From 6c4b31d609d3b6d3510129fc2966d0b8c31e8508 Mon Sep 17 00:00:00 2001 From: Huang-Ming Huang Date: Mon, 14 Sep 2026 18:06:36 +0000 Subject: [PATCH 1/3] Fix WIRE-360 auth permission escalation Change-Id: I2628c5e916d67b31cdf9c1d1f8259e654e4ff5a1 --- contracts/sysio.msgch/sysio.msgch.wasm | Bin 157530 -> 160395 bytes .../include/sysio.system/sysio.system.hpp | 11 +- contracts/sysio.system/src/sysio.system.cpp | 8 +- contracts/sysio.system/sysio.system.wasm | Bin 202534 -> 202045 bytes .../test_contracts/sendinline/sendinline.wasm | Bin 4346 -> 4346 bytes .../tests/sysio.system_authmsg_tests.cpp | 134 ++++++++++++++++++ 6 files changed, 150 insertions(+), 3 deletions(-) create mode 100644 contracts/tests/sysio.system_authmsg_tests.cpp diff --git a/contracts/sysio.msgch/sysio.msgch.wasm b/contracts/sysio.msgch/sysio.msgch.wasm index b581f28a4f6c2d039c3f9a103e3d3b01ddea705b..e625184a3c4f59032ac298aa1827d24cbc85d885 100755 GIT binary patch delta 24903 zcmd6P33yaR_HUoMy<{af5+H;Sx|;+NA#AcEnj1D*1l$#MfEiIIh=MD!b-)M_P$L&C zWDSZ=6wqMMW?Y7#pr9yG5u-9=RK%zVK{6W0fbVze-tKf_5dZ%--}@eXxl1jlPMxhz zojSKac{h5=SJ9<8PVIZ`J9CKhlCl-fY2<0qLTk}hv@qT7doNq&j2=Y}gJL`G6>o{R z#Xj+lcvlRm5}%7PO+${aWN>n+MJyF__;Man%nD|>W}Ixj`EAEuc*e|IPA*vMFU*a zuy|l@RGZoDAJb8TVvNG$WQwEa&a`&s^v*FbZcf1@ui#v{Owr4T-ERN_o0X;z_?%6*5 zPgc)i&5gN|d#;S=$z#T-o*thYAiVCrkghnvGS zXlQ2k;`edAhFKKt(Hu@C1kfean4=ER+NR6n$*Ah{NAMUxqE(-?oByf&}35G znxpPa0IG8|Ca%Tsvex~wDUKBqir~!aD{9Pf{rw3wA(4XSaan%<%I>VFmWBpt%Joc^46yR) z_ebXGGnfC-hUr6kd2FJX*AGcfJ|l@A9CGd-8#-xd&cH@w*3L#|D8DP7Z3);{_R!FH zHjrzEr{lVF_{CIZCX84B!)zH@qe>Z*YIDPg)>K`#eMAybRoOci-9&lD0e4=u1MA@o z%c380=UK~_S~K=EuB>QO`AXx;U6Ga9j#76R=5|$MW{(<}y9-O)j1-2Q?bz-KwqVU#QNipt{$yJ68|7?q8`c&0|bn0v>6 zFMcK2vyA$g$1hnRzR}FnZ%?Fe&BRArl~rGw?V|h4)>nJ!Kv}=5?;_7kufwb9_nKwb z%%GWO#)Nq^OHR6gTA6>J(4yU@*3S3<&2t9CJoqhD+El+Aev8{n`s}hVChQ=ZQ}+0E zQw7Z}YcX*)#m@7(jcu?!t@VJpVp3O{YrZzAUm}d9TghRP(KXK>tY5wh|8>qmHyZK!DMb1A$of7IP#VZUaBm`ojZ#HkaIS2i=+W#6?zCHL8SwMphn( ztju=g*pi?bdr;w0&Zjx=R=+uOS`TyF9c==@!=B3jV_Xy}!VKKn!CWHp=f8mJAGT|aovpX>4>@X_7(KC>Azzr zt~cE=G~p2G^Fk~o{h#JbcMPO_Gk=!fY;)%#$}d}g=P0t}zq^@o_hVpP=LWv`om>E&djA2i$xfyzEqem-!VYJ%)&bL%&g1kgn4>a2K^u@Rdk~h zvPY`$;&w@@Xk#v!-P-*$87IFKQa?sH@+j;Moiu-*{RS;E%jf)w3e664ub{%RyXNXd z510$*?We_MR|ZyTwAehcpd&3QYjq!LmX>uYxQpn)vNiXQBYMa@y6_Y|Y<|0F5CpYT z;Wm1t?9;*viI$bMTfB?NEUQ}5j%c}Azch_Zv)zMT{3gML5;?i~`Q;m)<8460lfHuB z1w3lr{GdtFtbg!9T4^qR=wI}h`PYY6yH}Cdp|3V$it=cUc~{Y`wAMUaG$f@Enxh#d z&O9AYu`m&r@OxaIzOKx8WHixw^TA~)K&xcgMgjK^#>M>eif3szp1uzJ{YDqTZV3Ff zVq;w%JJs)k<#2f^*IU?6+wQU+7kb4Ozq_EHR*C{%-LV^Td97U#+G6(;!|NE7$YoUW zf?!m{7fd4 zy3$6Z$i5fa_ZsYkxW3vPzOujA=rZ$HCI>cSM-vAqD{+s<9T>rk_*&o**z#in9)U7H z>UIO*o(Iqq$6uhUdjvf=P)Ek%yT zl)+poLAOj%p?OX33pv@lfV9`sSCsSJm4!PfE6|d?0gGg@`Ze(=$rP2QeC+CT7;_kS zhpweq04q#db*1+Zvjcz_JOir44y%#@RVqLg<~^%AQH8l~)i7KSuNvFExegWFp~C7A zljlvwu0)F`g|9hzbx-s(S6|xfP?VtgKWKRn~=XrR>AtHJfG;zvm5 zRKMo+c=0!~oxeSHT+!Y(`n5bxbu?<)kBfJP$W;-;#Z~64H7Ru1-1$s~Q60@Y5Cw5+ zU(wt&${CsR@HARQOoOp9t2QT@32V=}fZ46v0;b#2$2T665if;J#@NyRb|KXAe3rL{ zVn(K&Ic`f_$LeTi@$VvKKE1a6gvuD70(dyu*VY2)Q?gJM?NbAkYCfp1%d25lF$~he zLMd81uLtB)%x&xSO!c<~74Zl1wMA?5^DQZfsMI3xJLECTUrxtT*z;Mxxoq9l9;Osi z^2EAUZ7d3i-&ivh*3N+O5xX7 z_&@{Ip325Y?WwBFv<;~Np1QZ~$an|FV5w8W$|4CWS99l(~MEb!hv6c0EATs={#*E<>ifD)M$So{GSEb$*9xL5Ol8#|ky5pcBs@rn6xpzZ* zsx-ge(3?^7SR(;WXe1Ah)Yclw<_V9aJ;^ITLcvr=E z+jvv-iTIn866dn1ooZ_wG}Tha2$@m}7&yBEA~@nw!4YLry_N!ERM9I>h(-w8c+;*rTvVQzb(d1F?{=oi|?tkcF$0bs2(6EG{V(>VZ~82%wVSJ}@; z@mym+=Oc(z;BL@hWdJP=RtB(%2B)zB#FWx78Sd1?^dZK;T51|;$!5_Sr)32PpPdQ$ zJd6Bht)Myf$@9cUKV+QzdnwG4T_wK zzdXPHwb;~QsWIxXp9qP~1S~&TwL@Z)2cZ8)RJnnFwuH`@dh7-fUgXUPlo{7Z@7V`fR zE2?=W)lFETIBaR~IU!cmxGYv2bulaA&%_F4Hr15Q#ESo-991#$RT0Ru8>46(VScJz zadBs61E%^vWCJ^f78_u{{#$IQ}fIuoaL}7Xx=weD^SCVqE>cmMN#%Aaz!zp zebG$^%rTo&5>XdP;R7+|Bf%82bWKc$O3PPbx4bzg+I(sAxUTH4hJ8277p{o0=FT2r z1nU&wPGphlx(b$KqG~anHrS0z$C~y|4W6Oq<6KqnIWUw2n>tTieFA$D*TW8%a zu=C%3>-axFy|=bzWbXQ(QICON|9nQEyjcoDB$VaKv;02ngDRnV*bkn`PiI$Ad18$n z$T+){wFHW-c22gu;~k~vH5A)T*}dT^<>^2mB79F9w%NO^Q$onUWFHc4j``QJZd7fq zEW50435*PvZHCd|%|aYo6%I4#f3{F8!IIJ3hLOfzh*f4l3k%NmSO@78~Em&RgOm?!i6h>SbY2*4^NWULG#vU+h>l9PYQ3q!