand::SyncConnection {
         connection_id: id.clone(),
     };
-    command_handler(&id, &state.command.connection, command).await?;
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &id,
+        &state.command.connection,
+        command,
+    )
+    .await?;
     Ok(StatusCode::OK.into_response())
 }
 
@@ -197,12 +231,20 @@ pub struct AcceptConnectionChangesRequest {
 )]
 pub(crate) async fn accept_connection_changes(
     State(state): State<Arc<IdentityState>>,
+    RequestActor(actor): RequestActor,
     Json(AcceptConnectionChangesRequest { id }): Json<AcceptConnectionChangesRequest>,
 ) -> Result<Response, ApiError> {
     let command = ConnectionCommand::AcceptConnectionChanges {
         connection_id: id.clone(),
     };
-    command_handler(&id, &state.command.connection, command).await?;
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &id,
+        &state.command.connection,
+        command,
+    )
+    .await?;
     Ok(StatusCode::OK.into_response())
 }
 
@@ -226,12 +268,20 @@ pub struct RemoveConnectionRequest {
 )]
 pub(crate) async fn remove_connection(
     State(state): State<Arc<IdentityState>>,
+    RequestActor(actor): RequestActor,
     Json(RemoveConnectionRequest { id }): Json<RemoveConnectionRequest>,
 ) -> Result<Response, ApiError> {
     let command = ConnectionCommand::RemoveConnection {
         connection_id: id.clone(),
     };
-    command_handler(&id, &state.command.connection, command).await?;
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &id,
+        &state.command.connection,
+        command,
+    )
+    .await?;
     Ok(StatusCode::OK.into_response())
 }
 
diff --git a/agent_api_http/src/v0/identity/documents/mod.rs b/agent_api_http/src/v0/identity/documents/mod.rs
index 55042b23..246d6fd3 100644
--- a/agent_api_http/src/v0/identity/documents/mod.rs
+++ b/agent_api_http/src/v0/identity/documents/mod.rs
@@ -1,3 +1,4 @@
+use crate::extractors::RequestActor;
 use crate::handlers::query_handler;
 use agent_identity::{document::aggregate::Document, state::IdentityState};
 use agent_shared::config::SupportedDidMethod;
@@ -34,26 +35,32 @@ pub struct GetDocumentsEndpoint {
 #[axum_macros::debug_handler]
 pub(crate) async fn get_documents(
     State(state): State<Arc<IdentityState>>,
+    RequestActor(actor): RequestActor,
     Query(GetDocumentsEndpoint { did_method }): Query<GetDocumentsEndpoint>,
 ) -> Result<Response, ApiError> {
     debug!("Request Params - did_method: {did_method:?}");
 
-    let filtered_documents = query_handler("all_documents", &state.query.all_documents)
-        .await?
-        .map(|all_documents_view| {
-            let filtered_documents: Vec<_> = all_documents_view
-                .documents
-                .into_values()
-                .filter(|document| {
-                    did_method
-                        .as_ref()
-                        .map_or(true, |method| document.did_method.as_ref() == Some(method))
-                })
-                .collect();
+    let filtered_documents = query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        "all_documents",
+        &state.query.all_documents,
+    )
+    .await?
+    .map(|all_documents_view| {
+        let filtered_documents: Vec<_> = all_documents_view
+            .documents
+            .into_values()
+            .filter(|document| {
+                did_method
+                    .as_ref()
+                    .map_or(true, |method| document.did_method.as_ref() == Some(method))
+            })
+            .collect();
 
-            filtered_documents
-        })
-        .unwrap_or_default();
+        filtered_documents
+    })
+    .unwrap_or_default();
 
     Ok((StatusCode::OK, Json(filtered_documents)).into_response())
 }
@@ -74,10 +81,16 @@ pub(crate) async fn get_documents(
 #[axum_macros::debug_handler]
 pub(crate) async fn get_document(
     State(state): State<Arc<IdentityState>>,
+    RequestActor(actor): RequestActor,
     Path(document_id): Path<String>,
 ) -> Result<Response, ApiError> {
-    query_handler(&document_id, &state.query.document)
-        .await?
-        .map(|document_view| (StatusCode::OK, Json(document_view)).into_response())
-        .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &document_id,
+        &state.query.document,
+    )
+    .await?
+    .map(|document_view| (StatusCode::OK, Json(document_view)).into_response())
+    .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
 }
diff --git a/agent_api_http/src/v0/identity/profiles/mod.rs b/agent_api_http/src/v0/identity/profiles/mod.rs
index 678ef8ae..d3dbcced 100644
--- a/agent_api_http/src/v0/identity/profiles/mod.rs
+++ b/agent_api_http/src/v0/identity/profiles/mod.rs
@@ -1,4 +1,5 @@
 use crate::error::IntoApiErrorExt;
+use crate::extractors::RequestActor;
 use crate::handlers::{command_handler, query_handler};
 use crate::utils::serde_explicit_null;
 use agent_identity::profile::aggregate::Source;
@@ -45,6 +46,7 @@ pub struct PatchProfileEndpointRequest {
 #[axum_macros::debug_handler]
 pub(crate) async fn patch_profile(
     State(state): State<Arc<IdentityState>>,
+    RequestActor(actor): RequestActor,
     Json(PatchProfileEndpointRequest {
         display_name,
         description,
@@ -60,7 +62,14 @@ pub(crate) async fn patch_profile(
             source: Source::Runtime,
         };
 
-        command_handler(&profile_id, &state.command.profile, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            &profile_id,
+            &state.command.profile,
+            command,
+        )
+        .await?;
     }
 
     if let Some(description) = description {
@@ -69,7 +78,14 @@ pub(crate) async fn patch_profile(
             source: Source::Runtime,
         };
 
-        command_handler(&profile_id, &state.command.profile, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            &profile_id,
+            &state.command.profile,
+            command,
+        )
+        .await?;
     }
 
     if let Some(logo) = logo {
@@ -78,7 +94,14 @@ pub(crate) async fn patch_profile(
             source: Source::Runtime,
         };
 
-        command_handler(&profile_id, &state.command.profile, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            &profile_id,
+            &state.command.profile,
+            command,
+        )
+        .await?;
     }
 
     if let Some(country) = country {
@@ -87,7 +110,14 @@ pub(crate) async fn patch_profile(
             source: Source::Runtime,
         };
 
-        command_handler(&profile_id, &state.command.profile, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            &profile_id,
+            &state.command.profile,
+            command,
+        )
+        .await?;
     }
 
     query_profile(&state).await.map_err(IntoApiErrorExt::into_api_error)?;
@@ -121,21 +151,29 @@ struct GetProfileEndpointResponse {
     )
 )]
 #[axum_macros::debug_handler]
-pub(crate) async fn get_profile(State(state): State<Arc<IdentityState>>) -> Result<Response, ApiError> {
-    query_handler(PROFILE_ID, &state.query.profile)
-        .await?
-        .map(|profile_view| {
-            (
-                StatusCode::OK,
-                Json(GetProfileEndpointResponse {
-                    display_name: profile_view.display_name,
-                    description: profile_view.description,
-                    logo: profile_view.logo,
-                    country: profile_view.country,
-                    source: profile_view.source,
-                }),
-            )
-                .into_response()
-        })
-        .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
+pub(crate) async fn get_profile(
+    State(state): State<Arc<IdentityState>>,
+    RequestActor(actor): RequestActor,
+) -> Result<Response, ApiError> {
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        PROFILE_ID,
+        &state.query.profile,
+    )
+    .await?
+    .map(|profile_view| {
+        (
+            StatusCode::OK,
+            Json(GetProfileEndpointResponse {
+                display_name: profile_view.display_name,
+                description: profile_view.description,
+                logo: profile_view.logo,
+                country: profile_view.country,
+                source: profile_view.source,
+            }),
+        )
+            .into_response()
+    })
+    .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
 }
diff --git a/agent_api_http/src/v0/identity/services/linked_vp.rs b/agent_api_http/src/v0/identity/services/linked_vp.rs
index 3d7180ad..ccd061a4 100644
--- a/agent_api_http/src/v0/identity/services/linked_vp.rs
+++ b/agent_api_http/src/v0/identity/services/linked_vp.rs
@@ -1,3 +1,4 @@
+use crate::extractors::RequestActor;
 use crate::handlers::{command_handler, query_handler};
 use agent_identity::{
     document::{aggregate::Status, command::DocumentCommand},
@@ -24,6 +25,7 @@ pub struct LinkedVPEndpointRequest {
 #[axum_macros::debug_handler]
 pub(crate) async fn linked_vp(
     State(state): State<Arc<IdentityState>>,
+    RequestActor(actor): RequestActor,
     Json(LinkedVPEndpointRequest { presentation_ids }): Json<LinkedVPEndpointRequest>,
 ) -> Result<Response, ApiError> {
     let service_id = "linked-verifiable-presentation-service".to_string();
@@ -34,9 +36,23 @@ pub(crate) async fn linked_vp(
     };
 
     // Create a linked verifiable presentation service.
-    command_handler(&service_id, &state.command.service, command).await?;
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &service_id,
+        &state.command.service,
+        command,
+    )
+    .await?;
 
-    let linked_verifiable_presentation_service = match query_handler(&service_id, &state.query.service).await? {
+    let linked_verifiable_presentation_service = match query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &service_id,
+        &state.query.service,
+    )
+    .await?
+    {
         Some(Service {
             service: Some(linked_verifiable_presentation_service),
             ..
@@ -46,24 +62,29 @@ pub(crate) async fn linked_vp(
     };
 
     // Query all DID Documents that require an update.
-    let document_ids: Vec<String> = query_handler("all_documents", &state.query.all_documents)
-        .await?
-        .map(|all_documents_view| {
-            all_documents_view
-                .documents
-                .into_values()
-                .filter(|document| {
-                    document.status != Status::Disabled
-                        && document
-                            .did_method
-                            .as_ref()
-                            .map(SupportedDidMethod::supports_update)
-                            .unwrap_or(false)
-                })
-                .map(|document| document.document_id)
-                .collect()
-        })
-        .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))?;
+    let document_ids: Vec<String> = query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        "all_documents",
+        &state.query.all_documents,
+    )
+    .await?
+    .map(|all_documents_view| {
+        all_documents_view
+            .documents
+            .into_values()
+            .filter(|document| {
+                document.status != Status::Disabled
+                    && document
+                        .did_method
+                        .as_ref()
+                        .map(SupportedDidMethod::supports_update)
+                        .unwrap_or(false)
+            })
+            .map(|document| document.document_id)
+            .collect()
+    })
+    .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))?;
 
     for document_id in &document_ids {
         let command = DocumentCommand::AddService {
@@ -71,30 +92,42 @@ pub(crate) async fn linked_vp(
             service: Box::new(linked_verifiable_presentation_service.clone()),
         };
 
-        command_handler(document_id, &state.command.document, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            document_id,
+            &state.command.document,
+            command,
+        )
+        .await?;
     }
 
     publish_decentrally_hosted_documents(&state)
         .await
         .map_err(|_| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))?;
 
-    query_handler("all_documents", &state.query.all_documents)
-        .await?
-        .map(|all_documents_view| {
-            let documents: Vec<_> = all_documents_view
-                .documents
-                .into_values()
-                .filter(|document| {
-                    document.status != Status::Disabled
-                        && document
-                            .did_method
-                            .as_ref()
-                            .map(SupportedDidMethod::supports_update)
-                            .unwrap_or(false)
-                })
-                .collect();
-            (StatusCode::OK, Json(documents)).into_response()
-        })
-        // TODO: this *should* be an impossible error, what should we return here?
-        .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        "all_documents",
+        &state.query.all_documents,
+    )
+    .await?
+    .map(|all_documents_view| {
+        let documents: Vec<_> = all_documents_view
+            .documents
+            .into_values()
+            .filter(|document| {
+                document.status != Status::Disabled
+                    && document
+                        .did_method
+                        .as_ref()
+                        .map(SupportedDidMethod::supports_update)
+                        .unwrap_or(false)
+            })
+            .collect();
+        (StatusCode::OK, Json(documents)).into_response()
+    })
+    // TODO: this *should* be an impossible error, what should we return here?
+    .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
 }
diff --git a/agent_api_http/src/v0/identity/services/mod.rs b/agent_api_http/src/v0/identity/services/mod.rs
index ce81bf4f..f4871da9 100644
--- a/agent_api_http/src/v0/identity/services/mod.rs
+++ b/agent_api_http/src/v0/identity/services/mod.rs
@@ -1,5 +1,6 @@
 pub mod linked_vp;
 
+use crate::extractors::RequestActor;
 use crate::handlers::query_handler;
 use agent_identity::state::IdentityState;
 use axum::{
@@ -12,11 +13,19 @@ use hyper::StatusCode;
 use std::sync::Arc;
 
 #[axum_macros::debug_handler]
-pub(crate) async fn services(State(state): State<Arc<IdentityState>>) -> Result<Response, ApiError> {
-    let all_services = query_handler("all_services", &state.query.all_services)
-        .await?
-        .map(|all_services_view| all_services_view.services.into_values().collect::<Vec<_>>())
-        .unwrap_or_default();
+pub(crate) async fn services(
+    State(state): State<Arc<IdentityState>>,
+    RequestActor(actor): RequestActor,
+) -> Result<Response, ApiError> {
+    let all_services = query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        "all_services",
+        &state.query.all_services,
+    )
+    .await?
+    .map(|all_services_view| all_services_view.services.into_values().collect::<Vec<_>>())
+    .unwrap_or_default();
 
     Ok((StatusCode::OK, Json(all_services)).into_response())
 }
@@ -24,10 +33,16 @@ pub(crate) async fn services(State(state): State<Arc<IdentityState>>) -> Result<
 #[axum_macros::debug_handler]
 pub(crate) async fn service(
     State(state): State<Arc<IdentityState>>,
+    RequestActor(actor): RequestActor,
     Path(service_id): Path<String>,
 ) -> Result<Response, ApiError> {
-    query_handler(&service_id, &state.query.service)
-        .await?
-        .map(|service_view| (StatusCode::OK, Json(service_view)).into_response())
-        .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &service_id,
+        &state.query.service,
+    )
+    .await?
+    .map(|service_view| (StatusCode::OK, Json(service_view)).into_response())
+    .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
 }
diff --git a/agent_api_http/src/v0/identity/well_known/did.rs b/agent_api_http/src/v0/identity/well_known/did.rs
index e8299e9c..a991a555 100644
--- a/agent_api_http/src/v0/identity/well_known/did.rs
+++ b/agent_api_http/src/v0/identity/well_known/did.rs
@@ -1,4 +1,3 @@
-use crate::handlers::query_handler;
 use agent_identity::{document::aggregate::Status, state::IdentityState};
 use agent_shared::config::SupportedDidMethod;
 use axum::{
@@ -10,9 +9,11 @@ use http_api_problem::ApiError;
 use hyper::StatusCode;
 use std::sync::Arc;
 
+use crate::handlers::public_query_handler;
+
 #[axum_macros::debug_handler]
 pub(crate) async fn did(State(state): State<Arc<IdentityState>>) -> Result<Response, ApiError> {
-    query_handler("all_documents", &state.query.all_documents)
+    public_query_handler("all_documents", &state.query.all_documents)
         .await?
         .and_then(|all_documents_view| {
             all_documents_view.documents.into_values().find_map(|document| {
diff --git a/agent_api_http/src/v0/identity/well_known/did_configuration.rs b/agent_api_http/src/v0/identity/well_known/did_configuration.rs
index 95ae9840..f58f9ebb 100644
--- a/agent_api_http/src/v0/identity/well_known/did_configuration.rs
+++ b/agent_api_http/src/v0/identity/well_known/did_configuration.rs
@@ -1,4 +1,3 @@
-use crate::handlers::query_handler;
 use agent_identity::{
     service::{aggregate::ServiceResource, views::ServiceView},
     state::{IdentityState, DOMAIN_LINKAGE_SERVICE_ID},
@@ -12,10 +11,12 @@ use http_api_problem::ApiError;
 use hyper::StatusCode;
 use std::sync::Arc;
 
+use crate::handlers::public_query_handler;
+
 #[axum_macros::debug_handler]
 pub(crate) async fn did_configuration(State(state): State<Arc<IdentityState>>) -> Result<Response, ApiError> {
     // Get the DID Configuration Resource if it exists.
-    match query_handler(DOMAIN_LINKAGE_SERVICE_ID, &state.query.service).await? {
+    match public_query_handler(DOMAIN_LINKAGE_SERVICE_ID, &state.query.service).await? {
         Some(ServiceView {
             is_deleted: false,
             resource: Some(ServiceResource::DomainLinkage(domain_linkage_configuration)),
diff --git a/agent_api_http/src/v0/issuance/credential_configurations.rs b/agent_api_http/src/v0/issuance/credential_configurations.rs
new file mode 100644
index 00000000..4a179ac3
--- /dev/null
+++ b/agent_api_http/src/v0/issuance/credential_configurations.rs
@@ -0,0 +1,47 @@
+use crate::extractors::RequestActor;
+use crate::handlers::command_handler;
+use agent_issuance::server_config::command::ServerConfigCommand;
+use agent_issuance::state::{IssuanceState, SERVER_CONFIG_ID};
+use agent_shared::config::CredentialConfiguration;
+use axum::{
+    extract::{Json, State},
+    http::StatusCode,
+    response::{IntoResponse, Response},
+};
+use http_api_problem::ApiError;
+use std::sync::Arc;
+
+/// Update credential configuration
+///
+/// Publishes the provided credential configuration.
+#[utoipa::path(
+    post,
+    path = "/credential-configurations",
+    operation_id = "set_credential_configuration",
+    tags = ["Issuance"],
+    responses(
+        (status = 201, description = "Credential configuration updated successfully")
+    )
+)]
+#[axum_macros::debug_handler]
+pub(crate) async fn credential_configurations(
+    State(state): State<Arc<IssuanceState>>,
+    RequestActor(actor): RequestActor,
+    Json(credential_configuration): Json<CredentialConfiguration>,
+) -> Result<Response, ApiError> {
+    let command = ServerConfigCommand::UpdateCredentialConfiguration {
+        credential_configuration: credential_configuration.clone(),
+        provisioned: false,
+    };
+
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        SERVER_CONFIG_ID,
+        &state.command.server_config,
+        command,
+    )
+    .await?;
+
+    Ok((StatusCode::CREATED, Json(credential_configuration)).into_response())
+}
diff --git a/agent_api_http/src/v0/issuance/credential_issuer/credential.rs b/agent_api_http/src/v0/issuance/credential_issuer/credential.rs
index 959e2121..06a6229a 100644
--- a/agent_api_http/src/v0/issuance/credential_issuer/credential.rs
+++ b/agent_api_http/src/v0/issuance/credential_issuer/credential.rs
@@ -1,9 +1,8 @@
 use std::time::{Duration, Instant};
 
 use crate::{
-    handlers::{command_handler, query_handler},
-    v0::issuance::error::internal_server_error,
-    v0::issuance::error::PublicError,
+    handlers::{public_command_handler, public_query_handler},
+    v0::issuance::error::{internal_server_error, PublicError},
 };
 use agent_issuance::{
     application::{
@@ -54,7 +53,7 @@ pub(crate) async fn credential(
 
     // Get the `credential_issuer_metadata` and `authorization_server_metadata` from the `ServerConfigView`.
     let (credential_issuer_metadata, authorization_server_metadata) =
-        match query_handler(SERVER_CONFIG_ID, &state.query.server_config).await? {
+        match public_query_handler(SERVER_CONFIG_ID, &state.query.server_config).await? {
             Some(ServerConfigView {
                 credential_issuer_metadata,
                 authorization_server_metadata,
@@ -78,7 +77,7 @@ pub(crate) async fn credential(
     };
 
     // Use the `offer_id` to verify the `proof` inside the `CredentialRequest`.
-    command_handler(&offer_id, &state.command.offer, command).await?;
+    public_command_handler(&offer_id, &state.command.offer, command).await?;
 
     let timeout = config().external_server_response_timeout_ms;
     let start_time = Instant::now();
@@ -86,7 +85,7 @@ pub(crate) async fn credential(
     // TODO: replace this polling solution with a call to the `TxChannelRegistry` as described here: https://github.com/impierce/ssi-agent/issues/75
     // Use the `offer_id` to get the `credential_ids` and `subject_id` from the `OfferView`.
     let (credential_ids, subject_id) = loop {
-        match query_handler(&offer_id, &state.query.offer).await? {
+        match public_query_handler(&offer_id, &state.query.offer).await? {
             // When the Offer does not include the credential id's yet, wait for the external server to provide them.
             Some(OfferView { credential_ids, .. }) if credential_ids.is_empty() => {
                 if start_time.elapsed().as_millis() <= timeout as u128 {
@@ -109,7 +108,7 @@ pub(crate) async fn credential(
         }
     };
 
-    let all_status_lists = query_handler("all_status_lists", &state.query.all_status_lists)
+    let all_status_lists = public_query_handler("all_status_lists", &state.query.all_status_lists)
         .await?
         .map(|all_status_lists_view| all_status_lists_view.status_lists.into_values().collect::<Vec<_>>())
         .unwrap_or_default();
@@ -131,7 +130,7 @@ pub(crate) async fn credential(
             let id = TEST_STATUS_LIST_ID.to_string();
 
             let command = StatusListCommand::CreateStatusList { id: id.clone() };
-            command_handler(&id, &state.command.status_list, command).await?;
+            public_command_handler(&id, &state.command.status_list, command).await?;
 
             id
         }
@@ -144,9 +143,9 @@ pub(crate) async fn credential(
             status: StatusType::VALID,
         };
 
-        command_handler(&status_list_id, &state.command.status_list, command).await?;
+        public_command_handler(&status_list_id, &state.command.status_list, command).await?;
 
-        let status_list = query_handler(&status_list_id, &state.query.status_list)
+        let status_list = public_query_handler(&status_list_id, &state.query.status_list)
             .await?
             .ok_or(PublicError::InternalServerError)?;
 
@@ -163,9 +162,9 @@ pub(crate) async fn credential(
                 .ok_or(PublicError::InternalServerError)?, // TODO: even though the AddIndex command is executed right before this, retrieving the index this way is not the prettiest since something of a "data race" could occur where another index has already been added between the AddIndex command and this command. Then two credentials would be assigned the same index, as they both retrieve the same last index.
         };
 
-        command_handler(&credential_id, &state.command.credential, command).await?;
+        public_command_handler(&credential_id, &state.command.credential, command).await?;
 
-        let signed_credential = match query_handler(&credential_id, &state.query.credential).await? {
+        let signed_credential = match public_query_handler(&credential_id, &state.query.credential).await? {
             Some(CredentialView {
                 signed: Some(signed_credential),
                 notification_id,
@@ -183,10 +182,10 @@ pub(crate) async fn credential(
     };
 
     // Use the `offer_id` to create a `CredentialResponse` from the `CredentialRequest` and `credentials`.
-    command_handler(&offer_id, &state.command.offer, command).await?;
+    public_command_handler(&offer_id, &state.command.offer, command).await?;
 
     // Use the `offer_id` to get the `credential_response` from the `OfferView`.
-    query_handler(&offer_id, &state.query.offer)
+    public_query_handler(&offer_id, &state.query.offer)
         .await?
         .and_then(|offer_view| offer_view.credential_response)
         .map(|credential_response| (StatusCode::OK, Json(credential_response)).into_response())
@@ -339,9 +338,15 @@ pub mod tests {
         let command = agent_issuance::nonce::command::NonceCommand::GenerateNonce {
             c_nonce: TEST_NONCE.to_string(),
         };
-        agent_shared::handlers::command_handler(TEST_NONCE, &issuance_state.command.nonce, command)
-            .await
-            .unwrap();
+        agent_shared::handlers::command_handler(
+            issuance_state.authorization_checker.clone(),
+            None,
+            TEST_NONCE,
+            &issuance_state.command.nonce,
+            command,
+        )
+        .await
+        .unwrap();
 
         let response = issuance_app
             .oneshot(
@@ -443,9 +448,15 @@ pub mod tests {
         let command = agent_issuance::nonce::command::NonceCommand::GenerateNonce {
             c_nonce: TEST_NONCE.to_string(),
         };
-        agent_shared::handlers::command_handler(TEST_NONCE, &issuance_state.command.nonce, command)
-            .await
-            .unwrap();
+        agent_shared::handlers::command_handler(
+            issuance_state.authorization_checker.clone(),
+            None,
+            TEST_NONCE,
+            &issuance_state.command.nonce,
+            command,
+        )
+        .await
+        .unwrap();
 
         let mut issuance_app = router((issuance_state.clone(), library_state));
 
diff --git a/agent_api_http/src/v0/issuance/credential_issuer/credential_offer.rs b/agent_api_http/src/v0/issuance/credential_issuer/credential_offer.rs
index 03fa323e..992521af 100644
--- a/agent_api_http/src/v0/issuance/credential_issuer/credential_offer.rs
+++ b/agent_api_http/src/v0/issuance/credential_issuer/credential_offer.rs
@@ -1,4 +1,4 @@
-use crate::handlers::query_handler;
+use crate::handlers::public_query_handler;
 use crate::v0::issuance::public_offers::can_resolve_public_offer;
 use agent_issuance::{offer::aggregate::Offer, state::IssuanceState};
 use axum::{
@@ -20,7 +20,7 @@ pub(crate) async fn credential_offer_uri(
         return Err(ApiError::new(StatusCode::NOT_FOUND));
     }
 
-    match query_handler(&offer_id, &state.query.offer).await? {
+    match public_query_handler(&offer_id, &state.query.offer).await? {
         Some(Offer {
             credential_offer: Some(CredentialOffer::CredentialOffer(credential_offer_parameters)),
             ..
diff --git a/agent_api_http/src/v0/issuance/credential_issuer/notification.rs b/agent_api_http/src/v0/issuance/credential_issuer/notification.rs
index 094d9646..c52358d4 100644
--- a/agent_api_http/src/v0/issuance/credential_issuer/notification.rs
+++ b/agent_api_http/src/v0/issuance/credential_issuer/notification.rs
@@ -1,4 +1,4 @@
-use crate::handlers::{command_handler, query_handler};
+use crate::handlers::{public_command_handler, public_query_handler};
 use crate::v0::issuance::error::{internal_server_error, PublicError};
 use agent_issuance::application::access_token_validation_service::AccessTokenValidationService;
 use agent_issuance::{credential::command::CredentialCommand, state::IssuanceState};
@@ -30,7 +30,7 @@ pub async fn notification(
     let notification_request: NotificationRequest = serde_json::from_value::<NotificationRequest>(raw_value)
         .map_err(|_| PublicError::from(NotificationErrorResponse::InvalidNotificationRequest))?;
 
-    let credentials = match query_handler("all_credentials", &state.query.all_credentials).await? {
+    let credentials = match public_query_handler("all_credentials", &state.query.all_credentials).await? {
         Some(all_credentials) => all_credentials.credentials,
         _ => return Err(internal_server_error()),
     };
@@ -53,7 +53,7 @@ pub async fn notification(
         notification: notification_request,
     };
 
-    command_handler(&credential_id, &state.command.credential, command).await?;
+    public_command_handler(&credential_id, &state.command.credential, command).await?;
 
     Ok(StatusCode::NO_CONTENT.into_response())
 }
diff --git a/agent_api_http/src/v0/issuance/credential_issuer/token_status_list.rs b/agent_api_http/src/v0/issuance/credential_issuer/token_status_list.rs
index fb52df17..234d2a54 100644
--- a/agent_api_http/src/v0/issuance/credential_issuer/token_status_list.rs
+++ b/agent_api_http/src/v0/issuance/credential_issuer/token_status_list.rs
@@ -157,9 +157,15 @@ pub mod tests {
         let command = agent_issuance::nonce::command::NonceCommand::GenerateNonce {
             c_nonce: TEST_NONCE.to_string(),
         };
-        agent_shared::handlers::command_handler(TEST_NONCE, &issuance_state.command.nonce, command)
-            .await
-            .unwrap();
+        agent_shared::handlers::command_handler(
+            issuance_state.authorization_checker.clone(),
+            None,
+            TEST_NONCE,
+            &issuance_state.command.nonce,
+            command,
+        )
+        .await
+        .unwrap();
 
         let credential_endpoint = credentials(app).await;
 
diff --git a/agent_api_http/src/v0/issuance/credential_issuer/well_known/oauth_authorization_server.rs b/agent_api_http/src/v0/issuance/credential_issuer/well_known/oauth_authorization_server.rs
index c5e293e0..8bc25467 100644
--- a/agent_api_http/src/v0/issuance/credential_issuer/well_known/oauth_authorization_server.rs
+++ b/agent_api_http/src/v0/issuance/credential_issuer/well_known/oauth_authorization_server.rs
@@ -1,4 +1,3 @@
-use crate::handlers::query_handler;
 use agent_issuance::{
     server_config::views::ServerConfigView,
     state::{IssuanceState, SERVER_CONFIG_ID},
@@ -11,10 +10,12 @@ use axum::{
 use http_api_problem::ApiError;
 use std::sync::Arc;
 
+use crate::handlers::public_query_handler;
+
 // TODO: move this to `authorization/authorization_server/well_known.rs`!
 #[axum_macros::debug_handler]
 pub(crate) async fn oauth_authorization_server(State(state): State<Arc<IssuanceState>>) -> Result<Response, ApiError> {
-    match query_handler(SERVER_CONFIG_ID, &state.query.server_config).await? {
+    match public_query_handler(SERVER_CONFIG_ID, &state.query.server_config).await? {
         Some(ServerConfigView {
             authorization_server_metadata,
             ..
diff --git a/agent_api_http/src/v0/issuance/credential_issuer/well_known/openid_credential_issuer.rs b/agent_api_http/src/v0/issuance/credential_issuer/well_known/openid_credential_issuer.rs
index 110a3e31..771628d9 100644
--- a/agent_api_http/src/v0/issuance/credential_issuer/well_known/openid_credential_issuer.rs
+++ b/agent_api_http/src/v0/issuance/credential_issuer/well_known/openid_credential_issuer.rs
@@ -1,4 +1,3 @@
-use crate::handlers::query_handler;
 use agent_issuance::{
     server_config::views::ServerConfigView,
     state::{IssuanceState, SERVER_CONFIG_ID},
@@ -13,9 +12,11 @@ use http_api_problem::ApiError;
 use serde_json::json;
 use std::sync::Arc;
 
+use crate::handlers::public_query_handler;
+
 #[axum_macros::debug_handler]
 pub(crate) async fn openid_credential_issuer(State(state): State<Arc<IssuanceState>>) -> Result<Response, ApiError> {
-    match query_handler(SERVER_CONFIG_ID, &state.query.server_config).await? {
+    match public_query_handler(SERVER_CONFIG_ID, &state.query.server_config).await? {
         Some(ServerConfigView {
             mut credential_issuer_metadata,
             ..
diff --git a/agent_api_http/src/v0/issuance/credentials.rs b/agent_api_http/src/v0/issuance/credentials.rs
index d72ff846..fb3a421d 100644
--- a/agent_api_http/src/v0/issuance/credentials.rs
+++ b/agent_api_http/src/v0/issuance/credentials.rs
@@ -1,4 +1,5 @@
 use crate::error::type_url;
+use crate::extractors::RequestActor;
 use crate::handlers::{command_handler, query_handler};
 use crate::API_VERSION;
 use agent_issuance::status_list::command::StatusListCommand;
@@ -47,12 +48,18 @@ use std::sync::Arc;
 #[axum_macros::debug_handler]
 pub(crate) async fn credential(
     State(state): State<Arc<IssuanceState>>,
+    RequestActor(actor): RequestActor,
     Path(credential_id): Path<String>,
 ) -> Result<Response, ApiError> {
-    query_handler(&credential_id, &state.query.credential)
-        .await?
-        .map(|credential_view| (StatusCode::OK, Json(credential_view)).into_response())
-        .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &credential_id,
+        &state.query.credential,
+    )
+    .await?
+    .map(|credential_view| (StatusCode::OK, Json(credential_view)).into_response())
+    .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
 }
 
 #[derive(Deserialize, Serialize, utoipa::ToSchema)]
@@ -83,7 +90,8 @@ pub struct CredentialsEndpointRequest {
 )]
 #[axum_macros::debug_handler]
 pub(crate) async fn credentials(
-    State(issuance_state): State<Arc<IssuanceState>>,
+    State(state): State<Arc<IssuanceState>>,
+    RequestActor(actor): RequestActor,
     Extension(library_state): Extension<Arc<LibraryState>>,
     Json(CredentialsEndpointRequest {
         template_id,
@@ -108,16 +116,21 @@ pub(crate) async fn credentials(
     }
 
     // Look up the template by ID.
-    let template: Template = query_handler(&template_id, &library_state.query.template)
-        .await?
-        .filter(|t| t.status != TemplateStatus::Deleted)
-        .ok_or_else(|| {
-            ApiError::builder(StatusCode::NOT_FOUND)
-                .title("Template Not Found")
-                .type_url(type_url("issuance#template-not-found"))
-                .message(format!("No template found with id: `{template_id}`"))
-                .finish()
-        })?;
+    let template: Template = query_handler(
+        library_state.authorization_checker.clone(),
+        actor.clone(),
+        &template_id,
+        &library_state.query.template,
+    )
+    .await?
+    .filter(|t| t.status != TemplateStatus::Deleted)
+    .ok_or_else(|| {
+        ApiError::builder(StatusCode::NOT_FOUND)
+            .title("Template Not Found")
+            .type_url(type_url("issuance#template-not-found"))
+            .message(format!("No template found with id: `{template_id}`"))
+            .finish()
+    })?;
 
     if template.status != TemplateStatus::Published {
         return Err(ApiError::builder(StatusCode::UNPROCESSABLE_ENTITY)
@@ -141,24 +154,28 @@ pub(crate) async fn credentials(
         }
     }
 
-    let (_, credential_configuration, authorization) =
-        query_handler(SERVER_CONFIG_ID, &issuance_state.query.server_config)
-            .await?
-            .and_then(|server_config_view| {
-                server_config_view
-                    .credential_configurations
-                    .get(&credential_configuration_id)
-                    .cloned()
-            })
-            .ok_or_else(|| {
-                ApiError::builder(StatusCode::NOT_FOUND)
-                    .title("No Credential Configuration Found")
-                    .type_url(type_url("issuance#no-credential-configuration-found"))
-                    .message(format!(
-                        "No Credential Configuration found with id: `{credential_configuration_id}`"
-                    ))
-                    .finish()
-            })?;
+    let (_, credential_configuration, authorization) = query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        SERVER_CONFIG_ID,
+        &state.query.server_config,
+    )
+    .await?
+    .and_then(|server_config_view| {
+        server_config_view
+            .credential_configurations
+            .get(&credential_configuration_id)
+            .cloned()
+    })
+    .ok_or_else(|| {
+        ApiError::builder(StatusCode::NOT_FOUND)
+            .title("No Credential Configuration Found")
+            .type_url(type_url("issuance#no-credential-configuration-found"))
+            .message(format!(
+                "No Credential Configuration found with id: `{credential_configuration_id}`"
+            ))
+            .finish()
+    })?;
 
     let command = if is_signed {
         // For a signed credential, ensure that the credential is a string.
@@ -217,10 +234,25 @@ pub(crate) async fn credentials(
     };
 
     // Create an unsigned/signed credential.
-    command_handler(&credential_id, &issuance_state.command.credential, command).await?;
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &credential_id,
+        &state.command.credential,
+        command,
+    )
+    .await?;
 
     // Create an offer if it does not exist yet.
-    if query_handler(&offer_id, &issuance_state.query.offer).await?.is_none() {
+    if query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &offer_id,
+        &state.query.offer,
+    )
+    .await?
+    .is_none()
+    {
         // Extract the tx_code_constraints from the credential configuration if available.
         let tx_code_constraints = authorization
             .pre_authorized
@@ -241,7 +273,14 @@ pub(crate) async fn credentials(
             delivery_options: None,
         };
 
-        command_handler(&offer_id, &issuance_state.command.offer, command).await?
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            &offer_id,
+            &state.command.offer,
+            command,
+        )
+        .await?
     };
 
     let command = OfferCommand::AddCredentials {
@@ -251,27 +290,39 @@ pub(crate) async fn credentials(
     };
 
     // Add the credential to the offer.
-    command_handler(&offer_id, &issuance_state.command.offer, command).await?;
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &offer_id,
+        &state.command.offer,
+        command,
+    )
+    .await?;
 
     // Return the credential.
-    query_handler(&credential_id, &issuance_state.query.credential)
-        .await?
-        .and_then(|credential_view| {
-            if is_signed {
-                credential_view.signed
-            } else {
-                credential_view.data.map(|data| data.raw)
-            }
-        })
-        .map(|credential_body| {
-            (
-                StatusCode::CREATED,
-                [(header::LOCATION, &format!("{API_VERSION}/credentials/{credential_id}"))],
-                Json(credential_body),
-            )
-                .into_response()
-        })
-        .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &credential_id,
+        &state.query.credential,
+    )
+    .await?
+    .and_then(|credential_view| {
+        if is_signed {
+            credential_view.signed
+        } else {
+            credential_view.data.map(|data| data.raw)
+        }
+    })
+    .map(|credential_body| {
+        (
+            StatusCode::CREATED,
+            [(header::LOCATION, &format!("{API_VERSION}/credentials/{credential_id}"))],
+            Json(credential_body),
+        )
+            .into_response()
+    })
+    .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -397,11 +448,19 @@ fn invalid_signed_credential_format_error(message: impl Into<String>) -> ApiErro
     )
 )]
 #[axum_macros::debug_handler]
-pub(crate) async fn all_credentials(State(issuance_state): State<Arc<IssuanceState>>) -> Result<Response, ApiError> {
-    let all_credentials = query_handler("all_credentials", &issuance_state.query.all_credentials)
-        .await?
-        .map(|all_credentials_view| all_credentials_view.credentials.into_values().collect::<Vec<_>>())
-        .unwrap_or_default();
+pub(crate) async fn all_credentials(
+    State(state): State<Arc<IssuanceState>>,
+    RequestActor(actor): RequestActor,
+) -> Result<Response, ApiError> {
+    let all_credentials = query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        "all_credentials",
+        &state.query.all_credentials,
+    )
+    .await?
+    .map(|all_credentials_view| all_credentials_view.credentials.into_values().collect::<Vec<_>>())
+    .unwrap_or_default();
 
     Ok((StatusCode::OK, Json(all_credentials)).into_response())
 }
@@ -415,12 +474,20 @@ pub struct PatchCredentialEndpointRequest {
 /// Currently, this endpoint only supports patching the CredentialStatus of a credential according to the IETF OAuth Token Status List spec.
 pub async fn patch_credential(
     State(state): State<Arc<IssuanceState>>,
+    RequestActor(actor): RequestActor,
     Path(credential_id): Path<String>,
     Json(PatchCredentialEndpointRequest {
         credential_status: status,
     }): Json<PatchCredentialEndpointRequest>,
 ) -> Result<Response, ApiError> {
-    if let Some(credential) = query_handler(&credential_id, &state.query.credential).await? {
+    if let Some(credential) = query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &credential_id,
+        &state.query.credential,
+    )
+    .await?
+    {
         let credential_status = CredentialStatus {
             index: credential.credential_status.index,
             status,
@@ -432,7 +499,14 @@ pub async fn patch_credential(
             credential_status: credential_status.clone(),
         };
 
-        command_handler(&credential_id, &state.command.credential, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            &credential_id,
+            &state.command.credential,
+            command,
+        )
+        .await?;
 
         let command = StatusListCommand::UpdateIndex {
             index: credential_status.index,
@@ -445,7 +519,14 @@ pub async fn patch_credential(
             .next_back()
             .ok_or(ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))?; // This is an Internal Server Error because if this line fails that means we stored an incorect URL in our own credential.
 
-        command_handler(status_list_id, &state.command.status_list, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            status_list_id,
+            &state.command.status_list,
+            command,
+        )
+        .await?;
 
         Ok(StatusCode::NO_CONTENT.into_response())
     } else {
@@ -755,6 +836,8 @@ pub mod tests {
         let template_id = TEMPLATE_ID.to_string();
 
         command_handler(
+            library_state.authorization_checker.clone(),
+            None,
             &template_id,
             &library_state.command.template,
             TemplateCommand::CreateNewTemplate {
diff --git a/agent_api_http/src/v0/issuance/ietf_oauth_sd_jwt_vc.rs b/agent_api_http/src/v0/issuance/ietf_oauth_sd_jwt_vc.rs
index 4d850471..51041b76 100644
--- a/agent_api_http/src/v0/issuance/ietf_oauth_sd_jwt_vc.rs
+++ b/agent_api_http/src/v0/issuance/ietf_oauth_sd_jwt_vc.rs
@@ -1,4 +1,4 @@
-use crate::{handlers::query_handler, v0::issuance::error::PublicError};
+use crate::{handlers::public_query_handler, v0::issuance::error::PublicError};
 use agent_issuance::state::{IssuanceState, SERVER_CONFIG_ID};
 use axum::{
     extract::{Path, State},
@@ -25,7 +25,7 @@ pub(crate) async fn type_metadata(
         .ok_or(PublicError::NotFoundError)?;
 
     // Check if the credential configuration IDs are valid.
-    let credential_configuration = query_handler(SERVER_CONFIG_ID, &state.query.server_config)
+    let credential_configuration = public_query_handler(SERVER_CONFIG_ID, &state.query.server_config)
         .await?
         .and_then(|server_config_view| {
             server_config_view
diff --git a/agent_api_http/src/v0/issuance/nonce/mod.rs b/agent_api_http/src/v0/issuance/nonce/mod.rs
index dc557e3b..8e2bf75e 100644
--- a/agent_api_http/src/v0/issuance/nonce/mod.rs
+++ b/agent_api_http/src/v0/issuance/nonce/mod.rs
@@ -1,6 +1,6 @@
+use crate::handlers::public_command_handler;
 use agent_issuance::{nonce::command::NonceCommand, state::IssuanceState};
 use agent_shared::generate_random_string;
-use agent_shared::handlers::command_handler;
 use axum::{
     extract::State,
     http::{header::CACHE_CONTROL, HeaderMap, StatusCode},
@@ -19,7 +19,7 @@ pub(crate) async fn nonce(State(state): State<Arc<IssuanceState>>) -> Result<Res
         c_nonce: fresh_c_nonce.clone(),
     };
 
-    command_handler(&fresh_c_nonce, &state.command.nonce, command)
+    public_command_handler(&fresh_c_nonce, &state.command.nonce, command)
         .await
         .map_err(|_| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))?;
 
diff --git a/agent_api_http/src/v0/issuance/offers/mod.rs b/agent_api_http/src/v0/issuance/offers/mod.rs
index 220e77b1..d1a08755 100644
--- a/agent_api_http/src/v0/issuance/offers/mod.rs
+++ b/agent_api_http/src/v0/issuance/offers/mod.rs
@@ -1,5 +1,6 @@
 pub mod send;
 
+use crate::extractors::RequestActor;
 use crate::{
     error::type_url,
     handlers::{command_handler, query_handler},
@@ -36,6 +37,7 @@ pub struct OffersEndpointRequest {
 #[axum_macros::debug_handler]
 pub(crate) async fn offers(
     State(state): State<Arc<IssuanceState>>,
+    RequestActor(actor): RequestActor,
     Extension(library_state): Extension<Arc<LibraryState>>,
     Json(OffersEndpointRequest {
         offer_id,
@@ -55,16 +57,21 @@ pub(crate) async fn offers(
     let mut templates = Vec::with_capacity(template_ids.len());
 
     for template_id in &template_ids {
-        let template: Template = query_handler(template_id, &library_state.query.template)
-            .await?
-            .filter(|t| t.status != TemplateStatus::Deleted)
-            .ok_or_else(|| {
-                ApiError::builder(StatusCode::UNPROCESSABLE_ENTITY)
-                    .title("Template Not Found")
-                    .type_url(type_url("issuance#template-not-found"))
-                    .message(format!("No template found with id: `{template_id}`"))
-                    .finish()
-            })?;
+        let template: Template = query_handler(
+            library_state.authorization_checker.clone(),
+            actor.clone(),
+            template_id,
+            &library_state.query.template,
+        )
+        .await?
+        .filter(|t| t.status != TemplateStatus::Deleted)
+        .ok_or_else(|| {
+            ApiError::builder(StatusCode::UNPROCESSABLE_ENTITY)
+                .title("Template Not Found")
+                .type_url(type_url("issuance#template-not-found"))
+                .message(format!("No template found with id: `{template_id}`"))
+                .finish()
+        })?;
 
         // Template must be in "Published" status
         if template.status != TemplateStatus::Published {
@@ -96,7 +103,16 @@ pub(crate) async fn offers(
         GrantType::AuthorizationCode
     }];
 
-    if query_handler(&offer_id, &state.query.offer).await?.is_none() {
+    // Create an offer if it does not exist yet.
+    if query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &offer_id,
+        &state.query.offer,
+    )
+    .await?
+    .is_none()
+    {
         let command = OfferCommand::CreateCredentialOffer {
             offer_id: offer_id.clone(),
             template_ids,
@@ -105,22 +121,34 @@ pub(crate) async fn offers(
             delivery_options,
         };
 
-        command_handler(&offer_id, &state.command.offer, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            &offer_id,
+            &state.command.offer,
+            command,
+        )
+        .await?;
     }
 
-    query_handler(&offer_id, &state.query.offer)
-        .await?
-        .and_then(|offer_view| offer_view.form_url_encoded_credential_offer)
-        .map(|form_url_encoded_credential_offer| {
-            (
-                StatusCode::OK,
-                [(header::CONTENT_TYPE, "application/x-www-form-urlencoded")],
-                form_url_encoded_credential_offer,
-            )
-                .into_response()
-        })
-        // Unreachable error
-        .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &offer_id,
+        &state.query.offer,
+    )
+    .await?
+    .and_then(|offer_view| offer_view.form_url_encoded_credential_offer)
+    .map(|form_url_encoded_credential_offer| {
+        (
+            StatusCode::OK,
+            [(header::CONTENT_TYPE, "application/x-www-form-urlencoded")],
+            form_url_encoded_credential_offer,
+        )
+            .into_response()
+    })
+    // Unreachable error
+    .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
 }
 
 /// Get all offers
@@ -136,11 +164,19 @@ pub(crate) async fn offers(
     )
 )]
 #[axum_macros::debug_handler]
-pub(crate) async fn all_offers(State(state): State<Arc<IssuanceState>>) -> Result<Response, ApiError> {
-    let all_offers = query_handler("all_offers", &state.query.all_offers)
-        .await?
-        .map(|all_offers_view| all_offers_view.offers.into_values().collect::<Vec<_>>())
-        .unwrap_or_default();
+pub(crate) async fn all_offers(
+    State(state): State<Arc<IssuanceState>>,
+    RequestActor(actor): RequestActor,
+) -> Result<Response, ApiError> {
+    let all_offers = query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        "all_offers",
+        &state.query.all_offers,
+    )
+    .await?
+    .map(|all_offers_view| all_offers_view.offers.into_values().collect::<Vec<_>>())
+    .unwrap_or_default();
 
     Ok((StatusCode::OK, Json(all_offers)).into_response())
 }
@@ -161,12 +197,18 @@ pub(crate) async fn all_offers(State(state): State<Arc<IssuanceState>>) -> Resul
 #[axum_macros::debug_handler]
 pub(crate) async fn offer(
     State(state): State<Arc<IssuanceState>>,
+    RequestActor(actor): RequestActor,
     Path(offer_id): Path<String>,
 ) -> Result<Response, ApiError> {
-    query_handler(&offer_id, &state.query.offer)
-        .await?
-        .map(|offer_view| (StatusCode::OK, Json(offer_view)).into_response())
-        .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &offer_id,
+        &state.query.offer,
+    )
+    .await?
+    .map(|offer_view| (StatusCode::OK, Json(offer_view)).into_response())
+    .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
 }
 
 #[cfg(test)]
diff --git a/agent_api_http/src/v0/issuance/offers/send.rs b/agent_api_http/src/v0/issuance/offers/send.rs
index 5197d623..d297f47b 100644
--- a/agent_api_http/src/v0/issuance/offers/send.rs
+++ b/agent_api_http/src/v0/issuance/offers/send.rs
@@ -1,3 +1,4 @@
+use crate::extractors::RequestActor;
 use crate::handlers::command_handler;
 use agent_issuance::{offer::aggregate::DeliveryMethod, offer::command::OfferCommand, state::IssuanceState};
 use axum::{
@@ -33,6 +34,7 @@ pub struct EmailOfferEndpointRequest {
 #[axum_macros::debug_handler]
 pub(crate) async fn individual_offer(
     State(state): State<Arc<IssuanceState>>,
+    RequestActor(actor): RequestActor,
     Json(EmailOfferEndpointRequest {
         offer_id,
         recipient_email,
@@ -44,7 +46,14 @@ pub(crate) async fn individual_offer(
     };
 
     // Send the Credential Offer to the recipient's email.
-    command_handler(&offer_id, &state.command.offer, command).await?;
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &offer_id,
+        &state.command.offer,
+        command,
+    )
+    .await?;
 