^5C@ z59B<;@~gq}&OTUw4AVbyEcgaIR(Lm<-(X12HeBHB!}Y*$JtBvLch+dQdP{?OHVt6_ zW=qHbg%^e2%0pbl{8<+Nh(Kflq0C5mK)CV0B@b<3D9gHZ_Nj3|m*X%^B|R*CwPzCtUM4{1D)X~fI*W3b`Pi#H zuqRB*ZO*%!!~-eCg87G4os5krwt(fX@D{Mp#i1W%2bFEkZO(Mvj0QNE#Fh7w90j)4 zD9bpj2#PC?HeFUQ9Sf-ms9ckqwVB zw7F4cqCs86C==pUNXHrlyFzQ*SGvq+c1$^!?ObFslrnZWN>Ga#!smd=6yz0T zK>1BrXg8F1&)R6iz=Esu{y94LSNu!3&u4E>Aj7^i^f_eyT%H-&Kz?kw8K75Sug=yK z11JNFavsn?c_o*(%@kOd5Zggm4U3|`oj#32u-<6ivRii!@Nl@Gn)?-Nc{sSiKR&`? zB-N=0hvzrG>Chi1-r@%U)2~@UDi$9I5ucH(c|idf79s#VOUS4F#y3S7+{<|&0FG$O zZ{fD8E-JETB`>3%Opye`=E*cWyw(M4^yt^pJ2HAq7mTInlb6qidB#{E*yZHXC(LE9 zji8O@C$IGwgLjnHsOV8C>TUv5M1S_EBY&4sE7aLW8i%T~Kn}k<*SpZ`>Vpti0hg4z z?)Rdoke|1kSH9i}ap<|Pp9fU7zTPS8N%FNtxGG%W6d55~p-tj05ZG|c!b)}t|=(Ij+WYOLh) z1`-vkW=$qr5-yCu6O7~qw-GV((J+FT0mQsjNkca^7UG&#@K>EhXuKSAIg_X;2Ka%F zN4X4iRP8L1)v)aCQK&Q_S$ViHf@Irc@&XLC3C&7*fF_chuQirrOKR*=%WkpQZX%<8 zx%RtaYYVNd_5oXm4>=?glUBa|k@CnE(EqWCNSz46Ofg(O4Zc=M{ zKR87HC_D8*=XfeD%lLdb(N^=NFBZ`AWrM%`kf_W|svT)w_toRH&HVMNkId6wbuK$~ zq(dCNXtqC@)+Q(rRQ9?d#~!|xyN!Pza_FVzr6+gN_Ohhfd_a{ei0+`j%Vs~TiBy&N1SXi6g5ZE8u6(kn7IiSp=Gxh097rqbY5t*C2DdNEj#NiE#; z4{3IzWl1|2O1VJB)>v;egA)4A;DGM5-UBcn_oc1$T5w4}x}WHEnK*#f1Wre58Ztgq zdR~>=PS0bwt}YE*<$eWXe|QRqat zTo?cb(!zyZt}l@4%X8QR+#9)-cxQxhEysMGBkyq4m9vU{0Iw#)&wOMjIEMu*v1*~0 za`rGf!Mosy3MAi|?WlA5QJn24ktYUH>%dk*NQP^amJ+K4St}sgtO+SSYBxH=35G=x z#VZ?%3nGe_HWb%sp*%u9Dh&fUpo#++55N!EE(XTj6VbdPRE*&@KN*gT6nZUzFi>Vw z!m!zHa3Vt@!6N>Z;%A+67?K$z(*7Y-Ral1%)1&jA$e=)QKD=z$c>1l zRecT{HXnZ*z;_ldB+;EuX|cr`OpenCz}u0lP;l-MWNqOagMp3`?#fw|O1>fOU$f9z zqK#s`T7GdpT@onK;vMXUGQU^`)%PLWzU1#itfH;#n>SPI1vW_a1Marm~c9yIL$v4eijV%AJ=kr}q)(%BTzI zN_t98ynsGME?@Bc3n`Z98F^6-b*8_`={Yn3OU&CjbSv$W0}T{zmVY*AIBuwGBg+jM z-(rgf_ugK4K5Qw|a%n7Wk<)VNJ}Q(aa>>x1r4)HrJEcK;q$16z3Q<93>U1SL` zic2Gkw>K1Tj40mRP`omtxVWMCP6b-NJd`dBRBMU@f+;KP(Tz1)gus)rQMIvgU`Mh+ z8;C_dtSZDpA6dCHvJ$cbp|&Q)z9n~~Zo%kbbc>)TgLjXhSwv6D6BkhpJsxIWMVMqHYJk-TBDp*haQBd<%q40As6S6R>*FH#h7?3sZcrI#0Xtw z6t|J<28$McE=O7}J|WQbVwMV65(giLLKI;~k@PR$9W2tI#9K#;*0e$H87=z8@wWrW zomV;A!6TQ`rI0R%I$>ZZgtc5htdh8i#U)bwBh&s>+eUfZ#6dPz0<||K1Bu&_og+U0 zfaZrj0ANQp^gV>^eFNMd5gK__IEIHs?Wf^WEEVm< z>ZR5&@Z!6@4*hBfhtt?a5yW&F`xK9DKfu`DxDsn!m<>*2bK}Zw{>a*FM{&rest?|* ze)6Gfu{vy!|Gbv&rN`w}*HH(mlJ{IkJLy?D;Ck}WbMo5jX^iVFGJfdPkOUq$%13qh zmJhp|Vy{Yvjt)7;`ACNrNQZ{J!Z~*3=5H(9vVsGCIveWIDqbj*(}@kR*P&e2a+f|5 zW=iNIbE`f1Dur6G-PwjFXo@33tY~;IvEKv5+*fc6uCKtJPvl}Od`(8VQ1y_gNSViZAUMjPbuzR0UbpyTZ#RQgh+TqnPR!yAB97u&HVi-vK{rm0~>~y zDM~pwi~Ba0KZ;L5!-=NTht{v9cqMaq!+0;V_I<8^wMd(!jj< zlRr8=l6-KdG6hezDJXwTUzA&1$9KBc*orO1z+tLCZmK^TU+~K7C*#}bI*%{LYT~n- zz@Uns4&RplgzJ6IMAZjlL7hpRFelflMTw!o!3kts$PP zxWMsTJV9mb$gaR=+p_-@>P?5`=eJPH3t3%RvK2C{8r3L>++S8P_TWn;_yV<6nuaTe z$F)X&`e(|FhFB_kmCCrk(Bxj5T|Q(s2xBRBr7`#)WhC8_r@ux_6eAyn7?G*YGdHw5 z^Yqu{`oB<4PCkIxfH`_6j7s3WtBEl{v=es7!pPEVIPUmNn~~{o15N7+3xby-1RHjT zyGDo}>afL89m->*_XfIArcELDNDka#bYy+*R(lR%lv*)xn;9y8CJgHvLz^Q8zD~4+ zftg~7^kF$|3Js+L^7$#$k+#c&Q(&6kkabgNPP|1lc(aIOydme`h?4@Owm~G8f_+St z!#Ha|?y&thEMkcA(axLlfQnL#eaV+$<@P^=JpzQ)+F(Zv;hu>Pjn zx~p!HJ4(z4swx~XS{31dht&nXfK?ujj3{X-M_e^OMsB`| zx(Bw$pb20hXlj`$NRtX^s?sW!DMgrYDX`83hpkc^(sB#nge#EL_cFE?CHYk?cdEH! zJibL$_6x@%pl3DW_ZM&gAJ0`DzxvI9C~F6TkiNqzP)b=0F|`#A9|ov~s=P|ByqUTM z0Nd~)-Ts{L*s6r1eIaCk5(fbls(c0oIv6#e{M+QGT*7+C5hiQx69&iZL54jb6VDVY zoYk=*t}hG@v|F@I4urx^YNd`;Nmf^$-2p2@yMg$u5g>Xo-#02q*eK!9kBP}*3;B)= z_G6%MVFZg2I$=BmR^(bi=V*Va(l;&gh|p#&bH?C!)jn1}9Mw5Ox>5pA%5W+J#?AzA zSZP@UoJ(4C+Zd)BlI3GiXfZkfPUGb__JAcmODhC6Y@jZUx0h37g#!RU zi3m#(o{QPrX88KMr0;JKDzwon$QGLNXoY?!SY68ifYMPB_PCNggplgj%IZ8C7vPmn z#UB3GCIq(8iaL071YB8=%GrC$hh50U&uJ(#Y!L>kZB47eX`0g5YZCC9G&nG<1hz{A zQeC1vBAz_f5Oy!Zv|)fYUEU-8{l;|pAVil!`AQyjp;|fO78=u*9W^vm3lOJ$+p}-9 z)Z867V0AW@MuxhCu{;Ui|h?2}Iy(P#LQd9>V{Pis6?d{|l}@UP)z##qPujWQx2;t$y#x z*oE}A_?G1H0vbZ!$<#$uY{e(q$ODTg1<%J9@dvvyrx3(YU+l{J3h5p?CF2&;M!Eh0 zx`j>!