     Ok(StatusCode::OK.into_response())
 }
@@ -71,6 +80,7 @@ pub struct TargetUrlOfferEndpointRequest {
 #[axum_macros::debug_handler]
 pub(crate) async fn organization_offer(
     State(state): State<Arc<IssuanceState>>,
+    RequestActor(actor): RequestActor,
     Json(TargetUrlOfferEndpointRequest { offer_id, target_url }): Json<TargetUrlOfferEndpointRequest>,
 ) -> Result<Response, ApiError> {
     let command = OfferCommand::SendCredentialOffer {
@@ -79,7 +89,14 @@ pub(crate) async fn organization_offer(
     };
 
     // Send the offer to the organizational url.
-    command_handler(&offer_id, &state.command.offer, command).await?;
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &offer_id,
+        &state.command.offer,
+        command,
+    )
+    .await?;
 
     Ok(StatusCode::OK.into_response())
 }
diff --git a/agent_api_http/src/v0/issuance/public_offers.rs b/agent_api_http/src/v0/issuance/public_offers.rs
index 907359c9..2ad4f12d 100644
--- a/agent_api_http/src/v0/issuance/public_offers.rs
+++ b/agent_api_http/src/v0/issuance/public_offers.rs
@@ -1,5 +1,6 @@
 use crate::error::IntoApiErrorExt;
-use crate::handlers::{command_handler, query_handler};
+use crate::extractors::RequestActor;
+use crate::handlers::{command_handler, public_query_handler, query_handler};
 use agent_issuance::public_offer::aggregate::PublicOffer;
 use agent_issuance::public_offer::command::PublicOfferCommand;
 use agent_issuance::public_offer::error::PublicOfferError;
@@ -137,16 +138,31 @@ impl From<&PublicOffer> for PublicOfferStatusDto {
     )
 )]
 #[axum_macros::debug_handler]
-pub(crate) async fn all_public_offers(State(issuance_state): State<Arc<IssuanceState>>) -> Result<Response, ApiError> {
-    let all_offers = query_handler("all_public_offers", &issuance_state.query.all_public_offers)
-        .await?
-        .unwrap_or_default();
+pub(crate) async fn all_public_offers(
+    State(issuance_state): State<Arc<IssuanceState>>,
+    RequestActor(actor): RequestActor,
+) -> Result<Response, ApiError> {
+    let all_offers = query_handler(
+        issuance_state.authorization_checker.clone(),
+        actor.clone(),
+        "all_public_offers",
+        &issuance_state.query.all_public_offers,
+    )
+    .await?
+    .unwrap_or_default();
 
     let mut offers = Vec::with_capacity(all_offers.offers.len());
 
     for public_offer in all_offers.offers.values() {
         let mut dto = PublicOfferStatusDto::from(public_offer);
-        if let Some(offer_view) = query_handler(&public_offer.id, &issuance_state.query.offer).await? {
+        if let Some(offer_view) = query_handler(
+            issuance_state.authorization_checker.clone(),
+            actor.clone(),
+            &public_offer.id,
+            &issuance_state.query.offer,
+        )
+        .await?
+        {
             dto.amount_issued = offer_view.successful_issuances;
         }
         offers.push(dto);
@@ -170,17 +186,31 @@ pub(crate) async fn all_public_offers(State(issuance_state): State<Arc<IssuanceS
 #[axum_macros::debug_handler]
 pub(crate) async fn create_public_offer(
     State(issuance_state): State<Arc<IssuanceState>>,
+    RequestActor(actor): RequestActor,
     Extension(library_state): Extension<Arc<LibraryState>>,
     Json(CreatePublicOfferRequest { offer_id, template_id }): Json<CreatePublicOfferRequest>,
 ) -> Result<Response, ApiError> {
-    if query_handler(&offer_id, &issuance_state.query.offer).await?.is_none() {
+    if query_handler(
+        issuance_state.authorization_checker.clone(),
+        actor.clone(),
+        &offer_id,
+        &issuance_state.query.offer,
+    )
+    .await?
+    .is_none()
+    {
         return Err(ApiError::new(StatusCode::NOT_FOUND));
     }
 
-    let template = query_handler(&template_id, &library_state.query.template)
-        .await
-        .map_err(|_| PublicOfferError::TemplateNotFound.into_api_error())?
-        .ok_or_else(|| PublicOfferError::TemplateNotFound.into_api_error())?;
+    let template = query_handler(
+        library_state.authorization_checker.clone(),
+        actor.clone(),
+        &template_id,
+        &library_state.query.template,
+    )
+    .await
+    .map_err(|_| PublicOfferError::TemplateNotFound.into_api_error())?
+    .ok_or_else(|| PublicOfferError::TemplateNotFound.into_api_error())?;
 
     // Only non-deleted templates can be offered publicly
     if template.status == Status::Deleted {
@@ -196,7 +226,14 @@ pub(crate) async fn create_public_offer(
     };
 
     let aggregate_id = public_offer_aggregate_id(&offer_id);
-    command_handler(&aggregate_id, &issuance_state.command.public_offer, command).await?;
+    command_handler(
+        issuance_state.authorization_checker.clone(),
+        actor,
+        &aggregate_id,
+        &issuance_state.command.public_offer,
+        command,
+    )
+    .await?;
 
     Ok((StatusCode::CREATED).into_response())
 }
@@ -215,6 +252,7 @@ pub(crate) async fn create_public_offer(
 #[axum_macros::debug_handler]
 pub(crate) async fn take_public_offer_offline(
     State(issuance_state): State<Arc<IssuanceState>>,
+    RequestActor(actor): RequestActor,
     Json(TakePublicOfferOfflineRequest { offer_id }): Json<TakePublicOfferOfflineRequest>,
 ) -> Result<Response, ApiError> {
     let command = PublicOfferCommand::TakeOffline {
@@ -222,7 +260,14 @@ pub(crate) async fn take_public_offer_offline(
     };
 
     let aggregate_id = public_offer_aggregate_id(&offer_id);
-    command_handler(&aggregate_id, &issuance_state.command.public_offer, command).await?;
+    command_handler(
+        issuance_state.authorization_checker.clone(),
+        actor,
+        &aggregate_id,
+        &issuance_state.command.public_offer,
+        command,
+    )
+    .await?;
 
     Ok((StatusCode::NO_CONTENT).into_response())
 }
@@ -241,6 +286,7 @@ pub(crate) async fn take_public_offer_offline(
 #[axum_macros::debug_handler]
 pub(crate) async fn take_public_offer_online(
     State(issuance_state): State<Arc<IssuanceState>>,
+    RequestActor(actor): RequestActor,
     Json(TakePublicOfferOnlineRequest { offer_id }): Json<TakePublicOfferOnlineRequest>,
 ) -> Result<Response, ApiError> {
     let command = PublicOfferCommand::TakeOnline {
@@ -248,7 +294,14 @@ pub(crate) async fn take_public_offer_online(
     };
 
     let aggregate_id = public_offer_aggregate_id(&offer_id);
-    command_handler(&aggregate_id, &issuance_state.command.public_offer, command).await?;
+    command_handler(
+        issuance_state.authorization_checker.clone(),
+        actor,
+        &aggregate_id,
+        &issuance_state.command.public_offer,
+        command,
+    )
+    .await?;
 
     Ok((StatusCode::NO_CONTENT).into_response())
 }
@@ -267,6 +320,7 @@ pub(crate) async fn take_public_offer_online(
 #[axum_macros::debug_handler]
 pub(crate) async fn delete_public_offer(
     State(issuance_state): State<Arc<IssuanceState>>,
+    RequestActor(actor): RequestActor,
     Json(DeletePublicOfferRequest { offer_id }): Json<DeletePublicOfferRequest>,
 ) -> Result<Response, ApiError> {
     let command = PublicOfferCommand::Delete {
@@ -274,7 +328,14 @@ pub(crate) async fn delete_public_offer(
     };
 
     let aggregate_id = public_offer_aggregate_id(&offer_id);
-    command_handler(&aggregate_id, &issuance_state.command.public_offer, command).await?;
+    command_handler(
+        issuance_state.authorization_checker.clone(),
+        actor,
+        &aggregate_id,
+        &issuance_state.command.public_offer,
+        command,
+    )
+    .await?;
 
     Ok((StatusCode::NO_CONTENT).into_response())
 }
@@ -283,7 +344,7 @@ pub(crate) async fn delete_public_offer(
 pub(crate) async fn can_resolve_public_offer(state: &Arc<IssuanceState>, offer_id: &str) -> Result<bool, ApiError> {
     let aggregate_id = public_offer_aggregate_id(offer_id);
 
-    match query_handler(&aggregate_id, &state.query.public_offer).await? {
+    match public_query_handler(&aggregate_id, &state.query.public_offer).await? {
         Some(offer) => Ok(offer.active && !offer.deleted),
         // If there is no public-offer record, treat it as a normal offer.
         None => Ok(true),
@@ -292,7 +353,7 @@ pub(crate) async fn can_resolve_public_offer(state: &Arc<IssuanceState>, offer_i
 
 #[cfg(test)]
 mod tests {
-    use crate::handlers::command_handler;
+    use crate::handlers::public_command_handler;
     use crate::tests::TEMPLATE_ID;
     use crate::v0::issuance::credentials::tests::{create_test_template_with_auth, credentials, setup_library_state};
     use crate::v0::issuance::router;
@@ -357,7 +418,7 @@ mod tests {
             schema,
         };
 
-        command_handler(template_id, &library_state.command.template, command)
+        public_command_handler(template_id, &library_state.command.template, command)
             .await
             .unwrap();
     }
diff --git a/agent_api_http/src/v0/templates/mod.rs b/agent_api_http/src/v0/templates/mod.rs
index 55400a59..f318b429 100644
--- a/agent_api_http/src/v0/templates/mod.rs
+++ b/agent_api_http/src/v0/templates/mod.rs
@@ -1,4 +1,5 @@
 use crate::error::IntoApiErrorExt;
+use crate::extractors::RequestActor;
 use crate::handlers::{command_handler, query_handler};
 use crate::API_VERSION;
 use agent_library::state::LibraryState;
@@ -111,6 +112,7 @@ pub struct CreateNewTemplateRequestBody {
 #[axum_macros::debug_handler]
 pub(crate) async fn create_template(
     State(state): State<Arc<LibraryState>>,
+    RequestActor(actor): RequestActor,
     Json(CreateNewTemplateRequestBody {
         title,
         display,
@@ -148,24 +150,36 @@ pub(crate) async fn create_template(
         holder_authorization,
     };
 
-    command_handler(&template_id, &state.command.template, command).await?;
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &template_id,
+        &state.command.template,
+        command,
+    )
+    .await?;
 
     // Return the template.
-    query_handler(&template_id, &state.query.template)
-        .await?
-        .map(|template_view| {
-            (
-                StatusCode::CREATED,
-                [(
-                    header::LOCATION,
-                    &format!("{API_VERSION}/get-template-by-id/{template_id}"),
-                )],
-                Json(TemplateDto::from(template_view)),
-            )
-                .into_response()
-        })
-        // TODO: this *should* be an impossible error, what should we return here?
-        .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &template_id,
+        &state.query.template,
+    )
+    .await?
+    .map(|template_view| {
+        (
+            StatusCode::CREATED,
+            [(
+                header::LOCATION,
+                &format!("{API_VERSION}/get-template-by-id/{template_id}"),
+            )],
+            Json(TemplateDto::from(template_view)),
+        )
+            .into_response()
+    })
+    // TODO: this *should* be an impossible error, what should we return here?
+    .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
 }
 
 #[derive(Deserialize, Serialize, utoipa::ToSchema)]
@@ -193,14 +207,20 @@ pub struct DuplicateTemplateEndpointRequest {
 #[axum_macros::debug_handler]
 pub(crate) async fn duplicate_template(
     State(state): State<Arc<LibraryState>>,
+    RequestActor(actor): RequestActor,
     Json(DuplicateTemplateEndpointRequest { source_template_id }): Json<DuplicateTemplateEndpointRequest>,
 ) -> Result<Response, ApiError> {
     let new_template_id = Uuid::new_v4().to_string();
 
-    let original_template = query_handler(&source_template_id, &state.query.template)
-        .await?
-        .filter(|template| template.status != Status::Deleted)
-        .ok_or_else(|| TemplateError::SourceTemplateNotFound(source_template_id.clone()).into_api_error())?;
+    let original_template = query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &source_template_id,
+        &state.query.template,
+    )
+    .await?
+    .filter(|template| template.status != Status::Deleted)
+    .ok_or_else(|| TemplateError::SourceTemplateNotFound(source_template_id.clone()).into_api_error())?;
 
     let command = TemplateCommand::CreateNewTemplate {
         template_id: new_template_id.clone(),
@@ -220,12 +240,24 @@ pub(crate) async fn duplicate_template(
         holder_authorization: original_template.holder_authorization,
     };
 
-    command_handler(&new_template_id, &state.command.template, command).await?;
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &new_template_id,
+        &state.command.template,
+        command,
+    )
+    .await?;
 
     // Return the duplicated template.
-    let new_template = query_handler(&new_template_id, &state.query.template)
-        .await?
-        .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))?;
+    let new_template = query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &new_template_id,
+        &state.query.template,
+    )
+    .await?
+    .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))?;
 
     Ok((
         StatusCode::CREATED,
@@ -271,6 +303,7 @@ pub struct UpdateTemplateEndpointRequest {
 #[axum_macros::debug_handler]
 pub(crate) async fn update_template(
     State(state): State<Arc<LibraryState>>,
+    RequestActor(actor): RequestActor,
     Json(UpdateTemplateEndpointRequest {
         template_id,
         title,
@@ -290,17 +323,29 @@ pub(crate) async fn update_template(
         return Err(TemplateError::TemplateIdMissing.into_api_error());
     }
 
-    query_handler(&template_id, &state.query.template)
-        .await?
-        .filter(|t| t.status != Status::Deleted)
-        .ok_or_else(|| TemplateError::TemplateNotFound(template_id.clone()).into_api_error())?;
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &template_id,
+        &state.query.template,
+    )
+    .await?
+    .filter(|t| t.status != Status::Deleted)
+    .ok_or_else(|| TemplateError::TemplateNotFound(template_id.clone()).into_api_error())?;
 
     if let Some(title) = title {
         let command = TemplateCommand::UpdateTitle {
             template_id: template_id.clone(),
             title,
         };
-        command_handler(&template_id, &state.command.template, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            &template_id,
+            &state.command.template,
+            command,
+        )
+        .await?;
     }
 
     if let Some(display) = display {
@@ -308,7 +353,14 @@ pub(crate) async fn update_template(
             template_id: template_id.clone(),
             display,
         };
-        command_handler(&template_id, &state.command.template, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            &template_id,
+            &state.command.template,
+            command,
+        )
+        .await?;
     }
 
     if let Some(tags) = tags {
@@ -316,7 +368,14 @@ pub(crate) async fn update_template(
             template_id: template_id.clone(),
             tags,
         };
-        command_handler(&template_id, &state.command.template, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            &template_id,
+            &state.command.template,
+            command,
+        )
+        .await?;
     }
 
     if let Some(status) = status {
@@ -324,7 +383,14 @@ pub(crate) async fn update_template(
             template_id: template_id.clone(),
             status,
         };
-        command_handler(&template_id, &state.command.template, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            &template_id,
+            &state.command.template,
+            command,
+        )
+        .await?;
     }
 
     if let Some(visibility) = visibility {
@@ -332,7 +398,14 @@ pub(crate) async fn update_template(
             template_id: template_id.clone(),
             visibility,
         };
-        command_handler(&template_id, &state.command.template, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            &template_id,
+            &state.command.template,
+            command,
+        )
+        .await?;
     }
 
     if let Some(credential_expiration) = credential_expiration {
@@ -340,7 +413,14 @@ pub(crate) async fn update_template(
             template_id: template_id.clone(),
             credential_expiration,
         };
-        command_handler(&template_id, &state.command.template, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            &template_id,
+            &state.command.template,
+            command,
+        )
+        .await?;
     }
 
     if let Some(description) = description {
@@ -348,7 +428,14 @@ pub(crate) async fn update_template(
             template_id: template_id.clone(),
             description,
         };
-        command_handler(&template_id, &state.command.template, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            &template_id,
+            &state.command.template,
+            command,
+        )
+        .await?;
     }
 
     if let Some(r#type) = r#type {
@@ -356,7 +443,14 @@ pub(crate) async fn update_template(
             template_id: template_id.clone(),
             r#type,
         };
-        command_handler(&template_id, &state.command.template, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            &template_id,
+            &state.command.template,
+            command,
+        )
+        .await?;
     }
 
     if let Some(schema) = schema {
@@ -364,7 +458,14 @@ pub(crate) async fn update_template(
             template_id: template_id.clone(),
             schema,
         };
-        command_handler(&template_id, &state.command.template, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            &template_id,
+            &state.command.template,
+            command,
+        )
+        .await?;
     }
 
     if let Some(schema_properties_attributes) = schema_properties_attributes {
@@ -375,7 +476,14 @@ pub(crate) async fn update_template(
                 .map(|(k, v)| (k, v.strip_non_removable()))
                 .collect(),
         };
-        command_handler(&template_id, &state.command.template, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            &template_id,
+            &state.command.template,
+            command,
+        )
+        .await?;
     }
 
     if let Some(holder_authorization) = holder_authorization {
@@ -383,7 +491,14 @@ pub(crate) async fn update_template(
             template_id: template_id.clone(),
             holder_authorization,
         };
-        command_handler(&template_id, &state.command.template, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            actor.clone(),
+            &template_id,
+            &state.command.template,
+            command,
+        )
+        .await?;
     }
 
     Ok(StatusCode::NO_CONTENT.into_response())
@@ -402,26 +517,34 @@ pub(crate) async fn update_template(
     )
 )]
 #[axum_macros::debug_handler]
-pub(crate) async fn get_templates(State(state): State<Arc<LibraryState>>) -> Result<Response, ApiError> {
-    let filtered_templates = query_handler("all_templates", &state.query.all_templates)
-        .await?
-        .map(|all_templates_view| {
-            let mut filtered_templates: Vec<TemplateDto> = all_templates_view
-                .templates
-                .into_values()
-                .filter(|template| {
-                    template.status != Status::Deleted
-                    // TODO: Apply filtering logic based on request parameters
-                })
-                .map(TemplateDto::from)
-                .collect();
-
-            // Sort by most recently modified first (RFC 3339 strings are lexicographically comparable).
-            filtered_templates.sort_by(|a, b| b.modified_at.cmp(&a.modified_at));
-
-            filtered_templates
-        })
-        .unwrap_or_default();
+pub(crate) async fn get_templates(
+    State(state): State<Arc<LibraryState>>,
+    RequestActor(actor): RequestActor,
+) -> Result<Response, ApiError> {
+    let filtered_templates = query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        "all_templates",
+        &state.query.all_templates,
+    )
+    .await?
+    .map(|all_templates_view| {
+        let mut filtered_templates: Vec<TemplateDto> = all_templates_view
+            .templates
+            .into_values()
+            .filter(|template| {
+                template.status != Status::Deleted
+                // TODO: Apply filtering logic based on request parameters
+            })
+            .map(TemplateDto::from)
+            .collect();
+
+        // Sort by most recently modified first (RFC 3339 strings are lexicographically comparable).
+        filtered_templates.sort_by(|a, b| b.modified_at.cmp(&a.modified_at));
+
+        filtered_templates
+    })
+    .unwrap_or_default();
 
     Ok((StatusCode::OK, Json(filtered_templates)).into_response())
 }
@@ -441,19 +564,25 @@ pub(crate) async fn get_templates(State(state): State<Arc<LibraryState>>) -> Res
 #[axum_macros::debug_handler]
 pub(crate) async fn get_template(
     State(state): State<Arc<LibraryState>>,
+    RequestActor(actor): RequestActor,
     Path(template_id): Path<String>,
 ) -> Result<Response, ApiError> {
-    query_handler(&template_id, &state.query.template)
-        .await?
-        .and_then(|template_view| {
-            if template_view.status == Status::Deleted {
-                None
-            } else {
-                Some(template_view)
-            }
-        })
-        .map(|template_view| (StatusCode::OK, Json(TemplateDto::from(template_view))).into_response())
-        .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &template_id,
+        &state.query.template,
+    )
+    .await?
+    .and_then(|template_view| {
+        if template_view.status == Status::Deleted {
+            None
+        } else {
+            Some(template_view)
+        }
+    })
+    .map(|template_view| (StatusCode::OK, Json(TemplateDto::from(template_view))).into_response())
+    .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
 }
 
 #[derive(Deserialize, Serialize, utoipa::ToSchema)]
@@ -478,28 +607,42 @@ pub struct DeleteTemplateEndpointRequest {
 #[axum_macros::debug_handler]
 pub(crate) async fn delete_template(
     State(state): State<Arc<LibraryState>>,
+    RequestActor(actor): RequestActor,
     Json(DeleteTemplateEndpointRequest { template_id }): Json<DeleteTemplateEndpointRequest>,
 ) -> Result<Response, ApiError> {
     if template_id.is_empty() {
         return Err(TemplateError::TemplateIdMissing.into_api_error());
     }
 
-    query_handler(&template_id, &state.query.template)
-        .await?
-        .filter(|t| t.status != Status::Deleted)
-        .ok_or_else(|| TemplateError::TemplateNotFound(template_id.clone()).into_api_error())?;
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &template_id,
+        &state.query.template,
+    )
+    .await?
+    .filter(|t| t.status != Status::Deleted)
+    .ok_or_else(|| TemplateError::TemplateNotFound(template_id.clone()).into_api_error())?;
 
     let command = TemplateCommand::DeleteTemplate {
         template_id: template_id.clone(),
     };
 
-    command_handler(&template_id, &state.command.template, command).await?;
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &template_id,
+        &state.command.template,
+        command,
+    )
+    .await?;
     Ok(StatusCode::NO_CONTENT.into_response())
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::handlers::{public_command_handler as command_handler, public_query_handler as query_handler};
     use agent_store::{in_memory::InMemory, library_state};
     use axum::{body::to_bytes, response::IntoResponse};
     use serde_json::json;
@@ -645,6 +788,7 @@ mod tests {
 
         let response = duplicate_template(
             State(state),
+            RequestActor(None),
             Json(DuplicateTemplateEndpointRequest {
                 source_template_id: "source-template".to_string(),
             }),
@@ -680,6 +824,7 @@ mod tests {
 
         let response = duplicate_template(
             State(state),
+            RequestActor(None),
             Json(DuplicateTemplateEndpointRequest {
                 source_template_id: "deleted-source".to_string(),
             }),
@@ -702,6 +847,7 @@ mod tests {
 
         let response = create_template(
             State(state),
+            RequestActor(None),
             Json(CreateNewTemplateRequestBody {
                 title: "Created Template".to_string(),
                 display: None,
@@ -737,6 +883,7 @@ mod tests {
 
         let response = update_template(
             State(state),
+            RequestActor(None),
             Json(UpdateTemplateEndpointRequest {
                 template_id: String::new(),
                 title: Some("Updated title".to_string()),
@@ -781,6 +928,7 @@ mod tests {
 
         let response = update_template(
             State(state),
+            RequestActor(None),
             Json(UpdateTemplateEndpointRequest {
                 template_id: "deleted-template".to_string(),
                 title: Some("Updated title".to_string()),
@@ -815,6 +963,7 @@ mod tests {
 
         let response = update_template(
             State(state.clone()),
+            RequestActor(None),
             Json(UpdateTemplateEndpointRequest {
                 template_id: "template-to-update".to_string(),
                 title: None,
@@ -865,7 +1014,7 @@ mod tests {
         .await
         .unwrap();
 
-        let response = get_templates(State(state)).await.unwrap();
+        let response = get_templates(State(state), RequestActor(None)).await.unwrap();
         assert_eq!(response.status(), StatusCode::OK);
 
         let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
@@ -887,6 +1036,7 @@ mod tests {
 
         let response = delete_template(
             State(state.clone()),
+            RequestActor(None),
             Json(DeleteTemplateEndpointRequest {
                 template_id: "template-to-delete".to_string(),
             }),
@@ -896,7 +1046,7 @@ mod tests {
 
         assert_eq!(response.status(), StatusCode::NO_CONTENT);
 
-        let response = get_template(State(state), Path("template-to-delete".to_string()))
+        let response = get_template(State(state), RequestActor(None), Path("template-to-delete".to_string()))
             .await
             .unwrap_err()
             .into_response();
diff --git a/agent_api_http/src/v0/verification/authorization_requests.rs b/agent_api_http/src/v0/verification/authorization_requests.rs
index d5a9fbeb..600843e2 100644
--- a/agent_api_http/src/v0/verification/authorization_requests.rs
+++ b/agent_api_http/src/v0/verification/authorization_requests.rs
@@ -1,3 +1,4 @@
+use crate::extractors::RequestActor;
 use crate::{
     handlers::{command_handler, query_handler},
     API_VERSION,
@@ -19,17 +20,22 @@ use std::sync::Arc;
 #[axum_macros::debug_handler]
 pub(crate) async fn all_authorization_requests(
     State(state): State<Arc<VerificationState>>,
+    RequestActor(actor): RequestActor,
 ) -> Result<Response, ApiError> {
-    let all_authorization_requests =
-        query_handler("all_authorization_requests", &state.query.all_authorization_requests)
-            .await?
-            .map(|all_authorization_requests_view| {
-                all_authorization_requests_view
-                    .authorization_requests
-                    .into_values()
-                    .collect::<Vec<_>>()
-            })
-            .unwrap_or_default();
+    let all_authorization_requests = query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        "all_authorization_requests",
+        &state.query.all_authorization_requests,
+    )
+    .await?
+    .map(|all_authorization_requests_view| {
+        all_authorization_requests_view
+            .authorization_requests
+            .into_values()
+            .collect::<Vec<_>>()
+    })
+    .unwrap_or_default();
 
     Ok((StatusCode::OK, Json(all_authorization_requests)).into_response())
 }
@@ -37,12 +43,18 @@ pub(crate) async fn all_authorization_requests(
 #[axum_macros::debug_handler]
 pub(crate) async fn authorization_request(
     State(state): State<Arc<VerificationState>>,
+    RequestActor(actor): RequestActor,
     Path(authorization_request_id): Path<String>,
 ) -> Result<Response, ApiError> {
-    query_handler(&authorization_request_id, &state.query.authorization_request)
-        .await?
-        .map(|authorization_request_view| (StatusCode::OK, Json(authorization_request_view)).into_response())
-        .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &authorization_request_id,
+        &state.query.authorization_request,
+    )
+    .await?
+    .map(|authorization_request_view| (StatusCode::OK, Json(authorization_request_view)).into_response())
+    .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
 }
 
 #[derive(Deserialize, Serialize)]
@@ -54,6 +66,7 @@ pub struct AuthorizationRequestsEndpointRequest {
 #[axum_macros::debug_handler]
 pub(crate) async fn authorization_requests(
     State(verification_state): State<Arc<VerificationState>>,
+    RequestActor(actor): RequestActor,
     Json(AuthorizationRequestsEndpointRequest { state, dcql_query }): Json<AuthorizationRequestsEndpointRequest>,
 ) -> Result<Response, ApiError> {
     let state = state.unwrap_or(generate_random_string());
@@ -67,10 +80,19 @@ pub(crate) async fn authorization_requests(
     };
 
     // Create the authorization request.
-    command_handler(&state, &verification_state.command.authorization_request, command).await?;
+    command_handler(
+        verification_state.authorization_checker.clone(),
+        actor.clone(),
+        &state,
+        &verification_state.command.authorization_request,
+        command,
+    )
+    .await?;
 
     // Sign the authorization request object.
     command_handler(
+        verification_state.authorization_checker.clone(),
+        actor.clone(),
         &state,
         &verification_state.command.authorization_request,
         AuthorizationRequestCommand::SignAuthorizationRequestObject,
@@ -78,24 +100,29 @@ pub(crate) async fn authorization_requests(
     .await?;
 
     // Return the authorization_request.
-    query_handler(&state, &verification_state.query.authorization_request)
-        .await?
-        .and_then(|authorization_request_view| authorization_request_view.form_url_encoded_authorization_request)
-        .map(|form_url_encoded_authorization_request| {
-            (
-                StatusCode::CREATED,
-                [
-                    (
-                        header::LOCATION,
-                        format!("{API_VERSION}/authorization_requests/{state}").as_str(),
-                    ),
-                    (header::CONTENT_TYPE, "application/x-www-form-urlencoded"),
-                ],
-                form_url_encoded_authorization_request,
-            )
-                .into_response()
-        })
-        .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
+    query_handler(
+        verification_state.authorization_checker.clone(),
+        actor.clone(),
+        &state,
+        &verification_state.query.authorization_request,
+    )
+    .await?
+    .and_then(|authorization_request_view| authorization_request_view.form_url_encoded_authorization_request)
+    .map(|form_url_encoded_authorization_request| {
+        (
+            StatusCode::CREATED,
+            [
+                (
+                    header::LOCATION,
+                    format!("{API_VERSION}/authorization_requests/{state}").as_str(),
+                ),
+                (header::CONTENT_TYPE, "application/x-www-form-urlencoded"),
+            ],
+            form_url_encoded_authorization_request,
+        )
+            .into_response()
+    })
+    .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
 }
 
 #[cfg(test)]
diff --git a/agent_api_http/src/v0/verification/relying_party/redirect.rs b/agent_api_http/src/v0/verification/relying_party/redirect.rs
index edb8c6e3..a8690af3 100644
--- a/agent_api_http/src/v0/verification/relying_party/redirect.rs
+++ b/agent_api_http/src/v0/verification/relying_party/redirect.rs
@@ -1,4 +1,4 @@
-use crate::handlers::command_handler;
+use crate::handlers::public_command_handler;
 use agent_verification::{
     authorization_request::command::AuthorizationRequestCommand, generic_oid4vc::GenericAuthorizationResponse,
     state::VerificationState,
@@ -33,7 +33,7 @@ pub(crate) async fn redirect(
     let command = AuthorizationRequestCommand::VerifyAuthorizationResponse { authorization_response };
 
     // Verify the authorization response.
-    command_handler(
+    public_command_handler(
         &authorization_request_id,
         &verification_state.command.authorization_request,
         command,
diff --git a/agent_api_http/src/v0/verification/relying_party/request.rs b/agent_api_http/src/v0/verification/relying_party/request.rs
index ab34d5de..90ca097a 100644
--- a/agent_api_http/src/v0/verification/relying_party/request.rs
+++ b/agent_api_http/src/v0/verification/relying_party/request.rs
@@ -1,4 +1,3 @@
-use crate::handlers::query_handler;
 use agent_verification::state::VerificationState;
 use axum::{
     extract::{Path, State},
@@ -9,6 +8,8 @@ use http_api_problem::ApiError;
 use hyper::header;
 use std::sync::Arc;
 
+use crate::handlers::public_query_handler;
+
 /// Instead of directly embedding the Authorization Request into a QR-code or deeplink, the `Relying Party` can embed a
 /// `request_uri` that points to this endpoint from where the Authorization Request Object can be retrieved.
 /// As described here: https://www.rfc-editor.org/rfc/rfc9101.html#name-passing-a-request-object-by-
@@ -17,7 +18,7 @@ pub(crate) async fn request(
     State(verification_state): State<Arc<VerificationState>>,
     Path(request_id): Path<String>,
 ) -> Result<Response, ApiError> {
-    query_handler(&request_id, &verification_state.query.authorization_request)
+    public_query_handler(&request_id, &verification_state.query.authorization_request)
         .await?
         .and_then(|authorization_request_view| authorization_request_view.signed_authorization_request_object)
         .map(|signed_authorization_request_object| {
diff --git a/agent_application/Cargo.toml b/agent_application/Cargo.toml
index f3d496f6..f54b4074 100644
--- a/agent_application/Cargo.toml
+++ b/agent_application/Cargo.toml
@@ -27,6 +27,7 @@ did_manager = { git = "https://github.com/impierce/did-manager", rev = "cbf2993"
 serde.workspace = true
 serde_json.workspace = true
 serde_with.workspace = true
+shared-kernel.workspace = true
 tokio.workspace = true
 tower-http.workspace = true
 tracing.workspace = true
diff --git a/agent_application/src/lib.rs b/agent_application/src/lib.rs
index 43068084..d117b47d 100644
--- a/agent_application/src/lib.rs
+++ b/agent_application/src/lib.rs
@@ -2,7 +2,7 @@ mod metadata;
 mod probes;
 
 pub use agent_api_http::metrics::metrics;
-use agent_api_http::{app, metrics::track_metrics, ApplicationState};
+use agent_api_http::{app, metrics::track_metrics, ApplicationState, API_VERSION};
 use agent_authorization::services::{AuthorizationServices, OAuth2AuthorizationRequestDomainServices};
 use agent_event_publisher_http::EventPublisherHttp;
 use agent_event_publisher_nats::EventPublisherNats;
@@ -16,6 +16,7 @@ use agent_shared::config::{config, EventStoreType};
 use agent_store::{in_memory::InMemory, mongodb::MongoDB, postgres::Postgres, EventPublisher};
 use agent_verification::services::VerificationServices;
 use probes::liveness::healthz;
+use shared_kernel::authorization::{ActorExtractor, NoActorExtractor};
 use std::sync::Arc;
 use tokio::io;
 use tower_http::cors::CorsLayer;
@@ -256,7 +257,17 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
 
 /// Builds the full core SSI agent Router (app + metadata + probes).
 pub fn router(application_state: ApplicationState) -> axum::Router {
-    let app = app(application_state);
+    router_with_actor_extractor(application_state, NoActorExtractor)
+        .merge(axum::Router::new().nest(API_VERSION, configuration_router()))
+}
+
+/// Builds the full core SSI agent Router with a custom actor extractor.
+pub fn router_with_actor_extractor<E>(application_state: ApplicationState, actor_extractor: E) -> axum::Router
+where
+    E: ActorExtractor,
+{
+    let actor_extractor = Arc::new(actor_extractor);
+    let app = app(application_state, actor_extractor);
 
     let metadata_state = metadata::MetadataState {
         startup_instant: std::time::Instant::now(),
@@ -266,7 +277,6 @@ pub fn router(application_state: ApplicationState) -> axum::Router {
     let metadata_router = axum::Router::new()
         .route("/version", axum::routing::get(metadata::version::version))
         .route("/info", axum::routing::get(metadata::info::info))
-        .route("/v0/configuration", axum::routing::get(metadata::config::configuration))
         .with_state(metadata_state);
 
     let app = metadata_router.merge(app);
@@ -282,6 +292,11 @@ pub fn router(application_state: ApplicationState) -> axum::Router {
     app
 }
 
+/// Builds the application configuration router without the API version prefix.
+pub fn configuration_router() -> axum::Router {
+    axum::Router::new().route("/configuration", axum::routing::get(metadata::config::configuration))
+}
+
 async fn serve(app: axum::Router) -> io::Result<()> {
     let port = config().application_url.port().unwrap_or(3033);
 
diff --git a/agent_authorization/src/application/consent_query_service.rs b/agent_authorization/src/application/consent_query_service.rs
index bdb9cf37..556cdb1b 100644
--- a/agent_authorization/src/application/consent_query_service.rs
+++ b/agent_authorization/src/application/consent_query_service.rs
@@ -1,5 +1,5 @@
 use crate::state::AuthorizationState;
-use agent_shared::handlers::query_handler;
+use agent_shared::handlers::public_query_handler;
 use oid4vci::authorization_details::AuthorizationDetailsObject;
 use serde::{Deserialize, Serialize};
 use thiserror::Error;
@@ -31,12 +31,13 @@ impl ConsentQueryService {
         state: &AuthorizationState,
         request_uri: String,
     ) -> Result<ConsentPageViewModel, ConsentQueryError> {
-        let authorization_request = query_handler(&request_uri.to_string(), &state.query.oauth2_authorization_request)
-            .await
-            .map_err(|err| ConsentQueryError::Internal(err.to_string()))?
-            .ok_or(ConsentQueryError::RequestNotFound)?;
+        let authorization_request =
+            public_query_handler(&request_uri.to_string(), &state.query.oauth2_authorization_request)
+                .await
+                .map_err(|err| ConsentQueryError::Internal(err.to_string()))?
+                .ok_or(ConsentQueryError::RequestNotFound)?;
 
-        let client = query_handler(&authorization_request.client_id, &state.query.client)
+        let client = public_query_handler(&authorization_request.client_id, &state.query.client)
             .await
             .map_err(|err| ConsentQueryError::Internal(err.to_string()))?
             .ok_or(ConsentQueryError::ClientNotFound)?;
diff --git a/agent_authorization/src/application/consent_service.rs b/agent_authorization/src/application/consent_service.rs
index 42b3fb65..1c538a8e 100644
--- a/agent_authorization/src/application/consent_service.rs
+++ b/agent_authorization/src/application/consent_service.rs
@@ -1,7 +1,7 @@
 use crate::{
     domain::oauth2_authorization_request::command::OAuth2AuthorizationRequestCommand, state::AuthorizationState,
 };
-use agent_shared::handlers::{command_handler, query_handler};
+use agent_shared::handlers::{public_command_handler, public_query_handler};
 use thiserror::Error;
 
 pub enum ConsentServiceResponse {
@@ -31,7 +31,7 @@ impl ConsentService {
     ) -> Result<ConsentServiceResponse, ConsentError> {
         let oauth_authorization_request_id = request_uri.clone();
 
-        let _oauth_authorization_request = query_handler(
+        let _oauth_authorization_request = public_query_handler(
             &oauth_authorization_request_id,
             &state.query.oauth2_authorization_request,
         )
@@ -45,7 +45,7 @@ impl ConsentService {
             OAuth2AuthorizationRequestCommand::RejectConsent
         };
 
-        command_handler(
+        public_command_handler(
             &oauth_authorization_request_id,
             &state.command.oauth2_authorization_request,
             command,
diff --git a/agent_authorization/src/application/interactive_authorization_service.rs b/agent_authorization/src/application/interactive_authorization_service.rs
index a22d985c..dbac4073 100644
--- a/agent_authorization/src/application/interactive_authorization_service.rs
+++ b/agent_authorization/src/application/interactive_authorization_service.rs
@@ -1,4 +1,4 @@
-use agent_shared::handlers::{command_handler, query_handler};
+use agent_shared::handlers::{public_command_handler, public_query_handler};
 use oid4vci::{
     InteractionType, InteractiveAuthorizationRequest, InteractiveAuthorizationResponse, InteractiveAuthorizationStatus,
 };
@@ -64,7 +64,7 @@ impl InteractiveAuthorizationService {
         // registered in the Authorization Server). Therefore, as of now we can only validate the request for known
         // Clients. See: https://github.com/openid/OpenID4VCI/issues/94
         if authorization_request.client_id == UNIME_CLIENT_ID {
-            let client = query_handler(&authorization_request.client_id, &state.query.client)
+            let client = public_query_handler(&authorization_request.client_id, &state.query.client)
                 .await
                 .map_err(|err| InteractiveAuthorizationError::Internal(err.to_string()))?
                 .ok_or(InteractiveAuthorizationError::InvalidClientIdError)?;
@@ -107,7 +107,7 @@ impl InteractiveAuthorizationService {
             interaction_type: Some(InteractionType::OpenId4VpPresentation),
         };
 
-        command_handler(
+        public_command_handler(
             &oauth2_authorization_request_id,
             &state.command.oauth2_authorization_request,
             command,
@@ -115,7 +115,7 @@ impl InteractiveAuthorizationService {
         .await
         .map_err(|err| InteractiveAuthorizationError::Internal(err.to_string()))?;
 
-        let oauth2_authorization_request_view = query_handler(
+        let oauth2_authorization_request_view = public_query_handler(
             &oauth2_authorization_request_id,
             &state.query.oauth2_authorization_request,
         )
@@ -158,7 +158,7 @@ impl InteractiveAuthorizationService {
                 .ok_or(InteractiveAuthorizationError::MissingOpenId4VPResponseError)?,
         };
 
-        command_handler(
+        public_command_handler(
             &oauth2_authorization_request_id,
             &state.command.oauth2_authorization_request,
             command,
@@ -167,7 +167,7 @@ impl InteractiveAuthorizationService {
         .map_err(|err| InteractiveAuthorizationError::Internal(err.to_string()))?;
 
         // Get the OAuth2 authorization request that has been pushed via the `/auth/par` endpoint.
-        let oauth2_authorization_request = query_handler(
+        let oauth2_authorization_request = public_query_handler(
             &oauth2_authorization_request_id,
             &state.query.oauth2_authorization_request,
         )
@@ -193,7 +193,7 @@ impl InteractiveAuthorizationService {
             expires_in,
         };
 
-        command_handler(&authorization_code_id, &state.command.authorization_code, command)
+        public_command_handler(&authorization_code_id, &state.command.authorization_code, command)
             .await
             .map_err(|err| InteractiveAuthorizationError::Internal(err.to_string()))?;
 
diff --git a/agent_authorization/src/application/oauth2_authorization_service.rs b/agent_authorization/src/application/oauth2_authorization_service.rs
index 5f066093..bb5c8a1a 100644
--- a/agent_authorization/src/application/oauth2_authorization_service.rs
+++ b/agent_authorization/src/application/oauth2_authorization_service.rs
@@ -4,7 +4,7 @@ use crate::{
     },
     state::AuthorizationState,
 };
-use agent_shared::handlers::{command_handler, query_handler};
+use agent_shared::handlers::{public_command_handler, public_query_handler};
 use oid4vc_core::utils::form_urlencoded::to_form_urlencoded_string;
 use oid4vci::wallet::AuthorizationRequestByReference;
 use serde::{Deserialize, Serialize};
@@ -44,7 +44,7 @@ impl OAuth2AuthorizationService {
         AuthorizationRequestByReference { client_id, request_uri }: AuthorizationRequestByReference,
     ) -> Result<OAuth2AuthorizationServiceResponse, OAuth2AuthorizationError> {
         // Get the OAuth2 authorization request that has been pushed via the `/auth/par` endpoint.
-        let oauth2_authorization_request = query_handler(
+        let oauth2_authorization_request = public_query_handler(
             request_uri.to_string().as_ref(),
             &state.query.oauth2_authorization_request,
         )
@@ -89,7 +89,7 @@ impl OAuth2AuthorizationService {
                     expires_in: 600, // 10 minutes
                 };
 
-                command_handler(&authorization_code_id, &state.command.authorization_code, command)
+                public_command_handler(&authorization_code_id, &state.command.authorization_code, command)
                     .await
                     .map_err(|err| OAuth2AuthorizationError::Internal(err.to_string()))?;
 
diff --git a/agent_authorization/src/application/pushed_authorization_service.rs b/agent_authorization/src/application/pushed_authorization_service.rs
index ce321e14..70bf450a 100644
--- a/agent_authorization/src/application/pushed_authorization_service.rs
+++ b/agent_authorization/src/application/pushed_authorization_service.rs
@@ -1,4 +1,4 @@
-use agent_shared::handlers::{command_handler, query_handler};
+use agent_shared::handlers::{public_command_handler, public_query_handler};
 use oid4vci::authorization_request::AuthorizationRequest;
 use oid4vci::wallet::PushedAuthorizationResponse;
 use thiserror::Error;
@@ -36,7 +36,7 @@ impl PushedAuthorizationService {
         // registered in the Authorization Server). Therefore, as of now we can only validate the request for known
         // Clients. See: https://github.com/openid/OpenID4VCI/issues/94
         if pushed_authorization_request.client_id == UNIME_CLIENT_ID {
-            let client = query_handler(&pushed_authorization_request.client_id, &state.query.client)
+            let client = public_query_handler(&pushed_authorization_request.client_id, &state.query.client)
                 .await
                 .map_err(|err| PushedAuthorizationError::Internal(err.to_string()))?
                 .ok_or(PushedAuthorizationError::InvalidClientIdError)?;
@@ -83,7 +83,7 @@ impl PushedAuthorizationService {
             interaction_type: None,
         };
 
-        command_handler(
+        public_command_handler(
             &oauth2_authorization_request_id,
             &state.command.oauth2_authorization_request,
             command,
diff --git a/agent_authorization/src/application/token_issuance_service.rs b/agent_authorization/src/application/token_issuance_service.rs
index a0eda2e9..277e25c3 100644
--- a/agent_authorization/src/application/token_issuance_service.rs
+++ b/agent_authorization/src/application/token_issuance_service.rs
@@ -8,7 +8,7 @@ use crate::{
 use agent_issuance::{application::access_token_validation_service::AccessTokenClaims, state::IssuanceState};
 use agent_shared::{
     config::{config, get_preferred_did_method, get_preferred_signing_algorithm},
-    handlers::{command_handler, query_handler},
+    handlers::{public_command_handler, public_query_handler},
 };
 use jsonwebtoken;
 use oid4vc_core::jwt;
@@ -64,7 +64,7 @@ impl TokenIssuanceService {
         // TODO: This mirrors the `public_offer_aggregate_id()`. Aggregate IDs should be generated in a consistent way in a single place.
         let aggregate_id = format!("public_offer:{offer_id}");
 
-        let public_offer = query_handler(&aggregate_id, &issuance_state.query.public_offer)
+        let public_offer = public_query_handler(&aggregate_id, &issuance_state.query.public_offer)
             .await
             .map_err(|err| TokenIssuanceError::Internal(err.to_string()))?;
 
@@ -90,7 +90,7 @@ impl TokenIssuanceService {
             } => {
                 // TODO: make sure that the Pre-Authorized Code is short-lived and single-use.
                 // See https://github.com/impierce/ssi-agent/issues/240
-                let offer = query_handler("all_offers", &issuance_state.query.all_offers)
+                let offer = public_query_handler("all_offers", &issuance_state.query.all_offers)
                     .await
                     .map_err(|err| TokenIssuanceError::Internal(err.to_string()))?
                     .and_then(|all_offers_view| {
@@ -134,7 +134,7 @@ impl TokenIssuanceService {
                 redirect_uri,
                 authorization_details,
             } => {
-                let client = query_handler(&client_id, &authorization_state.query.client)
+                let client = public_query_handler(&client_id, &authorization_state.query.client)
                     .await
                     .map_err(|err| TokenIssuanceError::Internal(err.to_string()))?
                     .ok_or(TokenIssuanceError::InvalidClientIdError)?;
@@ -147,11 +147,11 @@ impl TokenIssuanceService {
                     code_verifier,
                 };
 
-                command_handler(&code, &authorization_state.command.authorization_code, command)
+                public_command_handler(&code, &authorization_state.command.authorization_code, command)
                     .await
                     .map_err(|err| TokenIssuanceError::InvalidAuthorizationCodeError(err.to_string()))?;
 
-                let issuer_state = query_handler(&code, &authorization_state.query.authorization_code)
+                let issuer_state = public_query_handler(&code, &authorization_state.query.authorization_code)
                     .await
                     .map_err(|err| TokenIssuanceError::Internal(err.to_string()))?
                     // This error should never happen, since we just redeemed the authorization code.
@@ -188,7 +188,7 @@ impl TokenIssuanceService {
             issuer_state,
         };
 
-        command_handler(&access_token_id, &authorization_state.command.access_token, command)
+        public_command_handler(&access_token_id, &authorization_state.command.access_token, command)
             .await
             .map_err(|err| TokenIssuanceError::Internal(err.to_string()))?;
 
@@ -202,7 +202,7 @@ impl TokenIssuanceService {
             // TODO: support refresh tokens
             refresh_token_expires_at: _refresh_token_expires_at,
             issuer_state,
-        } = query_handler(&access_token_id, &authorization_state.query.access_token)
+        } = public_query_handler(&access_token_id, &authorization_state.query.access_token)
             .await
             .map_err(|err| TokenIssuanceError::Internal(err.to_string()))?
             .ok_or(TokenIssuanceError::MissingAccessTokenError)?;
diff --git a/agent_authorization/src/state.rs b/agent_authorization/src/state.rs
index 8b73af0c..f4a5b7e7 100644
--- a/agent_authorization/src/state.rs
+++ b/agent_authorization/src/state.rs
@@ -1,7 +1,8 @@
 use agent_shared::application_state::CommandHandler;
-use agent_shared::handlers::{command_handler, query_handler};
+use agent_shared::handlers::{command_handler, public_query_handler};
 use oid4vc_core::Sign;
 use oid4vci::authorization_request::CodeChallengeMethod;
+use shared_kernel::authorization::AuthorizationChecker;
 use shared_kernel::view_repository::DynViewRepository;
 use std::sync::Arc;
 use tracing::{debug, info};
@@ -26,6 +27,7 @@ pub const UNIME_REDIRECT_URI: &str = "unime://callback";
 
 #[derive(Clone)]
 pub struct AuthorizationState {
+    pub authorization_checker: Arc<dyn AuthorizationChecker>,
     pub command: CommandHandlers,
     pub query: Queries,
     pub signer: Arc<dyn Sign>,
@@ -85,7 +87,7 @@ pub async fn initialize(state: &AuthorizationState) -> anyhow::Result<()> {
 