@!U)NPGH0JAU#IE2G>8xv4~$K?hnf`57Pn=aR0;fGRV24hz8NY;G0GCtVRX$ z?&WklSoqCydYwPw^{%Ea^5Yd0*Ghf6i^C%96qyjXIQ2!r|E!>%f*WS9q=AX54e|G? z`0fU0GhR7q6@p63R?1MQ7N zCVSu>Q@2>9A#{4MIy&@4GJiFtr4$J4mmImT39FIQZY=Z%*D1;eLucfzWtK7SeN|K&O z6xU!OK*EqNUSh#_lBp!CkaUDdf;1iF-Urjs?+0i(Ffh)&Dj?3yN5a_Itu8j!hoe2K85%?rn zt$K5#^gR8f9QPFZE|eE;qBJ?QjYyKkT}8J1@+o{4yqQar_)(M0r*MjDS;a1 z%Lhv6HYl!YnfNr#`%TNAWbxAqjaQ$hVd5o{qc>tG|1F96Vkvj2-zNe=}RgY-bC zVNdG=cG8ywKirN8H6xAwJyUHF1)@uMIq@R=!0}VwhAfs7UZQqlv5*sYQmQmxvIHI< z$9Ijf1(Wop!P{P@E=rG3(Ip`|RD;kIjAihnSLq@rk7j*SFUP$`Z`u^YC-%YNuhSUS zdHHS{7{U=T^|z?4Jigl+@E?1i$mMTPVjG2QNON=!{6lj@%A z>#0puF4gWRe|nR4GcFhaxLAX__BOzg2lrB9W9xwf2uoe-_crajgFzkLPucRbw@Gi@ z4IxU^E$D>16(Sao+4o(G95!{b_tUF3nDZM$z^6+VguxXEjb}UxAHk6uwJ_INpi3N! zL!AdYyf7Wu879MpfUVY71`oYQONiFVn?E2Qt(S{GK)mXR-1h-}7rkCZ`5pQ?S$=?O zX_b88L)uM`$=L_#GTinb1W8uQQ#jC0Tm!R*Er))bHNcyvuMTE>L>kfBU{)n1QONdR z@v*Y~(?3?Wf9J<^fwKJ*=?OXM699c8xa||VK@8t0aG1hhq$1EY$bq$pEXWYS)jSe( zO^t|=)V+s&XIr8QSg=+H|MXATvtG|&?i!M8k;26e6!z1OSU*5w`mA`kvkq=XD}ID^ z-y$b`M$2iFJpLJd8rD|vtdOH~MO!I8$GZKT-0?Z}30G3R{5%6{-SrE)7>oI=FUTpV zLIw`gOZ283_!VuVJ@WWh)CY@cC|3bi^2#F=`dN`U3m5)j5xqv19ic^$B`4(Yujxhi zNu2xWwLwu0!qLB_@eRF;{iyye9mVPwhMO;z2nhjP{l+Jv`GKd85Bf1tn6e!1fZ$>|IQV8m{!KqY;L3j_L(cgTu1KX^@*_r4MdRe+A1PL*{6sgR zVE#|k#{CJ-6ZKE!x}V6TL$X&Lmb#i?aUGU)8%hFFRC=(-%+es>WBGqk;I8@wR`Fl* z^Iu@`Ka)xIIO^LkudRpsw^}Z)rzzh35Eh~HmAwU=sv9_`(Q*I>!E{KTOgKe-Ja((# z=u=P|IucC$l?Dsi9~?)*Lsvw|9zU{-9~H43lwh)ehw7nKq5AK`^$`4Hw!mU(JZ<+s zF64%%aKISv6kX-_LhLm{Kz;+yaK>g>LxBrF*q|D>0#w7P00sf@IsrO_wIzhnk8-YC zwCNYBiNN(I5gGuvhUzmL9(w?7`Lz~)CR&0PRrF%!WUrOg*%m{_2(!*Z*wpy9utL`B8LN^cA;vi?1~W;+tnffkp88C zmewP)6)QOhO?aI7T5PIn9G;0i09P)MgQ7)I@6a5X1^~x3_h})1f=QwIVdC7B>kH(s z(IPD^64N+^Da4;K=rK{29htB`qutF1WCRSV^u7}1eV%ihzP@ehGG;yietAI6Jo!S|jm#B{vPO@I_E zlKWeTt{r(64h{-C3?Cb724wj1^tDhd_5wjg7RgrfyaX|_q3<&ZA}0lXF(9+f&k-`E zkMOYa;5j>WF(ZWItBE2m>j_OASMUnsZH~DL572m{+^>rXR@W;aiTQ~l8E=?Jx@15& zfPO1cbp6eorz3^Mp0j?AIE~*QN@yuI(bK_~TZ(M*HT4`f^E8$A;Lge|OUH}H&%tg) z`ADaES*-$NH_2C9iH^Re=JO=iqq{0c_k)sJi!pFh$F>$jV(_uI)q8Dlb!&06hz^au zS;n;$ZN(x@ZXGYy26wd;=L?)BtDhv=X8k15HvUPXYFp9N$5VrZTyvgLt9$-#JafUfEwG>?=Cr zmwX)R=!%5}6c5eqCFVHhbdqF3IsoL$_n_FL*9sr&GFEzUj$$vjez{Gz4!^knL4n0x zS%8zuU|{h;R2Ew%fP*5~)zGk$!RvjHMkKC1;uoC~LqvJi9(S{1!3bsn2GcibYK3Cw z7c;x^H^UxNE123ivc0iUP<+Lx$K=+I5S-2Ot&U)yVi!u+GS{Jp>W--@-v%1EL$*i{ zv2UN%c^wIj&{oWbdgK1$qO^YtjPM;t@`8anCzlQb<{xXIg&B^TyARA;54!SFtG)>-Q|I z-7&qH8g8=2W!+_X;$nrvOYs}l$G5?JY1b4-NfZd2Q@$B zL;px6W9gO1kJ3MuW4nutX@{5=aODp2RKaScgP@V3Cg9oBL=Eq9!BT~lw-KuR9hOxN zk+VcPvT=`ap{(jITE%`E7X0H+^$>zSkqDm5pilXCw1S1bn72j2_s@gPf^YL#ZwT0D z!LEHost^k`IjWzSgP$5J?tz#ktegn!jU6geN4a+}0lfK9Wy%&bBu-#`!eIe7#(b0~Xs3xj{$q8JEBZoU*4b0z7xPs%q-2A}S>WHxWW44x!2rB5?{4c(VW(!X@;RPQaO)ax4?* zB!$pX@nX$JhbC5$L2_=%}Bh3{fYu0Ud5?qti8nPI^E&2a)7qO*<2} zBB_J81^vc=hcsVlEH4iP&4mR}#tKH+R<9Oe`yz+-7l~Jgjg4gtv%I{{G-vdVXrO>l zz9-f#A6N~`p@3sBb%$9{cepv93b~-axSXoxNBu>ImLc3ulAjF$Z0u?oJwQysqIlZ? zQHWdJ08v2s!MOv)APRh>alj7nRh9=vV%cHhgx50J$GS9t`_z-IRaBI~Vo9v6-J3Y2K-< z=2=wXVJDY>vIy5cY+zM?L~b#}U6HOqo#g@iEJx*vT>6jY0X&{7N+ABDhlm`wLQ98; zXAzkiG*o1}SHbm%n%p{6l;@ra&7TN^LhVl5G*qi}vz`mnFjqc5OteST7@gF@jXTd- zRt;0$TJ~@;EHMkJEf&OI#S#z7hHr*&#Bn*;>(7+!Q=`34Ck0{xT6O#bshG9IN8XL8QDhNCzy)wa8(eT#kOV{wvIPsN z2n>Wp&9E5^*cm~MiW(I$xQwXiWJXjR84Y7p96|oSQ}=eK6NB)7Z@%|E{pfpd-KtZk z&VEkS&HOK8KG_pfInZf*YkVUIIY&`U)l%mzWM+NMfgWeJ_#jHYnR)r(nkWYG?w)T-EfCds_6STB#oheX8bD=K zz`P>C;dl5Sea&G~99}fI7^eMNUYE7DTMbVh<#A2%MHh&j{NO4O)wuc(xB}i7fQufS zfQ9(0WnTLylJEx2n8iY8r(3S+*qLf%T|ckv*rB9-wcD4$c-FXmp?(p4$=4Nc2E_^kv8;-ST8ZuXuU7uNUo-<9t2w zTjIMUX1DHA?DELUP6P958TY6H!2>}}TtR68#47}^c{ixp#vJE!CFoJR_zl5){l9yJg4D*H|M5w>D=Pk1UHA$#cf)k#27kKroUAM7&^rI0^s{ zI25)9sgxm=wty7V0#dz**PPuY*L3L;zsudv0kR}w;O?sTy5z-yRHE19q+M8jqF%iw z^e(sD-#=46-phyg)xD z;N@Y+=~FI-g1Bt3=>bnv1XxcLgLTKp*g_Ab)zkmZSlDyGP-vslH|cjaqAI=r?NJ3S z7U_Vhh){FY^A{u&RaU)w;bf9eUvy^SQgob_!8SkFQR4Q~G;2_)JCH3LX3sdw8|;tr zxvUrUa6s@Q4vz~jA#Zi=s;r9*K~JeQ4^bN3t9Cp@?N$HlC`nGfWMsV4A0067gAn@b z9964_-)GQKnRe;FM6r+$+>@tP^cT7Ey3tqDLHY9NiS&&uUzSqU=dxUvm?PwxWy$h^ zadGrv)!cD+lly*;!(*5aNO9#fx?kRPhED|%}pX-e&z9{(T zC=Z!4s(M}Z648TIhp(O@XlB*b6Q@&rktfQ(4NB6^EGGHIq#iU=n%DM8nnh@5+9msY z1bi{(gL3S(cj4VT*WOCAT)J3}zv(71mt@@3Uh>DAuBV6P_?x?lqa-Ko z>CjI2odFx z%at`#hSJ|}H2za=_)Hx_Te3#xZ6 z75Q;^RRh~3%maq zg>Id>Tjx->EZt4*X-84{+{?)BV`QTj^>Ylwr7w5x8^|%B=?*;S^K-uaEHApvCm+5w zzkLWt#4Ir~BkncRfP0s(Rji5kVoV z9=N9sUse8xluM6PRo}aSALWqy`$Rt?z}aZCwCdse3#rX~5e8^36!N0G&erg9=sS7# z^wIRaTsXZ8HOQ*zJ?VQj$tOH$GG^q`2H9)I7&Rqz&^)>2!OLl0m2;*^ z^r%cJdY9%`eOa{Jp!u@+p-!}*YW+iav#@IWoV$q@Rdt^`f@rav{>U*ZmG_tQhdyjC z*+!351?HVcB&#+&x{GLO)olwhi5{2p7j~efa>K&zzNLhiLkuh|F0NVg3ufGk{hfxn3ZRfK`)+AKyZ+LC+8bO1gC+1Ug;R>s zxG6ptOqR<-g`Sc=Mv2S1o$C>seNl7Z`Ov@~5b1`?W2G7Bi}WIvZ9b&S<*z^(=<=7x z+E(A?FGW5O(d^%ZL;)??qD)4W-FHQ`Gr;=IP%*K;!5O}V_;T>dt=!2Bz2L3~p?7?( zx3Bx`YmI%amLHb&6^%}r_(WRKQD?v#4=4y=ya~7hBUmeM8{7h0zD>j}Q080H?f{&; zNx0vM9OE=xH{sgWerE=}$+)eI(IZlDdkAma;mQe3Dy~P6QUO?+-{CdDZi6Xj_9G8HWY>eo-eC%nAF+7UHG%_qe<+6177|$kV z0{~U<6@V&`kL+VW`!t|(8MUG-Bp`RiVEo>>Vt8I_1L}A{oi!jf;7LOWZzK@UT`n6| z^ukEr%1c|Fs+LFA+EXoE*)_F1*6T)uz$>ke0ZQo}12I{p+`F>ffNe3JRP#y(TOH#w zJncs$I73t^kLBjd81(k);K356kVs{VZF1zsF8=Bm4%ao*DFvdnrPMG&HQ}YCL@b3d zlWlgUC5}jN``-Xp;^P?8a=G_d@@fERN4Q*SDH{F8f1(z7QS3|EfywF#d$G}oz8KjK@voh1;2HiAQ(>+M@(>)oW zWya70TAFK4VCN;lTt`tQH#*(r(1x;1a_E#EgK)&G9!xk6~+^E8X#iEdk}BekYmP zEBBOl>9#(WvsKN7Qy(~KO&9P^^TJ<=NXo(ss;AQp8!w%1RLae3vWl1hp7fy{9-wP= zjFwhjD5zb{bqKT`bfFKfhg?4Q2vj8u7K~_KbPmj1ADAOHuRb@d58vxKW4VVW-X`2~ z56i+;>L-oIL6<+-#54z8@lX*x?0`#-UE7{2ut(k1z@Jw2s zteM=+XJQBy5N5`z((O;iglww0c~eNnV?C*!408hhP0WaQ*)-1z>!2n~Gda=PS9Egi zLoETewT1R!Ru~e?F0iSpcj-B~wHUUVxd0@Kot(C%n)!}6zYiAES^?V-UI#iJU0+cX-IU^_r=(8f1HZD8d%OV?{~ zQo5k$kO# zh7L(cj4)8)MX`a3wX_Q>f`K}_$wFZ*T9RVo6M;Mj54KedQ>3M_PmyoDV73ta^{icx zV_rDBT$lu-fmhI=SHRIvia7}@z#KW4fy;3&PgEbH))n7|McD9*AuPV^Q23X<;SgT0 z6*>Km6@$^EHC}K`V(~&dvi}Y*4)RJ4w%|pC3ZE9@MUBmiothU3C*p;+n|ev$Mc>wV z@n00AdPcrJ0(lN(G>s$dPqiyP{={s+Qva81;E>Q_0}R-IOC|R4O7=ypgjFJ%rNvrF z+YlQnZ8mJuY=}D%8=@jrqNp`C#GRNXpx_B;astWZ(AXjg3TD42Ng@P3QqwrLYoTPV z#ddW}le!i((e}WiNpgrL>us8pYnsHKh$e`@ms5Sq;Kt`65Q%oQ>Z9Nq_dgZuhyL4One?rGY&vq#)ZIzA? z6K%)>Rvd`@r~;aZjPXQqJBN-sMrs~V#@nr|H_&sPQQ10xXSAN#)NFUP0?vw99r-{w zB4SY+wtTg!Yhozgy}`WJLh*4HYV&&hyTLLFnA=|}^R{@QS-UiKbY39WY#%_D}i%#Ylo*jYh#Ip2~ zvCJU}G4kA+G&%Y?t~^HlaG;Y2RwVjHO4~r%i4)di{`&MwAR%!)YY2sna;YW%2%H0xCrCvnYL}$qqYX z<@Z5Xk4krhU1a0S`LAUce`hV&E+U&d*}NBG-r9(H$0wlh#Cg1BEHR^|G)Sb4WeZ%%u-!|VyDnrY>S*rm)~`@ zi+8sZ5O}iNl*hKTm$&~VzGHX>G?&5WMtF(PJhz;Dp1zm|mG`D;5Jm7bc8Xpg>a@n_ zaN-nZEIRp&`Iro~{iYca$~BvDx24~_rlz6+GbUu7G>@CIph%HOh@b*w@zi7@8^~lc zMwTd!M~(xG{yQR(?mRV-=y!6$d4QoOl5j{1LlV(_XhPd?A?FnMbPAG@hUu`+b7DT# z{;wos>d6<#C15V#aDg{ctvF_{sfMzQr`N)=}R9Rur;huaTr<+5U%^Jaur)(=6FMB!U^oZm`mxr0+luSbi!+{+(XcP* z+ZveL(V?Lk7RZfi0^c>Olib&jHb=E*>9j%5JPl^k*)w$L>jzCjhw z51QUL4N+Vr)KasniB0BBD2QX_t^|S|WZpH30M|8{BL4a)IqkK!zTzm}ceOd~pM!%8 z8Wo1Z-Ll0}`P6G&y21@`Y{C(M-fQCf_FO0Qxb^PzL9X?c%fqj=jenZC!sdz_%-7o$ z6~{pwVwq}~sX)x(=n-eCEWHe;^f|^sVcui4mSV-00)<i=T5W0Vbdki|kYG@O*6vGf2xXlzk-GSRu>?E*|XP9}q?9fCDrh`T`M2H5Y zond`wjFrE>epOK|D|wEw&#)vMvd8{`&v)2+_COC^oRIr)L$z*5Yig*|mZA=O1rfdW zg&QM!Qa{H^R%j@`HUt;LB52bC9O{5W4Zp;sOF0s5jKG37EL)PQ4jr43 zYM*Xs8pTsppvr00g0VF*9uMr=`2`c8p2Z1N+R1I8lI~~`q=sLWSrXHnAf@5P2!fQz zQE#Rc6~|%_WR|7JGLx_vMr&efw}MLOiN%?l$bWRHVap&ITMa3q$XGz_u+rb$>d9$>cmOI|+L{k3ktu$=+A9-sm zw*E)G-J6!lxo^*iTTVVQv5imI#!uMYUo5eX-b~*;i=L9lc25*fTPKa~e5V&I;gj!7 z#QuNOo)PqCwYQOSWYHdX<_5vXaZEnek?DXkIiNa>ro;S2uGur^#Ah|s=1b|3jDKVM z*uk+I!LG28bg-}Y3G)Xvd^9OBkJOra@~Y^|=&C>JJo7SAI5BbgdoPKX47GVbb&$Q^ z@6Gr08Kufu@1IFK<@Wc_IQs=EB(H;I7t3bRBOtF&0KABX93$H6KojrSws zs*ZhddID{&>hh1JM9<3SznD!`RRa!uNVH8R|2R}$_0?M1E{}ip5j}_Bu2sjr?if!& z*}kzuYPCR}*Atav;EWu8Yoh!=?su45<)w`;(_gBRe=G)E^|+ur>3J1nP)^$&0(2OT zvpl0SaQ>XN$E{&gD*1}D-8g9d5Arz*;fo7tOr{U7iuoXSjXoLy`oa7Oy(j79gAUqT z+U5smvUNjP({S2TH>3rMLS1;O8cf6rjKdT-RL;kVXc|!hLq-q>LP5=XeHv@Mmrs84mFZrr&OMhp#1$LRN2k9CPFPJw zL$|MSx(Fx8`#DOqsG)kTSr0+LPElwo96mI^QO}%9ql!w51P6ybA@=Am1Gas^Uj|rB zv-t34D{no(Cf896KXNB9@&=^=+*<{ z;Axw&jQj0^)o$v?z@q}4)tdgIoBHrP8beR39s}u995D-Gt1XUbqe>~H)2TuYD5UYQ zzh#AVE4`-NgV4BHb zJ+o{u+UBVdgJ}dVs|VAh-jIHnK1YB{VqWN*zg$@NaDLusxD*Jv^*@wA_cXVv-b1KY zJIJ|UqENQjN7in*+ssoR4WVI))rMZa0GVNX@`CFwps6?