 /// Initialize the default client (UniMe) in the authorization state.
 async fn initialize_clients(state: &AuthorizationState) -> anyhow::Result<()> {
-    if let Some(client) = query_handler(UNIME_CLIENT_ID, &state.query.client).await? {
+    if let Some(client) = public_query_handler(UNIME_CLIENT_ID, &state.query.client).await? {
         debug!("UniMe client already exists: {:?}", client);
         Ok(())
     } else {
@@ -109,7 +111,14 @@ async fn initialize_clients(state: &AuthorizationState) -> anyhow::Result<()> {
             require_pushed_authorization_request: true,
         };
 
-        command_handler(UNIME_CLIENT_ID, &state.command.client, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            None,
+            UNIME_CLIENT_ID,
+            &state.command.client,
+            command,
+        )
+        .await?;
 
         Ok(())
     }
diff --git a/agent_holder/src/offer/aggregate.rs b/agent_holder/src/offer/aggregate.rs
index b683793e..f14c6cf1 100644
--- a/agent_holder/src/offer/aggregate.rs
+++ b/agent_holder/src/offer/aggregate.rs
@@ -344,7 +344,7 @@ pub mod tests {
     use agent_secret_manager::service::Service;
     use agent_shared::config::{config, config_mut, Authorization, CredentialConfiguration};
     use agent_shared::generate_random_string;
-    use agent_shared::handlers::command_handler;
+    use agent_shared::handlers::public_command_handler as command_handler;
     use agent_store::in_memory::InMemory;
     use agent_store::{authorization_state, issuance_state, library_state};
     use axum::{
diff --git a/agent_holder/src/state.rs b/agent_holder/src/state.rs
index e9067530..2539ec41 100644
--- a/agent_holder/src/state.rs
+++ b/agent_holder/src/state.rs
@@ -1,4 +1,5 @@
 use agent_shared::application_state::CommandHandler;
+use shared_kernel::authorization::AuthorizationChecker;
 use shared_kernel::view_repository::DynViewRepository;
 use std::sync::Arc;
 
@@ -14,6 +15,7 @@ use crate::presentation::views::PresentationView;
 
 #[derive(Clone)]
 pub struct HolderState {
+    pub authorization_checker: Arc<dyn AuthorizationChecker>,
     pub command: CommandHandlers,
     pub query: Queries,
 }
diff --git a/agent_identity/src/state.rs b/agent_identity/src/state.rs
index 465507e1..a1abe6cd 100644
--- a/agent_identity/src/state.rs
+++ b/agent_identity/src/state.rs
@@ -16,10 +16,11 @@ use agent_shared::config::{
     config, config_mut, get_all_enabled_signing_algorithms_supported, Display, SupportedDidMethod, ToggleOptions,
 };
 use agent_shared::handlers::command_handler;
-use agent_shared::{application_state::CommandHandler, handlers::query_handler};
+use agent_shared::{application_state::CommandHandler, handlers::public_query_handler};
 use cqrs_es::persist::PersistenceError;
 use itertools::iproduct;
 use jsonwebtoken::Algorithm;
+use shared_kernel::authorization::AuthorizationChecker;
 use shared_kernel::view_repository::DynViewRepository;
 use std::collections::HashMap;
 use std::sync::Arc;
@@ -33,6 +34,7 @@ pub const PROFILE_ID: &str = "PROFILE-001";
 
 #[derive(Clone)]
 pub struct IdentityState {
+    pub authorization_checker: Arc<dyn AuthorizationChecker>,
     pub command: CommandHandlers,
     pub query: Queries,
 }
@@ -120,7 +122,7 @@ pub async fn initialize(state: &IdentityState) -> anyhow::Result<()> {
 // updates, rather than reading from a shared, mutable global state.
 /// Queries the profile and updates the application state with the profile information.
 pub async fn query_profile(state: &IdentityState) -> Result<(), PersistenceError> {
-    match query_handler(PROFILE_ID, &state.query.profile).await? {
+    match public_query_handler(PROFILE_ID, &state.query.profile).await? {
         Some(Profile {
             display_name,
             logo,
@@ -173,7 +175,7 @@ async fn initialize_display(state: &IdentityState) -> anyhow::Result<()> {
     };
 
     if let Some(config_display) = first {
-        match query_handler(PROFILE_ID, &state.query.profile).await? {
+        match public_query_handler(PROFILE_ID, &state.query.profile).await? {
             // If the profile exists, we check if it needs to be updated based on the config.
             // We only update the Profile if the config source is:
             // - Provisioned: If the Profile is Provisioned, we update the persisted Profile.
@@ -194,7 +196,14 @@ async fn initialize_display(state: &IdentityState) -> anyhow::Result<()> {
                         source: config_display_source.clone(),
                     };
 
-                    command_handler(PROFILE_ID, &state.command.profile, command).await?;
+                    command_handler(
+                        state.authorization_checker.clone(),
+                        None,
+                        PROFILE_ID,
+                        &state.command.profile,
+                        command,
+                    )
+                    .await?;
                 }
 
                 if config_display.logo != persisted_logo {
@@ -203,7 +212,14 @@ async fn initialize_display(state: &IdentityState) -> anyhow::Result<()> {
                         source: config_display_source.clone(),
                     };
 
-                    command_handler(PROFILE_ID, &state.command.profile, command).await?;
+                    command_handler(
+                        state.authorization_checker.clone(),
+                        None,
+                        PROFILE_ID,
+                        &state.command.profile,
+                        command,
+                    )
+                    .await?;
                 }
 
                 if config_display.description != persisted_description {
@@ -212,7 +228,14 @@ async fn initialize_display(state: &IdentityState) -> anyhow::Result<()> {
                         source: config_display_source.clone(),
                     };
 
-                    command_handler(PROFILE_ID, &state.command.profile, command).await?;
+                    command_handler(
+                        state.authorization_checker.clone(),
+                        None,
+                        PROFILE_ID,
+                        &state.command.profile,
+                        command,
+                    )
+                    .await?;
                 }
 
                 if config_display.country != persisted_country {
@@ -221,14 +244,28 @@ async fn initialize_display(state: &IdentityState) -> anyhow::Result<()> {
                         source: config_display_source.clone(),
                     };
 
-                    command_handler(PROFILE_ID, &state.command.profile, command).await?;
+                    command_handler(
+                        state.authorization_checker.clone(),
+                        None,
+                        PROFILE_ID,
+                        &state.command.profile,
+                        command,
+                    )
+                    .await?;
                 }
 
                 let command = ProfileCommand::UpdateSource {
                     source: config_display_source,
                 };
 
-                command_handler(PROFILE_ID, &state.command.profile, command).await?;
+                command_handler(
+                    state.authorization_checker.clone(),
+                    None,
+                    PROFILE_ID,
+                    &state.command.profile,
+                    command,
+                )
+                .await?;
             }
             Some(_profile) => {
                 info!("Display is already configured, no action needed.");
@@ -246,11 +283,18 @@ async fn initialize_display(state: &IdentityState) -> anyhow::Result<()> {
                     country: config_display.country.clone(),
                 };
 
-                command_handler(PROFILE_ID, &state.command.profile, command).await?;
+                command_handler(
+                    state.authorization_checker.clone(),
+                    None,
+                    PROFILE_ID,
+                    &state.command.profile,
+                    command,
+                )
+                .await?;
             }
         };
     } else {
-        match query_handler(PROFILE_ID, &state.query.profile).await? {
+        match public_query_handler(PROFILE_ID, &state.query.profile).await? {
             Some(Profile {
                 display_name: persisted_display_name,
                 logo: persisted_logo,
@@ -264,7 +308,14 @@ async fn initialize_display(state: &IdentityState) -> anyhow::Result<()> {
                         source: config_display_source.clone(),
                     };
 
-                    command_handler(PROFILE_ID, &state.command.profile, command).await?;
+                    command_handler(
+                        state.authorization_checker.clone(),
+                        None,
+                        PROFILE_ID,
+                        &state.command.profile,
+                        command,
+                    )
+                    .await?;
                 }
 
                 if persisted_logo.is_some() {
@@ -273,7 +324,14 @@ async fn initialize_display(state: &IdentityState) -> anyhow::Result<()> {
                         source: config_display_source.clone(),
                     };
 
-                    command_handler(PROFILE_ID, &state.command.profile, command).await?;
+                    command_handler(
+                        state.authorization_checker.clone(),
+                        None,
+                        PROFILE_ID,
+                        &state.command.profile,
+                        command,
+                    )
+                    .await?;
                 }
 
                 if persisted_country.is_some() {
@@ -282,7 +340,14 @@ async fn initialize_display(state: &IdentityState) -> anyhow::Result<()> {
                         source: config_display_source.clone(),
                     };
 
-                    command_handler(PROFILE_ID, &state.command.profile, command).await?;
+                    command_handler(
+                        state.authorization_checker.clone(),
+                        None,
+                        PROFILE_ID,
+                        &state.command.profile,
+                        command,
+                    )
+                    .await?;
                 }
             }
             _ => {
@@ -295,7 +360,14 @@ async fn initialize_display(state: &IdentityState) -> anyhow::Result<()> {
                     source: config_display_source,
                 };
 
-                command_handler(PROFILE_ID, &state.command.profile, command).await?;
+                command_handler(
+                    state.authorization_checker.clone(),
+                    None,
+                    PROFILE_ID,
+                    &state.command.profile,
+                    command,
+                )
+                .await?;
             }
         };
     }
@@ -367,14 +439,28 @@ async fn initialize_documents(state: &IdentityState) -> anyhow::Result<()> {
 
         // If a Document command was generated, then execute the command and update the Document's Public Keys.
         if let Some((document_id, command)) = document_id_and_command {
-            command_handler(&document_id, &state.command.document, command).await?;
+            command_handler(
+                state.authorization_checker.clone(),
+                None,
+                &document_id,
+                &state.command.document,
+                command,
+            )
+            .await?;
 
             if enabled {
                 let command = DocumentCommand::UpdatePublicKeys {
                     public_key_jwks: vec![],
                 };
 
-                command_handler(&document_id, &state.command.document, command).await?;
+                command_handler(
+                    state.authorization_checker.clone(),
+                    None,
+                    &document_id,
+                    &state.command.document,
+                    command,
+                )
+                .await?;
             }
         }
     }
@@ -468,11 +554,18 @@ pub async fn initialize_domain_linkage(state: &IdentityState) -> anyhow::Result<
             verification_methods,
         };
 
-        command_handler(DOMAIN_LINKAGE_SERVICE_ID, &state.command.service, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            None,
+            DOMAIN_LINKAGE_SERVICE_ID,
+            &state.command.service,
+            command,
+        )
+        .await?;
 
         info!("Created Linked Domain service");
 
-        match query_handler(DOMAIN_LINKAGE_SERVICE_ID, &state.query.service).await {
+        match public_query_handler(DOMAIN_LINKAGE_SERVICE_ID, &state.query.service).await {
             Ok(Some(Service {
                 service: Some(service), ..
             })) => {
@@ -485,7 +578,14 @@ pub async fn initialize_domain_linkage(state: &IdentityState) -> anyhow::Result<
                         service: Box::new(service.clone()),
                     };
 
-                    command_handler(document_id, &state.command.document, command).await?;
+                    command_handler(
+                        state.authorization_checker.clone(),
+                        None,
+                        document_id,
+                        &state.command.document,
+                        command,
+                    )
+                    .await?;
                 }
             }
             _ => anyhow::bail!("Failed to retrieve Linked Domains service"),
@@ -496,7 +596,14 @@ pub async fn initialize_domain_linkage(state: &IdentityState) -> anyhow::Result<
             service_id: DOMAIN_LINKAGE_SERVICE_ID.to_string(),
         };
 
-        command_handler(DOMAIN_LINKAGE_SERVICE_ID, &state.command.service, command).await?;
+        command_handler(
+            state.authorization_checker.clone(),
+            None,
+            DOMAIN_LINKAGE_SERVICE_ID,
+            &state.command.service,
+            command,
+        )
+        .await?;
 
         info!("Disabled Domain Linkage service");
     }
@@ -519,7 +626,7 @@ pub async fn initialize_linked_verifiable_presentations(state: &IdentityState) -
 
     if let Some(Service {
         service: Some(service), ..
-    }) = query_handler(LINKED_VERIFIABLE_PRESENTATION_SERVICE_ID, &state.query.service).await?
+    }) = public_query_handler(LINKED_VERIFIABLE_PRESENTATION_SERVICE_ID, &state.query.service).await?
     {
         info!("Found Linked Verifiable Presentations service: {service}");
 
@@ -530,7 +637,14 @@ pub async fn initialize_linked_verifiable_presentations(state: &IdentityState) -
                 service: Box::new(service.clone()),
             };
 
-            command_handler(document_id, &state.command.document, command).await?;
+            command_handler(
+                state.authorization_checker.clone(),
+                None,
+                document_id,
+                &state.command.document,
+                command,
+            )
+            .await?;
         }
     }
 
@@ -559,7 +673,14 @@ pub async fn publish_decentrally_hosted_documents(state: &IdentityState) -> anyh
     // Publish each decentrally hosted Documents.
     for document_id in decentrally_hosted_documents.keys() {
         // Publish the Document. Note that we ignore any errors here to allow for the system to continue initializing.
-        let _ = command_handler(document_id, &state.command.document, DocumentCommand::PublishDocument).await;
+        let _ = command_handler(
+            state.authorization_checker.clone(),
+            None,
+            document_id,
+            &state.command.document,
+            DocumentCommand::PublishDocument,
+        )
+        .await;
     }
 
     Ok(())
@@ -575,7 +696,7 @@ pub async fn query_all_documents(
     state: &IdentityState,
     query: impl Fn(&(String, Document)) -> bool,
 ) -> anyhow::Result<HashMap<String, Document>> {
-    match query_handler("all_documents", &state.query.all_documents).await? {
+    match public_query_handler("all_documents", &state.query.all_documents).await? {
         Some(AllDocumentsView { documents }) => Ok(documents.into_iter().filter(query).collect()),
         None => Ok(Default::default()),
     }
diff --git a/agent_issuance/src/application/credential_configuration_projection.rs b/agent_issuance/src/application/credential_configuration_projection.rs
index 1346bfc4..d7f69551 100644
--- a/agent_issuance/src/application/credential_configuration_projection.rs
+++ b/agent_issuance/src/application/credential_configuration_projection.rs
@@ -3,7 +3,7 @@ use crate::state::{IssuanceState, SERVER_CONFIG_ID};
 use agent_library::template::aggregate::{DataModel, PropertyAttribute, Template};
 use agent_library::template::views::TemplateView;
 use agent_shared::config::CredentialConfiguration;
-use agent_shared::handlers::{command_handler, query_handler};
+use agent_shared::handlers::{command_handler, public_query_handler};
 use async_trait::async_trait;
 use cqrs_es::{EventEnvelope, Query};
 use oid4vc_core::claim_path_pointer::{ClaimPathElement, ClaimPathPointer};
@@ -54,7 +54,7 @@ impl CredentialConfigurationProjection {
             warn!("Template view not yet initialized; skipping credential configuration sync for `{template_id}`");
             return;
         };
-        match query_handler(template_id, view).await {
+        match public_query_handler(template_id, view).await {
             Ok(Some(template)) => {
                 if template.status != Status::Published {
                     self.remove_credential_configuration(template_id).await;
@@ -65,8 +65,14 @@ impl CredentialConfigurationProjection {
                     credential_configuration,
                     provisioned: false,
                 };
-                if let Err(e) =
-                    command_handler(SERVER_CONFIG_ID, &self.issuance_state.command.server_config, command).await
+                if let Err(e) = command_handler(
+                    self.issuance_state.authorization_checker.clone(),
+                    None,
+                    SERVER_CONFIG_ID,
+                    &self.issuance_state.command.server_config,
+                    command,
+                )
+                .await
                 {
                     warn!("Failed to update credential configuration for template `{template_id}`: {e}");
                 }
@@ -86,7 +92,15 @@ impl CredentialConfigurationProjection {
             credential_configuration_id: template_id.to_string(),
             provisioned: false,
         };
-        if let Err(e) = command_handler(SERVER_CONFIG_ID, &self.issuance_state.command.server_config, command).await {
+        if let Err(e) = command_handler(
+            self.issuance_state.authorization_checker.clone(),
+            None,
+            SERVER_CONFIG_ID,
+            &self.issuance_state.command.server_config,
+            command,
+        )
+        .await
+        {
             warn!("Failed to remove credential configuration for template `{template_id}`: {e}");
         }
     }
@@ -315,8 +329,14 @@ impl Query<Template> for CredentialConfigurationProjection {
                         credential_configuration,
                         provisioned: false,
                     };
-                    if let Err(e) =
-                        command_handler(SERVER_CONFIG_ID, &self.issuance_state.command.server_config, command).await
+                    if let Err(e) = command_handler(
+                        self.issuance_state.authorization_checker.clone(),
+                        None,
+                        SERVER_CONFIG_ID,
+                        &self.issuance_state.command.server_config,
+                        command,
+                    )
+                    .await
                     {
                         warn!("Failed to update credential configuration for template `{template_id}`: {e}");
                     }
diff --git a/agent_issuance/src/application/nonce_validation_service.rs b/agent_issuance/src/application/nonce_validation_service.rs
index d921d97d..9b73c281 100644
--- a/agent_issuance/src/application/nonce_validation_service.rs
+++ b/agent_issuance/src/application/nonce_validation_service.rs
@@ -1,6 +1,6 @@
 use crate::nonce::command::NonceCommand;
 use crate::state::IssuanceState;
-use agent_shared::handlers::{command_handler, query_handler};
+use agent_shared::handlers::{public_command_handler, public_query_handler};
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
 use oid4vci::credential_request::CredentialRequest;
 use thiserror::Error;
@@ -38,7 +38,7 @@ impl NonceValidationService {
 
         let nonce = &nonces[0];
 
-        let nonce_status = query_handler(nonce, &state.query.nonce)
+        let nonce_status = public_query_handler(nonce, &state.query.nonce)
             .await
             .map_err(|_| NonceValidationError::InvalidNonce)?;
 
@@ -46,7 +46,7 @@ impl NonceValidationService {
             Some(n) if n.is_redeemed => Err(NonceValidationError::RedeemedNonce),
             Some(_) => {
                 let command = NonceCommand::RedeemNonce { c_nonce: nonce.clone() };
-                command_handler(nonce, &state.command.nonce, command)
+                public_command_handler(nonce, &state.command.nonce, command)
                     .await
                     .map_err(|_| NonceValidationError::InvalidNonce)?;
                 Ok(())
@@ -97,7 +97,7 @@ mod tests {
     use agent_issuance::services::IssuanceServices;
     use agent_issuance::state::initialize;
     use agent_secret_manager::service::Service;
-    use agent_shared::handlers::command_handler;
+    use agent_shared::handlers::public_command_handler;
     use agent_store::in_memory::InMemory;
     use oid4vci::proofs::Proofs;
 
@@ -153,7 +153,7 @@ mod tests {
         let nonce = NONCE_VALUE.to_string();
 
         let create_command = NonceCommand::GenerateNonce { c_nonce: nonce.clone() };
-        command_handler(NONCE_VALUE, &state.command.nonce, create_command)
+        public_command_handler(NONCE_VALUE, &state.command.nonce, create_command)
             .await
             .unwrap();
 
@@ -169,12 +169,12 @@ mod tests {
         initialize(&state).await.unwrap();
 
         let create_command = NonceCommand::GenerateNonce { c_nonce: nonce.clone() };
-        command_handler(NONCE_VALUE, &state.command.nonce, create_command)
+        public_command_handler(NONCE_VALUE, &state.command.nonce, create_command)
             .await
             .unwrap();
 
         let redeem_command = NonceCommand::RedeemNonce { c_nonce: nonce.clone() };
-        command_handler(NONCE_VALUE, &state.command.nonce, redeem_command)
+        public_command_handler(NONCE_VALUE, &state.command.nonce, redeem_command)
             .await
             .unwrap();
 
@@ -191,7 +191,7 @@ mod tests {
         let create_command = NonceCommand::GenerateNonce {
             c_nonce: NONCE_VALUE_2.to_string(),
         };
-        command_handler(NONCE_VALUE_2, &state.command.nonce, create_command)
+        public_command_handler(NONCE_VALUE_2, &state.command.nonce, create_command)
             .await
             .unwrap();
 
diff --git a/agent_issuance/src/state.rs b/agent_issuance/src/state.rs
index cef1823d..93d3e9db 100644
--- a/agent_issuance/src/state.rs
+++ b/agent_issuance/src/state.rs
@@ -1,10 +1,11 @@
 use agent_secret_manager::subject::Subject;
 use agent_shared::application_state::CommandHandler;
 use agent_shared::config::{config, get_all_enabled_did_methods, get_all_enabled_signing_algorithms_supported};
-use agent_shared::handlers::{command_handler, query_handler};
+use agent_shared::handlers::{command_handler, public_query_handler};
 use agent_shared::UrlAppendHelpers;
 use oid4vci::credential_issuer::authorization_server_metadata::AuthorizationServerMetadata;
 use oid4vci::credential_issuer::credential_issuer_metadata::CredentialIssuerMetadata;
+use shared_kernel::authorization::AuthorizationChecker;
 use shared_kernel::view_repository::DynViewRepository;
 use std::sync::Arc;
 use tracing::{debug, info};
@@ -28,6 +29,7 @@ use crate::status_list::views::StatusListView;
 
 #[derive(Clone)]
 pub struct IssuanceState {
+    pub authorization_checker: Arc<dyn AuthorizationChecker>,
     pub command: CommandHandlers,
     pub query: Queries,
     pub subject: Arc<Subject>,
@@ -142,20 +144,34 @@ pub async fn load_server_metadata(state: &IssuanceState) -> anyhow::Result<()> {
 
     let signing_algorithms_supported = get_all_enabled_signing_algorithms_supported();
 
-    match query_handler(SERVER_CONFIG_ID, &state.query.server_config).await? {
+    match public_query_handler(SERVER_CONFIG_ID, &state.query.server_config).await? {
         Some(server_config_view) => {
             info!("Update Issuer URL in server metadata");
 
             let command = ServerConfigCommand::UpdateIssuerUrl {
                 url: public_url.clone(),
             };
-            command_handler(SERVER_CONFIG_ID, &state.command.server_config, command).await?;
+            command_handler(
+                state.authorization_checker.clone(),
+                None,
+                SERVER_CONFIG_ID,
+                &state.command.server_config,
+                command,
+            )
+            .await?;
 
             if display != server_config_view.credential_issuer_metadata.display {
                 debug!("The server metadata display does not match the configured display.");
 
                 let command = ServerConfigCommand::UpdateIssuerDisplay { display };
-                command_handler(SERVER_CONFIG_ID, &state.command.server_config, command).await?;
+                command_handler(
+                    state.authorization_checker.clone(),
+                    None,
+                    SERVER_CONFIG_ID,
+                    &state.command.server_config,
+                    command,
+                )
+                .await?;
             }
         }
         None => {
@@ -205,7 +221,14 @@ pub async fn load_server_metadata(state: &IssuanceState) -> anyhow::Result<()> {
                 signing_algorithms_supported,
             };
 
-            command_handler(SERVER_CONFIG_ID, &state.command.server_config, command).await?;
+            command_handler(
+                state.authorization_checker.clone(),
+                None,
+                SERVER_CONFIG_ID,
+                &state.command.server_config,
+                command,
+            )
+            .await?;
         }
     }
 
@@ -213,7 +236,7 @@ pub async fn load_server_metadata(state: &IssuanceState) -> anyhow::Result<()> {
 }
 
 pub async fn update_cryptographic_binding_methods(state: &IssuanceState) -> anyhow::Result<()> {
-    if let Some(server_config_view) = query_handler(SERVER_CONFIG_ID, &state.query.server_config).await? {
+    if let Some(server_config_view) = public_query_handler(SERVER_CONFIG_ID, &state.query.server_config).await? {
         let mut cryptographic_binding_methods_supported: Vec<_> = get_all_enabled_did_methods()
             .into_iter()
             .map(|did_method| did_method.to_string())
@@ -226,7 +249,14 @@ pub async fn update_cryptographic_binding_methods(state: &IssuanceState) -> anyh
                 cryptographic_binding_methods_supported,
             };
 
-            command_handler(SERVER_CONFIG_ID, &state.command.server_config, command).await?;
+            command_handler(
+                state.authorization_checker.clone(),
+                None,
+                SERVER_CONFIG_ID,
+                &state.command.server_config,
+                command,
+            )
+            .await?;
         } else {
             debug!("Cryptographic binding methods are already up to date.");
         }
@@ -236,7 +266,7 @@ pub async fn update_cryptographic_binding_methods(state: &IssuanceState) -> anyh
 }
 
 pub async fn update_signing_algorithms(state: &IssuanceState) -> anyhow::Result<()> {
-    if let Some(server_config_view) = query_handler(SERVER_CONFIG_ID, &state.query.server_config).await? {
+    if let Some(server_config_view) = public_query_handler(SERVER_CONFIG_ID, &state.query.server_config).await? {
         let signing_algorithms_supported = get_all_enabled_signing_algorithms_supported();
 
         if server_config_view.signing_algorithms_supported != signing_algorithms_supported {
@@ -244,7 +274,14 @@ pub async fn update_signing_algorithms(state: &IssuanceState) -> anyhow::Result<
                 signing_algorithms_supported,
             };
 
-            command_handler(SERVER_CONFIG_ID, &state.command.server_config, command).await?;
+            command_handler(
+                state.authorization_checker.clone(),
+                None,
+                SERVER_CONFIG_ID,
+                &state.command.server_config,
+                command,
+            )
+            .await?;
         } else {
             debug!("Signing algorithms are already up to date.");
         }
diff --git a/agent_issuance/src/status_list/application/token_status_list_service.rs b/agent_issuance/src/status_list/application/token_status_list_service.rs
index 02881f2d..a9b4e14a 100644
--- a/agent_issuance/src/status_list/application/token_status_list_service.rs
+++ b/agent_issuance/src/status_list/application/token_status_list_service.rs
@@ -1,6 +1,6 @@
 use agent_shared::{
     config::{get_preferred_did_method, get_preferred_signing_algorithm},
-    handlers::query_handler,
+    handlers::public_query_handler,
 };
 use oauth_tsl::{
     status_list::EncodedStatusList,
@@ -23,7 +23,7 @@ impl TokenStatusListService {
         status_list_id: String,
         state: &IssuanceState,
     ) -> Result<Vec<u8>, StatusListError> {
-        let status_list = query_handler(&status_list_id, &state.query.status_list)
+        let status_list = public_query_handler(&status_list_id, &state.query.status_list)
             .await
             .map_err(|_| StatusListError::StatusListQueryError)?
             .ok_or(StatusListError::StatusListNotFound(status_list_id.clone()))?;
diff --git a/agent_issuance/tests/credential_configuration_projection.rs b/agent_issuance/tests/credential_configuration_projection.rs
index cdbfa523..3f6917ad 100644
--- a/agent_issuance/tests/credential_configuration_projection.rs
+++ b/agent_issuance/tests/credential_configuration_projection.rs
@@ -7,7 +7,7 @@ use agent_library::template::command::TemplateCommand;
 use agent_library::template::event::{Expiration, HolderType, TemplateEvent};
 use agent_secret_manager::service::Service;
 use agent_shared::config::Authorization;
-use agent_shared::handlers::{command_handler, query_handler};
+use agent_shared::handlers::{public_command_handler as command_handler, public_query_handler as query_handler};
 use agent_store::in_memory::InMemory;
 use agent_store::{issuance_state, library_state};
 use cqrs_es::{EventEnvelope, Query};
diff --git a/agent_library/src/state.rs b/agent_library/src/state.rs
index 1d319791..2bb3dd6f 100644
--- a/agent_library/src/state.rs
+++ b/agent_library/src/state.rs
@@ -1,4 +1,5 @@
 use agent_shared::application_state::CommandHandler;
+use shared_kernel::authorization::AuthorizationChecker;
 use shared_kernel::view_repository::DynViewRepository;
 use std::sync::Arc;
 
@@ -9,6 +10,7 @@ use crate::template::{
 
 #[derive(Clone)]
 pub struct LibraryState {
+    pub authorization_checker: Arc<dyn AuthorizationChecker>,
     pub command: CommandHandlers,
     pub query: Queries,
 }
diff --git a/agent_macros/src/lib.rs b/agent_macros/src/lib.rs
index 80b921b8..4fc9ada0 100644
--- a/agent_macros/src/lib.rs
+++ b/agent_macros/src/lib.rs
@@ -122,9 +122,10 @@ pub fn config_derive(input: TokenStream) -> TokenStream {
 
                 *metadata = provisioned_config.clone().try_deserialize().expect("Failed to deserialize config");
 
-                let res = #struct_name {
+                let mut res = #struct_name {
                     #(#load_configuration_variables)*
                 };
+                res.apply_profile(&application_profile);
 
                 // Overwrite all fields from res into metadata
                 overwrite_existing_fields(&mut metadata, &json!(res));
diff --git a/agent_shared/src/config/mod.rs b/agent_shared/src/config/mod.rs
index ed3f99e9..d7ce72e4 100644
--- a/agent_shared/src/config/mod.rs
+++ b/agent_shared/src/config/mod.rs
@@ -108,6 +108,9 @@ pub fn config_mut() -> std::sync::RwLockWriteGuard<'static, ApplicationConfigura
 #[skip_serializing_none]
 #[derive(Debug, Deserialize, Clone, Serialize, Config)]
 pub struct ApplicationConfiguration {
+    #[config(default)]
+    #[serde(default, skip_serializing_if = "DevConfig::is_empty")]
+    pub dev: DevConfig,
     #[config(default)]
     pub log_format: LogFormat,
     #[config(development_default = "EventStoreConfig {
@@ -337,6 +340,12 @@ pub struct ApplicationConfiguration {
 }
 
 impl ApplicationConfiguration {
+    fn apply_profile(&mut self, application_profile: &ApplicationProfile) {
+        if let ApplicationProfile::Production = application_profile {
+            self.dev = DevConfig::default();
+        }
+    }
+
     /// Validates whether the configuration is suitable for development (enforce restrictions).
     pub fn validate_development(&self) -> Result<(), SharedError> {
         if self.event_store.type_ == EventStoreType::InMemory {
@@ -455,6 +464,18 @@ impl ApplicationConfiguration {
     }
 }
 
+#[derive(Debug, Deserialize, Clone, Default, Serialize)]
+pub struct DevConfig {
+    #[serde(serialize_with = "redact")]
+    pub api_key: Option<String>,
+}
+
+impl DevConfig {
+    fn is_empty(&self) -> bool {
+        self.api_key.is_none()
+    }
+}
+
 #[derive(Debug, Deserialize, Clone, Default, Serialize)]
 #[serde(rename_all = "lowercase")]
 pub enum LogFormat {
@@ -1192,6 +1213,73 @@ mod tests {
         );
     }
 
+    #[test]
+    #[serial]
+    fn test_development_config_loads_static_api_key() {
+        let provisioned_config = config::Config::builder()
+            .add_source(config::File::from_str(
+                r#"
+                    dev:
+                        api_key: "local-development-key"
+                "#,
+                config::FileFormat::Yaml,
+            ))
+            .build()
+            .unwrap();
+
+        let config = ApplicationConfiguration::load(provisioned_config, ApplicationProfile::Development).unwrap();
+
+        assert_eq!(config.dev.api_key.as_deref(), Some("local-development-key"));
+        assert_eq!(
+            serde_json::to_value(&config.dev).unwrap(),
+            json!({"api_key": "<REDACTED>"})
+        );
+        assert_eq!(
+            config.get_provisioned_config(),
+            json!({
+                "dev": {
+                    "api_key": "<REDACTED>"
+                }
+            })
+        );
+    }
+
+    #[test]
+    #[serial]
+    fn test_production_config_ignores_static_development_api_key() {
+        temp_env::with_vars(
+            [
+                ("UNICORE__SECRET_MANAGER__STRONGHOLD_PASSWORD", Some("unsafe-password")),
+                ("UNICORE__DEV__API_KEY", Some("local-development-key")),
+            ],
+            || {
+                let provisioned_config = config::Config::builder()
+                    .add_source(config::File::from_str(
+                        r#"
+                            dev:
+                                api_key: "yaml-development-key"
+                            application_url: "http://localhost"
+                            event_store:
+                                type: "postgres"
+                                connection_string: "postgresql://:test:"
+                            display:
+                                - name: "UniCore"
+                        "#,
+                        config::FileFormat::Yaml,
+                    ))
+                    .add_source(config::Environment::with_prefix("UNICORE").separator("__"))
+                    .build()
+                    .unwrap();
+
+                let config =
+                    ApplicationConfiguration::load(provisioned_config, ApplicationProfile::Production).unwrap();
+
+                assert!(config.dev.api_key.is_none());
+                assert!(config.get_provisioned_config().get("dev").is_none());
+            },
+        );
+    }
+
     #[test]
     #[serial]
     fn test_validate_production_config_without_stronghold_password_fails() {
diff --git a/agent_shared/src/handlers.rs b/agent_shared/src/handlers.rs
index 93c345ae..84703a0a 100644
--- a/agent_shared/src/handlers.rs
+++ b/agent_shared/src/handlers.rs
@@ -1,4 +1,7 @@
 use cqrs_es::{persist::PersistenceError, Aggregate, AggregateError, View};
+use shared_kernel::authorization::{
+    Actor, AuthorizationChecker, AuthorizationError, AuthorizationOperation, AuthorizationRequest, CommandAuthorization,
+};
 use shared_kernel::view_repository::DynViewRepository;
 use std::{collections::HashMap, sync::Arc};
 use time::format_description::well_known::Rfc3339;
@@ -6,8 +9,8 @@ use tracing::{debug, error, info};
 
 use crate::application_state::CommandHandler;
 
-/// The `query_handler` function is used to query the view repository for a specific view.
-pub async fn query_handler<A, V>(
+/// Loads a specific view from the view repository without running authorization.
+pub async fn public_query_handler<A, V>(
     view_id: &str,
     state: &Arc<dyn DynViewRepository<V, A>>,
 ) -> Result<Option<V>, PersistenceError>
@@ -27,25 +30,302 @@ where
     }
 }
 
+#[derive(Debug, thiserror::Error)]
+pub enum QueryHandlerError {
+    #[error(transparent)]
+    Authorization(AuthorizationError),
+    #[error(transparent)]
+    Persistence(#[from] PersistenceError),
+}
+
+/// The `query_handler` function is used to query the view repository after authorization.
+pub async fn query_handler<A, V>(
+    authorization_checker: Arc<dyn AuthorizationChecker>,
+    actor: Option<Actor>,
+    view_id: &str,
+    state: &Arc<dyn DynViewRepository<V, A>>,
+) -> Result<Option<V>, QueryHandlerError>
+where
+    A: Aggregate,
+    V: View<A>,
+{
+    let authorization_request = AuthorizationRequest {
+        actor,
+        operation: AuthorizationOperation::Query {
+            query_type: std::any::type_name::<V>(),
+        },
+    };
+
+    authorization_checker
+        .is_authorized(&authorization_request)
+        .await
+        .map_err(QueryHandlerError::Authorization)?;
+
+    public_query_handler(view_id, state)
+        .await
+        .map_err(QueryHandlerError::Persistence)
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum CommandHandlerError<E>
+where
+    E: std::error::Error,
+{
+    #[error(transparent)]
+    Authorization(AuthorizationError),
+    #[error(transparent)]
+    Aggregate(#[from] AggregateError<E>),
+}
+
 /// The `command_handler` function is used to execute a command on an aggregate.
 pub async fn command_handler<A>(
+    authorization_checker: Arc<dyn AuthorizationChecker>,
+    actor: Option<Actor>,
+    aggregate_id: &str,
+    state: &CommandHandler<A>,
+    command: A::Command,
+) -> Result<(), CommandHandlerError<<A as Aggregate>::Error>>
+where
+    A: Aggregate,
+    <A as Aggregate>::Command: Send + Sync + std::fmt::Debug,
+{
+    let authorization_request = AuthorizationRequest {
+        actor,
+        operation: AuthorizationOperation::Command {
+            aggregate_id: aggregate_id.to_string(),
+            // TODO: Use command variant names when authorization needs finer-grained permissions.
+            command_type: std::any::type_name::<A::Command>(),
+            authorization: CommandAuthorization::ACTOR_REQUIRED,
+        },
+    };
+
+    authorization_checker
+        .is_authorized(&authorization_request)
+        .await
+        .map_err(CommandHandlerError::Authorization)?;
+
+    public_command_handler(aggregate_id, state, command).await
+}
+
+pub async fn public_command_handler<A>(
     aggregate_id: &str,
     state: &CommandHandler<A>,
-    command: <A as Aggregate>::Command,
-) -> Result<(), AggregateError<<A as Aggregate>::Error>>
+    command: A::Command,
+) -> Result<(), CommandHandlerError<<A as Aggregate>::Error>>
 where
     A: Aggregate,
     <A as Aggregate>::Command: Send + Sync + std::fmt::Debug,
 {
     let mut metadata = HashMap::new();
-    metadata.insert(
-        "timestamp".to_string(),
-        time::OffsetDateTime::now_utc().format(&Rfc3339).unwrap(),
-    );
+    let timestamp = time::OffsetDateTime::now_utc()
+        .format(&Rfc3339)
+        .map_err(|err| CommandHandlerError::Aggregate(AggregateError::UnexpectedError(Box::new(err))))?;
+    metadata.insert("timestamp".to_string(), timestamp);
 
     info!("Executing command: {:?}", command);
     state
         .execute_with_metadata(aggregate_id, command, metadata)
         .await
+        .map_err(CommandHandlerError::Aggregate)
         .inspect_err(|err| error!("Error: {}", err.to_string()))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::application_state::Command;
+    use async_trait::async_trait;
+    use cqrs_es::{event_sink::EventSink, DomainEvent};
+    use serde::{Deserialize, Serialize};
+    use shared_kernel::authorization::AllowAllAuthorizationChecker;
+    use std::sync::Mutex;
+
+    #[derive(Default, Debug, Serialize, Deserialize)]
+    struct TestAggregate;
+
+    #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+    struct TestEvent;
+
+    impl DomainEvent for TestEvent {
+        fn event_type(&self) -> String {
+            "test-event".to_string()
+        }
+
+        fn event_version(&self) -> String {
+            "1".to_string()
+        }
+    }
+
+    #[derive(Debug, thiserror::Error)]
+    #[error("test error")]
+    struct TestError;
+
+    impl Aggregate for TestAggregate {
+        type Command = String;
+        type Event = TestEvent;
+        type Error = TestError;
+        type Services = ();
+
+        const TYPE: &'static str = "test";
+
+        async fn handle(
+            &mut self,
+            command: Self::Command,
+            _service: &Self::Services,
+            sink: &EventSink<Self>,
+        ) -> Result<(), Self::Error> {
+            if command == "emit" {
+                sink.write(TestEvent, self).await;
+            }
+
+            Ok(())
+        }
+
+        fn apply(&mut self, _event: Self::Event) {}
+    }
+
+    #[derive(Default)]
+    struct CapturingCommandHandler {
+        calls: Mutex<Vec<CapturedCommand>>,
+    }
+
+    #[derive(Debug, PartialEq)]
+    struct CapturedCommand {
+        aggregate_id: String,
+        command: String,
+        metadata: HashMap<String, String>,
+    }
+
+    #[async_trait]
+    impl Command<TestAggregate> for CapturingCommandHandler {
+        async fn execute_with_metadata(
+            &self,
+            aggregate_id: &str,
+            command: String,
+            metadata: HashMap<String, String>,
+        ) -> Result<(), AggregateError<TestError>> {
+            self.calls.lock().unwrap().push(CapturedCommand {
+                aggregate_id: aggregate_id.to_string(),
+                command,
+                metadata,
+            });
+
+            Ok(())
+        }
+    }
+
+    struct DenyAllAuthorizationChecker;
+
+    #[async_trait]
+    impl AuthorizationChecker for DenyAllAuthorizationChecker {
+        async fn is_authorized(&self, _request: &AuthorizationRequest) -> Result<(), AuthorizationError> {
+            Err(AuthorizationError::Forbidden)
+        }
+    }
+
+    struct CapturingAuthorizationChecker {
+        requests: Arc<Mutex<Vec<AuthorizationRequest>>>,
+    }
+
+    #[async_trait]
+    impl AuthorizationChecker for CapturingAuthorizationChecker {
+        async fn is_authorized(&self, request: &AuthorizationRequest) -> Result<(), AuthorizationError> {
+            self.requests.lock().unwrap().push(request.clone());
+            Ok(())
+        }
+    }
+
+    #[tokio::test]
+    async fn command_handler_executes_authorized_command() {
+        let handler = Arc::new(CapturingCommandHandler::default());
+        let handler_ref: CommandHandler<TestAggregate> = handler.clone();
+        let authorization_checker: Arc<dyn AuthorizationChecker> = Arc::new(AllowAllAuthorizationChecker);
+
+        command_handler(
+            authorization_checker,
+            None,
+            "aggregate-id",
+            &handler_ref,
+            "emit".to_string(),
+        )
+        .await
+        .unwrap();
+
+        let calls = handler.calls.lock().unwrap();
+        assert_eq!(calls.len(), 1);
+        assert_eq!(calls[0].aggregate_id, "aggregate-id");
+        assert_eq!(calls[0].command, "emit");
+        assert!(calls[0].metadata.contains_key("timestamp"));
+    }
+
+    #[tokio::test]
+    async fn command_handler_returns_forbidden_when_denied() {
+        let handler = Arc::new(CapturingCommandHandler::default());
+        let state: CommandHandler<TestAggregate> = handler.clone();
+
+        let result = command_handler(
+            Arc::new(DenyAllAuthorizationChecker),
+            None,
+            "aggregate-id",
+            &state,
+            "emit".to_string(),
+        )
+        .await;
+
+        assert!(matches!(
+            result,
+            Err(CommandHandlerError::Authorization(AuthorizationError::Forbidden))
+        ));
+    }
+
+    #[tokio::test]
+    async fn command_handler_does_not_execute_denied_command() {
+        let handler = Arc::new(CapturingCommandHandler::default());
+        let state: CommandHandler<TestAggregate> = handler.clone();
+
+        let _ = command_handler(
+            Arc::new(DenyAllAuthorizationChecker),
+            None,
+            "aggregate-id",
+            &state,
+            "emit".to_string(),
+        )
+        .await;
+
+        assert!(handler.calls.lock().unwrap().is_empty());
+    }
+
+    #[tokio::test]
+    async fn command_handler_sends_authorization_request() {
+        let handler = Arc::new(CapturingCommandHandler::default());
+        let state: CommandHandler<TestAggregate> = handler.clone();
+        let requests = Arc::new(Mutex::new(Vec::new()));
+        let actor = Actor {
+            subject: "user@example.test".to_string(),
+        };
+
+        command_handler(
+            Arc::new(CapturingAuthorizationChecker {
+                requests: Arc::clone(&requests),
+            }),
+            Some(actor.clone()),
+            "aggregate-id",
+            &state,
+            "emit".to_string(),
+        )
+        .await
+        .unwrap();
+
+        assert_eq!(
+            requests.lock().unwrap().as_slice(),
+            &[AuthorizationRequest {
+                actor: Some(actor),
+                operation: AuthorizationOperation::Command {
+                    aggregate_id: "aggregate-id".to_string(),
+                    command_type: std::any::type_name::<String>(),
+                    authorization: CommandAuthorization::ACTOR_REQUIRED,
+                },
+            }]
+        );
+    }
+}
diff --git a/agent_shared/src/profile.rs b/agent_shared/src/profile.rs
index d65564fa..cc332051 100644
--- a/agent_shared/src/profile.rs
+++ b/agent_shared/src/profile.rs
@@ -3,7 +3,7 @@ use std::env;
 use std::str::FromStr;
 use strum::{Display, EnumString};
 
-#[derive(Debug, Display, EnumString, Serialize)]
+#[derive(Clone, Copy, Debug, Display, EnumString, Serialize)]
 #[serde(rename_all = "lowercase")]
 #[strum(serialize_all = "lowercase")]
 pub enum ApplicationProfile {
diff --git a/agent_store/src/lib.rs b/agent_store/src/lib.rs
index e47649dd..f3137ad1 100644
--- a/agent_store/src/lib.rs
+++ b/agent_store/src/lib.rs
@@ -59,6 +59,7 @@ use agent_verification::state::VerificationState;
 use async_trait::async_trait;
 use cqrs_es::persist::ViewRepository;
 use cqrs_es::{Aggregate, CqrsFramework, EventStore, Query, View};
+use shared_kernel::authorization::AllowAllAuthorizationChecker;
 use shared_kernel::view_repository::DynViewRepository;
 use std::collections::HashMap;
 use std::sync::Arc;
@@ -206,6 +207,7 @@ pub async fn identity_state<CCB: CqrsComponentBuilder>(
         .await;
 
     IdentityState {
+        authorization_checker: Arc::new(AllowAllAuthorizationChecker),
         command: agent_identity::state::CommandHandlers {
             connection: connection_command_handler,
             document: document_command_handler,
@@ -244,6 +246,7 @@ pub async fn library_state<CCB: CqrsComponentBuilder>(
         .await;
 
     LibraryState {
+        authorization_checker: Arc::new(AllowAllAuthorizationChecker),
         command: agent_library::state::CommandHandlers {
             template: template_command_handler,
         },
@@ -293,6 +296,7 @@ pub async fn authorization_state<CCB: CqrsComponentBuilder>(
         .await;
 
     AuthorizationState {
+        authorization_checker: Arc::new(AllowAllAuthorizationChecker),
         command: agent_authorization::state::CommandHandlers {
             authorization_code: authorization_code_command_handler,
             client: client_command_handler,
@@ -357,6 +361,7 @@ pub async fn issuance_state<CCB: CqrsComponentBuilder>(
         .await;
 
     agent_issuance::state::IssuanceState {
+        authorization_checker: Arc::new(AllowAllAuthorizationChecker),
         command: agent_issuance::state::CommandHandlers {
             credential: credential_command_handler,
             offer: offer_command_handler,
@@ -400,6 +405,7 @@ pub async fn verification_state<CCB: CqrsComponentBuilder>(
         .await;
 
     VerificationState {
+        authorization_checker: Arc::new(AllowAllAuthorizationChecker),
         command: agent_verification::state::CommandHandlers {
             authorization_request: authorization_request_command_handler,
         },
@@ -445,6 +451,7 @@ pub async fn holder_state<CCB: CqrsComponentBuilder>(
         .await;
 
     HolderState {
+        authorization_checker: Arc::new(AllowAllAuthorizationChecker),
         command: agent_holder::state::CommandHandlers {
             credential: holder_credential_command_handler,
             presentation: presentation_command_handler,
diff --git a/agent_verification/src/state.rs b/agent_verification/src/state.rs
index 2662c680..d00cd441 100644
--- a/agent_verification/src/state.rs
+++ b/agent_verification/src/state.rs
@@ -1,4 +1,5 @@
 use agent_shared::application_state::CommandHandler;
+use shared_kernel::authorization::AuthorizationChecker;
 use shared_kernel::view_repository::DynViewRepository;
 use std::sync::Arc;
 
@@ -8,6 +9,7 @@ use crate::authorization_request::views::AuthorizationRequestView;
 
 #[derive(Clone)]
 pub struct VerificationState {
+    pub authorization_checker: Arc<dyn AuthorizationChecker>,
     pub command: CommandHandlers,
     pub query: Queries,
 }
diff --git a/docs/configuration/profiles.md b/docs/configuration/profiles.md
index fc208ba6..f3142d21 100644
--- a/docs/configuration/profiles.md
+++ b/docs/configuration/profiles.md
@@ -12,3 +12,16 @@ If nothing is further specified, UniCore will run in production mode by default.
 Can be enabled by setting the environment variable `UNICORE__PROFILE=development`.
 