$8#FJX2MA|l=U+?>R27^t zjJgud3$D9_Op4wHqXH6cS38DNAK>@HaPs%$M(mVA-TFDOk>iNVAS!}FJ%`!Roxn0- zwi|2)DI@L`QrC_ki8Em+UaR9HC`bJ~lBQ9$x_J~m`2W@|1>0Rt?J15$mo)Akm4Bhg zP-Dj+BCjKL;}}9p8bb8+^FT=L>K$e^{FEc^<7jfRH7>{T7s6pU04WgrwKZaY3w1zK zJ$O~aH~ZD$P9i;HKkPmlE@oe>Yn-|Z2&7L>rWWnT(L?`!WCC7xy5Kmd2lnkp2PPxL znGs^vK}j9{mDVi}!sKI_*ahM;T==CP&68yoh>^?*P7=(u_%z3~`VVWu6K`-Dz|)od zyV1wT0XU`|24sr`Bg<~X0st%ysB5mIp22bBs52?!N*a_l4DYOgR!>8ZHV*{R@lsL+ zS5sdq58ie)2EdOly#|i$@nFUTYC|+vpXO&x?&=Y%|{Z_+$Z3flWctY zpvxez^4iQq2mIf@=`hEtk&~c0Yt`yWbUzNBre8}PsZyPNExk<7s9&!oFP_?8N5foi zlmFjcmA{b&sx3J5UGz^~dKVlkJ=0O2bBqZ&+Pc^&J^|K(zHm|~Dr_s+{5a?3CM(Uw zI;}@0qceZVx^{o1E_0|Cd@zR=9&{J$vyp0)P_KWPz#ft7sMaUkg}+{#GC$!wGkU<4fLX8< z!Vj0jx0uwH{nO0&<75D##A?Jq|pf;c-f-Z?lA{F_()Xvpc3XP)kmWAL8WM3Hs11(vRF8gXu!e! z%2>{`^+_c>mFp+Lq$;y9fZ6AhO2xb$G_OQ6U#*i}8XWdhVy5_$Z}G*#jp3lwJ5N-7 z+jZoDZ~R#P~hFQL`q}Jite8IDHg9#TSFG*Hp*Jlrf>! z?FFG37q8s~0f!#w#fBPc+{`uLqd#{O9t_kHjVT%-gV_*t)X?-)yU~Zmp8M?P>G7Fg ztty*LS)e}vu`hCS0)sT zU>8&bf5yn(-kw5dbAk`y+KmCMz<&_wps4Y}`HOjg z{^Ag)B|Xu8kth%y49_BP;c6%@}|)Fv|imc zg*s7*Dw_gR`-Xac3e9L^;aP?fMU43dsmePjLtQhKqT1s;3V6Q&?BjKU%J>ek)PAZ~ zv!+t-A~smr77kb_-!f0RHOn$?+=|;ahSENbw@_YDNi4d+I-#^- z86QZ5u0!Zn)Fy23e$j+7=+>j zN@(Y@3&%b79rZ`E(N3gVTPeh3D2S zToDK%1C+Q>pi$)lFzDcK0Ofa+4>>)&80VmtM-zUon}G~vAQP_?e#;uzR9myO(4uWx zQK&Aa{cogNvC8r4)?4Q)n}~0_h6cViYVZqy%q?uOIFrI}vw|BY3O7cuxP%*X3^n&Q zN-QX5y}^rXp%nx05dxw<>)p6Uv2-Nn}+qdEK>-CHWm}ov3rVMr{PpZN!(x}^E zFk6vJ69AsMsXaDX3XQ4FJv!~d3|a8#*)-~o z;=+d8X+#419-Tgg)%t?wmQS;_lp~a4XlWrrNNw1F1i*6%QsdA{V4`MCqqapl(7;MY zvB_kru?^>HPY87l!hZE0neR8p`hyVG`=Xm$a5yD+H=V+;84K2>x#IP`IFY~~7Ph8G=h~|jnMi3uTP9Q2)nGe%?`c~CEOmpaO{54^K>iJ8; zuibywTLD5P-c335iK=~szNW8LWeF`$hcI)}z%v{{+GCjihFA>%XjV@2LR`=xy;WDert5M2FPyg;Z{3n5imi5oO@s zyNK|qnz~~Vh+uuIrnWDld+AqoZYez4-o-SPehuRO3}KCI?ejL(N755?EVx%9oup$5 z*Trh)<1`zTLpg8<==j1i>Q5g9e_2Lb40>2qET=obyv!B!s=(K4^(&}PivC`W(?)AO zSd`N&3HDe?y#)7}u!{O6=|03CZOwy4%rQJ_)oKXfu2r<2`&?7bU%{!e)wC<(aY4ED zh*`ShNGHQ6Tub_jT&*{%x=eJ;mp^5*)f&PgpOwX7mIyl=JcqxF<4Ob@Iu3u>OqmZ0 zq#BOGSA;d#X#)}FqwEUmxoqrl@t2m^0#irVP%_O{Noy$}9&*Y>(>sefPPuJ*F1|Y5 zyB4yKM(2zkppj=CxII_hyN+(5uhf_8=pqzG^Vic`^sM@IJyj%Ep@igT0YTyCY7$&= z*rtL{LRYq{*r#Yo;&Uisb3KdGV8aZm4NuVk$j!m0XgZ|f`lsnUny+4}pmxFMpC%`% zbx%`j@WTp(G)WB*E5rYRmME;(Y)}~+D2ooOJ{wRK`FAjTBhX2-di7?p>l`o})vQez z`-qyhl{%=q+lypXdWOhVDVy=>+-7b~Q=2!_^k%?!0eGW2dkZvkmfEp}Zi6!Go`asD znLQ)X;GRb`T8Jr7iQufHZy3qG0rRl>{uvr9c0k`Z0D;RY=^JWL=WeAlkP!eTzIap{ zx6-JN#|T`6{n1x5VE)F>SpoAn#jO(*rSf}-j;i0Y^d<|@&^J+{=~+eh8naOvnRtoF zh`~6mXUEjrRiNSQVB9wPE5Qu>V>_(^A7?!W*FQhF{yF-MK#q0Q^dcbXkEb8|3;lv2?!RK`;O}}_`2R%iLRA49Vqs75NFVH-)`}MNEgqyQ$Wxzrfu%LO6 zzjGCeBmVhnK@DY!`9hVxL0Rgx8cRR$m1vJxTRh2J7+mu*b=S&;7v0U6&>LMPDW+ib zF1pakSXf_|s^VIDgC9W>s9EsdH))t2{o32qFUGC%x}cTPg{j^&W{3+1TDp{=lM(O{Qx;q!;Xw z=QN)Yhy3-7!CU`|8e{ zNq=I)l?FX#QTGJQmBBHekwLU7IR0}Oq>xvb`#0?s*8EL-g@6Bz&b7S41o(m_^#Hm) z_+>p^FNQoRP{`$vw@@?c?|_>k3p9jrB~Jyd(oeBh9dI# zFDWCHzo5sGSu;0-8hi^wzeUael9tjY<@t&}4eOx$8T7!%=4x*hC95;PhVQOa4PVn) zO+6SK)YR&6^+CD>ZhhlHathk3D*s8(Q>~ivEp4MWmFEzh1@{`-JA`d~B+;Gz!zkrP&hx8E_>mTa zCx7}82GgpTs)C<1(?iCb*?HyL?ZCO;Ngx?$b;{*QOfcYtQHO&3$-D4!_ zGj-i>@Og)Wdw+xPw_zq?7df8;X3Pqg_qiHPf`OM1_G160P7~q`gjj=x7=lGD5TYmE z?GWMyPaV%_@-K%;*!IGn0T}}U2PIm_pc-h1v)p#C;0!~&hS(}t=n?}2)dh>)!cCV) zNG9L1wEs)Qb!1fVw-nfsSmFu=3%&m?{2nUsJh?FO+A(%o<>m9uZ@_Q%nRhT+CaF&akaaR@D{OB zBlgNM`f?4Mb;(8%joD%#7Z&YC-BTMEe{@_AivU3SXcHN&TjnSnH<#adp4moRmhK#0 zNdyfZQd1K}Y46Y)nFavI!{!(vR)RmF^OHLTP0^tPKZY=k*O)>N7*mEZS4}lV zkCc$zLMX18&aWO(n@!P)j;p<cc^D1Hm zj~XFfHJ5;pba4cu9!wH>LK^b>jJ!z0u~dDNBzlXrwiQ|z9B~>1o8DJfri#vLdRs9d z1K|zUM+L$updHzwug~xoK}XH^)mwI_*k#GWg$h?xvbfR!3sh3F=&lwgi$Q4Ik^(6y zS*CwgZi+~aTLlecnFme7%NrW*sXk2+1M!sAPNd;-Ry#2*gwNaUM10PALzn*9#dum{ zEK`!{`{c4zG2R+^IfQU)D!^%!^RbEdYpUq+yOrJUqtMFyY2r8hC60mVVk2z`9!eLv zd!ihzPPmOA__5jTo-YtbDQBM zmGm?uFY#hwsvoMFdag;uhInTQoMQV8==!-St!sq;@4o^BrrAA1ByX`|MA zI0KY5kq%kQuwO$_8iR{Y7iSXAhP;w3x+aCz`JxSdv!>}p-rVI7VUwXf4u`bZXB>m= z)J`z8)>ahr{Cn+@*rMaGb~I+wC}>6jmC#!_Dj0|eueDkInj<=SHB-=Ul^v<*E0(Au z7idw9Iej8c+XnE`%p8(@3F$DtIiZzk$vhcBJ5S=XNo}xA3%f@^~;%}JuOkG zy+xN!A6lrQ@D@fD+X+B*Y=~*A)P&w51to&Jd&7l)t}1#9Ush7;;_FR>h*N50wLl)1rAzL z{U!3)*vYh?|Flf-FMXNAOM*r}{K-HBFlK*9Tz&BB{vu0==SWQ-AZ8@?wQ>PW;dk_> zY*mskJVjq>hUmz97X3~$LX^`hX1&AQ9HMAOL$+=7+C(syI$Kh|3)pp$_w1q&eK59$JpR0tZb?;LsSd z4{Qm0YU{xcU*B+E^CRQN4qh9SdfdFiEr)Q^sA`5mJ04S?4-cwJ28`0`5uyg^1%PW2#x(*>{J8*axsTeU z(!vi?>HZ*B7pcA1;CRb-YV8CufPPf<6GV2G9|*M*P{8~pbn|`a=I7AOPbzn!=z{Xh=!v55 GY5xNU(m-4Q diff --git a/contracts/sysio.system/include/sysio.system/sysio.system.hpp b/contracts/sysio.system/include/sysio.system/sysio.system.hpp index 916edb54c8..e8da39f8a7 100644 --- a/contracts/sysio.system/include/sysio.system/sysio.system.hpp +++ b/contracts/sysio.system/include/sysio.system/sysio.system.hpp @@ -341,6 +341,7 @@ namespace sysiosystem { public: static constexpr sysio::name active_permission{"active"_n}; + static constexpr sysio::name auth_ext_permission{"auth.ext"_n}; static constexpr sysio::name token_account{"sysio.token"_n}; static constexpr sysio::name null_account{"sysio.null"_n}; @@ -619,7 +620,15 @@ namespace sysiosystem { void limitauthchg( const name& account, const std::vector& allow_perms, const std::vector& disallow_perms ); /** - * On Link Auth notify to catch auth.ext stuff for sig-em + * Install or rotate the reserved auth.ext child permission from an auth.msg notification. + * + * The notification payload is untrusted input. Only the protocol-reserved auth.ext permission + * may be changed through this privileged path; owner, active, and arbitrary permission names + * are rejected. + * + * @param user - account whose auth.ext permission is installed or rotated. + * @param permission - must be exactly auth.ext. + * @param pub_key - sole key for the auth.ext authority. */ [[sysio::on_notify("auth.msg::onlinkauth")]] void onlinkauth(const name &user, const name &permission, const sysio::public_key &pub_key); diff --git a/contracts/sysio.system/src/sysio.system.cpp b/contracts/sysio.system/src/sysio.system.cpp index aa50223792..d9fdbcfeba 100644 --- a/contracts/sysio.system/src/sysio.system.cpp +++ b/contracts/sysio.system/src/sysio.system.cpp @@ -270,7 +270,11 @@ namespace sysiosystem { } // ** ON NOTIFY OF AUTH.MSG MODIFICATION ** - void system_contract::onlinkauth(const name& account_name, const name& permission, const sysio::public_key& pub_key) { + void system_contract::onlinkauth( const name& account_name, + const name& permission, + const sysio::public_key& pub_key ) { + check( permission == auth_ext_permission, "onlinkauth may only update auth.ext" ); + // Convert pub_key to authority object authority auth; auth.threshold = 1; @@ -279,6 +283,6 @@ namespace sysiosystem { // Update auth with special permission. updateauth_action update_auth{ get_self(), { {get_self(), active_permission} } }; - update_auth.send(account_name, permission, name("owner"), auth, name("")); + update_auth.send(account_name, auth_ext_permission, active_permission, auth, name{}); } } /// sysio.system diff --git a/contracts/sysio.system/sysio.system.wasm b/contracts/sysio.system/sysio.system.wasm index f6399eed110447585a9a4c1a8a1bbfd81b5bf3fb..bb4e7e65fcc4586d87a862ffe21828b2039d5782 100755 GIT binary patch delta 23814 zcmbV!33yEB_y3%8XC@)RRZAj-Nrc9})UG9CX=|yqma0~@rERFvs_I5!--U~VT4LV` z!B~o@y>_LGD6wxrsH&~}KJR;HQ2n<3KY!07@4fH-p8cHn+?l&Hbi=~Xl>08@zWc8A z(A6cii@Su8Eh~va`Z~N>N!HYC<@=@tWg9}|@KVT23waSQ<|Vw8mvPq*yLIpJ@p4|l zsl1X`@oJvH!V`Hif5TIF2G8QzJdfw|0`C3ASA7zxKYhnrcq?z??Yx6C_#~g=GkliM zar?1`WxP4gIBlFU&Kl>93&urbrE8UIwQG%Qtt-zu*Lv5tt_`k@u1&5qSN7x`A$P3~ z*=yFjFp@kDuh}b_;-k3=QHneyV)Kp=$S?o!*dL2lY{2}b~eIcUva2krUGAoZ4(WVNdtSv~E^K|Ae1 z{fW45QHM9f(Iwgu~R>jIe14 z6=(&C98R+CR&Lf9y`xEk#RH`1?g})YU}+mTnHcaGqUz1zO>>%Yn*7w8N4+bWOR^?Z zDOd6g>SE9*AY=KAZuRQC`m}Yjy6TqtXLX^_5gg$G-N&-iTq_kuad8@%x}#=W zC#6}QxG(8&>Xf*W6nq4|oZe)TQx95X&+4X)5U#4=VM$8jnM$ z4uz_4dA*FDFc!