 This profile is designed to be used for development purposes. It requires less initial configuration, enables a more verbose API and debugging information.
+
+Development-only settings can be configured under the `dev` section. These values are ignored when UniCore runs with the `production` profile.
+
+| Environment variable     | `config.yaml` |
+| ------------------------ | ------------- |
+| `UNICORE__DEV__API_KEY`  | `dev.api_key` |
+
+#### Example
+
+```yaml
+dev:
+  api_key: 123123123
+```
diff --git a/docs/problem-details/authorization.md b/docs/problem-details/authorization.md
new file mode 100644
index 00000000..5e0b326b
--- /dev/null
+++ b/docs/problem-details/authorization.md
@@ -0,0 +1,19 @@
+# Authorization
+
+UniCore's authorization layer determines whether a request is allowed to perform an operation. The following errors may be encountered during authorization checks:
+
+## Unauthorized
+
+This error is raised when the request is performed without an identifiable actor, where one is required. The system returns a `401 Unauthorized` error.
+
+## Forbidden
+
+This error is raised when the request is authenticated or otherwise identified, but the actor does not have the permission to perform the requested operation. The system returns a `403 Forbidden` error.
+
+### Resolution
+
+Authenticate or provide sufficient permissions for the requested management operation.
+
+Authorization checks can include both the requested operation and the target aggregate instance. This allows permission
+models to be broad, such as allowing a command type in general, or scoped to a specific credential, offer, profile, or
+other aggregate instance.
diff --git a/infrastructure/adapters/verification-authorization/src/lib.rs b/infrastructure/adapters/verification-authorization/src/lib.rs
index c0feecc6..f583f10d 100644
--- a/infrastructure/adapters/verification-authorization/src/lib.rs
+++ b/infrastructure/adapters/verification-authorization/src/lib.rs
@@ -93,6 +93,8 @@ impl OpenId4VpPresentationService for VerificationAuthorizationAdapter {
         };
 
         command_handler(
+            self.verification_state.authorization_checker.clone(),
+            None,
             &authorization_request_id,
             &self.verification_state.command.authorization_request,
             command,
@@ -100,6 +102,8 @@ impl OpenId4VpPresentationService for VerificationAuthorizationAdapter {
         .await?;
 
         let mut authorization_request = query_handler(
+            self.verification_state.authorization_checker.clone(),
+            None,
             &authorization_request_id,
             &self.verification_state.query.authorization_request,
         )
@@ -131,6 +135,8 @@ impl OpenId4VpPresentationService for VerificationAuthorizationAdapter {
         let command = AuthorizationRequestCommand::VerifyAuthorizationResponse { authorization_response };
 
         command_handler(
+            self.verification_state.authorization_checker.clone(),
+            None,
             &authorization_request_id,
             &self.verification_state.command.authorization_request,
             command,
diff --git a/shared-kernel/src/application_service.rs b/shared-kernel/src/application_service.rs
index 3bef9115..66fac1e9 100644
--- a/shared-kernel/src/application_service.rs
+++ b/shared-kernel/src/application_service.rs
@@ -3,6 +3,11 @@ use std::sync::Arc;
 use tokio::sync::{mpsc, oneshot};
 use tracing::{debug, error, info, warn};
 
+use crate::authorization::{
+    Actor, AllowAllAuthorizationChecker, AuthorizationChecker, AuthorizationError, AuthorizationOperation,
+    AuthorizationRequest, CommandAuthorization,
+};
+
 /// Defines the domain-specific types and handlers for a bounded context.
 ///
 /// Each bounded context implements this trait to declare its command/query types
@@ -32,28 +37,48 @@ pub trait ApplicationContext: Send + Sync + 'static {
 
     /// Execute a read-side query, returning the projected view.
     async fn handle_query(&self, query: Self::Query) -> Result<Self::View, Self::QueryError>;
+
+    fn command_authorization(&self, _command: &Self::Command) -> CommandAuthorization {
+        CommandAuthorization::ACTOR_REQUIRED
+    }
 }
 
 /// A command message together with routing information and a reply channel.
 ///
 /// Sent from a presentation-layer handle to the [`ApplicationService`] over an `mpsc` channel.
 pub struct CommandEnvelope<AC: ApplicationContext> {
+    /// The actor of the command.
+    pub actor: Option<Actor>,
     /// The target aggregate ID.
     pub aggregate_id: String,
     /// The domain command to execute.
     pub command: AC::Command,
     /// One-shot channel for sending back the result.
-    pub reply: oneshot::Sender<Result<String, AC::CommandError>>,
+    pub reply: oneshot::Sender<Result<String, ApplicationServiceError<AC::CommandError>>>,
 }
 
 /// A query message together with a reply channel.
 ///
 /// Sent from a presentation-layer handle to the [`ApplicationService`] over an `mpsc` channel.
 pub struct QueryEnvelope<AC: ApplicationContext> {
+    /// The actor of the query.
+    pub actor: Option<Actor>,
     /// The domain query to execute.
     pub query: AC::Query,
     /// One-shot channel for sending back the result.
-    pub reply: oneshot::Sender<Result<AC::View, AC::QueryError>>,
+    pub reply: oneshot::Sender<Result<AC::View, ApplicationServiceError<AC::QueryError>>>,
+}
+
+/// A shared application-service error around bounded-context command and query errors.
+#[derive(Debug, thiserror::Error)]
+pub enum ApplicationServiceError<E>
+where
+    E: std::error::Error,
+{
+    #[error(transparent)]
+    Authorization(AuthorizationError),
+    #[error(transparent)]
+    Context(E),
 }
 
 /// An actor-style application service that drives an [`ApplicationContext`].
@@ -83,11 +108,12 @@ pub struct QueryEnvelope<AC: ApplicationContext> {
 ///
 /// // Send a command from the presentation layer:
 /// let (reply_tx, reply_rx) = tokio::sync::oneshot::channel();
-/// command_tx.send(CommandEnvelope { aggregate_id: "aggregate-id".into(), command: my_cmd, reply: reply_tx }).await?;
+/// command_tx.send(CommandEnvelope { actor: None, aggregate_id: "aggregate-id".into(), command: my_cmd, reply: reply_tx }).await?;
 /// let result = reply_rx.await?;
 /// ```
 pub struct ApplicationService<AC: ApplicationContext> {
     context: Arc<AC>,
+    authorization_checker: Arc<dyn AuthorizationChecker>,
     command_rx: mpsc::Receiver<CommandEnvelope<AC>>,
     query_rx: mpsc::Receiver<QueryEnvelope<AC>>,
 }
@@ -97,9 +123,19 @@ impl<AC: ApplicationContext> ApplicationService<AC> {
         context: AC,
         command_rx: mpsc::Receiver<CommandEnvelope<AC>>,
         query_rx: mpsc::Receiver<QueryEnvelope<AC>>,
+    ) -> Self {
+        Self::new_with_authorization(context, command_rx, query_rx, Arc::new(AllowAllAuthorizationChecker))
+    }
+
+    pub fn new_with_authorization(
+        context: AC,
+        command_rx: mpsc::Receiver<CommandEnvelope<AC>>,
+        query_rx: mpsc::Receiver<QueryEnvelope<AC>>,
+        authorization_checker: Arc<dyn AuthorizationChecker>,
     ) -> Self {
         Self {
             context: Arc::new(context),
+            authorization_checker,
             command_rx,
             query_rx,
         }
@@ -117,14 +153,16 @@ impl<AC: ApplicationContext> ApplicationService<AC> {
             tokio::select! {
                 Some(msg) = self.command_rx.recv() => {
                     let context = Arc::clone(&self.context);
+                    let authorization_checker = Arc::clone(&self.authorization_checker);
                     tokio::spawn(async move {
-                        process_command(context.as_ref(), msg).await;
+                        process_command(context.as_ref(), authorization_checker.as_ref(), msg).await;
                     });
                 }
                 Some(msg) = self.query_rx.recv() => {
                     let context = Arc::clone(&self.context);
+                    let authorization_checker = Arc::clone(&self.authorization_checker);
                     tokio::spawn(async move {
-                        process_query(context.as_ref(), msg).await;
+                        process_query(context.as_ref(), authorization_checker.as_ref(), msg).await;
                     });
                 }
                 // Both channels are closed — all senders have been dropped.
@@ -137,10 +175,35 @@ impl<AC: ApplicationContext> ApplicationService<AC> {
     }
 }
 
-async fn process_command<AC: ApplicationContext>(context: &AC, msg: CommandEnvelope<AC>) {
+async fn process_command<AC: ApplicationContext>(
+    context: &AC,
+    authorization_checker: &dyn AuthorizationChecker,
+    msg: CommandEnvelope<AC>,
+) {
     debug!(aggregate_id = %msg.aggregate_id, "Processing command");
 
-    let result = context.handle_command(&msg.aggregate_id, msg.command).await;
+    let authorization_request = AuthorizationRequest {
+        actor: msg.actor.clone(),
+        operation: AuthorizationOperation::Command {
+            aggregate_id: msg.aggregate_id.clone(),
+            // TODO: Use command variant names when authorization needs finer-grained permissions.
+            command_type: std::any::type_name::<AC::Command>(),
+            authorization: context.command_authorization(&msg.command),
+        },
+    };
+    if let Err(error) = authorization_checker
+        .is_authorized(&authorization_request)
+        .await
+        .map_err(ApplicationServiceError::Authorization)
+    {
+        let _ = msg.reply.send(Err(error));
+        return;
+    }
+
+    let result = context
+        .handle_command(&msg.aggregate_id, msg.command)
+        .await
+        .map_err(ApplicationServiceError::Context);
 
     match &result {
         Ok(id) => info!(aggregate_id = %id, "Command executed successfully"),
@@ -152,10 +215,32 @@ async fn process_command<AC: ApplicationContext>(context: &AC, msg: CommandEnvel
     }
 }
 
-async fn process_query<AC: ApplicationContext>(context: &AC, msg: QueryEnvelope<AC>) {
+async fn process_query<AC: ApplicationContext>(
+    context: &AC,
+    authorization_checker: &dyn AuthorizationChecker,
+    msg: QueryEnvelope<AC>,
+) {
     debug!("Processing query");
 
-    let result = context.handle_query(msg.query).await;
+    let authorization_request = AuthorizationRequest {
+        actor: msg.actor.clone(),
+        operation: AuthorizationOperation::Query {
+            query_type: std::any::type_name::<AC::Query>(),
+        },
+    };
+    if let Err(error) = authorization_checker
+        .is_authorized(&authorization_request)
+        .await
+        .map_err(ApplicationServiceError::Authorization)
+    {
+        let _ = msg.reply.send(Err(error));
+        return;
+    }
+
+    let result = context
+        .handle_query(msg.query)
+        .await
+        .map_err(ApplicationServiceError::Context);
 
     match &result {
         Ok(_) => debug!("Query executed successfully"),
@@ -169,10 +254,11 @@ async fn process_query<AC: ApplicationContext>(context: &AC, msg: QueryEnvelope<
 
 #[cfg(test)]
 mod tests {
-    use crate::service_registry::ServiceHandle;
+    use crate::service_registry::{ServiceError, ServiceHandle};
 
     use super::*;
     use std::fmt;
+    use std::sync::Mutex;
     use tokio::sync::mpsc;
 
     // ── Fixture types ──────────────────────────────────────────────
@@ -248,6 +334,27 @@ mod tests {
         }
     }
 
+    struct DenyAllAuthorizationChecker;
+
+    #[async_trait]
+    impl AuthorizationChecker for DenyAllAuthorizationChecker {
+        async fn is_authorized(&self, _request: &AuthorizationRequest) -> Result<(), AuthorizationError> {
+            Err(AuthorizationError::Forbidden)
+        }
+    }
+
+    struct CapturingAuthorizationChecker {
+        requests: Arc<Mutex<Vec<AuthorizationRequest>>>,
+    }
+
+    #[async_trait]
+    impl AuthorizationChecker for CapturingAuthorizationChecker {
+        async fn is_authorized(&self, request: &AuthorizationRequest) -> Result<(), AuthorizationError> {
+            self.requests.lock().unwrap().push(request.clone());
+            Ok(())
+        }
+    }
+
     // ── Helper ─────────────────────────────────────────────────────
 
     /// Spawn the service and return the sender halves for commands and queries.
@@ -259,6 +366,17 @@ mod tests {
         ServiceHandle::new(command_tx, query_tx)
     }
 
+    fn spawn_service_with_authorization<AC: ApplicationContext>(
+        context: AC,
+        authorization_checker: Arc<dyn AuthorizationChecker>,
+    ) -> ServiceHandle<AC> {
+        let (command_tx, command_rx) = mpsc::channel(16);
+        let (query_tx, query_rx) = mpsc::channel(16);
+        let service = ApplicationService::new_with_authorization(context, command_rx, query_rx, authorization_checker);
+        tokio::spawn(service.start());
+        ServiceHandle::new(command_tx, query_tx)
+    }
+
     // ── Tests ──────────────────────────────────────────────────────
 
     #[tokio::test]
@@ -269,6 +387,7 @@ mod tests {
         service_handle
             .command_tx
             .send(CommandEnvelope {
+                actor: None,
                 aggregate_id: "aggregate-id".into(),
                 command: "create".into(),
                 reply: reply_tx,
@@ -277,7 +396,7 @@ mod tests {
             .unwrap();
 
         let result = reply_rx.await.unwrap();
-        assert_eq!(result.unwrap(), "aggregate-id");
+        assert_eq!(result.ok(), Some("aggregate-id".to_string()));
     }
 
     #[tokio::test]
@@ -288,6 +407,7 @@ mod tests {
         service_handle
             .query_tx
             .send(QueryEnvelope {
+                actor: None,
                 query: "my-query".into(),
                 reply: reply_tx,
             })
@@ -295,7 +415,7 @@ mod tests {
             .unwrap();
 
         let result = reply_rx.await.unwrap();
-        assert_eq!(result.unwrap(), TestView("my-view".into()));
+        assert_eq!(result.ok(), Some(TestView("my-view".into())));
     }
 
     #[tokio::test]
@@ -306,6 +426,7 @@ mod tests {
         service_handle
             .command_tx
             .send(CommandEnvelope {
+                actor: None,
                 aggregate_id: "aggregate-id".into(),
                 command: "bad-command".into(),
                 reply: reply_tx,
@@ -326,6 +447,7 @@ mod tests {
         service_handle
             .query_tx
             .send(QueryEnvelope {
+                actor: None,
                 query: "bad-query".into(),
                 reply: reply_tx,
             })
@@ -336,4 +458,135 @@ mod tests {
         assert!(result.is_err());
         assert_eq!(result.unwrap_err().to_string(), "query failed");
     }
+
+    #[tokio::test]
+    async fn denied_command_returns_forbidden_before_context_error() {
+        let service_handle = spawn_service_with_authorization(FailingContext, Arc::new(DenyAllAuthorizationChecker));
+
+        let result = service_handle
+            .dispatch_command("aggregate-id".into(), "create".into())
+            .await;
+
+        assert!(matches!(
+            result,
+            Err(ServiceError::Authorization(AuthorizationError::Forbidden))
+        ));
+    }
+
+    #[tokio::test]
+    async fn denied_query_returns_forbidden_before_context_error() {
+        let service_handle = spawn_service_with_authorization(FailingContext, Arc::new(DenyAllAuthorizationChecker));
+
+        let result = service_handle.dispatch_query("my-query".into()).await;
+
+        assert!(matches!(
+            result,
+            Err(ServiceError::Authorization(AuthorizationError::Forbidden))
+        ));
+    }
+
+    #[tokio::test]
+    async fn command_result_send_failure_does_not_panic() {
+        let (reply_tx, reply_rx) = oneshot::channel();
+        drop(reply_rx);
+
+        process_command(
+            &EchoContext,
+            &AllowAllAuthorizationChecker,
+            CommandEnvelope {
+                actor: None,
+                aggregate_id: "aggregate-id".into(),
+                command: "create".into(),
+                reply: reply_tx,
+            },
+        )
+        .await;
+    }
+
+    #[tokio::test]
+    async fn query_result_send_failure_does_not_panic() {
+        let (reply_tx, reply_rx) = oneshot::channel();
+        drop(reply_rx);
+
+        process_query(
+            &EchoContext,
+            &AllowAllAuthorizationChecker,
+            QueryEnvelope {
+                actor: None,
+                query: "my-query".into(),
+                reply: reply_tx,
+            },
+        )
+        .await;
+    }
+
+    #[tokio::test]
+    async fn service_stops_when_channels_close() {
+        let (command_tx, command_rx) = mpsc::channel(16);
+        let (query_tx, query_rx) = mpsc::channel(16);
+        drop(command_tx);
+        drop(query_tx);
+
+        ApplicationService::new(EchoContext, command_rx, query_rx).start().await;
+    }
+
+    #[tokio::test]
+    async fn command_authorization_request_contains_actor_and_operation() {
+        let requests = Arc::new(Mutex::new(Vec::new()));
+        let service_handle = spawn_service_with_authorization(
+            EchoContext,
+            Arc::new(CapturingAuthorizationChecker {
+                requests: Arc::clone(&requests),
+            }),
+        );
+
+        let actor = Actor {
+            subject: "user@example.test".to_string(),
+        };
+        let result = service_handle
+            .dispatch_command_as(Some(actor.clone()), "aggregate-id".into(), "create".into())
+            .await;
+
+        assert_eq!(result.ok(), Some("aggregate-id".to_string()));
+        assert_eq!(
+            requests.lock().unwrap().as_slice(),
+            &[AuthorizationRequest {
+                actor: Some(actor),
+                operation: AuthorizationOperation::Command {
+                    aggregate_id: "aggregate-id".to_string(),
+                    command_type: std::any::type_name::<String>(),
+                    authorization: CommandAuthorization::ACTOR_REQUIRED,
+                },
+            }]
+        );
+    }
+
+    #[tokio::test]
+    async fn query_authorization_request_contains_actor_and_operation() {
+        let requests = Arc::new(Mutex::new(Vec::new()));
+        let service_handle = spawn_service_with_authorization(
+            EchoContext,
+            Arc::new(CapturingAuthorizationChecker {
+                requests: Arc::clone(&requests),
+            }),
+        );
+
+        let actor = Actor {
+            subject: "user@example.test".to_string(),
+        };
+        let result = service_handle
+            .dispatch_query_as(Some(actor.clone()), "my-query".into())
+            .await;
+
+        assert_eq!(result.ok(), Some(TestView("my-view".into())));
+        assert_eq!(
+            requests.lock().unwrap().as_slice(),
+            &[AuthorizationRequest {
+                actor: Some(actor),
+                operation: AuthorizationOperation::Query {
+                    query_type: std::any::type_name::<String>(),
+                },
+            }]
+        );
+    }
 }
diff --git a/shared-kernel/src/authorization.rs b/shared-kernel/src/authorization.rs
new file mode 100644
index 00000000..c319626d
--- /dev/null
+++ b/shared-kernel/src/authorization.rs
@@ -0,0 +1,116 @@
+use async_trait::async_trait;
+
+/// Identifies the caller on whose behalf an application operation is executed.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Actor {
+    /// Stable subject identifier for the caller.
+    pub subject: String,
+}
+
+/// Adapter trait for request-like inputs that can expose actor information.
+pub trait ToActor: Sync {
+    /// Returns the actor represented by this input, if one can be derived.
+    fn to_actor(&self) -> Option<Actor>;
+
+    /// Returns an authentication-related value by key when the input can expose one.
+    fn auth_value(&self, _key: &str) -> Option<&str> {
+        None
+    }
+
+    /// Returns a bearer token from the `Authorization` value without treating it as an actor.
+    fn bearer_token(&self) -> Option<&str> {
+        self.auth_value("authorization")
+            .and_then(|authorization_header| authorization_header.strip_prefix("Bearer "))
+            .filter(|token| !token.is_empty())
+    }
+}
+
+/// Extracts an [`Actor`] from an input object.
+#[async_trait]
+pub trait ActorExtractor: Send + Sync + 'static {
+    /// Returns the actor that should be attached to the application operation.
+    async fn extract_actor(&self, input: &dyn ToActor) -> Option<Actor>;
+}
+
+/// Actor extractor used when no actor context should be attached.
+#[derive(Clone)]
+pub struct NoActorExtractor;
+
+#[async_trait]
+impl ActorExtractor for NoActorExtractor {
+    async fn extract_actor(&self, _input: &dyn ToActor) -> Option<Actor> {
+        None
+    }
+}
+
+/// Describes the application operation that is being authorized.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct CommandAuthorization {
+    /// Domain-defined permission marker understood by the configured checker.
+    pub permission: &'static str,
+}
+
+impl CommandAuthorization {
+    /// Default requirement for commands that only need an authenticated actor.
+    pub const ACTOR_REQUIRED: Self = Self::new("actor_required");
+
+    #[must_use]
+    pub const fn new(permission: &'static str) -> Self {
+        Self { permission }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum AuthorizationOperation {
+    /// A write-side command against an aggregate.
+    Command {
+        /// Aggregate instance targeted by the command.
+        ///
+        /// This lets authorization checkers make instance-scoped decisions, such as allowing an
+        /// actor to execute a command type only for a specific credential, offer, or profile.
+        aggregate_id: String,
+        /// Command type name used as the operation identifier.
+        command_type: &'static str,
+        authorization: CommandAuthorization,
+    },
+    /// A read-side query.
+    Query {
+        /// Query type name used as the operation identifier.
+        query_type: &'static str,
+    },
+}
+
+/// Complete authorization input for an application command or query.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct AuthorizationRequest {
+    /// Caller context for the operation, if available.
+    pub actor: Option<Actor>,
+    /// Operation being authorized.
+    pub operation: AuthorizationOperation,
+}
+
+/// Errors related to authorization checks
+#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error)]
+pub enum AuthorizationError {
+    #[error("Unauthorized")]
+    Unauthorized, // 401
+    #[error("Forbidden")]
+    Forbidden, // 403
+}
+
+/// Decides whether an [`AuthorizationRequest`] is allowed to execute.
+#[async_trait]
+pub trait AuthorizationChecker: Send + Sync {
+    /// Returns `Ok(())` when the request is authorized.
+    async fn is_authorized(&self, request: &AuthorizationRequest) -> Result<(), AuthorizationError>;
+}
+
+/// Authorization checker that permits every request.
+pub struct AllowAllAuthorizationChecker;
+
+#[async_trait]
+impl AuthorizationChecker for AllowAllAuthorizationChecker {
+    async fn is_authorized(&self, _request: &AuthorizationRequest) -> Result<(), AuthorizationError> {
+        Ok(())
+    }
+}
diff --git a/shared-kernel/src/lib.rs b/shared-kernel/src/lib.rs
index 8b1877ed..ce20c161 100644
--- a/shared-kernel/src/lib.rs
+++ b/shared-kernel/src/lib.rs
@@ -3,12 +3,14 @@
 //! Provides infrastructure used by all bounded contexts:
 //!
 //! - [`application_service`] — Actor-style service that serialises command/query processing.
+//! - [`authorization`] — Shared authorization primitives for application command/query execution.
 //! - [`command_handler`] — Traits and helpers for dispatching commands to aggregates.
 //! - [`custom_queries`] — Reusable CQRS query types such as [`custom_queries::ListAllQuery`].
 //! - [`view_repository`] — Dyn-compatible view repository wrappers and factory trait.
 //! - [`service_registry`] — Type-keyed service registry and channel-based service handles.
 
 pub mod application_service;
+pub mod authorization;
 pub mod command_handler;
 pub mod custom_queries;
 pub mod service_registry;
diff --git a/shared-kernel/src/service_registry.rs b/shared-kernel/src/service_registry.rs
index 45e14d42..c99e4769 100644
--- a/shared-kernel/src/service_registry.rs
+++ b/shared-kernel/src/service_registry.rs
@@ -4,7 +4,8 @@ use tokio::sync::oneshot::error::RecvError;
 use tokio::sync::{mpsc, oneshot};
 use tracing::debug;
 
-use crate::application_service::{ApplicationContext, CommandEnvelope, QueryEnvelope};
+use crate::application_service::{ApplicationContext, ApplicationServiceError, CommandEnvelope, QueryEnvelope};
+use crate::authorization::{Actor, AuthorizationError};
 
 /// A type-keyed registry for storing and retrieving services at runtime.
 ///
@@ -50,6 +51,8 @@ pub enum ServiceError<AC: ApplicationContext> {
     CommandError(AC::CommandError),
     #[error("Query error: {0}")]
     QueryError(AC::QueryError),
+    #[error("Authorization error: {0}")]
+    Authorization(#[from] AuthorizationError),
 }
 
 /// A cloneable handle for sending commands and queries to an [`ApplicationService`](crate::application_service::ApplicationService).
@@ -80,17 +83,36 @@ where
     ///
     /// Returns `ServiceError::SendCommandError` if sending the command fails.
     /// Returns `ServiceError::RecvError` if awaiting the response fails.
+    /// Returns `ServiceError::Authorization` if authorization denies the command.
     /// Returns `ServiceError::CommandError` if the application service returns an error for the
     /// command.
     pub async fn dispatch_command(
         &self,
         aggregate_id: String,
         command: AC::Command,
+    ) -> Result<String, ServiceError<AC>> {
+        self.dispatch_command_as(None, aggregate_id, command).await
+    }
+
+    /// Send a command to the application service as an actor and await its result.
+    /// # Errors
+    ///
+    /// Returns `ServiceError::SendCommandError` if sending the command fails.
+    /// Returns `ServiceError::RecvError` if awaiting the response fails.
+    /// Returns `ServiceError::Authorization` if authorization denies the command.
+    /// Returns `ServiceError::CommandError` if the application service returns an error for the
+    /// command.
+    pub async fn dispatch_command_as(
+        &self,
+        actor: Option<Actor>,
+        aggregate_id: String,
+        command: AC::Command,
     ) -> Result<String, ServiceError<AC>> {
         debug!(%aggregate_id, "Dispatching command through service handle");
 
         let (reply_tx, reply_rx) = oneshot::channel();
         let command = CommandEnvelope {
+            actor,
             aggregate_id,
             command,
             reply: reply_tx,
@@ -98,7 +120,11 @@ where
 
         self.command_tx.send(command).await?;
 
-        reply_rx.await?.map_err(ServiceError::CommandError)
+        match reply_rx.await? {
+            Ok(id) => Ok(id),
+            Err(ApplicationServiceError::Authorization(error)) => Err(ServiceError::Authorization(error)),
+            Err(ApplicationServiceError::Context(error)) => Err(ServiceError::CommandError(error)),
+        }
     }
 
     /// Send a query to the application service and await the resulting view.
@@ -106,17 +132,42 @@ where
     ///
     /// Returns `ServiceError::SendQueryError` if sending the query fails.
     /// Returns `ServiceError::RecvError` if awaiting the response fails.
+    /// Returns `ServiceError::Authorization` if authorization denies the query.
     /// Returns `ServiceError::QueryError` if the application service returns an error for the
     /// query.
     pub async fn dispatch_query(&self, query: AC::Query) -> Result<AC::View, ServiceError<AC>> {
+        self.dispatch_query_as(None, query).await
+    }
+
+    /// Send a query to the application service as an actor and await the resulting view.
+    /// # Errors
+    ///
+    /// Returns `ServiceError::SendQueryError` if sending the query fails.
+    /// Returns `ServiceError::RecvError` if awaiting the response fails.
+    /// Returns `ServiceError::Authorization` if authorization denies the query.
+    /// Returns `ServiceError::QueryError` if the application service returns an error for the
+    /// query.
+    pub async fn dispatch_query_as(
+        &self,
+        actor: Option<Actor>,
+        query: AC::Query,
+    ) -> Result<AC::View, ServiceError<AC>> {
         debug!("Dispatching query through service handle");
 
         let (reply_tx, reply_rx) = oneshot::channel();
-        let query = QueryEnvelope { query, reply: reply_tx };
+        let query = QueryEnvelope {
+            actor,
+            query,
+            reply: reply_tx,
+        };
 
         self.query_tx.send(query).await?;
 
-        reply_rx.await?.map_err(ServiceError::QueryError)
+        match reply_rx.await? {
+            Ok(id) => Ok(id),
+            Err(ApplicationServiceError::Authorization(error)) => Err(ServiceError::Authorization(error)),
+            Err(ApplicationServiceError::Context(error)) => Err(ServiceError::QueryError(error)),
+        }
     }
 }
 
@@ -136,6 +187,7 @@ where
 mod tests {
     use super::*;
     use crate::application_service::{ApplicationContext, ApplicationService};
+    use crate::authorization::Actor;
     use async_trait::async_trait;
     use std::fmt;
     use tokio::sync::mpsc;
@@ -239,6 +291,111 @@ mod tests {
         assert_eq!(result.unwrap(), TestView("my-query".into()));
     }
 
+    #[tokio::test]
+    async fn dispatch_command_as_sends_actor_context() {
+        let (command_tx, mut command_rx) = mpsc::channel(16);
+        let (query_tx, _query_rx) = mpsc::channel(16);
+        let handle = ServiceHandle::<EchoContext>::new(command_tx, query_tx);
+        let actor = Actor {
+            subject: "user@example.test".to_string(),
+        };
+
+        let dispatch = tokio::spawn(async move {
+            handle
+                .dispatch_command_as(Some(actor), "aggregate-id".into(), "create".into())
+                .await
+        });
+
+        let command = command_rx.recv().await.unwrap();
+        assert_eq!(
+            command.actor,
+            Some(Actor {
+                subject: "user@example.test".to_string()
+            })
+        );
+        assert_eq!(command.aggregate_id, "aggregate-id");
+        assert_eq!(command.command, "create");
+
+        command.reply.send(Ok("aggregate-id".into())).unwrap();
+
+        assert_eq!(dispatch.await.unwrap().unwrap(), "aggregate-id");
+    }
+
+    #[tokio::test]
+    async fn dispatch_query_as_sends_actor_context() {
+        let (command_tx, _command_rx) = mpsc::channel(16);
+        let (query_tx, mut query_rx) = mpsc::channel(16);
+        let handle = ServiceHandle::<EchoContext>::new(command_tx, query_tx);
+        let actor = Actor {
+            subject: "user@example.test".to_string(),
+        };
+
+        let dispatch = tokio::spawn(async move { handle.dispatch_query_as(Some(actor), "my-query".into()).await });
+
+        let query = query_rx.recv().await.unwrap();
+        assert_eq!(
+            query.actor,
+            Some(Actor {
+                subject: "user@example.test".to_string()
+            })
+        );
+        assert_eq!(query.query, "my-query");
+
+        query.reply.send(Ok(TestView("my-query".into()))).unwrap();
+
+        assert_eq!(dispatch.await.unwrap().unwrap(), TestView("my-query".into()));
+    }
+
+    #[tokio::test]
+    async fn dispatch_command_maps_context_error_to_command_error() {
+        let (command_tx, mut command_rx) = mpsc::channel(16);
+        let (query_tx, _query_rx) = mpsc::channel(16);
+        let handle = ServiceHandle::<EchoContext>::new(command_tx, query_tx);
+
+        let dispatch = tokio::spawn(async move {
+            handle
+                .dispatch_command("aggregate-id".into(), "bad-command".into())
+                .await
+        });
+
+        let command = command_rx.recv().await.unwrap();
+        command
+            .reply
+            .send(Err(ApplicationServiceError::Context(TestCommandError(
+                "command failed".into(),
+            ))))
+            .unwrap();
+
+        let result = dispatch.await.unwrap();
+        assert!(matches!(
+            result,
+            Err(ServiceError::CommandError(error)) if error.to_string() == "command failed"
+        ));
+    }
+
+    #[tokio::test]
+    async fn dispatch_query_maps_context_error_to_query_error() {
+        let (command_tx, _command_rx) = mpsc::channel(16);
+        let (query_tx, mut query_rx) = mpsc::channel(16);
+        let handle = ServiceHandle::<EchoContext>::new(command_tx, query_tx);
+
+        let dispatch = tokio::spawn(async move { handle.dispatch_query("bad-query".into()).await });
+
+        let query = query_rx.recv().await.unwrap();
+        query
+            .reply
+            .send(Err(ApplicationServiceError::Context(TestQueryError(
+                "query failed".into(),
+            ))))
+            .unwrap();
+
+        let result = dispatch.await.unwrap();
+        assert!(matches!(
+            result,
+            Err(ServiceError::QueryError(error)) if error.to_string() == "query failed"
+        ));
+    }
+
     #[tokio::test]
     async fn service_handle_can_be_registered_and_retrieved() {
         let (command_tx, command_rx) = mpsc::channel(16);

From b20573b998404d4a7bc601fea242d68d6fa4bade Mon Sep 17 00:00:00 2001
From: Daniel Mader <daniel.mader@impierce.com>
Date: Mon, 6 Jul 2026 16:51:52 +0200
Subject: [PATCH 24/34] refactor: import schemas from `oid4vci` crate, inline
 `Status` schemas (#366)

---
 Cargo.lock                                    |  11 +-
 Cargo.toml                                    |  12 +-
 agent_api_http/openapi-generated.yaml         | 127 ++++++++++--------
 .../src/v0/issuance/public_offers.rs          |   1 +
 agent_api_http/src/v0/templates/mod.rs        |   3 +
 agent_holder/src/offer/aggregate.rs           |   2 +-
 agent_identity/src/document/aggregate.rs      |   2 +-
 agent_issuance/src/credential/aggregate.rs    |   2 +-
 agent_issuance/src/offer/aggregate.rs         |   2 +-
 agent_library/src/template/aggregate.rs       |   1 -
 agent_shared/src/config/mod.rs                |   7 +-
 agent_shared/src/config/openapi.rs            |  29 +---
 12 files changed, 94 insertions(+), 105 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 73a958cd..406c0826 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -8618,7 +8618,7 @@ dependencies = [
 [[package]]
 name = "oid4vc-core"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=0a5090e#0a5090e27bc004cfea0bbe141517a8cd5c0fa520"
+source = "git+https://github.com/impierce/openid4vc?rev=bc3f563#bc3f563c04dba4b000422bc48853ec293486f7c3"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -8650,7 +8650,7 @@ dependencies = [
 [[package]]
 name = "oid4vc-manager"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=0a5090e#0a5090e27bc004cfea0bbe141517a8cd5c0fa520"
+source = "git+https://github.com/impierce/openid4vc?rev=bc3f563#bc3f563c04dba4b000422bc48853ec293486f7c3"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -8683,7 +8683,7 @@ dependencies = [
 [[package]]
 name = "oid4vci"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=0a5090e#0a5090e27bc004cfea0bbe141517a8cd5c0fa520"
+source = "git+https://github.com/impierce/openid4vc?rev=bc3f563#bc3f563c04dba4b000422bc48853ec293486f7c3"
 dependencies = [
  "anyhow",
  "chrono",
@@ -8706,12 +8706,13 @@ dependencies = [
  "thiserror 1.0.69",
  "tokio",
  "url",
+ "utoipa",
 ]
 
 [[package]]
 name = "oid4vp"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=0a5090e#0a5090e27bc004cfea0bbe141517a8cd5c0fa520"
+source = "git+https://github.com/impierce/openid4vc?rev=bc3f563#bc3f563c04dba4b000422bc48853ec293486f7c3"
 dependencies = [
  "anyhow",
  "chrono",
@@ -11640,7 +11641,7 @@ dependencies = [
 [[package]]
 name = "siopv2"
 version = "0.1.0"
-source = "git+https://github.com/impierce/openid4vc?rev=0a5090e#0a5090e27bc004cfea0bbe141517a8cd5c0fa520"
+source = "git+https://github.com/impierce/openid4vc?rev=bc3f563#bc3f563c04dba4b000422bc48853ec293486f7c3"
 dependencies = [
  "anyhow",
  "async-trait",
diff --git a/Cargo.toml b/Cargo.toml
index 2922d144..2f5845a5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -36,11 +36,13 @@ publish = false
 pedantic = "warn"
 
 [workspace.dependencies]
-siopv2 = { git = "https://github.com/impierce/openid4vc", rev = "0a5090e" }
-oid4vci = { git = "https://github.com/impierce/openid4vc", rev = "0a5090e" }
-oid4vc-core = { git = "https://github.com/impierce/openid4vc", rev = "0a5090e" }
-oid4vc-manager = { git = "https://github.com/impierce/openid4vc", rev = "0a5090e" }
-oid4vp = { git = "https://github.com/impierce/openid4vc", rev = "0a5090e" }
+siopv2 = { git = "https://github.com/impierce/openid4vc", rev = "bc3f563" }
+oid4vci = { git = "https://github.com/impierce/openid4vc", rev = "bc3f563", features = [
+    "utoipa",
+] }
+oid4vc-core = { git = "https://github.com/impierce/openid4vc", rev = "bc3f563" }
+oid4vc-manager = { git = "https://github.com/impierce/openid4vc", rev = "bc3f563" }
+oid4vp = { git = "https://github.com/impierce/openid4vc", rev = "bc3f563" }
 
 shared-kernel = { path = "shared-kernel" }
 
diff --git a/agent_api_http/openapi-generated.yaml b/agent_api_http/openapi-generated.yaml
index e9bfb486..4246a39e 100644
--- a/agent_api_http/openapi-generated.yaml
+++ b/agent_api_http/openapi-generated.yaml
@@ -797,7 +797,12 @@ components:
             type: string
         status:
           oneOf:
-          - $ref: '#/components/schemas/TemplateStatus'
+          - type: string
+            enum:
+            - draft
+            - published
+            - archived
+            - deleted
           default: draft
         tags:
           type:
@@ -937,19 +942,16 @@ components:
           - 'null'
         signed: {}
         status:
-          $ref: '#/components/schemas/IssuanceStatus'
+          type: string
+          enum:
+          - Pending
+          - Issued
     CredentialExpiry:
       oneOf:
       - type: string
         format: date-time
       - type: 'null'
         default: null
-    CredentialOfferStatus:
-      type: string
-      enum:
-      - Created
-      - Pending
-      - Issued
     CredentialStatus:
       type: object
       required:
@@ -1070,17 +1072,15 @@ components:
           - type: 'null'
           - $ref: '#/components/schemas/IotaMetadata'
         status:
-          $ref: '#/components/schemas/DocumentStatus'
+          type: string
+          enum:
+          - SignAndValidate
+          - Disabled
         with_fixed_algorithm:
           type: string
           enum:
           - ES256
           - EdDSA
-    DocumentStatus:
-      type: string
-      enum:
-      - SignAndValidate
-      - Disabled
     DomainLinkageValidation:
       type: object
       required:
@@ -1169,26 +1169,9 @@ components:
         pre_authorized:
           type: boolean
         tx_code_constraints:
-          type: object
-          properties:
-            description:
-              type: string
-              description: The length of the string must not exceed 300 characters.
-            input_mode:
-              type: string
-              enum:
-              - numeric
-              - text
-            length:
-              type: integer
-              description: Allows a pin-length of 0-255.
-    HolderOfferStatus:
-      type: string
-      enum:
-      - Pending
-      - Accepted
-      - CredentialsReceived
-      - Rejected
+          oneOf:
+          - type: 'null'
+          - $ref: '#/components/schemas/TxCodeConstraints'
     HolderType:
       type: string
       enum:
@@ -1229,11 +1212,6 @@ components:
         wallet_address:
           type: string
           example: '0x1234567890'
-    IssuanceStatus:
-      type: string
-      enum:
-      - Pending
-      - Issued
     LinkedVpValidation:
       type: object
     Logo:
@@ -1307,7 +1285,11 @@ components:
         pre_authorized_code:
           type: string
         status:
-          $ref: '#/components/schemas/CredentialOfferStatus'
+          type: string
+          enum:
+          - Created
+          - Pending
+          - Issued
         subject_id:
           type:
           - string
@@ -1352,7 +1334,12 @@ components:
         id:
           type: string
         status:
-          $ref: '#/components/schemas/HolderOfferStatus'
+          type: string
+          enum:
+          - Pending
+          - Accepted
+          - CredentialsReceived
+          - Rejected
         token_response:
           type:
           - object
@@ -1426,11 +1413,6 @@ components:
             Defaults to `false`.
         selectivelyDisclosable:
           type: boolean
-    PublicOfferStatus:
-      type: string
-      enum:
-      - Active
-      - Inactive
     PublicOfferStatusDto:
       type: object
       required:
@@ -1446,7 +1428,10 @@ components:
         id:
           type: string
         status:
-          $ref: '#/components/schemas/PublicOfferStatus'
+          type: string
+          enum:
+          - Active
+          - Inactive
         templateId:
           type: string
     RemoveConnectionRequest:
@@ -1551,7 +1536,12 @@ components:
           propertyNames:
             type: string
         status:
-          $ref: '#/components/schemas/TemplateStatus'
+          type: string
+          enum:
+          - draft
+          - published
+          - archived
+          - deleted
         tags:
           type:
           - array
@@ -1566,13 +1556,33 @@ components:
             type: string
         visibility:
           $ref: '#/components/schemas/Visibility'
-    TemplateStatus:
-      type: string
-      enum:
-      - draft
-      - published
-      - archived
-      - deleted
+    TxCodeConstraints:
+      type: object
+      properties:
+        description:
+          type: string
+          description: The length of the description must not exceed 300 characters.
+          examples:
+          - Please provide the one-time code you received via email.
+          maxLength: 300
+        input_mode:
+          oneOf:
+          - type: 'null'
+          - type: string
+            enum:
+            - numeric
+            - text
+          default: numeric
+        length:
+          type:
+          - integer
+          - 'null'
+          format: int32
+          description: The length of the PIN must be between 0 and 255 characters.
+          examples:
+          - $serde_json::private::Number: '6'
+          maximum: 255
+          minimum: 0
     UpdateTemplateEndpointRequest:
       type: object
       properties:
@@ -1612,7 +1622,12 @@ components:
         status:
           oneOf:
           - type: 'null'
-          - $ref: '#/components/schemas/TemplateStatus'
+          - type: string
+            enum:
+            - draft
+            - published
+            - archived
+            - deleted
           default: null
         tags:
           type:
diff --git a/agent_api_http/src/v0/issuance/public_offers.rs b/agent_api_http/src/v0/issuance/public_offers.rs
index 2ad4f12d..e084018a 100644
--- a/agent_api_http/src/v0/issuance/public_offers.rs
+++ b/agent_api_http/src/v0/issuance/public_offers.rs
@@ -79,6 +79,7 @@ pub struct PublicOfferStatusDto {
     pub id: String,
     pub template_id: String,
     pub amount_issued: u32,
+    #[schema(inline)]
     pub status: PublicOfferStatus,
 }
 
diff --git a/agent_api_http/src/v0/templates/mod.rs b/agent_api_http/src/v0/templates/mod.rs
index f318b429..c343d401 100644
--- a/agent_api_http/src/v0/templates/mod.rs
+++ b/agent_api_http/src/v0/templates/mod.rs
@@ -35,6 +35,7 @@ pub struct TemplateDto {
     pub holder_type: HolderType,
     pub modified_at: Option<String>,
     pub tags: Option<Vec<String>>,
+    #[schema(inline)]
     pub status: Status,
     pub visibility: Visibility,
     pub credential_expiration: Expiration,
@@ -75,6 +76,7 @@ pub struct CreateNewTemplateRequestBody {
     pub data_model: DataModel,
     pub holder_type: HolderType,
     pub tags: Option<Vec<String>>,
+    #[schema(inline)]
     pub status: Status,
     pub visibility: Visibility,
     pub credential_expiration: Option<Expiration>,
@@ -278,6 +280,7 @@ pub struct UpdateTemplateEndpointRequest {
     pub title: Option<String>,
     pub display: Option<Display>,
     pub tags: Option<Vec<String>>,
+    #[schema(inline)]
     pub status: Option<Status>,
     pub visibility: Option<Visibility>,
     pub credential_expiration: Option<Expiration>,
diff --git a/agent_holder/src/offer/aggregate.rs b/agent_holder/src/offer/aggregate.rs
index f14c6cf1..4c858598 100644
--- a/agent_holder/src/offer/aggregate.rs
+++ b/agent_holder/src/offer/aggregate.rs
@@ -15,7 +15,6 @@ use std::sync::Arc;
 use tracing::{debug, info, warn};
 
 #[derive(Debug, Clone, Serialize, Deserialize, Default, PartialEq, Eq, utoipa::ToSchema)]
-#[schema(as = HolderOfferStatus)]
 pub enum Status {
     #[default]
     Pending,
@@ -39,6 +38,7 @@ pub struct Offer {
     // TODO: provide full type
     #[schema(value_type = Option<Object>)]
     pub credential_offer: Option<CredentialOfferParameters>,
+    #[schema(inline)]
     pub status: Status,
     // TODO: provide full type
     #[schema(value_type = Option<Object>)]
diff --git a/agent_identity/src/document/aggregate.rs b/agent_identity/src/document/aggregate.rs
index 7f7dc0f8..8f93fca5 100644
--- a/agent_identity/src/document/aggregate.rs
+++ b/agent_identity/src/document/aggregate.rs
@@ -51,7 +51,6 @@ pub struct IotaMetadata {
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, Default, PartialEq, utoipa::ToSchema)]
-#[schema(as = DocumentStatus)]
 pub enum Status {
     SignAndValidate,
     // TODO: Make a distinction between enabling both signing AND validation and just validation.
@@ -73,6 +72,7 @@ pub struct Document {
     pub with_fixed_algorithm: Option<Algorithm>,
     // Applicable only for DID methods that are based on the IOTA ledger.
     pub iota_metadata: Option<IotaMetadata>,
+    #[schema(inline)]
     pub status: Status,
 }
 
diff --git a/agent_issuance/src/credential/aggregate.rs b/agent_issuance/src/credential/aggregate.rs
index 832bb038..1ca6685f 100644
--- a/agent_issuance/src/credential/aggregate.rs
+++ b/agent_issuance/src/credential/aggregate.rs
@@ -33,7 +33,6 @@ use tracing::{debug, info};
 use url::Url;
 
 #[derive(Debug, Clone, Serialize, Deserialize, Default, PartialEq, Eq, utoipa::ToSchema)]
-#[schema(as = IssuanceStatus)]
 pub enum Status {
     #[default]
     Pending,
@@ -88,6 +87,7 @@ pub struct Credential {
     #[schema(schema_with = credential_configurations_supported)]
     pub credential_configuration: CredentialConfigurationsSupportedObject,
     pub signed: Option<serde_json::Value>,
+    #[schema(inline)]
     pub status: Status,
     #[schema(schema_with = holder_notifications)]
     pub holder_notifications: Vec<NotificationRequest>,
diff --git a/agent_issuance/src/offer/aggregate.rs b/agent_issuance/src/offer/aggregate.rs
index 87333aec..38933665 100644
--- a/agent_issuance/src/offer/aggregate.rs
+++ b/agent_issuance/src/offer/aggregate.rs
@@ -21,7 +21,6 @@ use oid4vci::credential_offer::CredentialConfigurationIds;
 use oid4vci::credential_request::CredentialIdentifierOrCredentialConfigurationId;
 
 #[derive(Debug, Clone, Serialize, Deserialize, Default, PartialEq, Eq, utoipa::ToSchema)]
-#[schema(as = CredentialOfferStatus)]
 pub enum Status {
     #[default]
     Created,
@@ -49,6 +48,7 @@ pub struct Offer {
     // TODO: provide full type
     #[schema(value_type = Option<Object>)]
     pub credential_response: Option<CredentialResponse>,
+    #[schema(inline)]
     pub status: Status,
     pub tx_code: Option<String>,
     pub delivery_options: Option<DeliveryOptions>,
diff --git a/agent_library/src/template/aggregate.rs b/agent_library/src/template/aggregate.rs
index 81ecc13a..e7481e72 100644
--- a/agent_library/src/template/aggregate.rs
+++ b/agent_library/src/template/aggregate.rs
@@ -53,7 +53,6 @@ pub enum HolderType {
 
 #[derive(Debug, Clone, Serialize, Deserialize, Default, Eq, PartialEq, utoipa::ToSchema)]
 #[serde(rename_all = "snake_case")]
-#[schema(as = TemplateStatus)]
 pub enum Status {
     #[default]
     Draft,
diff --git a/agent_shared/src/config/mod.rs b/agent_shared/src/config/mod.rs
index d7ce72e4..7a24fe68 100644
--- a/agent_shared/src/config/mod.rs
+++ b/agent_shared/src/config/mod.rs
@@ -26,11 +26,7 @@ use std::{
 use strum::VariantArray;
 use url::Url;
 
-use crate::{
-    config::openapi::{credential_metadata, tx_code_constraints},
-    error::SharedError,
-    profile::ApplicationProfile,
-};
+use crate::{config::openapi::credential_metadata, error::SharedError, profile::ApplicationProfile};
 // Re-export
 pub use provisioned::load_provisioned_config;
 
@@ -578,7 +574,6 @@ pub struct CredentialConfiguration {
 pub struct Authorization {
     pub pre_authorized: bool,
     #[serde(skip_serializing_if = "Option::is_none")]
-    #[schema(schema_with = tx_code_constraints)]
     pub tx_code_constraints: Option<TxCodeConstraints>,
 }
 
diff --git a/agent_shared/src/config/openapi.rs b/agent_shared/src/config/openapi.rs
index 43c01f83..65a5e961 100644
--- a/agent_shared/src/config/openapi.rs
+++ b/agent_shared/src/config/openapi.rs
@@ -1,4 +1,4 @@
-use utoipa::openapi::{schema::SchemaType, Object, ObjectBuilder, Type};
+use utoipa::openapi::{Object, ObjectBuilder};
 
 // TODO: incomplete type
 pub(crate) fn credential_metadata() -> Object {
@@ -7,30 +7,3 @@ pub(crate) fn credential_metadata() -> Object {
         .property("display", ObjectBuilder::new().build())
         .build()
 }
-
-pub(crate) fn tx_code_constraints() -> Object {
-    ObjectBuilder::new()
-        .schema_type(SchemaType::Type(Type::Object))
-        .property(
-            "input_mode",
-            ObjectBuilder::new()
-                .schema_type(SchemaType::Type(Type::String))
-                .enum_values(Some(["numeric", "text"]))
-                .build(),
-        )
-        .property(
-            "length",
-            ObjectBuilder::new()
-                .schema_type(SchemaType::Type(Type::Integer))
-                .description(Some("Allows a pin-length of 0-255."))
-                .build(),
-        )
-        .property(
-            "description",
-            ObjectBuilder::new()
-                .schema_type(SchemaType::Type(Type::String))
-                .description(Some("The length of the string must not exceed 300 characters."))
-                .build(),
-        )
-        .build()
-}

From 8434e8ea5bfa49725fb9eaa7045d19084585dae3 Mon Sep 17 00:00:00 2001
From: Chaya <79284542+coplat@users.noreply.github.com>
Date: Mon, 6 Jul 2026 23:57:43 +0200
Subject: [PATCH 25/34] feat: introduce catalogs (#347)