%0PHb|*;Y~iF4syn!P7)k%&hYQIe6#^d#ZbtNN*)7rYM-O$6ZO4y zy@$=2r1p|vec7lL&p%-uYV;+|vYIrmpk5Limvhf1^qga@ZrsSa@=B3xbIIdYYt6Ir zHEBXV>)j?JIgPFTm)g;0t4Y&}blFO58bO)Xl%`GSigmeZ1)6C^HmgQgt=7#J=U;%; z3?K^!F#s9-!CVWh@aAuD@>y$Gw;1c2=85GV^=gX_Kr;UR>_ET3;AW4i52$LZQHu(+ z$ojg4mljx?T9h;wQ&b4Lglhl?nM7Vi zrjT{eTOoYs|EBm|)|Hl(`Foc1H>rZv>eYhSvBY(w80p=a3guXX&5>fSP;(tyCr?Gt zdh7nF2pN_CvwEFTfM8dJ-((0(;>PV+smBV53w2s2QE4N;R=aa4T zmU;vM5Bfc?I(wb~i<&`K>KQz3%41aXHuel9t*LDiACLdbVgaz47_WB#SS+v_v{gI! zylr9ZU}D<^h4tEs;_GP)^7H6@SmWmTcypE2;k8z|R;!upDS%d=wdJ*~Pr_v_Nye{S zIJl{1XyAKYyQZ`%HT&ybnfINydcVsj?%@xU9l0T3vz zS0~YJIP@xO#hYzRdlz7D!3@L2^q^i$N8(JRK<+#%sH#1#aE?9qZYxRcWJD@$IcV%&o_p z?{wiU=d7>axk*c{kKZlFbKO?0=7p?H@Ag4Otxi=!=3^2}gM~L+eLM9C{SIgRt8m_u zTC{Uf;;Agj-PmL0dcTR3=+3$LcDmH)&dI7g)}2ezRBPP(!)T3FVpAWFSxrBfOp3u+hrit=!XFd^~Mh zFSqq!H^p2K2TN(U)okXjlEWZ`ytn_p8-<4L6rq@1Ew_gvtT7Y9a7?$=pnHMGwC6DQ zlI6V~Ye{#L_mOPuOyOohrD~x2HIy9Y1M6V-O8k(mpdMcV^J{w+$!YVn#!DzP-trz6 z9l(AzTE-{gQBMKpsjVE;TZyz@`{Xa%IP_>6?jO{d(!}!~<$HQ71FTb@)TV(}bk7O@ zYbQsob3F&4;lodh(Gjcf=LKk&wdB*YPs3F2NTWTiS78Ouj9xSTHtLu)t#`J68|k*v zdw>1+VUe)C{~0CzRo&K#FIE;wKC3mi0h`;SG@niQ7_BH`BUwG>)UvjGInLgM`w`XJ zB+=!osaQPQ*Uy5)D}0@okJ8w|Rjoc>XU}c3`AtoGb1_r8HRl;iZnf?|QK+>)u}{vWn#Bz$oM<-3Td((P#u*o^CH+QWNzi!Yo`0Re=3ci|XTTE5 z02ghG-2Sg8RsF$AFE?;Nu8`qw5CM zrPbC0{kOvKZdS_RE|I5UX#Dfh$Mh*|wH~qrV;>BvZoM!xJH}TS{zK%|e;pMyqN?@L zFhzHN9hLPTqn2x6Znb1&&VMFqB_4hm`30Q=9D7@PMzwyr>tkuuY;?}P3zT{A{{u5M zF2)bTSbtgCUzYcmmHcHj5U}cB!(T$DY8<3F^825*Le}Z3o%+ElV)fUD-DSm%`4{jRWsW`eF9)AB#6Nr2asM&BhAzgYt|TV*Dg zkt-Co{!xjvo6!BSgbp<`Nm)(2fTUJ96|h337)`S(iemo*5{ADQq-2=Qmp0Qc4)Ens zvdk5qS;-SSJ$)Wq1QwXIxA>FC2QIZuQN|G*rIfi16jf`5PCgpB?f-=lQ;U8BExGGI zc`$xT0$sPtPygI{cWUFv4Qjc61c>6<^HX#7-Q_1ZU4l7v`M;P_^#ft)b`X>Lw+T=kK=-*Bs8ND1-C8tl z0L+{6)3-%__n+r1ojl}!lH|scfDm-K$0*~N$L7xeoTyoVP$LhhzW*qK6>uN-J^r74 z72lkgtteXwiKBB`mOS%sd(lP+)>k_1539}G_vp6mWZ$vQ&AmlqtY7Cfe0GKbgaM(t z^r$il#)XHUl~Aqn<0p!Al?`s<3QL>tKiWC{P6}ilD$K{B6g_DCw8WH3S&T**r6_;*rDzZxuZ)ZcaqhS zl-$uZO77?fC3o}#Y`&qf-eD1I!-i}*r?ZY0V5hJFl69=$>W1PG*bb&bjL~WD zs(dv0_hpsc*ho$D<;FO0+P51^sh5lTrR1j4MQ36lqPg+W4sR6B5#muuh>ADos1jz# zT#m4M^v!2wYz(po##rk&mB)rMH@&DTDy6-QX}?Y@jlT=i;vz5~cA&z3I`C=0R{}T; zC7+y|>r+Z?Yk+ce3Cc;gXiH_t()Ez28Ox_w09sm^Wt2}0!X_A-IsQ_zl2R5)ty&F!gmb~b0)YmNJU zUEO`^z?e+Y*JyP}MPK?s=`~FsiiR}BJt7@NF}hCzB;aUk%q;jSdAB{h*+t z4M+u*T?%6gDq4{%sOUZlDhnvuuZfhL2I9&%a(Nvu)o={4k*7el)XLm9G5BXh$`Bp= z#Tv1HRw!OvX5B{>jZz04Xh|UcqX*kWj?<`8zP2}qW)@pCdK|ezOv`F=D1V{RY^y?V zHC(}Zls;wh-}8jmWWo z?nmQCSw()x*Ftf+q9g?m#p>!=L1L9E4J^StTGmq|Y?y zhjcn>y?wZ&BHV3<7g4&^<4FA~3rOw7j$h-!^fQMRRyeik=Z`dv4~>Q(WtL_h3GcgF zVN4-Y<4~PY<4~P2{n4zCfEJioMNh$ba9(ZXsbekuCj<|$`>3PoMKq?#K3Z!3AGZ(> zIcvTAb5A;NZTPtkU0CtUa-!3zD~`UvlwxHadxZ{KwSJvcKv59ZRKXQzw9&;|4p`3vR}AT1~`@?B=rdVn7?tz1hV1|=Ccl- z^g5Lox4t>(u`*8wTeVJ=Xcia&9>1y9@i;l zlC4pvqtGkmbU1X%uG8fy*}8i=mj1Mgo@rj->E8F$+7L|lt&wL+KAt-p`sr}{XzSNA zwP}UGbev13c0b#PV9Zsxl~=lbLe<=faBa+fmiPQxknX+nUr_(lUKd6Y z4YFL9%DD%t)*)7nOBM~a_Fa0NhFK*q4^gzf^745dVrfbvtjx^rcz)wbn0ut*ahj{G zFRobFP|mAG?Qm3#)#hqRJ0KH*yNdEU8mYi*jy6s!HdxpDxnRAKRmX!y%%uJ*B^G6%UlbW}z!UVV z;;Kzqm4p19tb1A2Llw_pam9xdthnpdSq$sJsc_4>{v1uTc3huRRP}&Q`$(7ROEE>| zU_nih@iA6~?K63jVIA3C+C5o8=^H?)sx{@e_B2I9YO2-hW-mZ0b??o0h^7PLWhpuJ zty@ir_FE}`#3%{>;~(XSW?Sw%)!cK`9CLw(s;OVzDM>WXntOL!HqD+;A`7gZ_gaFZ zcHVmtw=KEuPp7k~%kJ+mXu`)?`}x~+S>&esw8S?*h}s*JCaw_Lr>c*HPy$Vt)}eHTQl(xFD$i$s z!Bu9oOw2(oX{BW5fT&CK<;Y1nh*tRu=AwDHrSxsdLxssb-H66@nw-x|ooKbZl8++D z=X*aNeMr2t3F#b3Z%a@iYGZdO zOuG3zo$#ThJQ*1m9Wv?+7nGHSX)=B5Yg&Y^GWynnMTa6G8mIhLW<*m5+8|VvDtNv% zB0Mg2A-~h*$q%%@f>)2TCS7oO!a>R#q(xCWhB4)0s0GIKivhSd`c}kH5u#0Us2FN3 zDOQ|5=ASRiq~bIrVwO|!6a+#QMzVm)ObE7x*KA+SXQ?;=^KZw}>tUPqjUletNQLs@ z&3NagJIwFoa4a>TEmF7yRiv%byaWjrx>$k^&=gr$l0J*PY+p5cFJPe4n*rz3>HQhQ z@BH8}Go?u>il;-ewiFelALK|Wnon1JeM-|>gAV(um8T{KrW^bmrMh>3Qq7$bSBWO^ z_6&8`otM{~lCYF%od3SCce z#(VRb`_-cgPq23-#QXs*3RXI!T&Ms$9+YREr|DpU70=TWo_Iz&zCguQIrIgpUG|WM zmFkGzxcX)98ceDn^@E-n+m8hy*4$@in1i)C2AXV9mjT>H{|n|$jkkm`tD28U!raFyUci*mY`_bfX>rAsoIdb(|noV zkeUK4w;NK|NNf}L^1;zA4?