---
 agent_api_http/openapi-generated.yaml         | 292 +++++++++++
 agent_api_http/src/v0/library/catalog/mod.rs  | 464 +++++++++++++++++
 .../src/v0/library/catalog/openapi.rs         |  19 +
 .../catalog/queries/get_all_catalogs.rs       |  51 ++
 .../catalog/queries/get_catalog_by_id.rs      |  42 ++
 .../src/v0/library/catalog/queries/mod.rs     |   2 +
 agent_api_http/src/v0/library/error.rs        |  25 +
 agent_api_http/src/v0/library/mod.rs          |  20 +-
 agent_api_http/src/v0/mod.rs                  |   1 +
 agent_api_http/src/v0/openapi.rs              |   1 +
 agent_library/src/catalog/aggregate.rs        | 484 ++++++++++++++++++
 agent_library/src/catalog/command.rs          |  33 ++
 agent_library/src/catalog/error.rs            |  11 +
 agent_library/src/catalog/event.rs            |  46 ++
 agent_library/src/catalog/mod.rs              |   6 +
 agent_library/src/catalog/services.rs         |  27 +
 agent_library/src/catalog/views/mod.rs        |  57 +++
 .../src/catalog/views/view_all_catalogs.rs    |  27 +
 agent_library/src/lib.rs                      |   1 +
 agent_library/src/state.rs                    |  22 +-
 agent_library/src/template/event.rs           |   1 -
 agent_store/src/lib.rs                        |  15 +
 docs/problem-details/library.md               |  16 +
 23 files changed, 1658 insertions(+), 5 deletions(-)
 create mode 100644 agent_api_http/src/v0/library/catalog/mod.rs
 create mode 100644 agent_api_http/src/v0/library/catalog/openapi.rs
 create mode 100644 agent_api_http/src/v0/library/catalog/queries/get_all_catalogs.rs
 create mode 100644 agent_api_http/src/v0/library/catalog/queries/get_catalog_by_id.rs
 create mode 100644 agent_api_http/src/v0/library/catalog/queries/mod.rs
 create mode 100644 agent_library/src/catalog/aggregate.rs
 create mode 100644 agent_library/src/catalog/command.rs
 create mode 100644 agent_library/src/catalog/error.rs
 create mode 100644 agent_library/src/catalog/event.rs
 create mode 100644 agent_library/src/catalog/mod.rs
 create mode 100644 agent_library/src/catalog/services.rs
 create mode 100644 agent_library/src/catalog/views/mod.rs
 create mode 100644 agent_library/src/catalog/views/view_all_catalogs.rs

diff --git a/agent_api_http/openapi-generated.yaml b/agent_api_http/openapi-generated.yaml
index 4246a39e..cb200230 100644
--- a/agent_api_http/openapi-generated.yaml
+++ b/agent_api_http/openapi-generated.yaml
@@ -9,6 +9,48 @@ servers:
 - url: http://localhost:3033
   description: Local development
 paths:
+  /v0/add-templates-to-catalog:
+    post:
+      tags:
+      - Library
+      - Catalog
+      summary: Add one or more templates to a catalog
+      description: Adds one or more templates to a catalog by their IDs.
+      operationId: add_templates_to_catalog
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AddTemplatesRequest'
+        required: true
+      responses:
+        '200':
+          description: Catalog updated successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Catalog'
+  /v0/change-catalog-appearance:
+    post:
+      tags:
+      - Library
+      - Catalog
+      summary: Changes a catalog's display information
+      description: Changes a catalog's display information such as name, description, and icon.
+      operationId: change_catalog_appearance
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/ChangeCatalogAppearanceRequest'
+        required: true
+      responses:
+        '200':
+          description: Catalog appearance updated successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Catalog'
   /v0/connections:
     get:
       tags:
@@ -123,6 +165,27 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/Connection'
+  /v0/create-new-catalog:
+    post:
+      tags:
+      - Library
+      - Catalog
+      summary: Create a new catalog
+      description: Creates a new catalog with the provided display information.
+      operationId: create_new_catalog
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CreateCatalogRequest'
+        required: true
+      responses:
+        '201':
+          description: Catalog created successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Catalog'
   /v0/create-new-template:
     post:
       tags:
@@ -247,6 +310,23 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/Credential'
+  /v0/delete-catalog:
+    post:
+      tags:
+      - Library
+      - Catalog
+      summary: Delete a catalog
+      description: Deletes a catalog.
+      operationId: delete_catalog
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/DeleteCatalogRequest'
+        required: true
+      responses:
+        '204':
+          description: Catalog deleted
   /v0/delete-public-offer:
     post:
       tags:
@@ -357,6 +437,23 @@ paths:
                 $ref: '#/components/schemas/Template'
         '422':
           description: Source Template Not Found
+  /v0/get-all-catalogs:
+    get:
+      tags:
+      - Library
+      - Catalog
+      summary: List all Catalogs
+      description: List all available Catalogs.
+      operationId: get_all_catalogs
+      responses:
+        '200':
+          description: All catalogs retrieved successfully
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/Catalog'
   /v0/get-all-public-offers:
     get:
       tags:
@@ -372,6 +469,27 @@ paths:
                 type: array
                 items:
                   $ref: '#/components/schemas/PublicOfferStatusDto'
+  /v0/get-catalog-by-id/{catalog_id}:
+    get:
+      tags:
+      - Library
+      - Catalog
+      summary: Get catalog by ID
+      description: Retrieve a specific catalog by its ID.
+      operationId: get_catalog_by_id
+      parameters:
+      - name: catalog_id
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        '200':
+          description: Catalog retrieved successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Catalog'
   /v0/get-template-by-id/{id}:
     get:
       tags:
@@ -530,6 +648,48 @@ paths:
                 type: array
                 items:
                   $ref: '#/components/schemas/Template'
+  /v0/make-catalog-private:
+    post:
+      tags:
+      - Library
+      - Catalog
+      summary: Make catalog private
+      description: Updates a catalog's visibility to private. If not otherwise specified, the default visibility is private.
+      operationId: make_catalog_private
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MakeCatalogPrivateRequest'
+        required: true
+      responses:
+        '200':
+          description: Catalog made private successfully.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Catalog'
+  /v0/make-catalog-public:
+    post:
+      tags:
+      - Library
+      - Catalog
+      summary: Make catalog public
+      description: Updates a catalog's visibility to public.
+      operationId: make_catalog_public
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MakeCatalogPublicRequest'
+        required: true
+      responses:
+        '200':
+          description: Catalog make public successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Catalog'
   /v0/offers:
     get:
       tags:
@@ -633,6 +793,27 @@ paths:
       responses:
         '200':
           description: Profile updated successfully
+  /v0/remove-templates-from-catalog:
+    post:
+      tags:
+      - Library
+      - Catalog
+      summary: Remove one or more templates from a catalog
+      description: Removes one or more templates from a catalog by their ID.
+      operationId: remove-templates-from-catalog
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/RemoveTemplatesRequest'
+        required: true
+      responses:
+        '200':
+          description: Template(s) removed successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Catalog'
   /v0/take-public-offer-offline:
     post:
       tags:
@@ -700,6 +881,72 @@ components:
       properties:
         url:
           type: string
+    AddTemplatesRequest:
+      type: object
+      properties:
+        catalogId:
+          type: string
+          default: ''
+        templateIds:
+          type: array
+          items:
+            type: string
+          default: []
+    Catalog:
+      type: object
+      description: Data transfer object for Catalogs.
+      required:
+      - id
+      - display
+      - template_ids
+      - visibility
+      - modified_at
+      properties:
+        display:
+          $ref: '#/components/schemas/CatalogDisplay'
+        id:
+          type: string
+        modified_at:
+          type: string
+          format: date-time
+        template_ids:
+          type: array
+          items:
+            type: string
+        visibility:
+          $ref: '#/components/schemas/CatalogVisibility'
+    CatalogDisplay:
+      type: object
+      required:
+      - name
+      - description
+      properties:
+        description:
+          type: string
+        icon:
+          type:
+          - string
+          - 'null'
+        name:
+          type: string
+    CatalogVisibility:
+      type: string
+      enum:
+      - Public
+      - Private
+    ChangeCatalogAppearanceRequest:
+      type: object
+      properties:
+        catalogId:
+          type: string
+          default: ''
+        display:
+          oneOf:
+          - $ref: '#/components/schemas/CatalogDisplay'
+          default:
+            name: ''
+            description: ''
+            icon: null
     Connection:
       type: object
       required:
@@ -754,6 +1001,20 @@ components:
           type:
           - string
           - 'null'
+    CreateCatalogRequest:
+      type: object
+      properties:
+        display:
+          oneOf:
+          - $ref: '#/components/schemas/CatalogDisplay'
+          default:
+            name: ''
+            description: ''
+            icon: null
+        visibility:
+          oneOf:
+          - $ref: '#/components/schemas/CatalogVisibility'
+          default: Private
     CreateNewTemplateRequestBody:
       type: object
       properties:
@@ -1021,6 +1282,12 @@ components:
       - w3c_vc_data_model_v2-0
       - open_badges_3-0
       - european_learning_model_v3-3
+    DeleteCatalogRequest:
+      type: object
+      properties:
+        catalogId:
+          type: string
+          default: ''
     DeletePublicOfferRequest:
       type: object
       required:
@@ -1238,6 +1505,18 @@ components:
           - string
           - 'null'
           format: uri
+    MakeCatalogPrivateRequest:
+      type: object
+      properties:
+        catalogId:
+          type: string
+          default: ''
+    MakeCatalogPublicRequest:
+      type: object
+      properties:
+        catalogId:
+          type: string
+          default: ''
     Offer:
       type: object
       required:
@@ -1441,6 +1720,17 @@ components:
       properties:
         id:
           type: string
+    RemoveTemplatesRequest:
+      type: object
+      properties:
+        catalogId:
+          type: string
+          default: ''
+        templateIds:
+          type: array
+          items:
+            type: string
+          default: []
     Source:
       type: string
       enum:
@@ -1705,6 +1995,8 @@ tags:
   description: Manage your own templates, browse and import external templates.
 - name: Templates
   description: Create and manage templates which provide the structure for credentials to be issued.
+- name: Catalog
+  description: Create and manage catalogs to organize and share your templates.
 externalDocs:
   url: https://docs.impierce.com/unicore
   description: Official UniCore documentation
diff --git a/agent_api_http/src/v0/library/catalog/mod.rs b/agent_api_http/src/v0/library/catalog/mod.rs
new file mode 100644
index 00000000..7dd8f8ca
--- /dev/null
+++ b/agent_api_http/src/v0/library/catalog/mod.rs
@@ -0,0 +1,464 @@
+pub mod openapi;
+pub mod queries;
+use crate::error::IntoApiErrorExt;
+use crate::extractors::RequestActor;
+use crate::handlers::{command_handler, query_handler};
+use crate::API_VERSION;
+use agent_library::catalog::{
+    aggregate::{CatalogDisplay, CatalogVisibility},
+    command::CatalogCommand,
+    error::CatalogError,
+    views::CatalogView,
+};
+use axum::{
+    extract::State,
+    response::{IntoResponse, Response},
+    Json,
+};
+use chrono::{DateTime, Utc};
+
+use agent_library::state::LibraryState;
+use http::StatusCode;
+use http_api_problem::ApiError;
+use hyper::header;
+use serde::{Deserialize, Serialize};
+use std::sync::Arc;
+
+/// Data transfer object for Catalogs.
+#[derive(Serialize, Deserialize, utoipa::ToSchema)]
+#[schema(as = Catalog)]
+pub struct CatalogDto {
+    #[serde(rename = "id")]
+    pub catalog_id: String,
+    pub display: CatalogDisplay,
+    pub template_ids: Vec<String>,
+    pub visibility: CatalogVisibility,
+    pub modified_at: DateTime<Utc>,
+}
+
+impl From<CatalogView> for CatalogDto {
+    fn from(v: CatalogView) -> Self {
+        Self {
+            catalog_id: v.catalog_id,
+            display: v.display,
+            template_ids: v.template_ids,
+            visibility: v.visibility,
+            modified_at: v.modified_at,
+        }
+    }
+}
+
+#[derive(Deserialize, Serialize, Default, utoipa::ToSchema)]
+#[serde(default, rename_all = "camelCase")]
+pub struct CreateCatalogRequest {
+    pub display: CatalogDisplay,
+    pub visibility: CatalogVisibility,
+}
+
+/// Create a new catalog
+///
+/// Creates a new catalog with the provided display information.
+#[utoipa::path(
+    post,
+    path = "/create-new-catalog",
+    operation_id = "create_new_catalog",
+    tags = ["Library", "Catalog"],
+    request_body(
+        content = CreateCatalogRequest,
+        ),
+    responses(
+        (status = 201, description = "Catalog created successfully", body = CatalogDto)
+    )
+    )]
+#[axum_macros::debug_handler]
+pub(crate) async fn create_catalog(
+    State(state): State<Arc<LibraryState>>,
+    RequestActor(actor): RequestActor,
+    Json(CreateCatalogRequest { display, visibility }): Json<CreateCatalogRequest>,
+) -> Result<Response, ApiError> {
+    let catalog_id = uuid::Uuid::new_v4().to_string();
+
+    if display.name.trim().is_empty() {
+        return Err(ApiError::new(StatusCode::BAD_REQUEST));
+    }
+
+    let command = CatalogCommand::CreateCatalog {
+        catalog_id: catalog_id.clone(),
+        display,
+        visibility,
+    };
+
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &catalog_id,
+        &state.command.catalog,
+        command,
+    )
+    .await?;
+
+    // Return the created catalog
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &catalog_id,
+        &state.query.catalog,
+    )
+    .await?
+    .map(|catalog_view| {
+        (
+            StatusCode::CREATED,
+            [(header::LOCATION, format!("{API_VERSION}/catalog/{catalog_id}"))],
+            Json(CatalogDto::from(catalog_view)),
+        )
+            .into_response()
+    })
+    .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
+}
+
+#[derive(Deserialize, Serialize, Default, utoipa::ToSchema)]
+#[serde(default, rename_all = "camelCase")]
+pub struct AddTemplatesRequest {
+    pub catalog_id: String,
+    pub template_ids: Vec<String>,
+}
+
+/// Add one or more templates to a catalog
+///
+/// Adds one or more templates to a catalog by their IDs.
+#[utoipa::path(
+    post,
+    path = "/add-templates-to-catalog",
+    operation_id = "add_templates_to_catalog",
+    tags = ["Library", "Catalog"],
+    request_body(
+        content = AddTemplatesRequest,
+        ),
+    responses(
+        (status = 200, description = "Catalog updated successfully", body = CatalogDto)
+    )
+    )]
+#[axum_macros::debug_handler]
+pub(crate) async fn add_templates_to_catalog(
+    State(state): State<Arc<LibraryState>>,
+    RequestActor(actor): RequestActor,
+    Json(AddTemplatesRequest {
+        catalog_id,
+        template_ids,
+    }): Json<AddTemplatesRequest>,
+) -> Result<Response, ApiError> {
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &catalog_id,
+        &state.query.catalog,
+    )
+    .await?
+    .ok_or_else(|| CatalogError::CatalogNotFound(catalog_id.clone()).into_api_error())?;
+
+    let command = CatalogCommand::AddTemplateIds {
+        catalog_id: catalog_id.clone(),
+        template_ids,
+    };
+
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &catalog_id,
+        &state.command.catalog,
+        command,
+    )
+    .await?;
+
+    // Return the updated catalog
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &catalog_id,
+        &state.query.catalog,
+    )
+    .await?
+    .map(|catalog_view| (StatusCode::OK, Json(CatalogDto::from(catalog_view))).into_response())
+    .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
+}
+
+#[derive(Deserialize, Serialize, Default, utoipa::ToSchema)]
+#[serde(default, rename_all = "camelCase")]
+pub struct RemoveTemplatesRequest {
+    pub catalog_id: String,
+    pub template_ids: Vec<String>,
+}
+
+/// Remove one or more templates from a catalog
+///
+/// Removes one or more templates from a catalog by their ID.
+#[utoipa::path(
+    post,
+    path = "/remove-templates-from-catalog",
+    operation_id = "remove-templates-from-catalog",
+    tags = ["Library", "Catalog"],
+    request_body(
+        content = RemoveTemplatesRequest,
+        ),
+    responses(
+        (status = 200, description = "Template(s) removed successfully", body = CatalogDto)
+    )
+    )]
+#[axum_macros::debug_handler]
+pub(crate) async fn remove_templates_from_catalog(
+    State(state): State<Arc<LibraryState>>,
+    RequestActor(actor): RequestActor,
+    Json(RemoveTemplatesRequest {
+        catalog_id,
+        template_ids,
+    }): Json<RemoveTemplatesRequest>,
+) -> Result<Response, ApiError> {
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &catalog_id,
+        &state.query.catalog,
+    )
+    .await?
+    .ok_or_else(|| CatalogError::CatalogNotFound(catalog_id.clone()).into_api_error())?;
+
+    let command = CatalogCommand::RemoveTemplateIds {
+        catalog_id: catalog_id.clone(),
+        template_ids,
+    };
+
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &catalog_id,
+        &state.command.catalog,
+        command,
+    )
+    .await?;
+
+    // Return the updated catalog
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &catalog_id,
+        &state.query.catalog,
+    )
+    .await?
+    .map(|catalog_view| (StatusCode::OK, Json(CatalogDto::from(catalog_view))).into_response())
+    .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
+}
+
+#[derive(Deserialize, Serialize, Default, utoipa::ToSchema)]
+#[serde(default, rename_all = "camelCase")]
+pub struct ChangeCatalogAppearanceRequest {
+    pub catalog_id: String,
+    pub display: CatalogDisplay,
+}
+
+/// Changes a catalog's display information
+///
+/// Changes a catalog's display information such as name, description, and icon.
+#[utoipa::path(
+    post,
+    path = "/change-catalog-appearance",
+    operation_id = "change_catalog_appearance",
+    tags = ["Library", "Catalog"],
+    request_body(
+        content = ChangeCatalogAppearanceRequest,
+        ),
+    responses(
+        (status = 200, description = "Catalog appearance updated successfully", body = CatalogDto)
+    )
+    )]
+#[axum_macros::debug_handler]
+pub(crate) async fn change_catalog_appearance(
+    State(state): State<Arc<LibraryState>>,
+    RequestActor(actor): RequestActor,
+    Json(ChangeCatalogAppearanceRequest { catalog_id, display }): Json<ChangeCatalogAppearanceRequest>,
+) -> Result<Response, ApiError> {
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &catalog_id,
+        &state.query.catalog,
+    )
+    .await?
+    .ok_or_else(|| CatalogError::CatalogNotFound(catalog_id.clone()).into_api_error())?;
+
+    let command = CatalogCommand::ChangeCatalogAppearance {
+        catalog_id: catalog_id.clone(),
+        display: display.clone(),
+    };
+
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &catalog_id,
+        &state.command.catalog,
+        command,
+    )
+    .await?;
+
+    // Return the updated catalog
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &catalog_id,
+        &state.query.catalog,
+    )
+    .await?
+    .map(|catalog_view| (StatusCode::OK, Json(CatalogDto::from(catalog_view))).into_response())
+    .ok_or_else(|| ApiError::new(StatusCode::INTERNAL_SERVER_ERROR))
+}
+
+#[derive(Deserialize, Serialize, Default, utoipa::ToSchema)]
+#[serde(default, rename_all = "camelCase")]
+pub struct MakeCatalogPublicRequest {
+    pub catalog_id: String,
+}
+
+/// Make catalog public
+///
+/// Updates a catalog's visibility to public.
+#[utoipa::path(
+    post,
+    path = "/make-catalog-public",
+    operation_id = "make_catalog_public",
+    tags = ["Library", "Catalog"],
+    request_body(
+        content = MakeCatalogPublicRequest,
+        ),
+    responses(
+        (status = 200, description = "Catalog make public successfully", body = CatalogDto)
+    )
+    )]
+#[axum_macros::debug_handler]
+pub(crate) async fn make_catalog_public(
+    State(state): State<Arc<LibraryState>>,
+    RequestActor(actor): RequestActor,
+    Json(MakeCatalogPublicRequest { catalog_id }): Json<MakeCatalogPublicRequest>,
+) -> Result<Response, ApiError> {
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &catalog_id,
+        &state.query.catalog,
+    )
+    .await?
+    .ok_or_else(|| CatalogError::CatalogNotFound(catalog_id.clone()).into_api_error())?;
+
+    let command = CatalogCommand::MakeCatalogPublic {
+        catalog_id: catalog_id.clone(),
+    };
+
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &catalog_id,
+        &state.command.catalog,
+        command,
+    )
+    .await?;
+    Ok(StatusCode::OK.into_response())
+}
+
+#[derive(Deserialize, Serialize, Default, utoipa::ToSchema)]
+#[serde(default, rename_all = "camelCase")]
+pub struct MakeCatalogPrivateRequest {
+    pub catalog_id: String,
+}
+
+/// Make catalog private
+///
+/// Updates a catalog's visibility to private. If not otherwise specified, the default visibility is private.
+#[utoipa::path(
+    post,
+    path = "/make-catalog-private",
+    operation_id = "make_catalog_private",
+    tags = ["Library", "Catalog"],
+    request_body(
+        content = MakeCatalogPrivateRequest,
+        ),
+    responses(
+        (status = 200, description = "Catalog made private successfully.", body = CatalogDto)
+    )
+    )]
+#[axum_macros::debug_handler]
+pub(crate) async fn make_catalog_private(
+    State(state): State<Arc<LibraryState>>,
+    RequestActor(actor): RequestActor,
+    Json(MakeCatalogPrivateRequest { catalog_id }): Json<MakeCatalogPrivateRequest>,
+) -> Result<Response, ApiError> {
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &catalog_id,
+        &state.query.catalog,
+    )
+    .await?
+    .ok_or_else(|| CatalogError::CatalogNotFound(catalog_id.clone()).into_api_error())?;
+
+    let command = CatalogCommand::MakeCatalogPrivate {
+        catalog_id: catalog_id.clone(),
+    };
+
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &catalog_id,
+        &state.command.catalog,
+        command,
+    )
+    .await?;
+    Ok(StatusCode::OK.into_response())
+}
+
+#[derive(Deserialize, Serialize, Default, utoipa::ToSchema)]
+#[serde(default, rename_all = "camelCase")]
+pub struct DeleteCatalogRequest {
+    pub catalog_id: String,
+}
+
+/// Delete a catalog
+///
+/// Deletes a catalog.
+#[utoipa::path(
+    post,
+    path = "/delete-catalog",
+    operation_id = "delete_catalog",
+    tags = ["Library", "Catalog"],
+    request_body(
+        content = DeleteCatalogRequest,
+        ),
+    responses(
+        (status = 204, description = "Catalog deleted"))
+    )]
+#[axum_macros::debug_handler]
+pub(crate) async fn delete_catalog(
+    State(state): State<Arc<LibraryState>>,
+    RequestActor(actor): RequestActor,
+    Json(DeleteCatalogRequest { catalog_id }): Json<DeleteCatalogRequest>,
+) -> Result<Response, ApiError> {
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &catalog_id,
+        &state.query.catalog,
+    )
+    .await?
+    .ok_or_else(|| CatalogError::CatalogNotFound(catalog_id.clone()).into_api_error())?;
+
+    let command = CatalogCommand::DeleteCatalog {
+        catalog_id: catalog_id.clone(),
+    };
+
+    command_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &catalog_id,
+        &state.command.catalog,
+        command,
+    )
+    .await?;
+    Ok(StatusCode::NO_CONTENT.into_response())
+}
diff --git a/agent_api_http/src/v0/library/catalog/openapi.rs b/agent_api_http/src/v0/library/catalog/openapi.rs
new file mode 100644
index 00000000..da400ce4
--- /dev/null
+++ b/agent_api_http/src/v0/library/catalog/openapi.rs
@@ -0,0 +1,19 @@
+use crate::v0::library::catalog::{
+    __path_add_templates_to_catalog, __path_change_catalog_appearance, __path_create_catalog, __path_delete_catalog,
+    __path_make_catalog_private, __path_make_catalog_public, __path_remove_templates_from_catalog,
+};
+
+use crate::v0::library::catalog::queries::{
+    get_all_catalogs::__path_get_all_catalogs, get_catalog_by_id::__path_get_catalog_by_id,
+};
+
+use utoipa::OpenApi;
+
+#[derive(OpenApi)]
+#[openapi(
+    paths(create_catalog, delete_catalog, make_catalog_public, make_catalog_private, add_templates_to_catalog, remove_templates_from_catalog, change_catalog_appearance, get_all_catalogs, get_catalog_by_id),
+    tags(
+        (name = "Catalog", description = "Create and manage catalogs to organize and share your templates.")
+    )
+)]
+pub struct CatalogsApi;
diff --git a/agent_api_http/src/v0/library/catalog/queries/get_all_catalogs.rs b/agent_api_http/src/v0/library/catalog/queries/get_all_catalogs.rs
new file mode 100644
index 00000000..f50398b1
--- /dev/null
+++ b/agent_api_http/src/v0/library/catalog/queries/get_all_catalogs.rs
@@ -0,0 +1,51 @@
+use crate::extractors::RequestActor;
+use crate::handlers::query_handler;
+use crate::v0::library::catalog::CatalogDto;
+use agent_library::state::LibraryState;
+use axum::{
+    extract::State,
+    response::{IntoResponse, Response},
+    Json,
+};
+use http::StatusCode;
+use http_api_problem::ApiError;
+use std::sync::Arc;
+
+/// List all Catalogs
+///
+/// List all available Catalogs.
+#[utoipa::path(
+    get,
+    path = "/get-all-catalogs",
+    operation_id = "get_all_catalogs",
+    tags = ["Library", "Catalog"],
+    responses(
+        (status = 200, description = "All catalogs retrieved successfully", body = [CatalogDto]),
+    )
+)]
+#[axum_macros::debug_handler]
+pub(crate) async fn get_all_catalogs(
+    State(state): State<Arc<LibraryState>>,
+    RequestActor(actor): RequestActor,
+) -> Result<Response, ApiError> {
+    let filtered_catalogs = query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        "all_catalogs",
+        &state.query.all_catalogs,
+    )
+    .await?
+    .map(|all_catalogs_view| {
+        let filtered_catalogs: Vec<CatalogDto> = all_catalogs_view
+            .catalogs
+            .into_values()
+            .filter(|catalog| !catalog.deleted)
+            .map(CatalogDto::from)
+            .collect();
+
+        filtered_catalogs
+    })
+    .unwrap_or_default();
+
+    Ok((StatusCode::OK, Json(filtered_catalogs)).into_response())
+}
diff --git a/agent_api_http/src/v0/library/catalog/queries/get_catalog_by_id.rs b/agent_api_http/src/v0/library/catalog/queries/get_catalog_by_id.rs
new file mode 100644
index 00000000..4c8f021c
--- /dev/null
+++ b/agent_api_http/src/v0/library/catalog/queries/get_catalog_by_id.rs
@@ -0,0 +1,42 @@
+use crate::extractors::RequestActor;
+use crate::handlers::query_handler;
+use crate::v0::library::catalog::CatalogDto;
+use agent_library::state::LibraryState;
+use axum::{
+    extract::{Path, State},
+    response::{IntoResponse, Response},
+    Json,
+};
+use http::StatusCode;
+use http_api_problem::ApiError;
+use std::sync::Arc;
+
+/// Get catalog by ID
+///
+/// Retrieve a specific catalog by its ID.
+#[utoipa::path(
+    get,
+    path = "/get-catalog-by-id/{catalog_id}",
+    operation_id = "get_catalog_by_id",
+    tags = ["Library", "Catalog"],
+    responses(
+        (status = 200, description = "Catalog retrieved successfully", body = CatalogDto),
+    )
+)]
+#[axum_macros::debug_handler]
+pub(crate) async fn get_catalog_by_id(
+    State(state): State<Arc<LibraryState>>,
+    RequestActor(actor): RequestActor,
+    Path(catalog_id): Path<String>,
+) -> Result<Response, ApiError> {
+    query_handler(
+        state.authorization_checker.clone(),
+        actor.clone(),
+        &catalog_id,
+        &state.query.catalog,
+    )
+    .await?
+    .and_then(|catalog_view| (!catalog_view.deleted).then_some(catalog_view))
+    .map(|catalog_view| (StatusCode::OK, Json(CatalogDto::from(catalog_view))).into_response())
+    .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
+}
diff --git a/agent_api_http/src/v0/library/catalog/queries/mod.rs b/agent_api_http/src/v0/library/catalog/queries/mod.rs
new file mode 100644
index 00000000..eb0e1613
--- /dev/null
+++ b/agent_api_http/src/v0/library/catalog/queries/mod.rs
@@ -0,0 +1,2 @@
+pub mod get_all_catalogs;
+pub mod get_catalog_by_id;
diff --git a/agent_api_http/src/v0/library/error.rs b/agent_api_http/src/v0/library/error.rs
index fa7aa09b..2ade7682 100644
--- a/agent_api_http/src/v0/library/error.rs
+++ b/agent_api_http/src/v0/library/error.rs
@@ -1,4 +1,5 @@
 use crate::error::{type_url, IntoApiErrorExt};
+use agent_library::catalog::error::CatalogError;
 use agent_library::template::error::TemplateError;
 use http_api_problem::ApiError;
 use hyper::StatusCode;
@@ -114,6 +115,30 @@ impl IntoApiErrorExt for TemplateError {
     }
 }
 
+impl IntoApiErrorExt for CatalogError {
+    fn into_api_error(self) -> ApiError {
+        match self {
+            CatalogError::TemplateNotFound(_) => ApiError::builder(StatusCode::NOT_FOUND)
+                .title("Template Not Found")
+                .type_url(type_url("library#catalog-template-not-found"))
+                .message("No matching template found".to_string())
+                .source(self)
+                .finish(),
+            CatalogError::MissingCatalogName(_) => ApiError::builder(StatusCode::BAD_REQUEST)
+                .title("Catalog Name Missing")
+                .type_url(type_url("library#missing-catalog-name"))
+                .message("Catalog name must have a non-empty value".to_string())
+                .source(self)
+                .finish(),
+            CatalogError::CatalogNotFound(_) => ApiError::builder(StatusCode::NOT_FOUND)
+                .title("Catalog Not Found")
+                .type_url(type_url("library#catalog-not-found"))
+                .message("Catalog not found".to_string())
+                .source(self)
+                .finish(),
+        }
+    }
+}
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/agent_api_http/src/v0/library/mod.rs b/agent_api_http/src/v0/library/mod.rs
index f9b3e75d..e5b8e140 100644
--- a/agent_api_http/src/v0/library/mod.rs
+++ b/agent_api_http/src/v0/library/mod.rs
@@ -1,5 +1,6 @@
 // Endpoint handlers
 
+pub mod catalog;
 pub mod error;
 
 use agent_library::state::LibraryState;
@@ -10,6 +11,13 @@ use axum::{
 use std::sync::Arc;
 
 use crate::{
+    v0::library::catalog::{
+        queries::{get_all_catalogs::get_all_catalogs, get_catalog_by_id::get_catalog_by_id},
+        {
+            add_templates_to_catalog, change_catalog_appearance, create_catalog, delete_catalog, make_catalog_private,
+            make_catalog_public, remove_templates_from_catalog,
+        },
+    },
     v0::templates::{
         create_template, delete_template, duplicate_template, get_template, get_templates, update_template,
     },
@@ -26,7 +34,17 @@ pub fn router(library_state: Arc<LibraryState>) -> Router {
                 .route("/create-new-template", post(create_template))
                 .route("/delete-template", post(delete_template))
                 .route("/update-template", post(update_template))
-                .route("/duplicate-template", post(duplicate_template)),
+                .route("/duplicate-template", post(duplicate_template))
+                // Catalog Routes
+                .route("/create-new-catalog", post(create_catalog))
+                .route("/delete-catalog", post(delete_catalog))
+                .route("/add-templates-to-catalog", post(add_templates_to_catalog))
+                .route("/remove-templates-from-catalog", post(remove_templates_from_catalog))
+                .route("/change-catalog-appearance", post(change_catalog_appearance))
+                .route("/make-catalog-public", post(make_catalog_public))
+                .route("/make-catalog-private", post(make_catalog_private))
+                .route("/get-all-catalogs", get(get_all_catalogs))
+                .route("/get-catalog-by-id/{catalog_id}", get(get_catalog_by_id)),
         )
         .with_state(library_state)
 }
diff --git a/agent_api_http/src/v0/mod.rs b/agent_api_http/src/v0/mod.rs
index 25ccf89e..1b0062fc 100644
--- a/agent_api_http/src/v0/mod.rs
+++ b/agent_api_http/src/v0/mod.rs
@@ -11,4 +11,5 @@ pub use crate::v0::holder::openapi::HolderApi;
 pub use crate::v0::identity::connections::openapi::ConnectionsApi;
 pub use crate::v0::identity::openapi::IdentityApi;
 pub use crate::v0::issuance::openapi::IssuanceApi;
+pub use crate::v0::library::catalog::openapi::CatalogsApi;
 pub use crate::v0::templates::openapi::TemplatesApi;
diff --git a/agent_api_http/src/v0/openapi.rs b/agent_api_http/src/v0/openapi.rs
index 9fb74b0d..7540e876 100644
--- a/agent_api_http/src/v0/openapi.rs
+++ b/agent_api_http/src/v0/openapi.rs
@@ -16,6 +16,7 @@ use utoipa::OpenApi;
         (path = "/v0", api = crate::v0::identity::openapi::IdentityApi),
         (path = "/v0", api = crate::v0::issuance::openapi::IssuanceApi),
         (path = "/v0", api = crate::v0::templates::openapi::TemplatesApi),
+        (path = "/v0", api = crate::v0::library::catalog::openapi::CatalogsApi),
     )
 )]
 pub struct ApiDoc;
diff --git a/agent_library/src/catalog/aggregate.rs b/agent_library/src/catalog/aggregate.rs
new file mode 100644
index 00000000..a9adc9aa
--- /dev/null
+++ b/agent_library/src/catalog/aggregate.rs
@@ -0,0 +1,484 @@
+use crate::catalog::{
+    command::CatalogCommand::{self},
+    error::CatalogError,
+    event::CatalogEvent,
+    services::CatalogServices,
+};
+use chrono::{DateTime, Utc};
+use cqrs_es::{event_sink::EventSink, Aggregate};
+use serde::{Deserialize, Serialize};
+use std::sync::Arc;
+use tracing::{debug, info};
+use utoipa::ToSchema;
+
+#[derive(Debug, Clone, Deserialize, Default, Serialize, PartialEq)]
+pub struct Catalog {
+    #[serde(rename = "id")]
+    pub catalog_id: String,
+    pub display: CatalogDisplay,
+    pub template_ids: Vec<String>,
+    pub visibility: CatalogVisibility,
+    pub modified_at: DateTime<Utc>,
+    pub deleted: bool,
+}
+
+#[derive(Debug, Clone, Deserialize, Default, Serialize, PartialEq, ToSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct CatalogDisplay {
+    pub name: String,
+    pub description: String,
+    pub icon: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Default, Serialize, Deserialize, ToSchema)]
+pub enum CatalogVisibility {
+    Public,
+    #[default]
+    Private,
+}
+
+impl Aggregate for Catalog {
+    type Command = CatalogCommand;
+    type Event = CatalogEvent;
+    type Error = CatalogError;
+    type Services = Arc<dyn CatalogServices + 'static>;
+
+    const TYPE: &'static str = "catalog";
+
+    async fn handle(
+        &mut self,
+        command: Self::Command,
+        service: &Self::Services,
+        sink: &EventSink<Self>,
+    ) -> Result<(), Self::Error> {
+        use CatalogCommand::*;
+        use CatalogEvent::*;
+
+        info!("Handling command: {:?}", command);
+
+        let events: Vec<Self::Event> = match command {
+            CreateCatalog {
+                catalog_id,
+                display,
+                visibility,
+            } => {
+                if display.name.trim().is_empty() {
+                    return Err(CatalogError::MissingCatalogName(
+                        "Catalog name cannot be empty".to_string(),
+                    ));
+                }
+
+                vec![CatalogCreated {
+                    id: catalog_id,
+                    display,
+                    visibility,
+                }]
+            }
+            ChangeCatalogAppearance { catalog_id, display } => {
+                if self.deleted {
+                    return Err(CatalogError::CatalogNotFound(catalog_id));
+                }
+
+                if display.name.trim().is_empty() {
+                    return Err(CatalogError::MissingCatalogName(
+                        "Catalog name cannot be empty".to_string(),
+                    ));
+                }
+
+                vec![CatalogAppearanceChanged {
+                    id: catalog_id,
+                    display,
+                }]
+            }
+            MakeCatalogPublic { catalog_id } => {
+                if self.deleted {
+                    return Err(CatalogError::CatalogNotFound(catalog_id));
+                }
+                vec![CatalogMadePublic {
+                    id: catalog_id,
+                    visibility: CatalogVisibility::Public,
+                }]
+            }
+            MakeCatalogPrivate { catalog_id } => {
+                if self.deleted {
+                    return Err(CatalogError::CatalogNotFound(catalog_id));
+                }
+                vec![CatalogMadePrivate {
+                    id: catalog_id,
+                    visibility: CatalogVisibility::Private,
+                }]
+            }
+            AddTemplateIds {
+                catalog_id,
+                template_ids,
+            } => {
+                if self.deleted {
+                    return Err(CatalogError::CatalogNotFound(catalog_id));
+                }
+
+                // Check if all template IDs exist before proceeding
+                let missing_templates = service.check_all_templates_exist(&template_ids).await;
+
+                if !missing_templates.is_empty() {
+                    return Err(CatalogError::TemplateNotFound(missing_templates.join(", ")));
+                }
+
+                let new_template_ids: Vec<String> = template_ids
+                    .into_iter()
+                    .filter(|id| !self.template_ids.contains(id))
+                    .collect();
+
+                if new_template_ids.is_empty() {
+                    debug!("No new template IDs to add, ignoring AddTemplateIds command");
+                    return Ok(());
+                }
+
+                vec![TemplateIdsAdded {
+                    id: catalog_id,
+                    template_ids: new_template_ids,
+                }]
+            }
+            RemoveTemplateIds {
+                catalog_id,
+                template_ids,
+            } => {
+                if self.deleted {
+                    return Err(CatalogError::CatalogNotFound(catalog_id));
+                }
+
+                let to_remove: Vec<String> = template_ids
+                    .into_iter()
+                    .filter(|id| self.template_ids.contains(id))
+                    .collect();
+
+                if to_remove.is_empty() {
+                    debug!("No matching template IDs to remove, ignoring RemoveTemplateIds command");
+                    return Ok(());
+                }
+
+                vec![TemplateIdsRemoved {
+                    id: catalog_id,
+                    template_ids: to_remove,
+                }]
+            }
+            DeleteCatalog { catalog_id } => {
+                vec![CatalogDeleted { id: catalog_id }]
+            }
+        };
+
+        for event in events {
+            sink.write(event, self).await;
+        }
+
+        Ok(())
+    }
+
+    fn apply(&mut self, event: Self::Event) {
+        use CatalogEvent::*;
+        debug!("Applying event: {:?}", event);
+
+        match event {
+            CatalogCreated {
+                id,
+                display,
+                visibility,
+            } => {
+                self.catalog_id = id;
+                self.display = display;
+                self.visibility = visibility;
+                self.modified_at = Utc::now();
+            }
+            CatalogAppearanceChanged { id: _, display } => {
+                self.display = display;
+                self.modified_at = Utc::now();
+            }
+            CatalogMadePublic { id: _, visibility } => {
+                self.visibility = visibility;
+                self.modified_at = Utc::now();
+            }
+            CatalogMadePrivate { id: _, visibility } => {
+                self.visibility = visibility;
+                self.modified_at = Utc::now();
+            }
+            TemplateIdsAdded { id: _, template_ids } => {
+                self.template_ids.extend(template_ids);
+                self.modified_at = Utc::now();
+            }
+            TemplateIdsRemoved { id: _, template_ids } => {
+                self.template_ids.retain(|id| !template_ids.contains(id));
+                self.modified_at = Utc::now();
+            }
+            CatalogDeleted { id: _ } => {
+                self.deleted = true;
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+pub mod catalog_tests {
+    use super::test_utils::*;
+    use super::*;
+    use async_trait::async_trait;
+    use cqrs_es::test::TestFramework;
+    use rstest::rstest;
+    use std::sync::Arc;
+
+    pub struct MockCatalogServices {
+        pub all_templates_exist: bool,
+    }
+
+    impl MockCatalogServices {
+        fn successfully_finds_templates() -> Arc<Self> {
+            Arc::new(Self {
+                all_templates_exist: true,
+            })
+        }
+
+        fn finds_no_templates() -> Arc<Self> {
+            Arc::new(Self {
+                all_templates_exist: false,
+            })
+        }
+    }
+
+    #[async_trait]
+    impl CatalogServices for MockCatalogServices {
+        async fn check_all_templates_exist(&self, ids: &[String]) -> Vec<String> {
+            if self.all_templates_exist {
+                vec![]
+            } else {
+                ids.to_vec()
+            }
+        }
+    }
+
+    type CatalogTestFramework = TestFramework<Catalog>;
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_create_catalog(catalog_id: String, display: CatalogDisplay, visibility: CatalogVisibility) {
+        CatalogTestFramework::with(MockCatalogServices::successfully_finds_templates())
+            .given_no_previous_events()
+            .when(CatalogCommand::CreateCatalog {
+                catalog_id: catalog_id.clone(),
+                display: display.clone(),
+                visibility: visibility.clone(),
+            })
+            .then_expect_events(vec![CatalogEvent::CatalogCreated {
+                id: catalog_id,
+                display,
+                visibility,
+            }])
+    }
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_update_display(catalog_id: String, display: CatalogDisplay, visibility: CatalogVisibility) {
+        let new_display = CatalogDisplay {
+            name: "Updated Name".to_string(),
+            description: "Updated Description".to_string(),
+            icon: None,
+        };
+
+        CatalogTestFramework::with(MockCatalogServices::successfully_finds_templates())
+            .given(vec![CatalogEvent::CatalogCreated {
+                id: catalog_id.clone(),
+                display,
+                visibility,
+            }])
+            .when(CatalogCommand::ChangeCatalogAppearance {
+                catalog_id: catalog_id.clone(),
+                display: new_display.clone(),
+            })
+            .then_expect_events(vec![CatalogEvent::CatalogAppearanceChanged {
+                id: catalog_id,
+                display: new_display,
+            }])
+    }
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_update_visibility(catalog_id: String, display: CatalogDisplay, visibility: CatalogVisibility) {
+        CatalogTestFramework::with(MockCatalogServices::successfully_finds_templates())
+            .given(vec![CatalogEvent::CatalogCreated {
+                id: catalog_id.clone(),
+                display,
+                visibility,
+            }])
+            .when(CatalogCommand::MakeCatalogPublic {
+                catalog_id: catalog_id.clone(),
+            })
+            .then_expect_events(vec![CatalogEvent::CatalogMadePublic {
+                id: catalog_id,
+                visibility: CatalogVisibility::Public,
+            }])
+    }
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_add_template_ids(catalog_id: String, display: CatalogDisplay, visibility: CatalogVisibility) {
+        let template_ids = ["template-001".to_string(), "template-002".to_string()].to_vec();
+
+        CatalogTestFramework::with(MockCatalogServices::successfully_finds_templates())
+            .given(vec![CatalogEvent::CatalogCreated {
+                id: catalog_id.clone(),
+                display,
+                visibility,
+            }])
+            .when(CatalogCommand::AddTemplateIds {
+                catalog_id: catalog_id.clone(),
+                template_ids: template_ids.clone(),
+            })
+            .then_expect_events(vec![CatalogEvent::TemplateIdsAdded {
+                id: catalog_id,
+                template_ids,
+            }])
+    }
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_add_template_id_already_present(
+        catalog_id: String,
+        display: CatalogDisplay,
+        visibility: CatalogVisibility,
+    ) {
+        let template_ids = ["template-001".to_string(), "template-002".to_string()].to_vec();
+
+        CatalogTestFramework::with(MockCatalogServices::successfully_finds_templates())
+            .given(vec![
+                CatalogEvent::CatalogCreated {
+                    id: catalog_id.clone(),
+                    display,
+                    visibility,
+                },
+                CatalogEvent::TemplateIdsAdded {
+                    id: catalog_id.clone(),
+                    template_ids: template_ids.clone(),
+                },
+            ])
+            .when(CatalogCommand::AddTemplateIds {
+                catalog_id,
+                template_ids,
+            })
+            .then_expect_events(vec![])
+    }
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_add_template_id_not_found(
+        catalog_id: String,
+        display: CatalogDisplay,
+        visibility: CatalogVisibility,
+    ) {
+        let template_ids = ["nonexistent-template".to_string(), "template-002".to_string()].to_vec();
+
+        CatalogTestFramework::with(MockCatalogServices::finds_no_templates())
+            .given(vec![CatalogEvent::CatalogCreated {
+                id: catalog_id.clone(),
+                display,
+                visibility,
+            }])
+            .when(CatalogCommand::AddTemplateIds {
+                catalog_id,
+                template_ids: template_ids.clone(),
+            })
+            .then_expect_error_message(&format!("Template not found: {}", template_ids.join(", ")))
+    }
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_remove_template_id(catalog_id: String, display: CatalogDisplay, visibility: CatalogVisibility) {
+        let existing_templates = ["template-001".to_string(), "template-002".to_string()].to_vec();
+        let to_remove = ["template-001".to_string()].to_vec();
+
+        CatalogTestFramework::with(MockCatalogServices::successfully_finds_templates())
+            .given(vec![
+                CatalogEvent::CatalogCreated {
+                    id: catalog_id.clone(),
+                    display,
+                    visibility,
+                },
+                CatalogEvent::TemplateIdsAdded {
+                    id: catalog_id.clone(),
+                    template_ids: existing_templates.clone(),
+                },
+            ])
+            .when(CatalogCommand::RemoveTemplateIds {
+                catalog_id: catalog_id.clone(),
+                template_ids: to_remove.clone(),
+            })
+            .then_expect_events(vec![CatalogEvent::TemplateIdsRemoved {
+                id: catalog_id,
+                template_ids: to_remove,
+            }])
+    }
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_remove_template_id_not_in_catalog(
+        catalog_id: String,
+        display: CatalogDisplay,
+        visibility: CatalogVisibility,
+    ) {
+        let template_ids = ["template-001".to_string()].to_vec();
+
+        CatalogTestFramework::with(MockCatalogServices::successfully_finds_templates())
+            .given(vec![CatalogEvent::CatalogCreated {
+                id: catalog_id.clone(),
+                display,
+                visibility,
+            }])
+            .when(CatalogCommand::RemoveTemplateIds {
+                catalog_id,
+                template_ids,
+            })
+            .then_expect_events(vec![])
+    }
+
+    #[rstest]
+    #[serial_test::serial]
+    async fn test_delete_catalog(catalog_id: String, display: CatalogDisplay, visibility: CatalogVisibility) {
+        CatalogTestFramework::with(MockCatalogServices::successfully_finds_templates())
+            .given(vec![CatalogEvent::CatalogCreated {
+                id: catalog_id.clone(),
+                display,
+                visibility,
+            }])
+            .when(CatalogCommand::DeleteCatalog {
+                catalog_id: catalog_id.clone(),
+            })
+            .then_expect_events(vec![CatalogEvent::CatalogDeleted { id: catalog_id }])
+    }
+}
+
+#[cfg(any(test, feature = "test_utils"))]
+pub mod test_utils {
+    use rstest::fixture;
+
+    use super::*;
+
+    #[fixture]
+    pub fn catalog_id() -> String {
+        "catalog-id-12345".to_string()
+    }
+
+    #[fixture]
+    pub fn display() -> CatalogDisplay {
+        CatalogDisplay {
+            name: "Sample Catalog".to_string(),
+            description: "A sample Catalog for testing".to_string(),
+            icon: None,
+        }
+    }
+
+    #[fixture]
+    pub fn visibility() -> CatalogVisibility {
+        CatalogVisibility::Private
+    }
+
+    #[fixture]
+    pub fn modified_at() -> String {
+        "2024-01-01T00:00:00Z".to_string()
+    }
+}
diff --git a/agent_library/src/catalog/command.rs b/agent_library/src/catalog/command.rs
new file mode 100644
index 00000000..498438bd
--- /dev/null
+++ b/agent_library/src/catalog/command.rs
@@ -0,0 +1,33 @@
+use crate::catalog::aggregate::{CatalogDisplay, CatalogVisibility};
+use serde::Deserialize;
+
+#[derive(Debug, Deserialize)]
+#[serde(untagged)]
+pub enum CatalogCommand {
+    CreateCatalog {
+        catalog_id: String,
+        display: CatalogDisplay,
+        visibility: CatalogVisibility,
+    },
+    ChangeCatalogAppearance {
+        catalog_id: String,
+        display: CatalogDisplay,
+    },
+    MakeCatalogPublic {
+        catalog_id: String,
+    },
+    MakeCatalogPrivate {
+        catalog_id: String,
+    },
+    AddTemplateIds {
+        catalog_id: String,
+        template_ids: Vec<String>,
+    },
+    RemoveTemplateIds {
+        catalog_id: String,
+        template_ids: Vec<String>,
+    },
+    DeleteCatalog {
+        catalog_id: String,
+    },
+}
diff --git a/agent_library/src/catalog/error.rs b/agent_library/src/catalog/error.rs
new file mode 100644
index 00000000..e10423c6
--- /dev/null
+++ b/agent_library/src/catalog/error.rs
@@ -0,0 +1,11 @@
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum CatalogError {
+    #[error("Template not found: {0}")]
+    TemplateNotFound(String),
+    #[error("Catalog name is required")]
+    MissingCatalogName(String),
+    #[error("Catalog not found: {0}")]
+    CatalogNotFound(String),
+}
diff --git a/agent_library/src/catalog/event.rs b/agent_library/src/catalog/event.rs
new file mode 100644
index 00000000..0bf8e648
--- /dev/null
+++ b/agent_library/src/catalog/event.rs
@@ -0,0 +1,46 @@
+use crate::catalog::aggregate::{CatalogDisplay, CatalogVisibility};
+use cqrs_es::DomainEvent;
+use serde::{Deserialize, Serialize};
+use strum::Display;
+
+#[derive(Debug, Clone, Serialize, Display, Deserialize, PartialEq)]
+pub enum CatalogEvent {
+    CatalogCreated {
+        id: String,
+        display: CatalogDisplay,
+        visibility: CatalogVisibility,
+    },
+    CatalogAppearanceChanged {
+        id: String,
+        display: CatalogDisplay,
+    },
+    CatalogMadePublic {
+        id: String,
+        visibility: CatalogVisibility,
+    },
+    CatalogMadePrivate {
+        id: String,
+        visibility: CatalogVisibility,
+    },
+    TemplateIdsAdded {
+        id: String,
+        template_ids: Vec<String>,
+    },
+    TemplateIdsRemoved {
+        id: String,
+        template_ids: Vec<String>,
+    },
+    CatalogDeleted {
+        id: String,
+    },
+}
+
+impl DomainEvent for CatalogEvent {
+    fn event_type(&self) -> String {
+        self.to_string()
+    }
+
+    fn event_version(&self) -> String {
+        "1".to_string()
+    }
+}
diff --git a/agent_library/src/catalog/mod.rs b/agent_library/src/catalog/mod.rs
new file mode 100644
index 00000000..366dcd85
--- /dev/null
+++ b/agent_library/src/catalog/mod.rs
@@ -0,0 +1,6 @@
+pub mod aggregate;
+pub mod command;
+pub mod error;
+pub mod event;
+pub mod services;
+pub mod views;
diff --git a/agent_library/src/catalog/services.rs b/agent_library/src/catalog/services.rs
new file mode 100644
index 00000000..478d0f8e
--- /dev/null
+++ b/agent_library/src/catalog/services.rs
@@ -0,0 +1,27 @@
+use crate::template::aggregate::Template;
+use crate::template::views::TemplateView;
+use async_trait::async_trait;
+use shared_kernel::view_repository::DynViewRepository;
+use std::sync::Arc;
+
+#[async_trait]
+pub trait CatalogServices: Send + Sync {
+    async fn check_all_templates_exist(&self, ids: &[String]) -> Vec<String>;
+}
+
+pub struct CatalogServiceImpl {
+    pub template_view_repo: Arc<dyn DynViewRepository<TemplateView, Template>>,
+}
+
+#[async_trait]
+impl CatalogServices for CatalogServiceImpl {
+    async fn check_all_templates_exist(&self, ids: &[String]) -> Vec<String> {
+        let mut templates = Vec::new();
+        for id in ids {
+            if self.template_view_repo.load(id).await.ok().flatten().is_none() {
+                templates.push(id.clone());
+            }
+        }
+        templates
+    }
+}
diff --git a/agent_library/src/catalog/views/mod.rs b/agent_library/src/catalog/views/mod.rs
new file mode 100644
index 00000000..de59c15b
--- /dev/null
+++ b/agent_library/src/catalog/views/mod.rs
@@ -0,0 +1,57 @@
+pub mod view_all_catalogs;
+use super::event::CatalogEvent;
+use crate::catalog::aggregate::{Catalog, CatalogDisplay, CatalogVisibility};
+use chrono::DateTime;
+use chrono::Utc;
+use cqrs_es::{EventEnvelope, View};
+use serde::{Deserialize, Serialize};
+use utoipa::ToSchema;
+
+#[derive(Debug, Clone, Deserialize, Default, Serialize, ToSchema)]
+pub struct CatalogView {
+    #[serde(rename = "id")]
+    pub catalog_id: String,
+    pub display: CatalogDisplay,
+    pub template_ids: Vec<String>,
+    pub visibility: CatalogVisibility,
+    pub modified_at: DateTime<Utc>,
+    pub deleted: bool,
+}
+
+impl View<Catalog> for CatalogView {
+    fn update(&mut self, event: &EventEnvelope<Catalog>) {
+        use CatalogEvent::*;
+
+        self.modified_at = Utc::now();
+
+        match &event.payload {
+            CatalogCreated {
+                id,
+                display,
+                visibility,
+            } => {
+                self.catalog_id.clone_from(id);
+                self.display.clone_from(display);
+                self.visibility.clone_from(visibility);
+            }
+            CatalogAppearanceChanged { id: _, display } => {
+                self.display.clone_from(display);
+            }
+            CatalogMadePublic { id: _, visibility } => {
+                self.visibility.clone_from(visibility);
+            }
+            CatalogMadePrivate { id: _, visibility } => {
+                self.visibility.clone_from(visibility);
+            }
+            TemplateIdsAdded { id: _, template_ids } => {
+                self.template_ids.extend(template_ids.iter().cloned());
+            }
+            TemplateIdsRemoved { id: _, template_ids } => {
+                self.template_ids.retain(|id| !template_ids.contains(id));
+            }
+            CatalogDeleted { id: _ } => {
+                self.deleted = true;
+            }
+        }
+    }
+}
diff --git a/agent_library/src/catalog/views/view_all_catalogs.rs b/agent_library/src/catalog/views/view_all_catalogs.rs
new file mode 100644
index 00000000..ecc557f6
--- /dev/null
+++ b/agent_library/src/catalog/views/view_all_catalogs.rs
@@ -0,0 +1,27 @@
+use crate::catalog::aggregate::Catalog;
+use crate::catalog::views::CatalogView;
+use cqrs_es::{EventEnvelope, View};
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+
+#[derive(Debug, Default, Serialize, Deserialize, Clone)]
+pub struct AllCatalogsView {
+    #[serde(flatten)]
+    pub catalogs: HashMap<String, CatalogView>,
+}
+
+impl View<Catalog> for AllCatalogsView {
+    fn update(&mut self, event: &EventEnvelope<Catalog>) {
+        let view = self
+            .catalogs
+            // Get the entry for the aggregate_id
+            .entry(event.aggregate_id.clone())
+            // or insert a new one if it doesn't exist
+            .or_default();
+        // update the view with the event
+        view.update(event);
+        if view.deleted {
+            self.catalogs.remove(&event.aggregate_id);
+        }
+    }
+}
diff --git a/agent_library/src/lib.rs b/agent_library/src/lib.rs
index e96a3999..e8f2a917 100644
--- a/agent_library/src/lib.rs
+++ b/agent_library/src/lib.rs
@@ -1,3 +1,4 @@
+pub mod catalog;
 pub mod json_schema_validation;
 pub mod state;
 pub mod template;
diff --git a/agent_library/src/state.rs b/agent_library/src/state.rs
index 2bb3dd6f..9631752b 100644
--- a/agent_library/src/state.rs
+++ b/agent_library/src/state.rs
@@ -8,6 +8,11 @@ use crate::template::{
     views::{all_templates::AllTemplatesView, TemplateView},
 };
 
+use crate::catalog::{
+    aggregate::Catalog,
+    views::{view_all_catalogs::AllCatalogsView, CatalogView},
+};
+
 #[derive(Clone)]
 pub struct LibraryState {
     pub authorization_checker: Arc<dyn AuthorizationChecker>,
@@ -19,21 +24,30 @@ pub struct LibraryState {
 #[derive(Clone)]
 pub struct CommandHandlers {
     pub template: CommandHandler<Template>,
+    pub catalog: CommandHandler<Catalog>,
 }
 
 /// This type is used to define the queries that are used to query the view repositories. We make use of `dyn` here, so
 /// that any type of repository that implements the `ViewRepository` trait can be used, but the corresponding `View` and
 /// `Aggregate` types must be the same.
-type Queries =
-    ViewRepositories<dyn DynViewRepository<TemplateView, Template>, dyn DynViewRepository<AllTemplatesView, Template>>;
+type Queries = ViewRepositories<
+    dyn DynViewRepository<TemplateView, Template>,
+    dyn DynViewRepository<AllTemplatesView, Template>,
+    dyn DynViewRepository<CatalogView, Catalog>,
+    dyn DynViewRepository<AllCatalogsView, Catalog>,
+>;
 
-pub struct ViewRepositories<T1, T2>
+pub struct ViewRepositories<T1, T2, T3, T4>
 where
     T1: DynViewRepository<TemplateView, Template> + ?Sized,
     T2: DynViewRepository<AllTemplatesView, Template> + ?Sized,
+    T3: DynViewRepository<CatalogView, Catalog> + ?Sized,
+    T4: DynViewRepository<AllCatalogsView, Catalog> + ?Sized,
 {
     pub template: Arc<T1>,
     pub all_templates: Arc<T2>,
+    pub catalog: Arc<T3>,
+    pub all_catalogs: Arc<T4>,
 }
 
 impl Clone for Queries {
@@ -41,6 +55,8 @@ impl Clone for Queries {
         ViewRepositories {
             template: self.template.clone(),
             all_templates: self.all_templates.clone(),
+            catalog: self.catalog.clone(),
+            all_catalogs: self.all_catalogs.clone(),
         }
     }
 }
diff --git a/agent_library/src/template/event.rs b/agent_library/src/template/event.rs
index a79f1566..caf34cba 100644
--- a/agent_library/src/template/event.rs
+++ b/agent_library/src/template/event.rs
@@ -6,7 +6,6 @@ use cqrs_es::DomainEvent;
 use serde::{Deserialize, Serialize};
 use strum::Display;
 
-// TODO: Add `modified_at` to metadata.
 #[derive(Clone, Debug, Deserialize, PartialEq, Serialize, Display)]
 pub enum TemplateEvent {
     TemplateCreated {
diff --git a/agent_store/src/lib.rs b/agent_store/src/lib.rs
index f3137ad1..fdd43067 100644
--- a/agent_store/src/lib.rs
+++ b/agent_store/src/lib.rs
@@ -46,6 +46,10 @@ use agent_issuance::{
     credential::aggregate::Credential, nonce::aggregate::Nonce, offer::aggregate::Offer,
     public_offer::aggregate::PublicOffer, server_config::aggregate::ServerConfig,
 };
+use agent_library::catalog::aggregate::Catalog;
+use agent_library::catalog::services::{CatalogServiceImpl, CatalogServices};
+use agent_library::catalog::views::view_all_catalogs::AllCatalogsView;
+use agent_library::catalog::views::CatalogView;
 use agent_library::state::LibraryState;
 use agent_library::template::aggregate::Template;
 use agent_library::template::views::all_templates::AllTemplatesView;
@@ -245,14 +249,25 @@ pub async fn library_state<CCB: CqrsComponentBuilder>(
         .commands_and_queries::<Template, Template, AllTemplatesView>((), queries)
         .await;
 
+    let catalog_services: Arc<dyn CatalogServices> = Arc::new(CatalogServiceImpl {
+        template_view_repo: template.clone(),
+    });
+
+    let (catalog_command_handler, catalog, all_catalogs) = builder
+        .commands_and_queries::<CatalogView, Catalog, AllCatalogsView>(catalog_services, vec![])
+        .await;
+
     LibraryState {
         authorization_checker: Arc::new(AllowAllAuthorizationChecker),
         command: agent_library::state::CommandHandlers {
             template: template_command_handler,
+            catalog: catalog_command_handler,
         },
         query: agent_library::state::ViewRepositories {
             template,
             all_templates,
+            catalog,
+            all_catalogs,
         },
     }
 }
diff --git a/docs/problem-details/library.md b/docs/problem-details/library.md
index fd96d6e2..c6f8798e 100644
--- a/docs/problem-details/library.md
+++ b/docs/problem-details/library.md
@@ -1,3 +1,5 @@
+# Templates
+
 ## Source Template Not Found
 
 This error arises when the source template data for duplication can not be fetched. This could indicate that the `sourceTemplateId` used for duplication is not associated with an existing template. It can also arise in instances where the template has been deleted.
@@ -73,3 +75,17 @@ This error occurs when `schemaPropertiesAttributes` contains duplicate keys afte
 ## Draft Template Cannot Be Public
 
 This error occurs when a template in `Draft` stage is made public.
+
+# Catalogs 
+
+## Catalog Template Not Found 
+
+A requested template was not found. 
+
+## Missing Catalog Name
+
+This error occurs when a catalog does not have a name. Name is a required field in catalogs. 
+
+## Catalog Not Found
+
+This error occurs when a catalog could not be found. 
\ No newline at end of file

From aafcf2e7aa1985b42954561dddbedcb062a45f35 Mon Sep 17 00:00:00 2001
From: Daniel Mader <daniel.mader@impierce.com>
Date: Fri, 10 Jul 2026 09:34:30 +0200
Subject: [PATCH 26/34] docs: add OpenAPI definition for credential
 presentations (#372)

---
 agent_api_http/openapi-generated.yaml         | 82 +++++++++++++++++++
 .../src/v0/holder/holder/presentations/mod.rs | 45 +++++++++-
 agent_api_http/src/v0/holder/openapi.rs       | 15 +++-
 agent_holder/src/presentation/aggregate.rs    |  4 +-
 4 files changed, 142 insertions(+), 4 deletions(-)

diff --git a/agent_api_http/openapi-generated.yaml b/agent_api_http/openapi-generated.yaml
index cb200230..e9b82785 100644
--- a/agent_api_http/openapi-generated.yaml
+++ b/agent_api_http/openapi-generated.yaml
@@ -631,6 +631,68 @@ paths:
                 $ref: '#/components/schemas/OfferView'
         '404':
           description: Offer not found
+  /v0/holder/presentations:
+    get:
+      tags:
+      - Identity
+      - Holder
+      summary: List all credential presentations
+      description: Retrieves all credential presentations held by your organisation.
+      operationId: get_all_holder_presentations
+      responses:
+        '200':
+          description: All presentations retrieved successfully
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/PresentationView'
+    post:
+      tags:
+      - Identity
+      - Holder
+      summary: Create a new credential presentation
+      description: Creates and signs a new credential presentation containing the given credentials held by your organisation.
+      operationId: create_holder_presentation
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/PresentationsEndpointRequest'
+        required: true
+      responses:
+        '201':
+          description: Presentation created successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PresentationView'
+        '404':
+          description: Credential not found
+  /v0/holder/presentations/{presentation_id}:
+    get:
+      tags:
+      - Identity
+      - Holder
+      summary: Get credential presentation by ID
+      description: Retrieves a single credential presentation held by your organisation by its ID.
+      operationId: get_holder_presentation_by_id
+      parameters:
+      - name: presentation_id
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        '200':
+          description: Presentation retrieved successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PresentationView'
+        '404':
+          description: Presentation not found
   /v0/list-all-templates:
     get:
       tags:
@@ -1655,6 +1717,26 @@ components:
           oneOf:
           - type: 'null'
           - $ref: '#/components/schemas/ConnectionDisplayProperties'
+    PresentationView:
+      type: object
+      required:
+      - id
+      properties:
+        id:
+          type: string
+        signed:
+          type:
+          - string
+          - 'null'
+    PresentationsEndpointRequest:
+      type: object
+      required:
+      - credentialIds
+      properties:
+        credentialIds:
+          type: array
+          items:
+            type: string
     Profile:
       type: object
       required:
diff --git a/agent_api_http/src/v0/holder/holder/presentations/mod.rs b/agent_api_http/src/v0/holder/holder/presentations/mod.rs
index ea414e8b..68cc5f95 100644
--- a/agent_api_http/src/v0/holder/holder/presentations/mod.rs
+++ b/agent_api_http/src/v0/holder/holder/presentations/mod.rs
@@ -3,7 +3,9 @@ pub mod presentation_signed;
 use crate::extractors::RequestActor;
 use crate::handlers::{command_handler, query_handler};
 use agent_holder::{
-    credential::queries::HolderCredentialView, presentation::command::PresentationCommand, state::HolderState,
+    credential::queries::HolderCredentialView,
+    presentation::{aggregate::Presentation, command::PresentationCommand},
+    state::HolderState,
 };
 use axum::{
     extract::{Path, State},
@@ -15,6 +17,18 @@ use hyper::StatusCode;
 use serde::{Deserialize, Serialize};
 use std::sync::Arc;
 
+/// List all credential presentations
+///
+/// Retrieves all credential presentations held by your organisation.
+#[utoipa::path(
+    get,
+    path = "/holder/presentations",
+    operation_id = "get_all_holder_presentations",
+    tags = ["Identity", "Holder"],
+    responses(
+        (status = 200, description = "All presentations retrieved successfully", body = [Presentation]),
+    )
+)]
 #[axum_macros::debug_handler]
 pub(crate) async fn get_presentations(
     State(state): State<Arc<HolderState>>,
@@ -33,6 +47,19 @@ pub(crate) async fn get_presentations(
     Ok((StatusCode::OK, Json(all_presentations)).into_response())
 }
 
+/// Get credential presentation by ID
+///
+/// Retrieves a single credential presentation held by your organisation by its ID.
+#[utoipa::path(
+    get,
+    path = "/holder/presentations/{presentation_id}",
+    operation_id = "get_holder_presentation_by_id",
+    tags = ["Identity", "Holder"],
+    responses(
+        (status = 200, description = "Presentation retrieved successfully", body = Presentation),
+        (status = 404, description = "Presentation not found"),
+    )
+)]
 #[axum_macros::debug_handler]
 pub(crate) async fn presentation(
     State(state): State<Arc<HolderState>>,
@@ -50,12 +77,26 @@ pub(crate) async fn presentation(
     .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
 }
 
-#[derive(Deserialize, Serialize)]
+#[derive(Deserialize, Serialize, utoipa::ToSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct PresentationsEndpointRequest {
     pub credential_ids: Vec<String>,
 }
 
+/// Create a new credential presentation
+///
+/// Creates and signs a new credential presentation containing the given credentials held by your organisation.
+#[utoipa::path(
+    post,
+    path = "/holder/presentations",
+    operation_id = "create_holder_presentation",
+    tags = ["Identity", "Holder"],
+    request_body = PresentationsEndpointRequest,
+    responses(
+        (status = 201, description = "Presentation created successfully", body = Presentation),
+        (status = 404, description = "Credential not found"),
+    )
+)]
 #[axum_macros::debug_handler]
 pub(crate) async fn post_presentations(
     State(state): State<Arc<HolderState>>,
diff --git a/agent_api_http/src/v0/holder/openapi.rs b/agent_api_http/src/v0/holder/openapi.rs
index 8d40069b..bb864cd1 100644
--- a/agent_api_http/src/v0/holder/openapi.rs
+++ b/agent_api_http/src/v0/holder/openapi.rs
@@ -1,10 +1,23 @@
 use crate::v0::holder::holder::credentials::{__path_credential, __path_credentials};
 use crate::v0::holder::holder::offers::{__path_offer, __path_offers, accept::__path_accept, reject::__path_reject};
+use crate::v0::holder::holder::presentations::{
+    __path_get_presentations, __path_post_presentations, __path_presentation,
+};
 use utoipa::OpenApi;
 
 #[derive(OpenApi)]
 #[openapi(
-    paths(credential, credentials, offer, offers, accept, reject),
+    paths(
+        credential,
+        credentials,
+        offer,
+        offers,
+        accept,
+        reject,
+        get_presentations,
+        post_presentations,
+        presentation
+    ),
     tags(
         (name = "Identity", description = "Manage all aspects of your organisational identity."),
         (name = "Holder", description = "Manage the credentials your organisation holds itself."),
diff --git a/agent_holder/src/presentation/aggregate.rs b/agent_holder/src/presentation/aggregate.rs
index e179fcba..e775c58a 100644
--- a/agent_holder/src/presentation/aggregate.rs
+++ b/agent_holder/src/presentation/aggregate.rs
@@ -11,10 +11,12 @@ use serde::{Deserialize, Serialize};
 use std::sync::Arc;
 use tracing::{debug, info};
 
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[derive(Debug, Clone, Serialize, Deserialize, Default, utoipa::ToSchema)]
+#[schema(as = PresentationView)]
 pub struct Presentation {
     #[serde(rename = "id")]
     pub presentation_id: String,
+    #[schema(value_type = Option<String>)]
     pub signed: Option<Jwt>,
 }
 

From fb09d490888211776a9105ed149291c86aecd55c Mon Sep 17 00:00:00 2001
From: Daniel Mader <daniel.mader@impierce.com>
Date: Fri, 10 Jul 2026 15:36:11 +0200
Subject: [PATCH 27/34] build: ignore advisories for `quick-xml`, pin `clippy`
 version (#369)

---
 .cargo/audit.toml                                 | 15 +++++++++++++++
 .github/copilot-instructions.md                   |  6 +++---
 .github/workflows/audit.yaml                      |  1 +
 .github/workflows/format-lint-test.yaml           |  2 +-
 Cargo.lock                                        |  4 ++--
 Cargo.toml                                        |  2 +-
 agent_api_http/src/v0/identity/connections/mod.rs |  6 +++---
 agent_api_http/src/v0/identity/documents/mod.rs   |  2 +-
 8 files changed, 27 insertions(+), 11 deletions(-)

diff --git a/.cargo/audit.toml b/.cargo/audit.toml
index f506975d..8bde5ddd 100644
--- a/.cargo/audit.toml
+++ b/.cargo/audit.toml
@@ -61,4 +61,19 @@ ignore = [
     # via did-web/hyper-rustls) nor async-nats enable CRL checking in their TLS
     # configurations, so CRL parsing code is never reached in this application.
     "RUSTSEC-2026-0104",
+
+    # RUSTSEC-2026-0194: quick-xml 0.39.4 — Quadratic run time in duplicate-attribute check
+    # Same crate and dependency chain as RUSTSEC-2026-0195 below: quick-xml is only pulled in
+    # through object_store inside the IOTA SDK. The ssi-agent never parses XML; the vulnerable
+    # attribute iteration only runs when object_store parses S3/Azure-style XML API responses,
+    # and no object-storage backend is configured or reachable from application code.
+    # TODO: revisit once the IOTA SDK upgrades quick-xml to >= 0.41.0.
+    "RUSTSEC-2026-0194",
+
+    # RUSTSEC-2026-0195: quick-xml 0.39.4 — Unbounded namespace-declaration allocation in NsReader
+    # The vulnerable quick-xml code is pulled in through object_store inside the IOTA SDK
+    # dependency chain. This workspace does not use object_store or any XML/object-storage
+    # client directly, so the NsReader path is not reachable from ssi-agent application code.
+    # TODO: revisit once the IOTA SDK upgrades quick-xml to >= 0.41.0.
+    "RUSTSEC-2026-0195",
 ]
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index fa963838..5fa8ebea 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -4,7 +4,7 @@
 
 **ssi-agent** is a Self-Sovereign Identity (SSI) agent implementing OpenID4VCI (issuance) and OpenID4VP (verification) protocols. It's a Rust Tokio-based service that manages identity credentials, digital wallets, and credential verification flows.
 
-- **Language**: Rust 1.76.0+ (enforced in Cargo.toml `rust-version`)
+- **Language**: Rust 1.94.0+ (enforced in Cargo.toml `rust-version`)
 - **Build System**: Cargo workspace with 18 crates
 - **HTTP Framework**: Axum 0.8 with Tokio async runtime
 - **Persistence**: PostgreSQL with CQRS-ES event sourcing pattern
@@ -18,12 +18,12 @@ All commands run from repository root. **Always use `cargo` commands; do not use
 ### Bootstrap (one-time setup)
 
 ```bash
-# Install Rust 1.76.0+ (use dtolnay/rust-toolchain@stable for CI version)
+# Install Rust 1.94.0+ (use dtolnay/rust-toolchain@stable for CI version)
 curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
 rustup component add rustfmt clippy
 
 # Verify installation
-cargo --version  # Should show 1.76.0+
+cargo --version  # Should show 1.94.0+
 ```
 
 ### Build
diff --git a/.github/workflows/audit.yaml b/.github/workflows/audit.yaml
index 43a8a558..608805b1 100644
--- a/.github/workflows/audit.yaml
+++ b/.github/workflows/audit.yaml
@@ -5,6 +5,7 @@ on:
     - cron: "0 3 * * *" # run at 3 AM every day
   workflow_dispatch:
   pull_request:
+  push:
     branches:
       - main
       - next
diff --git a/.github/workflows/format-lint-test.yaml b/.github/workflows/format-lint-test.yaml
index e3ffadf3..dd3318be 100644
--- a/.github/workflows/format-lint-test.yaml
+++ b/.github/workflows/format-lint-test.yaml
@@ -20,7 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@1.94.0
         with:
           components: rustfmt, clippy
 
diff --git a/Cargo.lock b/Cargo.lock
index 406c0826..6443b67f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2515,9 +2515,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 2f5845a5..f9cc51d7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -25,7 +25,7 @@ members = [
 [workspace.package]
 version = "0.1.0"
 edition = "2021"
-rust-version = "1.76.0"
+rust-version = "1.94.0"
 license-file = "LICENSE"
 publish = false
 
diff --git a/agent_api_http/src/v0/identity/connections/mod.rs b/agent_api_http/src/v0/identity/connections/mod.rs
index 02502e11..bb1e8a20 100644
--- a/agent_api_http/src/v0/identity/connections/mod.rs
+++ b/agent_api_http/src/v0/identity/connections/mod.rs
@@ -130,9 +130,9 @@ pub(crate) async fn get_connections(
             .filter(|connection| {
                 display
                     .as_ref()
-                    .map_or(true, |display| connection.display.as_ref() == Some(display))
-                    && url.as_ref().map_or(true, |url| *url == connection.url)
-                    && did.as_ref().map_or(true, |did| connection.dids.contains(did))
+                    .is_none_or(|display| connection.display.as_ref() == Some(display))
+                    && url.as_ref().is_none_or(|url| *url == connection.url)
+                    && did.as_ref().is_none_or(|did| connection.dids.contains(did))
             })
             .collect();
 
diff --git a/agent_api_http/src/v0/identity/documents/mod.rs b/agent_api_http/src/v0/identity/documents/mod.rs
index 246d6fd3..0be24e7c 100644
--- a/agent_api_http/src/v0/identity/documents/mod.rs
+++ b/agent_api_http/src/v0/identity/documents/mod.rs
@@ -54,7 +54,7 @@ pub(crate) async fn get_documents(
             .filter(|document| {
                 did_method
                     .as_ref()
-                    .map_or(true, |method| document.did_method.as_ref() == Some(method))
+                    .is_none_or(|method| document.did_method.as_ref() == Some(method))
             })
             .collect();
 

From ac8908c6d77342d9b9d1c0a484ad6c0517500789 Mon Sep 17 00:00:00 2001
From: Daniel Mader <daniel.mader@impierce.com>
Date: Mon, 13 Jul 2026 12:14:28 +0200
Subject: [PATCH 28/34] fix: adjust link to credential offer (#374)

---
 agent_issuance/src/offer/aggregate.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/agent_issuance/src/offer/aggregate.rs b/agent_issuance/src/offer/aggregate.rs
index 38933665..a47e97d9 100644
--- a/agent_issuance/src/offer/aggregate.rs
+++ b/agent_issuance/src/offer/aggregate.rs
@@ -260,8 +260,8 @@ impl Aggregate for Offer {
 
                         // TODO: Remove this client-side logic.
                         let offer_link = config()
-                            .application_url
-                            .join(&format!("offer/{}", offer_id))
+                            .public_url
+                            .join(&format!("public/offers/{}", offer_id))
                             .expect("Failed to construct offer link URL");
 
                         Ok(vec![CredentialOfferEmailSent {

From 3241e96a2d6c38a9931ba35937a699505eaacf44 Mon Sep 17 00:00:00 2001
From: Nander Stabel <nander.stabel@impierce.com>
Date: Tue, 14 Jul 2026 15:57:29 +0200
Subject: [PATCH 29/34] feat(test): support local E2E testing with
 `allow-localhost` feature (#371)

---
 .github/workflows/format-lint-test.yaml       |  5 +-
 agent_api_http/Cargo.toml                     |  1 +
 .../src/v0/identity/connections/mod.rs        | 54 ++++++++++++++-----
 agent_identity/Cargo.toml                     |  1 +
 agent_identity/src/services.rs                | 50 ++++++++++++++++-
 agent_shared/src/config/mod.rs                | 14 ++++-
 ...calhost-http-fallback-for-local-testing.md | 30 +++++++++++
 7 files changed, 139 insertions(+), 16 deletions(-)
 create mode 100644 docs/adr/0002-allow-localhost-http-fallback-for-local-testing.md

diff --git a/.github/workflows/format-lint-test.yaml b/.github/workflows/format-lint-test.yaml
index dd3318be..023d7253 100644
--- a/.github/workflows/format-lint-test.yaml
+++ b/.github/workflows/format-lint-test.yaml
@@ -32,8 +32,11 @@ jobs:
       - name: Lint
         run: cargo clippy --all-targets --all-features -- -D warnings
 
-      - name: Test
+      - name: Test (Default features)
         run: cargo test --workspace
 
+      - name: Test (allow-localhost)
+        run: cargo test -p agent_api_http -p agent_identity --features allow-localhost allow_localhost_tests
+
       - name: Generated files are unchanged
         run: git diff --exit-code
diff --git a/agent_api_http/Cargo.toml b/agent_api_http/Cargo.toml
index 7d80b1d8..61cc9e3c 100644
--- a/agent_api_http/Cargo.toml
+++ b/agent_api_http/Cargo.toml
@@ -93,3 +93,4 @@ wiremock.workspace = true
 
 [features]
 test_utils = []
+allow-localhost = ["agent_identity/allow-localhost"]
diff --git a/agent_api_http/src/v0/identity/connections/mod.rs b/agent_api_http/src/v0/identity/connections/mod.rs
index bb1e8a20..5e922b43 100644
--- a/agent_api_http/src/v0/identity/connections/mod.rs
+++ b/agent_api_http/src/v0/identity/connections/mod.rs
@@ -290,8 +290,13 @@ pub(crate) async fn remove_connection(
 pub fn parse_url(input: &str) -> Result<Url, ApiError> {
     let input = input.trim();
     let with_scheme = match input.strip_prefix("http://") {
+        #[cfg(not(feature = "allow-localhost"))]
         Some(rest) => format!("https://{rest}"),
+        #[cfg(feature = "allow-localhost")]
+        Some(_rest) => input.to_string(),
         None if input.starts_with("https://") => input.to_string(),
+        #[cfg(feature = "allow-localhost")]
+        None if input.starts_with("localhost") => format!("http://{input}"),
         None => format!("https://{input}"),
     };
 
@@ -301,16 +306,19 @@ pub fn parse_url(input: &str) -> Result<Url, ApiError> {
             .finish()
     })?;
 
-    let host = url.host_str().ok_or_else(|| {
-        ApiError::builder(StatusCode::BAD_REQUEST)
-            .message("Url missing host".to_string())
-            .finish()
-    })?;
-
-    if !host.contains('.') {
-        return Err(ApiError::builder(StatusCode::BAD_REQUEST)
-            .message("Url must contain a top-level domain (e.g. .com, .nl, .eu).".to_string())
-            .finish());
+    #[cfg(not(feature = "allow-localhost"))]
+    {
+        let host = url.host_str().ok_or_else(|| {
+            ApiError::builder(StatusCode::BAD_REQUEST)
+                .message("Url missing host".to_string())
+                .finish()
+        })?;
+
+        if !host.contains('.') {
+            return Err(ApiError::builder(StatusCode::BAD_REQUEST)
+                .message("Url must contain a top-level domain (e.g. .com, .nl, .eu).".to_string())
+                .finish());
+        }
     }
 
     Ok(url)
@@ -321,7 +329,8 @@ pub mod tests {
     use super::*;
 
     #[test]
-    fn test_parsing_with_http_prefix() {
+    #[cfg(not(feature = "allow-localhost"))]
+    fn test_parsing_with_http_prefix_upgrades_to_https() {
         let input_string = "http://a-via-lactea.example.com/";
         let parsed = parse_url(input_string).unwrap();
 
@@ -353,8 +362,29 @@ pub mod tests {
     }
 
     #[test]
-    fn invalid_input_no_tld() {
+    #[cfg(not(feature = "allow-localhost"))]
+    fn invalid_input_no_tld_fails() {
         let input_string = "a-via-lactea";
         assert!(parse_url(input_string).is_err());
     }
+
+    #[cfg(feature = "allow-localhost")]
+    pub mod allow_localhost_tests {
+        use super::*;
+
+        #[test]
+        fn test_parsing_with_http_prefix_preserves_http() {
+            let input_string = "http://a-via-lactea.example.com/";
+            let parsed = parse_url(input_string).unwrap();
+
+            assert_eq!(parsed, Url::parse("http://a-via-lactea.example.com/").unwrap());
+        }
+
+        #[test]
+        fn test_parsing_localhost_defaults_to_http() {
+            let input_string = "localhost:8080";
+            let parsed = parse_url(input_string).unwrap();
+            assert_eq!(parsed, Url::parse("http://localhost:8080/").unwrap());
+        }
+    }
 }
diff --git a/agent_identity/Cargo.toml b/agent_identity/Cargo.toml
index 781d1629..0810d77e 100644
--- a/agent_identity/Cargo.toml
+++ b/agent_identity/Cargo.toml
@@ -74,3 +74,4 @@ wiremock.workspace = true
 
 [features]
 test_utils = ["dep:futures", "dep:rstest"]
+allow-localhost = []
diff --git a/agent_identity/src/services.rs b/agent_identity/src/services.rs
index 30213a26..ce520517 100644
--- a/agent_identity/src/services.rs
+++ b/agent_identity/src/services.rs
@@ -68,6 +68,18 @@ impl IdentityServices {
     }
 
     pub async fn fetch_linked_dids(&self, url: &Url) -> Result<(Vec<DIDUrl>, bool), ConnectionError> {
+        // TODO: This essentially disables domain linkage fetching because HTTPS is strictly
+        // required by `DomainLinkageConfiguration::from_json_value`. When running locally
+        // with HTTP, the fetch fails and we gracefully default to no linked DIDs.
+        // See `docs/adr/0002-allow-localhost-http-fallback-for-local-testing.md` for more context and the future plan
+        // to use `rcgen`.
+        #[cfg(feature = "allow-localhost")]
+        let config = match self.fetch_domain_linkage_configuration(url).await {
+            Ok(config) => config,
+            Err(_) => return Ok((vec![], false)),
+        };
+
+        #[cfg(not(feature = "allow-localhost"))]
         let config = self.fetch_domain_linkage_configuration(url).await?;
         let linked_dids: Vec<DIDUrl> = config
             .linked_dids()
@@ -205,7 +217,8 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn test_fetch_linked_dids_empty() {
+    #[cfg(not(feature = "allow-localhost"))]
+    async fn test_fetch_linked_dids_empty_fails() {
         let mock_server = MockServer::start().await;
 
         Mock::given(method("GET"))
@@ -225,4 +238,39 @@ mod tests {
 
         assert!(result.is_err());
     }
+
+    #[cfg(feature = "allow-localhost")]
+    pub mod allow_localhost_tests {
+        use super::*;
+
+        #[tokio::test]
+        // DISCLAIMER: The DID Configuration specification strictly requires a non-empty `linked_dids` array.
+        // This test asserts that the parser's validation error is intentionally swallowed, returning an
+        // empty list instead. This is a deliberate bypass to prevent local HTTP testing from failing
+        // due to domain linkage requirements. See `docs/adr/0002-allow-localhost-http-fallback-for-local-testing.md`
+        // for the full context.
+        async fn test_fetch_linked_dids_empty_succeeds_with_fallback() {
+            let mock_server = MockServer::start().await;
+
+            Mock::given(method("GET"))
+                .and(path("/.well-known/did-configuration.json"))
+                .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+                    "@context": "https://identity.foundation/.well-known/did-configuration/v1",
+                    "linked_dids": []
+                })))
+                .mount(&mock_server)
+                .await;
+
+            let subject = Arc::new(Subject::new().await);
+            let services = IdentityServices::new(subject);
+
+            let issuer_url: Url = mock_server.uri().parse().unwrap();
+            let result = services.fetch_linked_dids(&issuer_url).await;
+
+            // When allow-localhost is on, the error is swallowed and fallback is returned.
+            let (dids, valid) = result.unwrap();
+            assert_eq!(dids.len(), 0);
+            assert!(!valid);
+        }
+    }
 }
diff --git a/agent_shared/src/config/mod.rs b/agent_shared/src/config/mod.rs
index 7a24fe68..5308862e 100644
--- a/agent_shared/src/config/mod.rs
+++ b/agent_shared/src/config/mod.rs
@@ -60,9 +60,19 @@ pub static CONFIG: Lazy<RwLock<ApplicationConfiguration>> = Lazy::new(|| {
             // Set the default logging level to `info`, equivalent to `RUST_LOG=info`
             .with(tracing_subscriber::EnvFilter::try_from_default_env().unwrap_or_else(|_| "info".into()));
 
+        // We use TestWriter to ensure that `cargo test` can capture the logs.
+        // In a normal `cargo run` scenario, this falls back to standard stdout.
         match application_configuration.log_format {
-            LogFormat::Json => tracing_subscriber.with(tracing_subscriber::fmt::layer().json()).init(),
-            LogFormat::Text => tracing_subscriber.with(tracing_subscriber::fmt::layer()).init(),
+            LogFormat::Json => tracing_subscriber
+                .with(
+                    tracing_subscriber::fmt::layer()
+                        .json()
+                        .with_writer(tracing_subscriber::fmt::TestWriter::new()),
+                )
+                .init(),
+            LogFormat::Text => tracing_subscriber
+                .with(tracing_subscriber::fmt::layer().with_writer(tracing_subscriber::fmt::TestWriter::new()))
+                .init(),
         }
 
         info!("Configuration loaded successfully");
diff --git a/docs/adr/0002-allow-localhost-http-fallback-for-local-testing.md b/docs/adr/0002-allow-localhost-http-fallback-for-local-testing.md
new file mode 100644
index 00000000..6c7eb0ef
--- /dev/null
+++ b/docs/adr/0002-allow-localhost-http-fallback-for-local-testing.md
@@ -0,0 +1,30 @@
+# ADR 0002: Localhost HTTP Fallback for Local Testing
+
+**Status**: Accepted  
+**Date**: 2026-07-07  
+**Context**: Support for local E2E testing without TLS  
+
+---
+
+## Context
+
+When testing identity services locally, protocols such as DID Configuration and OIDC specifically require the use of HTTPS for security reasons. For example, `DomainLinkageConfiguration::from_json_value` strictly mandates that fetched documents conform to these secure protocols. 
+
+However, during local development and automated E2E testing, running a full TLS server stack and managing certificates is burdensome. We needed a simple way to boot the application locally on HTTP (`http://localhost`) and still have tests run without failing due to strict HTTPS checks.
+
+---
+
+## Decision
+
+We introduced an `allow-localhost` feature flag that disables strict HTTPS checks for `localhost` URLs. 
+Specifically, in `fetch_linked_dids`, when the `allow-localhost` feature is active, we attempt to fetch the domain linkage configuration via HTTP. Since `DomainLinkageConfiguration::from_json_value` strictly requires HTTPS, this fetch inevitably fails. We gracefully catch this error and default to returning no linked DIDs `(vec![], false)`, rather than causing the entire connection flow to panic or fail.
+
+---
+
+## Rationale
+
+This approach provides a quick and non-intrusive workaround to allow local development and tests to proceed without needing a full TLS setup.
+
+## Future Work
+
+This is recognized as a non-ideal solution because it essentially disables domain linkage fetching in the local testing environment. In the future, we should implement a proper local HTTPS solution using a crate like `rcgen` to dynamically generate self-signed certificates during test initialization. This would allow the test harness to run on `https://localhost` natively, enabling us to test the entire domain linkage flow securely and without skipping validation logic.

From c2078619d779e0a2094cdcfaa0c1257512e0add4 Mon Sep 17 00:00:00 2001
From: Floris Hafkenscheid
 <120176014+florishafkenscheid@users.noreply.github.com>
Date: Wed, 15 Jul 2026 10:37:55 +0200
Subject: [PATCH 30/34] feat: verify historical events on startup, add
 readiness probe (#375)

---
 Cargo.lock                                |   3 +
 agent_application/src/lib.rs              |  50 ++++-
 agent_application/src/probes/mod.rs       |   1 +
 agent_application/src/probes/readiness.rs |  17 ++
 agent_store/Cargo.toml                    |   3 +
 agent_store/src/event_verification.rs     | 231 ++++++++++++++++++++++
 agent_store/src/lib.rs                    |   1 +
 agent_store/src/mongodb.rs                |  52 +++++
 agent_store/src/postgres.rs               |  29 ++-
 9 files changed, 382 insertions(+), 5 deletions(-)
 create mode 100644 agent_application/src/probes/readiness.rs
 create mode 100644 agent_store/src/event_verification.rs

diff --git a/Cargo.lock b/Cargo.lock
index 6443b67f..04390690 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -514,10 +514,13 @@ dependencies = [
  "async-trait",
  "cqrs-es",
  "mongo-es",
+ "mongodb 3.7.0",
  "postgres-es",
+ "serde",
  "serde_json",
  "shared-kernel",
  "sqlx",
+ "thiserror 1.0.69",
  "tokio",
 ]
 
diff --git a/agent_application/src/lib.rs b/agent_application/src/lib.rs
index d117b47d..1d6fe307 100644
--- a/agent_application/src/lib.rs
+++ b/agent_application/src/lib.rs
@@ -13,14 +13,23 @@ use agent_issuance::{
 };
 use agent_secret_manager::{service::Service as _, subject::Subject};
 use agent_shared::config::{config, EventStoreType};
-use agent_store::{in_memory::InMemory, mongodb::MongoDB, postgres::Postgres, EventPublisher};
+use agent_store::{
+    event_verification::{EventVerificationError, EventVerificationReport},
+    in_memory::InMemory,
+    mongodb::MongoDB,
+    postgres::Postgres,
+    EventPublisher,
+};
 use agent_verification::services::VerificationServices;
-use probes::liveness::healthz;
+use probes::{
+    liveness::healthz,
+    readiness::{mark_ready, readyz},
+};
 use shared_kernel::authorization::{ActorExtractor, NoActorExtractor};
 use std::sync::Arc;
 use tokio::io;
 use tower_http::cors::CorsLayer;
-use tracing::info;
+use tracing::{error, info};
 use verification_authorization::VerificationAuthorizationAdapter;
 
 // Re-export states
@@ -89,6 +98,8 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
             EventStoreType::Postgres => {
                 let builder = Postgres::new().await;
 
+                verify_persisted_events(builder.verify_events().await);
+
                 let issuance_state =
                     Arc::new(agent_store::issuance_state(&builder, issuance_services, issuance_event_publishers).await);
 
@@ -137,6 +148,8 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
             EventStoreType::MongoDb => {
                 let builder = MongoDB::new().await;
 
+                verify_persisted_events(builder.verify_events().await);
+
                 let issuance_state =
                     Arc::new(agent_store::issuance_state(&builder, issuance_services, issuance_event_publishers).await);
 
@@ -183,6 +196,8 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
                 )
             }
             EventStoreType::InMemory => {
+                mark_ready();
+
                 let issuance_state = Arc::new(
                     agent_store::issuance_state(&InMemory, issuance_services, issuance_event_publishers).await,
                 );
@@ -282,7 +297,9 @@ where
     let app = metadata_router.merge(app);
 
     // Add probes routes
-    let probes_router = axum::Router::new().route("/healthz", axum::routing::get(healthz));
+    let probes_router = axum::Router::new()
+        .route("/healthz", axum::routing::get(healthz))
+        .route("/readyz", axum::routing::get(readyz));
     let mut app = probes_router.merge(app);
 
     if config().metrics.enabled {
@@ -297,6 +314,31 @@ pub fn configuration_router() -> axum::Router {
     axum::Router::new().route("/configuration", axum::routing::get(metadata::config::configuration))
 }
 
+fn verify_persisted_events(result: Result<EventVerificationReport, EventVerificationError>) {
+    match result {
+        Ok(report) if report.is_compatible() => {
+            info!(checked = report.checked, "Persisted event verification succeeded");
+            mark_ready();
+        }
+        Ok(report) => {
+            for event in report.incompatible {
+                error!(
+                    aggregate_type = %event.aggregate_type,
+                    aggregate_id = %event.aggregate_id,
+                    sequence = event.sequence,
+                    event_type = %event.event_type,
+                    event_version = %event.event_version,
+                    reason = %event.reason,
+                    "Incompatible persisted event"
+                );
+            }
+        }
+        Err(error) => {
+            error!(%error, "Failed to verify persisted events");
+        }
+    }
+}
+
 async fn serve(app: axum::Router) -> io::Result<()> {
     let port = config().application_url.port().unwrap_or(3033);
 
diff --git a/agent_application/src/probes/mod.rs b/agent_application/src/probes/mod.rs
index ac13b337..89c08bc0 100644
--- a/agent_application/src/probes/mod.rs
+++ b/agent_application/src/probes/mod.rs
@@ -1 +1,2 @@
 pub mod liveness;
+pub mod readiness;
diff --git a/agent_application/src/probes/readiness.rs b/agent_application/src/probes/readiness.rs
new file mode 100644
index 00000000..fa36a446
--- /dev/null
+++ b/agent_application/src/probes/readiness.rs
@@ -0,0 +1,17 @@
+use std::sync::atomic::{AtomicBool, Ordering};
+
+use axum::{http::StatusCode, response::IntoResponse};
+
+static READY: AtomicBool = AtomicBool::new(false);
+
+pub fn mark_ready() {
+    READY.store(true, Ordering::Release);
+}
+
+pub async fn readyz() -> impl IntoResponse {
+    if READY.load(Ordering::Acquire) {
+        StatusCode::OK
+    } else {
+        StatusCode::SERVICE_UNAVAILABLE
+    }
+}
diff --git a/agent_store/Cargo.toml b/agent_store/Cargo.toml
index 1de2d7c3..343913d5 100644
--- a/agent_store/Cargo.toml
+++ b/agent_store/Cargo.toml
@@ -17,12 +17,15 @@ shared-kernel.workspace = true
 
 async-trait.workspace = true
 cqrs-es.workspace = true
+mongodb = "3.7"
 mongo-es.workspace = true
 postgres-es = "0.5.0"
+serde.workspace = true
 serde_json.workspace = true
 sqlx = { version = "0.8", features = [
     "postgres",
     "runtime-tokio-rustls",
     "json",
 ] }
+thiserror.workspace = true
 tokio.workspace = true
diff --git a/agent_store/src/event_verification.rs b/agent_store/src/event_verification.rs
new file mode 100644
index 00000000..715d1aa5
--- /dev/null
+++ b/agent_store/src/event_verification.rs
@@ -0,0 +1,231 @@
+use agent_authorization::domain::{
+    access_token::{aggregate::AccessToken, event::AccessTokenEvent},
+    authorization_code::{aggregate::AuthorizationCode, event::AuthorizationCodeEvent},
+    client::{aggregate::Client, event::ClientEvent},
+    oauth2_authorization_request::{aggregate::OAuth2AuthorizationRequest, event::OAuth2AuthorizationRequestEvent},
+};
+use agent_holder::{
+    credential::{aggregate::Credential as HolderCredential, event::CredentialEvent as HolderCredentialEvent},
+    offer::{aggregate::Offer as ReceivedOffer, event::OfferEvent as ReceivedOfferEvent},
+    presentation::{aggregate::Presentation, event::PresentationEvent},
+};
+use agent_identity::{
+    connection::{aggregate::Connection, event::ConnectionEvent},
+    document::{aggregate::Document, event::DocumentEvent},
+    profile::{aggregate::Profile, event::ProfileEvent},
+    service::{aggregate::Service, event::ServiceEvent},
+};
+use agent_issuance::{
+    credential::{aggregate::Credential as IssuanceCredential, event::CredentialEvent as IssuanceCredentialEvent},
+    nonce::{aggregate::Nonce, event::NonceEvent},
+    offer::{aggregate::Offer as IssuanceOffer, event::OfferEvent as IssuanceOfferEvent},
+    public_offer::{aggregate::PublicOffer, event::PublicOfferEvent},
+    server_config::{aggregate::ServerConfig, event::ServerConfigEvent},
+    status_list::{aggregate::StatusListAggregate, event::StatusListEvent},
+};
+use agent_library::{
+    catalog::{aggregate::Catalog, event::CatalogEvent},
+    template::{aggregate::Template, event::TemplateEvent},
+};
+use agent_verification::authorization_request::{aggregate::AuthorizationRequest, event::AuthorizationRequestEvent};
+use cqrs_es::{Aggregate, DomainEvent};
+use serde::de::DeserializeOwned;
+
+#[derive(Clone, Debug)]
+pub struct RawStoredEvent {
+    pub aggregate_type: String,
+    pub aggregate_id: String,
+    pub sequence: i64,
+    pub event_type: String,
+    pub event_version: String,
+    pub payload: serde_json::Value,
+}
+
+#[derive(Clone, Debug)]
+pub struct IncompatibleEvent {
+    pub aggregate_type: String,
+    pub aggregate_id: String,
+    pub sequence: i64,
+    pub event_type: String,
+    pub event_version: String,
+    pub reason: String,
+}
+
+#[derive(Clone, Debug, Default)]
+pub struct EventVerificationReport {
+    pub checked: usize,
+    pub incompatible: Vec<IncompatibleEvent>,
+}
+
+impl EventVerificationReport {
+    pub fn is_compatible(&self) -> bool {
+        self.incompatible.is_empty()
+    }
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum EventVerificationError {
+    #[error("failed to load persisted events from Postgres: {0}")]
+    Postgres(#[from] sqlx::Error),
+    #[error("failed to load persisted events from MongoDB: {0}")]
+    MongoDb(#[from] mongodb::error::Error),
+    #[error("MongoDB client has no default database configured")]
+    MissingMongoDefaultDatabase,
+    #[error("failed to deserialize persisted MongoDB event document: {0}")]
+    MongoDbDocument(#[from] mongodb::bson::de::Error),
+}
+
+type VerifyPayload = fn(&RawStoredEvent) -> Result<(), String>;
+
+struct EventVerifier {
+    aggregate_type: &'static str,
+    verify: VerifyPayload,
+}
+
+pub fn verify_events(events: impl IntoIterator<Item = RawStoredEvent>) -> EventVerificationReport {
+    let mut report = EventVerificationReport::default();
+
+    for event in events {
+        report.checked += 1;
+
+        let Some(verifier) = event_verifier_for(&event.aggregate_type) else {
+            report
+                .incompatible
+                .push(incompatible_event(event, "unknown aggregate type"));
+            continue;
+        };
+
+        if let Err(reason) = (verifier.verify)(&event) {
+            report.incompatible.push(incompatible_event(event, reason));
+        }
+    }
+
+    report
+}
+
+fn event_verifier_for(aggregate_type: &str) -> Option<&'static EventVerifier> {
+    event_verifiers()
+        .iter()
+        .find(|verifier| verifier.aggregate_type == aggregate_type)
+}
+
+fn incompatible_event(event: RawStoredEvent, reason: impl Into<String>) -> IncompatibleEvent {
+    IncompatibleEvent {
+        aggregate_type: event.aggregate_type,
+        aggregate_id: event.aggregate_id,
+        sequence: event.sequence,
+        event_type: event.event_type,
+        event_version: event.event_version,
+        reason: reason.into(),
+    }
+}
+
+fn verify_aggregate_event<E>(raw: &RawStoredEvent) -> Result<(), String>
+where
+    E: DeserializeOwned + DomainEvent,
+{
+    let event: E = serde_json::from_value(raw.payload.clone()).map_err(|error| error.to_string())?;
+
+    if event.event_type() != raw.event_type {
+        return Err(format!(
+            "event type mismatch: stored `{}`, current `{}`",
+            raw.event_type,
+            event.event_type()
+        ));
+    }
+
+    if event.event_version() != raw.event_version {
+        return Err(format!(
+            "event version mismatch: stored `{}`, current `{}`",
+            raw.event_version,
+            event.event_version()
+        ));
+    }
+
+    Ok(())
+}
+
+fn event_verifiers() -> &'static [EventVerifier] {
+    &[
+        EventVerifier {
+            aggregate_type: AccessToken::TYPE,
+            verify: verify_aggregate_event::<AccessTokenEvent>,
+        },
+        EventVerifier {
+            aggregate_type: AuthorizationCode::TYPE,
+            verify: verify_aggregate_event::<AuthorizationCodeEvent>,
+        },
+        EventVerifier {
+            aggregate_type: Client::TYPE,
+            verify: verify_aggregate_event::<ClientEvent>,
+        },
+        EventVerifier {
+            aggregate_type: OAuth2AuthorizationRequest::TYPE,
+            verify: verify_aggregate_event::<OAuth2AuthorizationRequestEvent>,
+        },
+        EventVerifier {
+            aggregate_type: Connection::TYPE,
+            verify: verify_aggregate_event::<ConnectionEvent>,
+        },
+        EventVerifier {
+            aggregate_type: Document::TYPE,
+            verify: verify_aggregate_event::<DocumentEvent>,
+        },
+        EventVerifier {
+            aggregate_type: Profile::TYPE,
+            verify: verify_aggregate_event::<ProfileEvent>,
+        },
+        EventVerifier {
+            aggregate_type: Service::TYPE,
+            verify: verify_aggregate_event::<ServiceEvent>,
+        },
+        EventVerifier {
+            aggregate_type: Template::TYPE,
+            verify: verify_aggregate_event::<TemplateEvent>,
+        },
+        EventVerifier {
+            aggregate_type: Catalog::TYPE,
+            verify: verify_aggregate_event::<CatalogEvent>,
+        },
+        EventVerifier {
+            aggregate_type: ServerConfig::TYPE,
+            verify: verify_aggregate_event::<ServerConfigEvent>,
+        },
+        EventVerifier {
+            aggregate_type: IssuanceCredential::TYPE,
+            verify: verify_aggregate_event::<IssuanceCredentialEvent>,
+        },
+        EventVerifier {
+            aggregate_type: IssuanceOffer::TYPE,
+            verify: verify_aggregate_event::<IssuanceOfferEvent>,
+        },
+        EventVerifier {
+            aggregate_type: PublicOffer::TYPE,
+            verify: verify_aggregate_event::<PublicOfferEvent>,
+        },
+        EventVerifier {
+            aggregate_type: Nonce::TYPE,
+            verify: verify_aggregate_event::<NonceEvent>,
+        },
+        EventVerifier {
+            aggregate_type: StatusListAggregate::TYPE,
+            verify: verify_aggregate_event::<StatusListEvent>,
+        },
+        EventVerifier {
+            aggregate_type: HolderCredential::TYPE,
+            verify: verify_aggregate_event::<HolderCredentialEvent>,
+        },
+        EventVerifier {
+            aggregate_type: Presentation::TYPE,
+            verify: verify_aggregate_event::<PresentationEvent>,
+        },
+        EventVerifier {
+            aggregate_type: ReceivedOffer::TYPE,
+            verify: verify_aggregate_event::<ReceivedOfferEvent>,
+        },
+        EventVerifier {
+            aggregate_type: AuthorizationRequest::TYPE,
+            verify: verify_aggregate_event::<AuthorizationRequestEvent>,
+        },
+    ]
+}
diff --git a/agent_store/src/lib.rs b/agent_store/src/lib.rs
index fdd43067..31a6761c 100644
--- a/agent_store/src/lib.rs
+++ b/agent_store/src/lib.rs
@@ -68,6 +68,7 @@ use shared_kernel::view_repository::DynViewRepository;
 use std::collections::HashMap;
 use std::sync::Arc;
 
+pub mod event_verification;
 pub mod in_memory;
 pub mod mongodb;
 pub mod postgres;
diff --git a/agent_store/src/mongodb.rs b/agent_store/src/mongodb.rs
index 9af4aa8c..0406aaab 100644
--- a/agent_store/src/mongodb.rs
+++ b/agent_store/src/mongodb.rs
@@ -1,8 +1,11 @@
+use crate::event_verification::{self, EventVerificationError, EventVerificationReport, RawStoredEvent};
 use crate::{AggregateHandler, CqrsComponentBuilder};
 use agent_shared::{application_state::Command, config::config};
 use cqrs_es::{persist::PersistedEventStore, CqrsFramework};
 use cqrs_es::{Aggregate, Query, View};
 use mongo_es::{default_mongo_client, Client, MongoEventRepository, MongoViewRepository};
+use mongodb::bson::{self, doc, Document};
+use mongodb::options::FindOptions;
 use shared_kernel::view_repository::DynViewRepository;
 use std::sync::Arc;
 
@@ -34,6 +37,55 @@ impl MongoDB {
         Self { client }
     }
     // TODO: Run [Client::shutdown] during graceful shutdown to close all open connections.
+
+    pub async fn verify_events(&self) -> Result<EventVerificationReport, EventVerificationError> {
+        Ok(event_verification::verify_events(self.load_raw_events().await?))
+    }
+
+    async fn load_raw_events(&self) -> Result<Vec<RawStoredEvent>, EventVerificationError> {
+        #[derive(serde::Deserialize)]
+        struct RawStoredEventDocument {
+            aggregate_type: String,
+            aggregate_id: String,
+            sequence: i64,
+            event_type: String,
+            event_version: String,
+            payload: serde_json::Value,
+        }
+
+        impl From<RawStoredEventDocument> for RawStoredEvent {
+            fn from(event: RawStoredEventDocument) -> Self {
+                Self {
+                    aggregate_type: event.aggregate_type,
+                    aggregate_id: event.aggregate_id,
+                    sequence: event.sequence,
+                    event_type: event.event_type,
+                    event_version: event.event_version,
+                    payload: event.payload,
+                }
+            }
+        }
+
+        let Some(database) = self.client.default_database() else {
+            return Err(EventVerificationError::MissingMongoDefaultDatabase);
+        };
+
+        let collection = database.collection::<Document>("events");
+        let options = FindOptions::builder()
+            .sort(doc! { "aggregate_type": 1, "aggregate_id": 1, "sequence": 1 })
+            .build();
+
+        let mut cursor = collection.find(doc! {}).with_options(options).await?;
+        let mut events = Vec::new();
+
+        while cursor.advance().await? {
+            let document = cursor.deserialize_current()?;
+            let event: RawStoredEventDocument = bson::from_document(document)?;
+            events.push(event.into());
+        }
+
+        Ok(events)
+    }
 }
 
 impl CqrsComponentBuilder for MongoDB {
diff --git a/agent_store/src/postgres.rs b/agent_store/src/postgres.rs
index 2e6e5bd3..f9882e20 100644
--- a/agent_store/src/postgres.rs
+++ b/agent_store/src/postgres.rs
@@ -1,10 +1,11 @@
+use crate::event_verification::{self, EventVerificationError, EventVerificationReport, RawStoredEvent};
 use crate::{AggregateHandler, CqrsComponentBuilder};
 use agent_shared::{application_state::Command, config::config};
 use cqrs_es::persist::PersistedEventStore;
 use cqrs_es::{Aggregate, Query, View};
 use postgres_es::{default_postgress_pool, PostgresEventRepository, PostgresViewRepository};
 use shared_kernel::view_repository::DynViewRepository;
-use sqlx::Pool;
+use sqlx::{Pool, Row};
 use std::sync::Arc;
 
 impl<A> AggregateHandler<A, PersistedEventStore<PostgresEventRepository, A>>
@@ -31,6 +32,32 @@ impl Postgres {
         Self { pool }
     }
     // TODO: Run [Pool::close] during graceful shutdown to close all open connections.
+
+    pub async fn verify_events(&self) -> Result<EventVerificationReport, EventVerificationError> {
+        Ok(event_verification::verify_events(self.load_raw_events().await?))
+    }
+
+    pub async fn load_raw_events(&self) -> Result<Vec<RawStoredEvent>, EventVerificationError> {
+        let rows = sqlx::query(
+            "SELECT aggregate_type, aggregate_id, sequence, event_type, event_version, payload
+          FROM events
+          ORDER BY aggregate_type, aggregate_id, sequence",
+        )
+        .fetch_all(&self.pool)
+        .await?;
+
+        Ok(rows
+            .into_iter()
+            .map(|row| RawStoredEvent {
+                aggregate_type: row.get("aggregate_type"),
+                aggregate_id: row.get("aggregate_id"),
+                sequence: row.get("sequence"),
+                event_type: row.get("event_type"),
+                event_version: row.get("event_version"),
+                payload: row.get("payload"),
+            })
+            .collect())
+    }
 }
 
 impl CqrsComponentBuilder for Postgres {

From 41d3ba38fc87ebacec8ee917347ab0c677c82d05 Mon Sep 17 00:00:00 2001
From: Nander Stabel <nander.stabel@impierce.com>
Date: Wed, 15 Jul 2026 17:07:41 +0200
Subject: [PATCH 31/34] fix: send B2B credential offers to `/credential_offer`
 (#376)

---
 agent_api_http/src/v0/holder/mod.rs            |  3 +--
 agent_api_http/src/v0/holder/openid4vci/mod.rs | 13 ++-----------
 agent_issuance/src/offer/aggregate.rs          | 14 ++++++++++++--
 3 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/agent_api_http/src/v0/holder/mod.rs b/agent_api_http/src/v0/holder/mod.rs
index da7351a0..9c98dd90 100644
--- a/agent_api_http/src/v0/holder/mod.rs
+++ b/agent_api_http/src/v0/holder/mod.rs
@@ -39,9 +39,8 @@ pub fn router(holder_state: Arc<HolderState>) -> Router {
                 .route("/holder/offers/{offer_id}/accept", post(accept))
                 .route("/holder/offers/{offer_id}/reject", post(reject)),
         )
-        // TODO: move these behind some sort of authentication?
+        // TODO: move this behind some sort of authentication?
         .route("/credential_offer", get(openid4vci::offers_params))
-        .route("/", get(openid4vci::offers_params))
         .route(
             "/linked-verifiable-presentations/{presentation_id}",
             get(presentation_signed),
diff --git a/agent_api_http/src/v0/holder/openid4vci/mod.rs b/agent_api_http/src/v0/holder/openid4vci/mod.rs
index 98a89e82..849f17cb 100644
--- a/agent_api_http/src/v0/holder/openid4vci/mod.rs
+++ b/agent_api_http/src/v0/holder/openid4vci/mod.rs
@@ -1,5 +1,4 @@
-use crate::extractors::RequestActor;
-use crate::handlers::command_handler;
+use crate::handlers::public_command_handler;
 use agent_holder::{offer::command::OfferCommand, state::HolderState};
 use axum::{
     extract::State,
@@ -16,7 +15,6 @@ use tracing::info;
 #[axum_macros::debug_handler]
 pub(crate) async fn offers_params(
     State(state): State<Arc<HolderState>>,
-    RequestActor(actor): RequestActor,
     // TODO: Can this be changed to `StringifiedForm`?
     Form(payload): Form<serde_json::Value>,
 ) -> Result<Response, ApiError> {
@@ -45,14 +43,7 @@ pub(crate) async fn offers_params(
     };
 
     // Add the Credential Offer to the state.
-    command_handler(
-        state.authorization_checker.clone(),
-        actor.clone(),
-        &received_offer_id,
-        &state.command.offer,
-        command,
-    )
-    .await?;
+    public_command_handler(&received_offer_id, &state.command.offer, command).await?;
 
     Ok(StatusCode::OK.into_response())
 }
diff --git a/agent_issuance/src/offer/aggregate.rs b/agent_issuance/src/offer/aggregate.rs
index a47e97d9..fb61cbef 100644
--- a/agent_issuance/src/offer/aggregate.rs
+++ b/agent_issuance/src/offer/aggregate.rs
@@ -237,8 +237,18 @@ impl Aggregate for Offer {
                 match delivery_method {
                     DeliveryMethod::TargetUrl { target_url } => {
                         let client = reqwest::Client::new();
-                        let target = form_url_encoded_credential_offer
-                            .replace("openid-credential-offer://", target_url.as_str());
+
+                        // TODO: Currently, we are hardcoding the `/credential_offer` endpoint on the target URL.
+                        // According to the OpenID4VCI specification, we should instead retrieve the `credential_offer_endpoint`
+                        // from the Wallet's Client Metadata.
+                        // See: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-client-metadata
+                        let target = form_url_encoded_credential_offer.replace(
+                            "openid-credential-offer://",
+                            target_url
+                                .join("credential_offer")
+                                .map_err(InvalidCredentialOfferUriError)?
+                                .as_str(),
+                        );
 
                         info!("Sending credential offer to: {}", target);
 

From b555ee9a337d0132aac6f3b5ceb6b155ea691f30 Mon Sep 17 00:00:00 2001
From: Daniel Mader <daniel.mader@impierce.com>
Date: Wed, 15 Jul 2026 17:49:42 +0200
Subject: [PATCH 32/34] feat: use OpenTelemetry for traces, logs and metrics
 (#373)

---
 .env.example                                  |   2 +
 Cargo.lock                                    | 179 +++++----
 Cargo.toml                                    |   1 +
 agent_api_http/Cargo.toml                     |   3 +-
 agent_api_http/src/metrics.rs                 |  60 ++-
 agent_application/Cargo.toml                  |  10 +
 agent_application/docker/compose.yaml         |  30 --
 .../docker/monitoring/grafana/dashboards.yaml |   9 -
 .../grafana/dashboards/http-requests.json     | 360 ------------------
 .../monitoring/grafana/datasources.yaml       |   9 -
 .../docker/monitoring/prometheus.yml          |  19 -
 agent_application/docker/telemetry/README.md  |  29 ++
 .../docker/telemetry/compose.yaml             |  12 +
 agent_application/src/lib.rs                  |  27 +-
 agent_application/src/telemetry.rs            | 209 ++++++++++
 agent_shared/Cargo.toml                       |   1 -
 agent_shared/src/config/mod.rs                |  56 ---
 docs/README.md                                |   1 +
 docs/deployment/monitoring.md                 |   6 +-
 docs/introduction/quick-start.md              |   3 -
 docs/metrics/README.md                        |  88 +++++
 21 files changed, 508 insertions(+), 606 deletions(-)
 delete mode 100644 agent_application/docker/monitoring/grafana/dashboards.yaml
 delete mode 100644 agent_application/docker/monitoring/grafana/dashboards/http-requests.json
 delete mode 100644 agent_application/docker/monitoring/grafana/datasources.yaml
 delete mode 100644 agent_application/docker/monitoring/prometheus.yml
 create mode 100644 agent_application/docker/telemetry/README.md
 create mode 100644 agent_application/docker/telemetry/compose.yaml
 create mode 100644 agent_application/src/telemetry.rs
 create mode 100644 docs/metrics/README.md

diff --git a/.env.example b/.env.example
index 8c9e56ac..3bb89317 100644
--- a/.env.example
+++ b/.env.example
@@ -4,3 +4,5 @@ UNICORE__DEV__API_KEY="change-me-local-dev-key"
 UNICORE__LOG_FORMAT=text
 UNICORE__APPLICATION_URL="http://localhost:3033"
 UNICORE__SECRET_MANAGER__STRONGHOLD_PASSWORD="7Bs4IgCRaibbjd3of2pnoU7K"
+
+# OTEL_EXPORTER_OTLP_ENDPOINT="http://localhost:4317"
diff --git a/Cargo.lock b/Cargo.lock
index 04390690..463de133 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -96,14 +96,13 @@ dependencies = [
  "jsonschema 0.46.6",
  "jsonwebtoken",
  "lazy_static",
- "metrics",
- "metrics-exporter-prometheus",
  "mime",
  "oauth_tsl",
  "oid4vc-core",
  "oid4vc-manager",
  "oid4vci",
  "oid4vp",
+ "opentelemetry",
  "rand 0.9.4",
  "rstest",
  "sd-jwt-payload",
@@ -148,6 +147,10 @@ dependencies = [
  "axum 0.8.9",
  "chrono",
  "did_manager",
+ "opentelemetry",
+ "opentelemetry-appender-tracing",
+ "opentelemetry-otlp",
+ "opentelemetry_sdk",
  "serde",
  "serde_json",
  "serde_with 3.21.0",
@@ -155,6 +158,8 @@ dependencies = [
  "tokio",
  "tower-http 0.6.11",
  "tracing",
+ "tracing-opentelemetry",
+ "tracing-subscriber",
  "verification-authorization",
 ]
 
@@ -494,7 +499,6 @@ dependencies = [
  "time",
  "tokio",
  "tracing",
- "tracing-subscriber",
  "url",
  "utoipa",
  "wiremock",
@@ -5380,7 +5384,7 @@ checksum = "d0acd33ff0285af998aaf9b57342af478078f53492322fafc47450e09397e0e9"
 dependencies = [
  "bitmaps",
  "rand_core 0.6.4",
- "rand_xoshiro 0.6.0",
+ "rand_xoshiro",
  "sized-chunks",
  "typenum",
  "version_check",
@@ -7509,47 +7513,6 @@ dependencies = [
  "autocfg",
 ]
 
-[[package]]
-name = "metrics"
-version = "0.24.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89550ee9f79e88fef3119de263694973a8adb26c21d75322164fb8c493039fe2"
-dependencies = [
- "portable-atomic",
- "rapidhash",
-]
-
-[[package]]
-name = "metrics-exporter-prometheus"
-version = "0.17.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b166dea96003ee2531cf14833efedced545751d800f03535801d833313f8c15"
-dependencies = [
- "base64 0.22.1",
- "indexmap 2.14.0",
- "metrics",
- "metrics-util",
- "quanta",
- "thiserror 2.0.18",
-]
-
-[[package]]
-name = "metrics-util"
-version = "0.20.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96f8722f8562635f92f8ed992f26df0532266eb03d5202607c20c0d7e9745e13"
-dependencies = [
- "crossbeam-epoch",
- "crossbeam-utils",
- "hashbrown 0.16.1",
- "metrics",
- "quanta",
- "rand 0.9.4",
- "rand_xoshiro 0.7.0",
- "rapidhash",
- "sketches-ddsketch",
-]
-
 [[package]]
 name = "micromap"
 version = "0.3.0"
@@ -8778,6 +8741,92 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
+[[package]]
+name = "opentelemetry"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b84bcd6ae87133e903af7ef497404dda70c60d0ea14895fc8a5e6722754fc2a0"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "js-sys",
+ "pin-project-lite",
+ "thiserror 2.0.18",
+ "tracing",
+]
+
+[[package]]
+name = "opentelemetry-appender-tracing"
+version = "0.31.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef6a1ac5ca3accf562b8c306fa8483c85f4390f768185ab775f242f7fe8fdcc2"
+dependencies = [
+ "opentelemetry",
+ "tracing",
+ "tracing-core",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "opentelemetry-http"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7a6d09a73194e6b66df7c8f1b680f156d916a1a942abf2de06823dd02b7855d"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "http 1.4.2",
+ "opentelemetry",
+ "reqwest 0.12.28",
+]
+
+[[package]]
+name = "opentelemetry-otlp"
+version = "0.31.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f69cd6acbb9af919df949cd1ec9e5e7fdc2ef15d234b6b795aaa525cc02f71f"
+dependencies = [
+ "http 1.4.2",
+ "opentelemetry",
+ "opentelemetry-http",
+ "opentelemetry-proto",
+ "opentelemetry_sdk",
+ "prost",
+ "reqwest 0.12.28",
+ "thiserror 2.0.18",
+ "tokio",
+ "tonic",
+ "tracing",
+]
+
+[[package]]
+name = "opentelemetry-proto"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7175df06de5eaee9909d4805a3d07e28bb752c34cab57fa9cff549da596b30f"
+dependencies = [
+ "opentelemetry",
+ "opentelemetry_sdk",
+ "prost",
+ "tonic",
+ "tonic-prost",
+]
+
+[[package]]
+name = "opentelemetry_sdk"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e14ae4f5991976fd48df6d843de219ca6d31b01daaab2dad5af2badeded372bd"
+dependencies = [
+ "futures-channel",
+ "futures-executor",
+ "futures-util",
+ "opentelemetry",
+ "percent-encoding",
+ "rand 0.9.4",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "option-ext"
 version = "0.2.0"
@@ -10024,24 +10073,6 @@ dependencies = [
  "rand_core 0.6.4",
 ]
 
-[[package]]
-name = "rand_xoshiro"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f703f4665700daf5512dcca5f43afa6af89f09db47fb56be587f80636bda2d41"
-dependencies = [
- "rand_core 0.9.5",
-]
-
-[[package]]
-name = "rapidhash"
-version = "4.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e48930979c155e2f33aa36ab3119b5ee81332beb6482199a8ecd6029b80b59"
-dependencies = [
- "rustversion",
-]
-
 [[package]]
 name = "raw-cpuid"
 version = "11.6.0"
@@ -11684,12 +11715,6 @@ dependencies = [
  "typenum",
 ]
 
-[[package]]
-name = "sketches-ddsketch"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c6f73aeb92d671e0cc4dca167e59b2deb6387c375391bc99ee743f326994a2b"
-
 [[package]]
 name = "slab"
 version = "0.4.12"
@@ -13256,6 +13281,22 @@ dependencies = [
  "tracing-core",
 ]
 
+[[package]]
+name = "tracing-opentelemetry"
+version = "0.32.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ac28f2d093c6c477eaa76b23525478f38de514fa9aeb1285738d4b97a9552fc"
+dependencies = [
+ "js-sys",
+ "opentelemetry",
+ "smallvec",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+ "tracing-subscriber",
+ "web-time",
+]
+
 [[package]]
 name = "tracing-serde"
 version = "0.2.0"
diff --git a/Cargo.toml b/Cargo.toml
index f9cc51d7..ee8ad34a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -83,6 +83,7 @@ mime = { version = "0.3" }
 mongo-es = "0.4.1"
 oauth_tsl = { git = "https://github.com/impierce/oauth-token-status-list", rev = "0aa0228" }
 once_cell = { version = "1.19" }
+opentelemetry = "0.31"
 product_common = { git = "https://github.com/iotaledger/product-core", tag = "v0.8.16", package = "product_common", features = [
     "gas-station",
     "default-http-client",
diff --git a/agent_api_http/Cargo.toml b/agent_api_http/Cargo.toml
index 61cc9e3c..4fce8a17 100644
--- a/agent_api_http/Cargo.toml
+++ b/agent_api_http/Cargo.toml
@@ -33,12 +33,11 @@ identity_credential.workspace = true
 identity_did.workspace = true
 iso8601.workspace = true
 jsonschema.workspace = true
-metrics = "0.24"
-metrics-exporter-prometheus = { version = "0.17", default-features = false }
 oauth_tsl.workspace = true
 oid4vc-core.workspace = true
 oid4vci.workspace = true
 oid4vp.workspace = true
+opentelemetry.workspace = true
 rand.workspace = true
 sd-jwt.workspace = true
 serde.workspace = true
diff --git a/agent_api_http/src/metrics.rs b/agent_api_http/src/metrics.rs
index b5186e48..eef7f2f8 100644
--- a/agent_api_http/src/metrics.rs
+++ b/agent_api_http/src/metrics.rs
@@ -2,35 +2,34 @@ use axum::{
     extract::{MatchedPath, Request},
     middleware::Next,
     response::IntoResponse,
-    routing::get,
-    Router,
 };
-use metrics_exporter_prometheus::{Matcher, PrometheusBuilder, PrometheusHandle};
-use std::{future::ready, time::Instant};
-
-/// Source: https://github.com/tokio-rs/axum/blob/9ec85d69703a9065a1098bb43bd93113695d5ade/examples/prometheus-metrics/src/main.rs
-pub fn metrics() -> Router {
-    let recorder_handle = setup_metrics_recorder();
-    Router::new().route("/metrics", get(move || ready(recorder_handle.render())))
-}
-
-fn setup_metrics_recorder() -> PrometheusHandle {
-    const EXPONENTIAL_SECONDS: &[f64] = &[0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1.0, 2.5, 5.0, 10.0];
-
-    PrometheusBuilder::new()
-        .set_buckets_for_metric(
-            Matcher::Full("http_requests_duration_seconds".to_string()),
-            EXPONENTIAL_SECONDS,
-        )
-        .unwrap()
-        .install_recorder()
-        .unwrap()
+use opentelemetry::{metrics::Histogram, KeyValue};
+use std::{sync::OnceLock, time::Instant};
+
+/// Explicit bucket boundaries for the request duration histogram, following the
+/// [OpenTelemetry semantic conventions for HTTP metrics](https://opentelemetry.io/docs/specs/semconv/http/http-metrics/).
+const REQUEST_DURATION_SECONDS_BOUNDARIES: [f64; 11] = [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1.0, 2.5, 5.0, 10.0];
+
+/// The `http.server.request.duration` histogram, created lazily so that it is bound to the meter provider that
+/// is globally registered once the application is up (a no-op provider when OpenTelemetry is not enabled).
+fn request_duration() -> &'static Histogram<f64> {
+    static REQUEST_DURATION: OnceLock<Histogram<f64>> = OnceLock::new();
+
+    REQUEST_DURATION.get_or_init(|| {
+        opentelemetry::global::meter("unicore")
+            .f64_histogram("http.server.request.duration")
+            .with_unit("s")
+            .with_description("Duration of HTTP server requests.")
+            .with_boundaries(REQUEST_DURATION_SECONDS_BOUNDARIES.to_vec())
+            .build()
+    })
 }
 
-/// Source: https://github.com/tokio-rs/axum/blob/9ec85d69703a9065a1098bb43bd93113695d5ade/examples/prometheus-metrics/src/main.rs
+/// Middleware recording the [`http.server.request.duration`](https://opentelemetry.io/docs/specs/semconv/http/http-metrics/#metric-httpserverrequestduration)
+/// histogram for every request. The request count per route/method/status is derived from the histogram's count.
 pub async fn track_metrics(req: Request, next: Next) -> impl IntoResponse {
     let start = Instant::now();
-    let path = if let Some(matched_path) = req.extensions().get::<MatchedPath>() {
+    let route = if let Some(matched_path) = req.extensions().get::<MatchedPath>() {
         matched_path.as_str().to_owned()
     } else {
         req.uri().path().to_owned()
@@ -39,13 +38,12 @@ pub async fn track_metrics(req: Request, next: Next) -> impl IntoResponse {
 
     let response = next.run(req).await;
 
-    let latency = start.elapsed().as_secs_f64();
-    let status = response.status().as_u16().to_string();
-
-    let labels = [("method", method.to_string()), ("path", path), ("status", status)];
-
-    metrics::counter!("http_requests_total", &labels).increment(1);
-    metrics::histogram!("http_requests_duration_seconds", &labels).record(latency);
+    let attributes = [
+        KeyValue::new("http.request.method", method.to_string()),
+        KeyValue::new("http.route", route),
+        KeyValue::new("http.response.status_code", i64::from(response.status().as_u16())),
+    ];
+    request_duration().record(start.elapsed().as_secs_f64(), &attributes);
 
     response
 }
diff --git a/agent_application/Cargo.toml b/agent_application/Cargo.toml
index f54b4074..563524bd 100644
--- a/agent_application/Cargo.toml
+++ b/agent_application/Cargo.toml
@@ -24,6 +24,14 @@ anyhow.workspace = true
 axum.workspace = true
 chrono.workspace = true
 did_manager = { git = "https://github.com/impierce/did-manager", rev = "cbf2993" }
+opentelemetry.workspace = true
+opentelemetry-appender-tracing = "0.31"
+opentelemetry-otlp = { version = "0.31", features = [
+    "grpc-tonic",
+    "http-proto",
+    "reqwest-blocking-client",
+] }
+opentelemetry_sdk = "0.31"
 serde.workspace = true
 serde_json.workspace = true
 serde_with.workspace = true
@@ -31,3 +39,5 @@ shared-kernel.workspace = true
 tokio.workspace = true
 tower-http.workspace = true
 tracing.workspace = true
+tracing-opentelemetry = "0.32"
+tracing-subscriber.workspace = true
diff --git a/agent_application/docker/compose.yaml b/agent_application/docker/compose.yaml
index 8b5c46cf..fdd30ec9 100644
--- a/agent_application/docker/compose.yaml
+++ b/agent_application/docker/compose.yaml
@@ -27,33 +27,6 @@ services:
     depends_on:
       - cqrs-postgres-db
 
-  prometheus:
-    image: prom/prometheus
-    container_name: prometheus
-    ports:
-      - 9090:9090
-    volumes:
-      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml
-    profiles:
-      - monitoring
-
-  grafana:
-    image: grafana/grafana
-    container_name: grafana
-    ports:
-      - 3000:3000
-    environment:
-      GF_SECURITY_ADMIN_USER: admin
-      GF_SECURITY_ADMIN_PASSWORD: grafana
-    volumes:
-      - ./monitoring/grafana/datasources.yaml:/etc/grafana/provisioning/datasources/datasources.yaml
-      - ./monitoring/grafana/dashboards.yaml:/etc/grafana/provisioning/dashboards/dashboards.yaml
-      - ./monitoring/grafana/dashboards:/var/lib/grafana/dashboards
-    depends_on:
-      - prometheus
-    profiles:
-      - monitoring
-
   ssi-agent:
     build:
       context: ../..
@@ -62,15 +35,12 @@ services:
       - cqrs-postgres-db
     ports:
       - 3033:3033
-      - 9091:9091
     environment:
       UNICORE__PROFILE: development
       UNICORE__APPLICATION_URL: ${UNICORE__APPLICATION_URL}
       UNICORE__EVENT_STORE__TYPE: postgres
       UNICORE__EVENT_STORE__CONNECTION_STRING: postgresql://demo_user:demo_pass@cqrs-postgres-db:5432/demo
       UNICORE__SECRET_MANAGER__STRONGHOLD_PASSWORD: "secure_password"
-      UNICORE__METRICS__ENABLED: true
-      UNICORE__METRICS__PORT: 9091
 
     volumes:
       - ../example.config.yaml:/app/config.yaml
diff --git a/agent_application/docker/monitoring/grafana/dashboards.yaml b/agent_application/docker/monitoring/grafana/dashboards.yaml
deleted file mode 100644
index 78bc7392..00000000
--- a/agent_application/docker/monitoring/grafana/dashboards.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-apiVersion: 1
-
-providers:
-  - name: "Dashboard provider"
-    disableDeletion: true
-    updateIntervalSeconds: 10
-    allowUiUpdates: false
-    options:
-      path: /var/lib/grafana/dashboards
diff --git a/agent_application/docker/monitoring/grafana/dashboards/http-requests.json b/agent_application/docker/monitoring/grafana/dashboards/http-requests.json
deleted file mode 100644
index 2d1bf279..00000000
--- a/agent_application/docker/monitoring/grafana/dashboards/http-requests.json
+++ /dev/null
@@ -1,360 +0,0 @@
-{
-  "annotations": {
-    "list": [
-      {
-        "builtIn": 1,
-        "datasource": {
-          "type": "grafana",
-          "uid": "-- Grafana --"
-        },
-        "enable": true,
-        "hide": true,
-        "iconColor": "rgba(0, 211, 255, 1)",
-        "name": "Annotations & Alerts",
-        "type": "dashboard"
-      }
-    ]
-  },
-  "editable": true,
-  "fiscalYearStartMonth": 0,
-  "graphTooltip": 0,
-  "id": 1,
-  "links": [],
-  "panels": [
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "PBFA97CFB590B2093"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "fixedColor": "green",
-            "mode": "fixed"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 85,
-            "gradientMode": "opacity",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "smooth",
-            "lineStyle": {
-              "fill": "solid"
-            },
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "normal"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "fieldMinMax": false,
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              }
-            ]
-          },
-          "unit": "reqps"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 10,
-        "w": 12,
-        "x": 0,
-        "y": 0
-      },
-      "id": 1,
-      "options": {
-        "legend": {
-          "calcs": [],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "single",
-          "sort": "none"
-        }
-      },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "PBFA97CFB590B2093"
-          },
-          "disableTextWrap": false,
-          "editorMode": "code",
-          "exemplar": false,
-          "expr": "sum by (path) (rate(http_requests_total{status=~\"2..\"}[1m]))",
-          "fullMetaSearch": false,
-          "includeNullMetadata": false,
-          "instant": false,
-          "legendFormat": "{{method}} {{path}}",
-          "range": true,
-          "refId": "Success",
-          "useBackend": false
-        }
-      ],
-      "title": "Successful requests",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "PBFA97CFB590B2093"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "fixedColor": "red",
-            "mode": "fixed"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 85,
-            "gradientMode": "opacity",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "smooth",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "red",
-                "value": null
-              }
-            ]
-          },
-          "unit": "reqps"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 10,
-        "w": 12,
-        "x": 12,
-        "y": 0
-      },
-      "id": 2,
-      "options": {
-        "legend": {
-          "calcs": [],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "single",
-          "sort": "none"
-        }
-      },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "PBFA97CFB590B2093"
-          },
-          "editorMode": "code",
-          "expr": "sum by (path) (rate(http_requests_total{status=~\"4..\"}[1m]))",
-          "hide": false,
-          "instant": false,
-          "legendFormat": "__auto",
-          "range": true,
-          "refId": "A"
-        },
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "PBFA97CFB590B2093"
-          },
-          "editorMode": "code",
-          "expr": "sum by (path) (rate(http_requests_total{status=~\"5..\"}[1m]))",
-          "hide": false,
-          "instant": false,
-          "legendFormat": "__auto",
-          "range": true,
-          "refId": "B"
-        }
-      ],
-      "title": "Failed requests",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "PBFA97CFB590B2093"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "ms",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "opacity",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "smooth",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              },
-              {
-                "color": "red",
-                "value": 80
-              }
-            ]
-          }
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 14,
-        "w": 24,
-        "x": 0,
-        "y": 10
-      },
-      "id": 3,
-      "options": {
-        "legend": {
-          "calcs": [],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "single",
-          "sort": "none"
-        }
-      },
-      "pluginVersion": "11.4.0",
-      "targets": [
-        {
-          "editorMode": "code",
-          "expr": "histogram_quantile(\n  0.95,\n  sum by (le, path, method) (\n    rate(http_requests_duration_seconds_bucket[5m])\n  )\n) * 1000",
-          "legendFormat": "{{method}} {{path}} (p95)",
-          "range": true,
-          "refId": "p95"
-        },
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "PBFA97CFB590B2093"
-          },
-          "editorMode": "code",
-          "expr": "histogram_quantile(\n  0.99,\n  sum by (le, path, method) (\n    rate(http_requests_duration_seconds_bucket[5m])\n  )\n) * 1000",
-          "hide": false,
-          "instant": false,
-          "legendFormat": "{{method}} {{path}} (p99)",
-          "range": true,
-          "refId": "p99"
-        }
-      ],
-      "title": "Latency",
-      "type": "timeseries"
-    }
-  ],
-  "preload": false,
-  "refresh": "10s",
-  "schemaVersion": 40,
-  "tags": [],
-  "templating": {
-    "list": []
-  },
-  "time": {
-    "from": "now-6h",
-    "to": "now"
-  },
-  "timepicker": {},
-  "timezone": "browser",
-  "title": "HTTP Requests",
-  "uid": "bdmdj3cl1g4jka",
-  "version": 1,
-  "weekStart": ""
-}
diff --git a/agent_application/docker/monitoring/grafana/datasources.yaml b/agent_application/docker/monitoring/grafana/datasources.yaml
deleted file mode 100644
index bb009bb2..00000000
--- a/agent_application/docker/monitoring/grafana/datasources.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-apiVersion: 1
-
-datasources:
-  - name: Prometheus
-    type: prometheus
-    access: proxy
-    url: http://prometheus:9090
-    isDefault: true
-    editable: false
diff --git a/agent_application/docker/monitoring/prometheus.yml b/agent_application/docker/monitoring/prometheus.yml
deleted file mode 100644
index e4924e8e..00000000
--- a/agent_application/docker/monitoring/prometheus.yml
+++ /dev/null
@@ -1,19 +0,0 @@
-global:
-  scrape_interval: 15s
-  scrape_timeout: 10s
-  evaluation_interval: 15s
-alerting:
-  alertmanagers:
-    - static_configs:
-        - targets: []
-      scheme: http
-      timeout: 10s
-      api_version: v2
-scrape_configs:
-  - job_name: ssi-agent
-    scrape_interval: 5s
-    static_configs:
-      - targets:
-          - ssi-agent:9091
-          # Uncomment to scrape UniCore instance running on the host machine (macOS, Windows)
-          # - host.docker.internal:9091
diff --git a/agent_application/docker/telemetry/README.md b/agent_application/docker/telemetry/README.md
new file mode 100644
index 00000000..4b18d0ba
--- /dev/null
+++ b/agent_application/docker/telemetry/README.md
@@ -0,0 +1,29 @@
+# OpenTelemetry
+
+This Docker Compose file fires up a local OpenTelemetry test stack for traces, logs, and metrics.
+
+It uses the [Grafana LGTM all-in-one image](https://github.com/grafana/docker-otel-lgtm):
+
+- Tempo (traces)
+- Loki (logs)
+- Prometheus (metrics)
+
+It also includes a pre-provisioned Grafana UI with dashboards for all three signals.
+
+## Usage
+
+```bash
+# From the repository root:
+docker compose -f agent_application/docker/telemetry/compose.yaml up -d
+
+# From the `agent_application/docker/telemetry` folder:
+docker compose up -d
+```
+
+Set the `OTEL_EXPORTER_OTLP_ENDPOINT` environment variable to activate OpenTelemetry export in UniCore:
+
+```bash
+OTEL_EXPORTER_OTLP_ENDPOINT="http://localhost:4317"
+```
+
+Visit http://localhost:3000 (Grafana) and go to the `Explore` tab.
diff --git a/agent_application/docker/telemetry/compose.yaml b/agent_application/docker/telemetry/compose.yaml
new file mode 100644
index 00000000..e01b086e
--- /dev/null
+++ b/agent_application/docker/telemetry/compose.yaml
@@ -0,0 +1,12 @@
+name: opentelemetry
+
+services:
+  lgtm:
+    image: grafana/otel-lgtm
+    container_name: otel-lgtm
+    ports:
+      - "4317:4317"
+      - "4318:4318"
+      - "3000:3000"
+    tmpfs:
+      - /data
diff --git a/agent_application/src/lib.rs b/agent_application/src/lib.rs
index 1d6fe307..0e821bfe 100644
--- a/agent_application/src/lib.rs
+++ b/agent_application/src/lib.rs
@@ -1,7 +1,7 @@
 mod metadata;
 mod probes;
+pub mod telemetry;
 
-pub use agent_api_http::metrics::metrics;
 use agent_api_http::{app, metrics::track_metrics, ApplicationState, API_VERSION};
 use agent_authorization::services::{AuthorizationServices, OAuth2AuthorizationRequestDomainServices};
 use agent_event_publisher_http::EventPublisherHttp;
@@ -41,6 +41,13 @@ pub use agent_library::state::LibraryState;
 pub use agent_verification::state::VerificationState;
 
 pub async fn run() -> io::Result<()> {
+    // Initialize the tracing subscriber before anything else so that all subsequent log output is captured.
+    // Reading the log format triggers the configuration to be loaded first.
+    let log_format = config().log_format.clone();
+    let _telemetry_guard = telemetry::init_telemetry(&log_format);
+
+    info!("Configuration loaded successfully");
+
     let subject = Arc::new(Subject::new().await);
     let state = state(subject).await?;
 
@@ -300,13 +307,10 @@ where
     let probes_router = axum::Router::new()
         .route("/healthz", axum::routing::get(healthz))
         .route("/readyz", axum::routing::get(readyz));
-    let mut app = probes_router.merge(app);
-
-    if config().metrics.enabled {
-        app = app.route_layer(axum::middleware::from_fn(track_metrics));
-    }
+    let app = probes_router.merge(app);
 
-    app
+    // Record the OpenTelemetry HTTP request metrics (a no-op when OpenTelemetry is not enabled).
+    app.route_layer(axum::middleware::from_fn(track_metrics))
 }
 
 /// Builds the application configuration router without the API version prefix.
@@ -342,14 +346,7 @@ fn verify_persisted_events(result: Result<EventVerificationReport, EventVerifica
 async fn serve(app: axum::Router) -> io::Result<()> {
     let port = config().application_url.port().unwrap_or(3033);
 
-    let app_handle = tokio::spawn(start_server("HTTP API".to_string(), app, port));
-
-    if config().metrics.enabled {
-        let metrics_handle = tokio::spawn(start_server("Metrics".to_string(), metrics(), config().metrics.port));
-        let _ = tokio::join!(app_handle, metrics_handle);
-    } else {
-        let _ = app_handle.await;
-    }
+    start_server("HTTP API".to_string(), app, port).await;
 
     Ok(())
 }
diff --git a/agent_application/src/telemetry.rs b/agent_application/src/telemetry.rs
new file mode 100644
index 00000000..39569b92
--- /dev/null
+++ b/agent_application/src/telemetry.rs
@@ -0,0 +1,209 @@
+use agent_shared::config::LogFormat;
+use opentelemetry::trace::TracerProvider as _;
+use opentelemetry_appender_tracing::layer::OpenTelemetryTracingBridge;
+use opentelemetry_sdk::{
+    logs::SdkLoggerProvider, metrics::SdkMeterProvider, propagation::TraceContextPropagator, trace::SdkTracerProvider,
+    Resource,
+};
+use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt, EnvFilter, Layer};
+
+/// Environment variables that activate OpenTelemetry export when present.
+///
+/// Follows the [OTLP Exporter specification](https://opentelemetry.io/docs/specs/otel/protocol/exporter/): the
+/// general endpoint applies to all signals, the signal-specific ones take precedence for their respective signal.
+const OTLP_ENDPOINT_ENV_VARS: [&str; 4] = [
+    "OTEL_EXPORTER_OTLP_ENDPOINT",
+    "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT",
+    "OTEL_EXPORTER_OTLP_LOGS_ENDPOINT",
+    "OTEL_EXPORTER_OTLP_METRICS_ENDPOINT",
+];
+
+/// OTLP transport protocol, selected through the standard `OTEL_EXPORTER_OTLP_PROTOCOL` environment
+/// variables.
+#[derive(Clone, Copy)]
+enum OtlpProtocol {
+    Grpc,
+    HttpProtobuf,
+}
+
+/// The OTLP transport protocol for a signal, respecting the signal-specific
+/// `OTEL_EXPORTER_OTLP_{TRACES,LOGS,METRICS}_PROTOCOL` environment variable over the general
+/// `OTEL_EXPORTER_OTLP_PROTOCOL` (default: `grpc`).
+///
+/// # Panics
+///
+/// Panics when the configured protocol is not one of the supported values `grpc` and `http/protobuf`,
+/// since silently falling back would export to an endpoint speaking a different protocol.
+fn otlp_protocol(signal_env_var: &str) -> OtlpProtocol {
+    let value = std::env::var(signal_env_var)
+        .or_else(|_| std::env::var("OTEL_EXPORTER_OTLP_PROTOCOL"))
+        .unwrap_or_default();
+
+    match value.to_ascii_lowercase().as_str() {
+        "" | "grpc" => OtlpProtocol::Grpc,
+        "http/protobuf" => OtlpProtocol::HttpProtobuf,
+        other => panic!("Unsupported OTLP protocol `{other}`, expected `grpc` or `http/protobuf`"),
+    }
+}
+
+/// Guard that shuts down the OpenTelemetry providers (flushing any pending export batches) when dropped.
+#[derive(Default)]
+pub struct TelemetryGuard {
+    tracer_provider: Option<SdkTracerProvider>,
+    logger_provider: Option<SdkLoggerProvider>,
+    meter_provider: Option<SdkMeterProvider>,
+}
+
+impl Drop for TelemetryGuard {
+    fn drop(&mut self) {
+        if let Some(tracer_provider) = self.tracer_provider.take() {
+            if let Err(error) = tracer_provider.shutdown() {
+                eprintln!("Failed to shut down OpenTelemetry tracer provider: {error}");
+            }
+        }
+        if let Some(logger_provider) = self.logger_provider.take() {
+            if let Err(error) = logger_provider.shutdown() {
+                eprintln!("Failed to shut down OpenTelemetry logger provider: {error}");
+            }
+        }
+        if let Some(meter_provider) = self.meter_provider.take() {
+            if let Err(error) = meter_provider.shutdown() {
+                eprintln!("Failed to shut down OpenTelemetry meter provider: {error}");
+            }
+        }
+    }
+}
+
+/// Whether OpenTelemetry export should be activated.
+///
+/// Activation is driven purely by the standard OpenTelemetry environment variables: the presence of an OTLP
+/// endpoint enables export, [`OTEL_SDK_DISABLED`](https://opentelemetry.io/docs/specs/otel/configuration/sdk-environment-variables/)
+/// force-disables it.
+fn otel_export_enabled() -> bool {
+    let sdk_disabled = std::env::var("OTEL_SDK_DISABLED").is_ok_and(|value| value.eq_ignore_ascii_case("true"));
+
+    !sdk_disabled
+        && OTLP_ENDPOINT_ENV_VARS
+            .iter()
+            .any(|var| std::env::var(var).is_ok_and(|value| !value.is_empty()))
+}
+
+/// Whether the exporter for an individual signal is enabled, respecting the standard
+/// `OTEL_{TRACES,LOGS,METRICS}_EXPORTER` environment variables (default: `otlp`).
+///
+/// Only the `otlp` exporter is supported; any other value (e.g. `none`) disables the signal. This allows
+/// disabling individual signals when the collector does not support them (e.g. Jaeger only accepts traces).
+fn signal_enabled(exporter_env_var: &str) -> bool {
+    std::env::var(exporter_env_var).map_or(true, |value| value.eq_ignore_ascii_case("otlp"))
+}
+
+/// Resource describing this service, respecting `OTEL_SERVICE_NAME` and `OTEL_RESOURCE_ATTRIBUTES`.
+///
+/// Only when no service name is provided through the environment does the name default to `unicore`.
+fn resource() -> Resource {
+    let mut builder = Resource::builder();
+
+    if std::env::var("OTEL_SERVICE_NAME").is_err() {
+        builder = builder.with_service_name("unicore");
+    }
+
+    builder.build()
+}
+
+/// Initialize the global tracing subscriber with console output and optional OpenTelemetry export.
+///
+/// - Console logging is always enabled (JSON or text format based on `log_format`), driven by the `RUST_LOG`
+///   environment variable (defaulting to `info`).
+/// - When an OTLP endpoint is configured through the standard `OTEL_EXPORTER_OTLP_*` environment variables,
+///   traces, logs and metrics are additionally exported via OTLP, using gRPC (default) or HTTP/protobuf as
+///   selected by `OTEL_EXPORTER_OTLP_PROTOCOL`. All other standard `OTEL_*` environment variables (service
+///   name, headers, timeouts, ...) are respected by the exporters.
+///
+/// Returns a [`TelemetryGuard`] that must be held for the lifetime of the application to ensure the
+/// OpenTelemetry providers are flushed and shut down properly.
+pub fn init_telemetry(log_format: &LogFormat) -> TelemetryGuard {
+    let env_filter = EnvFilter::try_from_default_env().unwrap_or_else(|_| "info".into());
+
+    // The console format layers are mutually exclusive; `Option`s keep the subscriber composition uniform.
+    let (json_layer, text_layer) = match log_format {
+        LogFormat::Json => (Some(tracing_subscriber::fmt::layer().json()), None),
+        LogFormat::Text => (None, Some(tracing_subscriber::fmt::layer())),
+    };
+
+    let mut guard = TelemetryGuard::default();
+    let mut otel_trace_layer = None;
+    let mut otel_log_layer = None;
+
+    if otel_export_enabled() {
+        let resource = resource();
+
+        // Traces: `tracing` spans are bridged to OTel spans and exported via OTLP.
+        if signal_enabled("OTEL_TRACES_EXPORTER") {
+            let span_exporter = match otlp_protocol("OTEL_EXPORTER_OTLP_TRACES_PROTOCOL") {
+                OtlpProtocol::Grpc => opentelemetry_otlp::SpanExporter::builder().with_tonic().build(),
+                OtlpProtocol::HttpProtobuf => opentelemetry_otlp::SpanExporter::builder().with_http().build(),
+            }
+            .expect("Failed to build the OTLP span exporter");
+            let tracer_provider = SdkTracerProvider::builder()
+                .with_batch_exporter(span_exporter)
+                .with_resource(resource.clone())
+                .build();
+
+            otel_trace_layer = Some(tracing_opentelemetry::layer().with_tracer(tracer_provider.tracer("unicore")));
+            guard.tracer_provider = Some(tracer_provider);
+        }
+
+        // Logs: `tracing` events are bridged to OTel log records and exported via OTLP. Events emitted by the
+        // OTLP export pipeline itself are excluded to prevent a feedback loop on export errors.
+        if signal_enabled("OTEL_LOGS_EXPORTER") {
+            let log_exporter = match otlp_protocol("OTEL_EXPORTER_OTLP_LOGS_PROTOCOL") {
+                OtlpProtocol::Grpc => opentelemetry_otlp::LogExporter::builder().with_tonic().build(),
+                OtlpProtocol::HttpProtobuf => opentelemetry_otlp::LogExporter::builder().with_http().build(),
+            }
+            .expect("Failed to build the OTLP log exporter");
+            let logger_provider = SdkLoggerProvider::builder()
+                .with_batch_exporter(log_exporter)
+                .with_resource(resource.clone())
+                .build();
+
+            otel_log_layer = Some(OpenTelemetryTracingBridge::new(&logger_provider).with_filter(
+                tracing_subscriber::filter::filter_fn(|metadata| {
+                    let target = metadata.target();
+                    !["opentelemetry", "tonic", "h2", "tower", "hyper", "reqwest"]
+                        .iter()
+                        .any(|noisy| target.starts_with(noisy))
+                }),
+            ));
+            guard.logger_provider = Some(logger_provider);
+        }
+
+        // Metrics: the global meter provider exports via OTLP on a periodic interval.
+        if signal_enabled("OTEL_METRICS_EXPORTER") {
+            let metric_exporter = match otlp_protocol("OTEL_EXPORTER_OTLP_METRICS_PROTOCOL") {
+                OtlpProtocol::Grpc => opentelemetry_otlp::MetricExporter::builder().with_tonic().build(),
+                OtlpProtocol::HttpProtobuf => opentelemetry_otlp::MetricExporter::builder().with_http().build(),
+            }
+            .expect("Failed to build the OTLP metric exporter");
+            let meter_provider = SdkMeterProvider::builder()
+                .with_periodic_exporter(metric_exporter)
+                .with_resource(resource)
+                .build();
+
+            opentelemetry::global::set_meter_provider(meter_provider.clone());
+            guard.meter_provider = Some(meter_provider);
+        }
+
+        // Propagate trace context on outgoing requests using the W3C `traceparent` header.
+        opentelemetry::global::set_text_map_propagator(TraceContextPropagator::new());
+    }
+
+    tracing_subscriber::registry()
+        .with(env_filter)
+        .with(json_layer)
+        .with(text_layer)
+        .with(otel_trace_layer)
+        .with(otel_log_layer)
+        .init();
+
+    guard
+}
diff --git a/agent_shared/Cargo.toml b/agent_shared/Cargo.toml
index fccba331..54b9487c 100644
--- a/agent_shared/Cargo.toml
+++ b/agent_shared/Cargo.toml
@@ -36,7 +36,6 @@ temp-env = "0.3"
 thiserror.workspace = true
 time = { version = "0.3" }
 tracing.workspace = true
-tracing-subscriber.workspace = true
 url.workspace = true
 utoipa.workspace = true
 
diff --git a/agent_shared/src/config/mod.rs b/agent_shared/src/config/mod.rs
index 5308862e..f277c0af 100644
--- a/agent_shared/src/config/mod.rs
+++ b/agent_shared/src/config/mod.rs
@@ -51,34 +51,6 @@ pub static CONFIG: Lazy<RwLock<ApplicationConfiguration>> = Lazy::new(|| {
             // Fail fast when the configuration is not suitable for the current application profile.
             .unwrap_or_else(|e| panic!("{e}"));
 
-    #[cfg(not(feature = "test_utils"))]
-    {
-        use tracing::{debug, info};
-        use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
-
-        let tracing_subscriber = tracing_subscriber::registry()
-            // Set the default logging level to `info`, equivalent to `RUST_LOG=info`
-            .with(tracing_subscriber::EnvFilter::try_from_default_env().unwrap_or_else(|_| "info".into()));
-
-        // We use TestWriter to ensure that `cargo test` can capture the logs.
-        // In a normal `cargo run` scenario, this falls back to standard stdout.
-        match application_configuration.log_format {
-            LogFormat::Json => tracing_subscriber
-                .with(
-                    tracing_subscriber::fmt::layer()
-                        .json()
-                        .with_writer(tracing_subscriber::fmt::TestWriter::new()),
-                )
-                .init(),
-            LogFormat::Text => tracing_subscriber
-                .with(tracing_subscriber::fmt::layer().with_writer(tracing_subscriber::fmt::TestWriter::new()))
-                .init(),
-        }
-
-        info!("Configuration loaded successfully");
-        debug!("{:#?}", application_configuration);
-    }
-
     RwLock::new(application_configuration)
 });
 
@@ -204,14 +176,6 @@ pub struct ApplicationConfiguration {
     pub redirect_uri: Url,
     #[config(default)]
     pub cors_enabled: bool,
-    #[config(
-        default,
-        development_default = "Metrics {
-            enabled: false,
-            port: 9090
-        }"
-    )]
-    pub metrics: Metrics,
     #[config(
         default,
         development_default = "HashMap::from(
@@ -821,22 +785,6 @@ pub enum AuthorizationRequestEvent {
     OID4VPAuthorizationResponseVerified,
 }
 
-#[derive(Debug, Deserialize, Clone, Serialize)]
-#[serde(default)]
-pub struct Metrics {
-    pub enabled: bool,
-    pub port: u16,
-}
-
-impl Default for Metrics {
-    fn default() -> Self {
-        Self {
-            enabled: true,
-            port: 9090,
-        }
-    }
-}
-
 /// All DID methods supported by UniCore
 /// ```
 /// use agent_shared::config::SupportedDidMethod;
@@ -1140,10 +1088,6 @@ mod tests {
               "ietf_oauth_token_status_list_uri": "http://localhost:3033/ietf-oauth-token-status-list",
               "redirect_uri": "http://localhost:3033/redirect",
               "cors_enabled": true,
-              "metrics": {
-                "enabled": false,
-                "port": 9090
-              },
               "did_methods": {
                 "did:jwk": {
                   "enabled": true,
diff --git a/docs/README.md b/docs/README.md
index 48bffa2a..34a309e3 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -28,4 +28,5 @@ These markdown files are used as input for generating the official documentation
 - **[Template Model](./template-model.md)** - Current template structure, reasoning, and data-model-specific behavior
 - **[Architecture Decision Records](./adr/)** - Why certain design choices were made
 - **[Deployment](./deployment/)** - Production deployment guides
+- **[Metrics](./metrics/README.md)** - OpenTelemetry metrics export and how to add new metrics
 - **[Problem Details](./problem-details/)** - Troubleshooting and error handling
diff --git a/docs/deployment/monitoring.md b/docs/deployment/monitoring.md
index 85467e84..190d1534 100644
--- a/docs/deployment/monitoring.md
+++ b/docs/deployment/monitoring.md
@@ -22,6 +22,8 @@ Although the `/version` and `/info` endpoints do not contain sensitive data, the
 
 :::
 
-<!-- ## Metrics
+## Metrics
 
-- `/metrics`: Exposes Prometheus metrics for monitoring and alerting -->
+Metrics are exported via **OpenTelemetry** (OTLP push), activated by setting the standard `OTEL_EXPORTER_OTLP_*` environment variables. There is no `/metrics` endpoint to scrape.
+
+See [Metrics](../metrics/README.md) for the available metrics, how to activate the export, and how to add new metrics.
diff --git a/docs/introduction/quick-start.md b/docs/introduction/quick-start.md
index 65f9f221..b5d67603 100644
--- a/docs/introduction/quick-start.md
+++ b/docs/introduction/quick-start.md
@@ -54,15 +54,12 @@ services:
       - mongodb
     ports:
       - 3033:3033
-      - 9091:9091
     environment:
       UNICORE__PROFILE: development
       UNICORE__APPLICATION_URL: ${UNICORE__APPLICATION_URL}
       UNICORE__EVENT_STORE__TYPE: mongodb
       UNICORE__EVENT_STORE__CONNECTION_STRING: mongodb://mongodb:27017/ssi-agent?directConnection=true&retryWrites=false&replicaSet=rs0
       UNICORE__SECRET_MANAGER__STRONGHOLD_PASSWORD: "secure_password"
-      UNICORE__METRICS__ENABLED: true
-      UNICORE__METRICS__PORT: 9091
 ```
 
 :::info
diff --git a/docs/metrics/README.md b/docs/metrics/README.md
new file mode 100644
index 00000000..eb50f1e3
--- /dev/null
+++ b/docs/metrics/README.md
@@ -0,0 +1,88 @@
+# Metrics
+
+UniCore publishes all metrics via **OpenTelemetry** (OTLP push). There is no scrape endpoint (such as `/metrics` used by Prometheus).
+
+## Activating the export
+
+OpenTelemetry export (traces, logs **and metrics**) is activated purely by the standard
+[OTLP exporter environment variables](https://opentelemetry.io/docs/specs/otel/protocol/exporter/). There are no specific `UNICORE__` configuration keys for it.
+
+```sh
+# Activates export of all three signals via OTLP (gRPC by default):
+OTEL_EXPORTER_OTLP_ENDPOINT="http://localhost:4317"
+# Optional; defaults to "grpc", set to "http/protobuf" for OTLP over HTTP:
+OTEL_EXPORTER_OTLP_PROTOCOL="grpc"
+# Optional; defaults to "unicore":
+OTEL_SERVICE_NAME="unicore"
+# Disable individual signals when the collector does not support them
+# (e.g. Jaeger only accepts traces):
+OTEL_LOGS_EXPORTER=none
+OTEL_METRICS_EXPORTER=none
+# Force-disable everything regardless of the endpoint variables:
+OTEL_SDK_DISABLED=true
+```
+
+If **none** of the `OTEL_EXPORTER_OTLP_*` endpoint variables is set, no OpenTelemetry provider is installed: the global meter provider stays a no-op, nothing is buffered or exported, and console logging behaves exactly as before.
+
+The wiring lives in `agent_application/src/telemetry.rs` (`init_telemetry`), which is called first thing in `agent_application::run()`. When active, metrics recorded through the **global OpenTelemetry meter provider** are pushed periodically to the collector by the `SdkMeterProvider`.
+
+## Published metrics
+
+| Metric                                                                                                        | Type      | Source                                              |
+| ------------------------------------------------------------------------------------------------------------- | --------- | --------------------------------------------------- |
+| `http.server.request.duration` (attributes: `http.request.method`, `http.route`, `http.response.status_code`) | histogram | `agent_api_http::metrics::track_metrics` middleware |
+
+The HTTP histogram follows the [OpenTelemetry semantic conventions](https://opentelemetry.io/docs/specs/semconv/http/http-metrics/#metric-httpserverrequestduration); the request count per route/method/status is derived from the histogram's count.
+
+## Cardinality: what makes a good metric
+
+Every distinct **combination of attribute values** on an instrument creates its own time series: it is aggregated separately in memory, exported on every push, and stored and indexed by the backend forever. The total number of combinations (the _cardinality_) is the product of the value counts of all attributes - it grows multiplicatively, and it is the primary driver of both metrics cost and query complexity. A histogram multiplies this further: each series carries one counter **per bucket**.
+
+A good metric therefore has a **small, bounded, and predictable** set of attribute values, known roughly at design time:
+
+- ✅ `http.request.method` (~9 values), `http.response.status_code` (~60, in practice ~10), `http.route` (bounded by the number of routes), `credential_format` (a handful of enum variants).
+- ❌ Anything identifier-like or unbounded: credential/offer/aggregate IDs, UUIDs, DIDs, subject or holder identifiers, session/correlation IDs, raw URL paths or query strings, timestamps, free-text error messages, anything derived from user input.
+
+Rules of thumb:
+
+- **Estimate the product before adding an attribute.** `method × route × status` for the HTTP histogram is on the order of a few hundred series. Adding a user ID with 10,000 users quickly turns it into millions.
+- **Attributes are for grouping, not for lookup.** If you would ever filter a metric down to a _single_ entity (_"What happened to credential X?"_), that question belongs to a **trace or log** which carry per-request context for free - not to a metric. Metrics answer aggregate questions (_"How many? How fast? How often?"_).
+- **Use `http.route`, never the raw path.** The `track_metrics` middleware records the matched route pattern (`/v0/credentials/{credential_id}`) instead of the concrete URL precisely to keep the value set bounded. Follow the same principle for any attribute: record the _category_, not the _instance_.
+- **Map open-ended inputs to a closed set.** Bucket error details into a small `error.type`, cap enums coming from external input to known values plus `"other"`.
+- **The SDK will defend itself, at the cost of your data.** The OpenTelemetry SDK caps the number of series per instrument (cardinality limit, default 2000); once exceeded, additional combinations are folded into a single series with the `otel.metric.overflow` attribute - your metric silently stops being attributable. Treat hitting that limit as a bug in the metric's design, not something to raise the limit for.
+
+## Adding a new metric: step by step
+
+### 1. Create an instrument from the global meter
+
+Always resolve the meter through `opentelemetry::global::meter(...)`. This decouples the recording site from the initialization: when OpenTelemetry is not activated, the global provider is a no-op and recording is essentially free. There is no separate registration step - building the instrument defines the metric.
+
+```rust
+use opentelemetry::KeyValue;
+
+let counter = opentelemetry::global::meter("unicore")
+    .u64_counter("offers_created")
+    .with_description("The number of credential offers created.")
+    .build();
+```
+
+Available instrument kinds on the meter: `u64_counter`, `f64_histogram`, `u64_gauge`, `i64_up_down_counter`, and their observable (callback-based) variants.
+
+Naming: use lowercase dot-separated names and check the [semantic conventions](https://opentelemetry.io/docs/specs/semconv/) first. If a convention exists for what you are measuring (as it does for HTTP), use its metric name, unit, and attribute names so that common off-the-shelf dashboards work automatically.
+
+### 2. Record values
+
+```rust
+counter.add(1, &[KeyValue::new("credential_format", "sd_jwt")]);
+```
+
+- Recording is synchronous and in-memory; the periodic exporter pushes the aggregated state to the collector in the background.
+- Keep the attribute value set small and bounded — see [Cardinality](#cardinality-what-makes-a-good-metric) before adding any attribute.
+- For histograms, set explicit buckets with `.with_boundaries(...)` where the defaults do not fit - see `agent_api_http/src/metrics.rs`.
+- If the same instrument is recorded on a hot path, build it once and cache it (e.g. in a `OnceLock`, as `track_metrics` does) instead of rebuilding it on every call. Make sure the first access happens **after** startup so the cached instrument is bound to the real meter provider, not the no-op default.
+
+### 3. Verify locally
+
+Spin up the local all-in-one OTel stack (OTel Collector, Tempo, Loki, Prometheus, and a Grafana UI behind one OTLP endpoint) from [`agent_application/docker/telemetry/compose.yaml`](../../agent_application/docker/telemetry/compose.yaml):
+
+Then exercise the code path that records your metric and check it in Grafana (`http://localhost:3000`) under **Explore → Prometheus**.

From b3d0688573d57f9131e17d5f42b653944a355673 Mon Sep 17 00:00:00 2001
From: Daniel Mader <daniel.mader@impierce.com>
Date: Thu, 16 Jul 2026 15:54:45 +0200
Subject: [PATCH 33/34] fix: use `jwt_vc_json` for B2B credentials (#378)

Co-authored-by: Nander Stabel <nander.stabel@impierce.com>
---
 .../credential_configuration_projection.rs    | 23 +++++++++++++++----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/agent_issuance/src/application/credential_configuration_projection.rs b/agent_issuance/src/application/credential_configuration_projection.rs
index d7f69551..c3f7a39c 100644
--- a/agent_issuance/src/application/credential_configuration_projection.rs
+++ b/agent_issuance/src/application/credential_configuration_projection.rs
@@ -1,6 +1,6 @@
 use crate::server_config::command::ServerConfigCommand;
 use crate::state::{IssuanceState, SERVER_CONFIG_ID};
-use agent_library::template::aggregate::{DataModel, PropertyAttribute, Template};
+use agent_library::template::aggregate::{DataModel, HolderType, PropertyAttribute, Template};
 use agent_library::template::views::TemplateView;
 use agent_shared::config::CredentialConfiguration;
 use agent_shared::handlers::{command_handler, public_query_handler};
@@ -117,6 +117,7 @@ impl CredentialConfigurationProjection {
 fn credential_configuration_from_template(template: &Template) -> CredentialConfiguration {
     let format = match template.data_model {
         DataModel::W3CVcDataModelV1_1 => "jwt_vc_json",
+        _ if template.holder_type == HolderType::Organization => "jwt_vc_json",
         _ => "vc+sd-jwt",
     }
     .to_string();
@@ -296,15 +297,21 @@ impl Query<Template> for CredentialConfigurationProjection {
                 // On creation we have the full template state in the event itself.
                 TemplateCreated {
                     template_id,
+                    source_template_id,
                     title,
                     display,
                     data_model,
-                    r#type,
+                    holder_type,
+                    modified_at,
+                    tags,
                     status,
+                    visibility,
+                    credential_expiration,
+                    description,
+                    r#type,
                     schema,
                     schema_properties_attributes,
                     holder_authorization,
-                    ..
                 } => {
                     // Only published templates have a credential configuration.
                     if *status != Status::Published {
@@ -313,15 +320,21 @@ impl Query<Template> for CredentialConfigurationProjection {
 
                     let template = Template {
                         template_id: template_id.clone(),
+                        source_template_id: source_template_id.clone(),
                         title: title.clone(),
                         display: *display.clone(),
                         data_model: data_model.clone(),
-                        r#type: r#type.clone(),
+                        holder_type: holder_type.clone(),
+                        modified_at: Some(modified_at.clone()),
+                        tags: tags.clone(),
                         status: status.clone(),
+                        visibility: visibility.clone(),
+                        credential_expiration: credential_expiration.clone(),
+                        description: description.clone(),
+                        r#type: r#type.clone(),
                         schema: schema.clone(),
                         schema_properties_attributes: schema_properties_attributes.clone(),
                         holder_authorization: holder_authorization.clone(),
-                        ..Default::default()
                     };
 
                     let credential_configuration = credential_configuration_from_template(&template);

From 7c820091f12a854d25716a597141eeb1ab82d05d Mon Sep 17 00:00:00 2001
From: Floris Hafkenscheid
 <120176014+florishafkenscheid@users.noreply.github.com>
Date: Mon, 20 Jul 2026 11:27:41 +0200
Subject: [PATCH 34/34] feat: verify external events on startup (#379)

---
 agent_api_http/src/lib.rs                 |   6 +-
 agent_application/src/lib.rs              | 111 ++++++--
 agent_application/src/probes/readiness.rs |  46 +++-
 agent_store/src/event_verification.rs     | 297 ++++++++++++++--------
 agent_store/src/mongodb.rs                |  15 +-
 agent_store/src/postgres.rs               |  15 +-
 6 files changed, 341 insertions(+), 149 deletions(-)

diff --git a/agent_api_http/src/lib.rs b/agent_api_http/src/lib.rs
index a6d099af..c96f37ff 100644
--- a/agent_api_http/src/lib.rs
+++ b/agent_api_http/src/lib.rs
@@ -35,7 +35,7 @@ pub const API_VERSION: &str = "/v0";
 pub const DOCUMENTATION_URL: &str = "https://beta.docs.impierce.com/unicore/";
 
 #[derive(Default)]
-pub struct ApplicationState {
+pub struct ApiState {
     pub identity_state: Option<Arc<IdentityState>>,
     pub library_state: Option<Arc<LibraryState>>,
     pub authorization_state: Option<Arc<AuthorizationState>>,
@@ -51,14 +51,14 @@ pub struct ApplicationState {
 /// When the configured application URL includes a non-root base path, the
 /// router is nested under that path.
 pub fn app<E>(
-    ApplicationState {
+    ApiState {
         identity_state,
         library_state,
         authorization_state,
         issuance_state,
         holder_state,
         verification_state,
-    }: ApplicationState,
+    }: ApiState,
     actor_extractor: Arc<E>,
 ) -> Router
 where
diff --git a/agent_application/src/lib.rs b/agent_application/src/lib.rs
index 0e821bfe..f7f4ea60 100644
--- a/agent_application/src/lib.rs
+++ b/agent_application/src/lib.rs
@@ -2,7 +2,7 @@ mod metadata;
 mod probes;
 pub mod telemetry;
 
-use agent_api_http::{app, metrics::track_metrics, ApplicationState, API_VERSION};
+use agent_api_http::{app, metrics::track_metrics, ApiState, API_VERSION};
 use agent_authorization::services::{AuthorizationServices, OAuth2AuthorizationRequestDomainServices};
 use agent_event_publisher_http::EventPublisherHttp;
 use agent_event_publisher_nats::EventPublisherNats;
@@ -13,6 +13,7 @@ use agent_issuance::{
 };
 use agent_secret_manager::{service::Service as _, subject::Subject};
 use agent_shared::config::{config, EventStoreType};
+pub use agent_store::event_verification::{core_event_verifiers, EventVerifier};
 use agent_store::{
     event_verification::{EventVerificationError, EventVerificationReport},
     in_memory::InMemory,
@@ -23,7 +24,7 @@ use agent_store::{
 use agent_verification::services::VerificationServices;
 use probes::{
     liveness::healthz,
-    readiness::{mark_ready, readyz},
+    readiness::{readyz, ReadinessState},
 };
 use shared_kernel::authorization::{ActorExtractor, NoActorExtractor};
 use std::sync::Arc;
@@ -40,6 +41,52 @@ pub use agent_issuance::state::{IssuanceState, SERVER_CONFIG_ID};
 pub use agent_library::state::LibraryState;
 pub use agent_verification::state::VerificationState;
 
+pub struct ApplicationState {
+    pub api: ApiState,
+    pub event_verification: EventVerification,
+    readiness: ReadinessState,
+}
+
+impl ApplicationState {
+    pub async fn verify_persisted_events(&self) {
+        verify_persisted_events(self.event_verification.verify_events().await, &self.readiness);
+    }
+
+    pub async fn verify_persisted_events_with(&self, verifiers: &[EventVerifier]) {
+        verify_persisted_events(
+            self.event_verification.verify_events_with(verifiers).await,
+            &self.readiness,
+        );
+    }
+
+    pub fn mark_ready(&self) {
+        self.readiness.mark_ready();
+    }
+}
+
+pub enum EventVerification {
+    Postgres(Postgres),
+    MongoDb(MongoDB),
+    InMemory,
+}
+
+impl EventVerification {
+    pub async fn verify_events(&self) -> Result<EventVerificationReport, EventVerificationError> {
+        self.verify_events_with(core_event_verifiers()).await
+    }
+
+    pub async fn verify_events_with(
+        &self,
+        verifiers: &[EventVerifier],
+    ) -> Result<EventVerificationReport, EventVerificationError> {
+        match self {
+            Self::Postgres(store) => store.verify_events_with(verifiers).await,
+            Self::MongoDb(store) => store.verify_events_with(verifiers).await,
+            Self::InMemory => Ok(EventVerificationReport::default()),
+        }
+    }
+}
+
 pub async fn run() -> io::Result<()> {
     // Initialize the tracing subscriber before anything else so that all subsequent log output is captured.
     // Reading the log format triggers the configuration to be loaded first.
@@ -50,6 +97,7 @@ pub async fn run() -> io::Result<()> {
 
     let subject = Arc::new(Subject::new().await);
     let state = state(subject).await?;
+    state.verify_persisted_events().await;
 
     serve(router(state)).await
 }
@@ -98,6 +146,8 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
         .collect();
 
     let event_store_type = config().event_store.type_.clone();
+    let event_verification;
+    let readiness = ReadinessState::default();
 
     // TODO: Refactor this to reduce code duplication.
     let (identity_state, library_state, authorization_state, issuance_state, holder_state, verification_state) =
@@ -105,8 +155,6 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
             EventStoreType::Postgres => {
                 let builder = Postgres::new().await;
 
-                verify_persisted_events(builder.verify_events().await);
-
                 let issuance_state =
                     Arc::new(agent_store::issuance_state(&builder, issuance_services, issuance_event_publishers).await);
 
@@ -135,7 +183,7 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
                     Box::new(VerificationAuthorizationAdapter::new(verification_state.clone())),
                 );
 
-                (
+                let states = (
                     Arc::new(agent_store::identity_state(&builder, identity_services, identity_event_publishers).await),
                     library_state,
                     Arc::new(
@@ -150,13 +198,13 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
                     issuance_state,
                     Arc::new(agent_store::holder_state(&builder, holder_services, holder_event_publishers).await),
                     verification_state,
-                )
+                );
+                event_verification = EventVerification::Postgres(builder);
+                states
             }
             EventStoreType::MongoDb => {
                 let builder = MongoDB::new().await;
 
-                verify_persisted_events(builder.verify_events().await);
-
                 let issuance_state =
                     Arc::new(agent_store::issuance_state(&builder, issuance_services, issuance_event_publishers).await);
 
@@ -185,7 +233,7 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
                     Box::new(VerificationAuthorizationAdapter::new(verification_state.clone())),
                 );
 
-                (
+                let states = (
                     Arc::new(agent_store::identity_state(&builder, identity_services, identity_event_publishers).await),
                     library_state,
                     Arc::new(
@@ -200,11 +248,11 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
                     issuance_state,
                     Arc::new(agent_store::holder_state(&builder, holder_services, holder_event_publishers).await),
                     verification_state,
-                )
+                );
+                event_verification = EventVerification::MongoDb(builder);
+                states
             }
             EventStoreType::InMemory => {
-                mark_ready();
-
                 let issuance_state = Arc::new(
                     agent_store::issuance_state(&InMemory, issuance_services, issuance_event_publishers).await,
                 );
@@ -234,7 +282,7 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
                     Box::new(VerificationAuthorizationAdapter::new(verification_state.clone())),
                 );
 
-                (
+                let states = (
                     Arc::new(
                         agent_store::identity_state(&InMemory, identity_services, identity_event_publishers).await,
                     ),
@@ -251,7 +299,9 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
                     issuance_state,
                     Arc::new(agent_store::holder_state(&InMemory, holder_services, holder_event_publishers).await),
                     verification_state,
-                )
+                );
+                event_verification = EventVerification::InMemory;
+                states
             }
         };
 
@@ -268,12 +318,16 @@ pub async fn state(subject: Arc<Subject>) -> io::Result<ApplicationState> {
     agent_issuance::state::initialize(&issuance_state).await.unwrap();
 
     Ok(ApplicationState {
-        identity_state: Some(identity_state),
-        library_state: Some(library_state),
-        authorization_state: Some(authorization_state),
-        issuance_state: Some(issuance_state),
-        holder_state: Some(holder_state),
-        verification_state: Some(verification_state),
+        api: ApiState {
+            identity_state: Some(identity_state),
+            library_state: Some(library_state),
+            authorization_state: Some(authorization_state),
+            issuance_state: Some(issuance_state),
+            holder_state: Some(holder_state),
+            verification_state: Some(verification_state),
+        },
+        event_verification,
+        readiness,
     })
 }
 
@@ -288,8 +342,13 @@ pub fn router_with_actor_extractor<E>(application_state: ApplicationState, actor
 where
     E: ActorExtractor,
 {
+    let ApplicationState {
+        api,
+        event_verification: _,
+        readiness,
+    } = application_state;
     let actor_extractor = Arc::new(actor_extractor);
-    let app = app(application_state, actor_extractor);
+    let app = app(api, actor_extractor);
 
     let metadata_state = metadata::MetadataState {
         startup_instant: std::time::Instant::now(),
@@ -306,7 +365,8 @@ where
     // Add probes routes
     let probes_router = axum::Router::new()
         .route("/healthz", axum::routing::get(healthz))
-        .route("/readyz", axum::routing::get(readyz));
+        .route("/readyz", axum::routing::get(readyz))
+        .with_state(readiness);
     let app = probes_router.merge(app);
 
     // Record the OpenTelemetry HTTP request metrics (a no-op when OpenTelemetry is not enabled).
@@ -318,11 +378,14 @@ pub fn configuration_router() -> axum::Router {
     axum::Router::new().route("/configuration", axum::routing::get(metadata::config::configuration))
 }
 
-fn verify_persisted_events(result: Result<EventVerificationReport, EventVerificationError>) {
+fn verify_persisted_events(
+    result: Result<EventVerificationReport, EventVerificationError>,
+    readiness: &ReadinessState,
+) {
     match result {
         Ok(report) if report.is_compatible() => {
             info!(checked = report.checked, "Persisted event verification succeeded");
-            mark_ready();
+            readiness.mark_ready();
         }
         Ok(report) => {
             for event in report.incompatible {
diff --git a/agent_application/src/probes/readiness.rs b/agent_application/src/probes/readiness.rs
index fa36a446..89d95d7b 100644
--- a/agent_application/src/probes/readiness.rs
+++ b/agent_application/src/probes/readiness.rs
@@ -1,17 +1,49 @@
-use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{
+    atomic::{AtomicBool, Ordering},
+    Arc,
+};
 
-use axum::{http::StatusCode, response::IntoResponse};
+use axum::{extract::State, http::StatusCode, response::IntoResponse};
 
-static READY: AtomicBool = AtomicBool::new(false);
+#[derive(Clone, Default)]
+pub struct ReadinessState {
+    ready: Arc<AtomicBool>,
+}
+
+impl ReadinessState {
+    pub fn mark_ready(&self) {
+        self.ready.store(true, Ordering::Release);
+    }
 
-pub fn mark_ready() {
-    READY.store(true, Ordering::Release);
+    fn is_ready(&self) -> bool {
+        self.ready.load(Ordering::Acquire)
+    }
 }
 
-pub async fn readyz() -> impl IntoResponse {
-    if READY.load(Ordering::Acquire) {
+pub async fn readyz(State(readiness): State<ReadinessState>) -> impl IntoResponse {
+    if readiness.is_ready() {
         StatusCode::OK
     } else {
         StatusCode::SERVICE_UNAVAILABLE
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn readiness_probe_reflects_shared_state() {
+        let readiness = ReadinessState::default();
+        let clone = readiness.clone();
+
+        assert_eq!(
+            readyz(State(clone.clone())).await.into_response().status(),
+            StatusCode::SERVICE_UNAVAILABLE
+        );
+
+        readiness.mark_ready();
+
+        assert_eq!(readyz(State(clone)).await.into_response().status(), StatusCode::OK);
+    }
+}
diff --git a/agent_store/src/event_verification.rs b/agent_store/src/event_verification.rs
index 715d1aa5..23353d8e 100644
--- a/agent_store/src/event_verification.rs
+++ b/agent_store/src/event_verification.rs
@@ -1,33 +1,22 @@
 use agent_authorization::domain::{
-    access_token::{aggregate::AccessToken, event::AccessTokenEvent},
-    authorization_code::{aggregate::AuthorizationCode, event::AuthorizationCodeEvent},
-    client::{aggregate::Client, event::ClientEvent},
-    oauth2_authorization_request::{aggregate::OAuth2AuthorizationRequest, event::OAuth2AuthorizationRequestEvent},
+    access_token::aggregate::AccessToken, authorization_code::aggregate::AuthorizationCode, client::aggregate::Client,
+    oauth2_authorization_request::aggregate::OAuth2AuthorizationRequest,
 };
 use agent_holder::{
-    credential::{aggregate::Credential as HolderCredential, event::CredentialEvent as HolderCredentialEvent},
-    offer::{aggregate::Offer as ReceivedOffer, event::OfferEvent as ReceivedOfferEvent},
-    presentation::{aggregate::Presentation, event::PresentationEvent},
+    credential::aggregate::Credential as HolderCredential, offer::aggregate::Offer as ReceivedOffer,
+    presentation::aggregate::Presentation,
 };
 use agent_identity::{
-    connection::{aggregate::Connection, event::ConnectionEvent},
-    document::{aggregate::Document, event::DocumentEvent},
-    profile::{aggregate::Profile, event::ProfileEvent},
-    service::{aggregate::Service, event::ServiceEvent},
+    connection::aggregate::Connection, document::aggregate::Document, profile::aggregate::Profile,
+    service::aggregate::Service,
 };
 use agent_issuance::{
-    credential::{aggregate::Credential as IssuanceCredential, event::CredentialEvent as IssuanceCredentialEvent},
-    nonce::{aggregate::Nonce, event::NonceEvent},
-    offer::{aggregate::Offer as IssuanceOffer, event::OfferEvent as IssuanceOfferEvent},
-    public_offer::{aggregate::PublicOffer, event::PublicOfferEvent},
-    server_config::{aggregate::ServerConfig, event::ServerConfigEvent},
-    status_list::{aggregate::StatusListAggregate, event::StatusListEvent},
+    credential::aggregate::Credential as IssuanceCredential, nonce::aggregate::Nonce,
+    offer::aggregate::Offer as IssuanceOffer, public_offer::aggregate::PublicOffer,
+    server_config::aggregate::ServerConfig, status_list::aggregate::StatusListAggregate,
 };
-use agent_library::{
-    catalog::{aggregate::Catalog, event::CatalogEvent},
-    template::{aggregate::Template, event::TemplateEvent},
-};
-use agent_verification::authorization_request::{aggregate::AuthorizationRequest, event::AuthorizationRequestEvent};
+use agent_library::{catalog::aggregate::Catalog, template::aggregate::Template};
+use agent_verification::authorization_request::aggregate::AuthorizationRequest;
 use cqrs_es::{Aggregate, DomainEvent};
 use serde::de::DeserializeOwned;
 
@@ -75,27 +64,60 @@ pub enum EventVerificationError {
     MongoDbDocument(#[from] mongodb::bson::de::Error),
 }
 
-type VerifyPayload = fn(&RawStoredEvent) -> Result<(), String>;
+pub type VerifyPayload = fn(&RawStoredEvent) -> Result<(), String>;
 
-struct EventVerifier {
+#[derive(Clone, Copy)]
+pub struct EventVerifier {
     aggregate_type: &'static str,
     verify: VerifyPayload,
 }
 
+impl EventVerifier {
+    pub const fn new(aggregate_type: &'static str, verify: VerifyPayload) -> Self {
+        Self { aggregate_type, verify }
+    }
+
+    pub fn for_aggregate<A>() -> Self
+    where
+        A: Aggregate,
+        A::Event: DeserializeOwned,
+    {
+        Self {
+            aggregate_type: A::TYPE,
+            verify: verify_aggregate_event::<A::Event>,
+        }
+    }
+
+    pub fn aggregate_type(&self) -> &'static str {
+        self.aggregate_type
+    }
+
+    fn verify(&self, event: &RawStoredEvent) -> Result<(), String> {
+        (self.verify)(event)
+    }
+}
+
 pub fn verify_events(events: impl IntoIterator<Item = RawStoredEvent>) -> EventVerificationReport {
+    verify_events_with(events, core_event_verifiers())
+}
+
+pub fn verify_events_with(
+    events: impl IntoIterator<Item = RawStoredEvent>,
+    verifiers: &[EventVerifier],
+) -> EventVerificationReport {
     let mut report = EventVerificationReport::default();
 
     for event in events {
         report.checked += 1;
 
-        let Some(verifier) = event_verifier_for(&event.aggregate_type) else {
+        let Some(verifier) = event_verifier_for(verifiers, &event.aggregate_type) else {
             report
                 .incompatible
                 .push(incompatible_event(event, "unknown aggregate type"));
             continue;
         };
 
-        if let Err(reason) = (verifier.verify)(&event) {
+        if let Err(reason) = verifier.verify(&event) {
             report.incompatible.push(incompatible_event(event, reason));
         }
     }
@@ -103,8 +125,8 @@ pub fn verify_events(events: impl IntoIterator<Item = RawStoredEvent>) -> EventV
     report
 }
 
-fn event_verifier_for(aggregate_type: &str) -> Option<&'static EventVerifier> {
-    event_verifiers()
+fn event_verifier_for<'a>(verifiers: &'a [EventVerifier], aggregate_type: &str) -> Option<&'a EventVerifier> {
+    verifiers
         .iter()
         .find(|verifier| verifier.aggregate_type == aggregate_type)
 }
@@ -145,87 +167,140 @@ where
     Ok(())
 }
 
-fn event_verifiers() -> &'static [EventVerifier] {
-    &[
-        EventVerifier {
-            aggregate_type: AccessToken::TYPE,
-            verify: verify_aggregate_event::<AccessTokenEvent>,
-        },
-        EventVerifier {
-            aggregate_type: AuthorizationCode::TYPE,
-            verify: verify_aggregate_event::<AuthorizationCodeEvent>,
-        },
-        EventVerifier {
-            aggregate_type: Client::TYPE,
-            verify: verify_aggregate_event::<ClientEvent>,
-        },
-        EventVerifier {
-            aggregate_type: OAuth2AuthorizationRequest::TYPE,
-            verify: verify_aggregate_event::<OAuth2AuthorizationRequestEvent>,
-        },
-        EventVerifier {
-            aggregate_type: Connection::TYPE,
-            verify: verify_aggregate_event::<ConnectionEvent>,
-        },
-        EventVerifier {
-            aggregate_type: Document::TYPE,
-            verify: verify_aggregate_event::<DocumentEvent>,
-        },
-        EventVerifier {
-            aggregate_type: Profile::TYPE,
-            verify: verify_aggregate_event::<ProfileEvent>,
-        },
-        EventVerifier {
-            aggregate_type: Service::TYPE,
-            verify: verify_aggregate_event::<ServiceEvent>,
-        },
-        EventVerifier {
-            aggregate_type: Template::TYPE,
-            verify: verify_aggregate_event::<TemplateEvent>,
-        },
-        EventVerifier {
-            aggregate_type: Catalog::TYPE,
-            verify: verify_aggregate_event::<CatalogEvent>,
-        },
-        EventVerifier {
-            aggregate_type: ServerConfig::TYPE,
-            verify: verify_aggregate_event::<ServerConfigEvent>,
-        },
-        EventVerifier {
-            aggregate_type: IssuanceCredential::TYPE,
-            verify: verify_aggregate_event::<IssuanceCredentialEvent>,
-        },
-        EventVerifier {
-            aggregate_type: IssuanceOffer::TYPE,
-            verify: verify_aggregate_event::<IssuanceOfferEvent>,
-        },
-        EventVerifier {
-            aggregate_type: PublicOffer::TYPE,
-            verify: verify_aggregate_event::<PublicOfferEvent>,
-        },
-        EventVerifier {
-            aggregate_type: Nonce::TYPE,
-            verify: verify_aggregate_event::<NonceEvent>,
-        },
-        EventVerifier {
-            aggregate_type: StatusListAggregate::TYPE,
-            verify: verify_aggregate_event::<StatusListEvent>,
-        },
-        EventVerifier {
-            aggregate_type: HolderCredential::TYPE,
-            verify: verify_aggregate_event::<HolderCredentialEvent>,
-        },
-        EventVerifier {
-            aggregate_type: Presentation::TYPE,
-            verify: verify_aggregate_event::<PresentationEvent>,
-        },
-        EventVerifier {
-            aggregate_type: ReceivedOffer::TYPE,
-            verify: verify_aggregate_event::<ReceivedOfferEvent>,
-        },
-        EventVerifier {
-            aggregate_type: AuthorizationRequest::TYPE,
-            verify: verify_aggregate_event::<AuthorizationRequestEvent>,
-        },
-    ]
+macro_rules! event_verifier {
+    ($aggregate:ty) => {
+        EventVerifier::new(
+            <$aggregate as Aggregate>::TYPE,
+            verify_aggregate_event::<<$aggregate as Aggregate>::Event>,
+        )
+    };
+}
+
+static CORE_EVENT_VERIFIERS: &[EventVerifier] = &[
+    event_verifier!(AccessToken),
+    event_verifier!(AuthorizationCode),
+    event_verifier!(Client),
+    event_verifier!(OAuth2AuthorizationRequest),
+    event_verifier!(Connection),
+    event_verifier!(Document),
+    event_verifier!(Profile),
+    event_verifier!(Service),
+    event_verifier!(Template),
+    event_verifier!(Catalog),
+    event_verifier!(ServerConfig),
+    event_verifier!(IssuanceCredential),
+    event_verifier!(IssuanceOffer),
+    event_verifier!(PublicOffer),
+    event_verifier!(Nonce),
+    event_verifier!(StatusListAggregate),
+    event_verifier!(HolderCredential),
+    event_verifier!(Presentation),
+    event_verifier!(ReceivedOffer),
+    event_verifier!(AuthorizationRequest),
+];
+
+pub fn core_event_verifiers() -> &'static [EventVerifier] {
+    CORE_EVENT_VERIFIERS
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{convert::Infallible, error::Error, fmt};
+
+    use cqrs_es::event_sink::EventSink;
+    use serde::{Deserialize, Serialize};
+
+    use super::*;
+
+    #[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+    enum TestEvent {
+        Created { id: String },
+    }
+
+    impl DomainEvent for TestEvent {
+        fn event_type(&self) -> String {
+            "created".to_string()
+        }
+
+        fn event_version(&self) -> String {
+            "1".to_string()
+        }
+    }
+
+    #[derive(Debug)]
+    struct TestError;
+
+    impl fmt::Display for TestError {
+        fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+            write!(f, "test error")
+        }
+    }
+
+    impl Error for TestError {}
+
+    #[derive(Default, Deserialize, Serialize)]
+    struct TestAggregate;
+
+    impl Aggregate for TestAggregate {
+        const TYPE: &'static str = "test";
+
+        type Command = Infallible;
+        type Event = TestEvent;
+        type Error = TestError;
+        type Services = ();
+
+        async fn handle(
+            &mut self,
+            command: Self::Command,
+            _service: &Self::Services,
+            _sink: &EventSink<Self>,
+        ) -> Result<(), Self::Error> {
+            match command {}
+        }
+
+        fn apply(&mut self, _event: Self::Event) {}
+    }
+
+    fn raw_event(aggregate_type: &str, payload: serde_json::Value) -> RawStoredEvent {
+        RawStoredEvent {
+            aggregate_type: aggregate_type.to_string(),
+            aggregate_id: "aggregate-id".to_string(),
+            sequence: 1,
+            event_type: "created".to_string(),
+            event_version: "1".to_string(),
+            payload,
+        }
+    }
+
+    #[test]
+    fn core_verification_reports_unknown_external_aggregate() {
+        let report = verify_events([raw_event("test", serde_json::json!({ "Created": { "id": "id" } }))]);
+
+        assert_eq!(report.checked, 1);
+        assert_eq!(report.incompatible.len(), 1);
+        assert_eq!(report.incompatible[0].reason, "unknown aggregate type");
+    }
+
+    #[test]
+    fn custom_verifier_accepts_external_aggregate() {
+        let report = verify_events_with(
+            [raw_event("test", serde_json::json!({ "Created": { "id": "id" } }))],
+            &[EventVerifier::for_aggregate::<TestAggregate>()],
+        );
+
+        assert_eq!(report.checked, 1);
+        assert!(report.is_compatible());
+    }
+
+    #[test]
+    fn custom_verifier_reports_bad_payload() {
+        let report = verify_events_with(
+            [raw_event("test", serde_json::json!({ "Created": {} }))],
+            &[EventVerifier::for_aggregate::<TestAggregate>()],
+        );
+
+        assert_eq!(report.checked, 1);
+        assert_eq!(report.incompatible.len(), 1);
+        assert!(report.incompatible[0].reason.contains("missing field"));
+    }
 }
diff --git a/agent_store/src/mongodb.rs b/agent_store/src/mongodb.rs
index 0406aaab..45c9bd69 100644
--- a/agent_store/src/mongodb.rs
+++ b/agent_store/src/mongodb.rs
@@ -1,4 +1,4 @@
-use crate::event_verification::{self, EventVerificationError, EventVerificationReport, RawStoredEvent};
+use crate::event_verification::{self, EventVerificationError, EventVerificationReport, EventVerifier, RawStoredEvent};
 use crate::{AggregateHandler, CqrsComponentBuilder};
 use agent_shared::{application_state::Command, config::config};
 use cqrs_es::{persist::PersistedEventStore, CqrsFramework};
@@ -39,7 +39,18 @@ impl MongoDB {
     // TODO: Run [Client::shutdown] during graceful shutdown to close all open connections.
 
     pub async fn verify_events(&self) -> Result<EventVerificationReport, EventVerificationError> {
-        Ok(event_verification::verify_events(self.load_raw_events().await?))
+        self.verify_events_with(event_verification::core_event_verifiers())
+            .await
+    }
+
+    pub async fn verify_events_with(
+        &self,
+        verifiers: &[EventVerifier],
+    ) -> Result<EventVerificationReport, EventVerificationError> {
+        Ok(event_verification::verify_events_with(
+            self.load_raw_events().await?,
+            verifiers,
+        ))
     }
 
     async fn load_raw_events(&self) -> Result<Vec<RawStoredEvent>, EventVerificationError> {
diff --git a/agent_store/src/postgres.rs b/agent_store/src/postgres.rs
index f9882e20..1c7d8824 100644
--- a/agent_store/src/postgres.rs
+++ b/agent_store/src/postgres.rs
@@ -1,4 +1,4 @@
-use crate::event_verification::{self, EventVerificationError, EventVerificationReport, RawStoredEvent};
+use crate::event_verification::{self, EventVerificationError, EventVerificationReport, EventVerifier, RawStoredEvent};
 use crate::{AggregateHandler, CqrsComponentBuilder};
 use agent_shared::{application_state::Command, config::config};
 use cqrs_es::persist::PersistedEventStore;
@@ -34,7 +34,18 @@ impl Postgres {
     // TODO: Run [Pool::close] during graceful shutdown to close all open connections.
 
     pub async fn verify_events(&self) -> Result<EventVerificationReport, EventVerificationError> {
-        Ok(event_verification::verify_events(self.load_raw_events().await?))
+        self.verify_events_with(event_verification::core_event_verifiers())
+            .await
+    }
+
+    pub async fn verify_events_with(
+        &self,
+        verifiers: &[EventVerifier],
+    ) -> Result<EventVerificationReport, EventVerificationError> {
+        Ok(event_verification::verify_events_with(
+            self.load_raw_events().await?,
+            verifiers,
+        ))
     }
 
     pub async fn load_raw_events(&self) -> Result<Vec<RawStoredEvent>, EventVerificationError> {