&7nH5}kuwG(9*q)TEWD(uD~oH)dsMvx$<cV{+C=R9$dD}vsIwL}zg4C$Iu4Q;MB%(hAT8hkWOfeA0yBgEckQ2~gF6B;pTvC1j z6_6dTfbUPpAFoiCTq(||AR83fu-sDV(S+UvQy*wTFQCZT6vAbRbZbggi!X6{g5VxT z1u6Um;bIVbHkUi2)T;{{ip~ZYFPGg-sZ73fP!g)59HG#|>IqHhlA{^Df!Vq=qYuLp z6k1>-klD}B*z_n}eNx_fpTeZ+Ldq>+%_%p)RiZhzkRU^wQ^A7iI0@7l0O$3<4N%6a zp(cT$A)A^5HFM--bI8_onb?BH&|E3ml1AEsIZXDq1Z39ArIyqTg1P3a5Cn@Q{Q~5D zpI4!MewNLzLdqPM5?3Hoo?|FL-r2`)f{gR9=IybH)sX@CcZc5^FlX`Xb0j7AYk|(H$g-WL~rn> z%tdMZCN_Laj=o8o^8KNdueP{uqnExc2UjocKpz)CliycT1oKpLjJ)v{HQ+H$ooOJy zyhRmgtb}x=5|HkdJ3?h0mTn#C9FKEq7f^b>4IMX5JiRE~y3w+X%k`=GjXgLD-i9(u z7m!Vwx`aWwO1;BGTuN51Dix&HJG7YY_=>(u9jRcT?_D5Q9q}H{i{l|Mxn8DsqOj-g zs|JtXVT|>c<^83yNz~-Zg0(;iTW6* z{qd>PiU)?iBzR~@!S{gle)8sf&`kYh%zIQUWPtOL$0VEIqp&b_9Sx;W!U(Qvyrlr4 zQi06Xa!m~yB^^JeX!t6q1`-0G(Is%XK;C$to}+;>=6!lK?;vNi6L1`i>?g3<5Mr<^u>oGP_LxhNL6AU4O)Z=H25%&AAEX+$Gh=h9_>WvEh+}Hcd5{&>(zZlVC&@{ zRZ7MOlrLm8>2slGSbc#Y} zZJMZIUg#fTP9b}x`8g^oL%PAzm}GBuvf6AflE_bKDNps&{N+zU^HUYg7ip`P*8s-$ zK;8NsD9|O2vrBE;<1cX>{f=Ykc7&p)spG5d>jnr~oFn9OGOXnjp18aZHK#kD%wIWi z3Hd9fBN)U#DQc2pnZ7nhE`3-Y(i8BN#B2ZYakPncYsQRLIsZ$b9P=4rvgNd+9mdI7R2<8JqO!D`q!i7?x2;tNnK(;H^)Vk84!dcNu zzcuSmMu^@G@lzLY? z)rEr-+<`yH>>IV;Vft`Pr#B@?X-2;wUav^;2~xeR-XVxDlMH#4FVg_&FpQpuZGWu= zx1f!3Z5Z{*u|`Q9>`4t=D_;zUleAv;4W}yk5pU zwIw64r8T~bBjCRQJS#_0I;HxOMpI7ZJWNlb2!wp?-38(ftCXb2#H$SJqq7BlSCi-z z!;w2^(c7GrDV4{;&_uau9E_44RQt5YFFWpswx1rUb8+kn_Ij?nswR+Sa0 zY#_oc17S^Xhrx;39q?e$CUt~nf%QgDgk|!lfX=o{{)zN@;bWNDi`kG?8q&qValk*! zT1<)En7aQB_bz3-n$m3@6$}}Nyj-MwmT@E{$&yJF-u}iZoX)Nw%506rMt38Ew5g$4)*Eb>|vFtR8&2d@z2r8QpC;ZO$&NMjF zMKWQMAe}Ty-ODQzM&Ur`Ndh6Lk?zwd(zkdzjUx9RV8`4daWi0V?3K@FK-=zx z?U&;-Xi(&>3wq<)bi_jH%0XH6F>2Zak~kB{Jc#I@9cDO$b%2UPGwI{pKR979y3E5s zkG7f)ORHJbB__cYFpfd62~u$ZT?;v)9FQMDn&wYZdLcD}g6+MK z-iG&TiF zU(+24U50e$N5RPKfdJuMrz}4UmL9x}5^#dx6ohkzx@=qXj}*`&UetYq)LTxK{b_>* zWk)>ck~zyMvi1ouRviS~JY;A3+ET?PgbW>!fFjYHdJ-AiUqwTWAu0i!2glcOm>E9U z+M!wjrqUF?bW;|m;#}YPf>u%@(M}n8>ENRl zx$vQYEqlFbi1nS5G#{0TQknI-7n1KiL0tkYcQoe@eJD$ncMb7in2%oE-fwZLCn_MG|JE80R;MRx z0SS1b>wco|3agm_9ea>c1G*oUQa6Bq%H*FBk$E76e}Q;===8Pvg>Dc}yy0t*4y>S| z{W1EK9{3I&gXGUP00y`ER>NU!+LKQz9;b_)62Q&?)8FiHsJN%?aMjgshxgi zNt1JQntqgu=c#KT-Z}d`4GRQ`UPL?y&mAx5Akm5ofgsTvaQFLOqO!jCE&^yY%7>T1 zRBE(K1!iEEO_gZj6=YnNUWSEY3tQaGc!FR3!XAui-RBW8{4qafQl5 zs&2SKv46X)yRY;fdQFuFR}d%^sdE)vdP%;#N?(9CZe4{6o-ChTqhjuF6yr^inb&YL zF;%WygF!gumQ>23dU*Xji(aK^vM&qAn=a?FAl{NC>N-`8nxfCR)fI25Cx`m0BxHgc zZi$MMvovo{HD%>>dY6AbA?2RoqVmEG+^)=!SvP0^&6L>Rs1@e!^BYKKihT1MouNIF za1)mFUYT?gk@)XysBDo&zXMUpzOKJhUdp>eEoUQqCmuOa@&FZ zOl1h@aLhs3dY8ULU_b62t>77%a`PU=s50U{#o>nIbtK>AwWIiX)tFc|;S7W#-Z%6< zy{S50yic!|n~|w44fbY1N#ro+!?}hZ9*@Ja_crVle<)tBt3vTz|Af^RvcRRn+UmTE zq{>4?11HJ*58)*)mN^dr{i$;QAw3s54Oc~&29C11czjK+LsQ20;XX8d{GTAPWGPIj zvZN#N9uQPn=Ff4NFrWE-yyZ6dOxJTPP^n_oH1=27|9#g!1{x$fe6!Y)S2_<#1ErF!oSovYVXiApIhE1^>fx$0)O zvD_7*zMPRfL0mF)g(j#ctYc1fS>Af#a7=~;@w@VJFo(+BAg=J(rVZMUF@eu4)a(+?F%Wft`)H||g9}F5sbcD=Po#?Z zhi;Wma&T$*mdOaZK-z51!7l;c*>dtU+}T&y5T+BaR$fBJR*YokP%ER1TR=Va!XyLeQ%FW&U3_lff?tO++5gts;!^%OPoQI3y5NUb1 zAr29e7irm+tjY^`9THDI?&!+Oa+oc|n~(F#%(zl3o`IxV5$oP_13 zhV!Pd6PW%d#k`0TD5nvB%E#kI=#v5*6^aEl-DCPsB&9v&=W{L{zW41bz+qHP=YA_! zM141CQ>@|=UG0D0kN2aRRP1&YwN97Fg8WssgGz)TYIsb>MB;w99LQ4A3UU&s{UI$1 zarGQ0U5~${Iwcbe@nA&jJdylL(ZpAom#lradYSbU{X<^=lYaV@5 z{bmuc4lZ!iP4%K8JR}HNN!~LnSibDT$bKK!c$U|qcyYG#kcjG9*<*{}Qqf!lLC8kYoKoe2tqq=3f$9ELw9SM@x+v`Xz8F^{^Qr>d0iDO3hJ3?|^31brLH5plmZ#>q7i2TDR`Ry&|&s-D{~Mj$T&=Yx3(*AT=R(Zslv~PK5%&pH_(1r#%)~H z^9u-XI;--=^8Sl(aBT+k2dk_$?{B*U*WjT_9pa8qIT~KYh==7yRqg~q*R~qJnQfu^ z@EY)5E}N=x8Cv1HQjKd7E^12G;Fn>0ep-XKA<|K^CcmC{i2IS75}=2nvalvM#ewhE zJ?OvPn+q54o3u<#wFu>m0ygbl6Ar6RHD=Bf@2rc*H_}RdfW-Twjg+omD zaxq@yw%w?7FCQ(LbO#oM0(yvd{ub(v_@_#LN>Q~cfE{91dPPG#>yDhL!O9C5kH{j<`)M~)7lql~t;6b3{s}1-(dj8mu zo0yiuT8d5&IpB^r$4R9|JQG2LpBnKFnjq5~b66q7*qvS^9|Gus$O}ezhkx%dMGiIQ zO1UQ5SxY)C$uK8LzE}81n53Dnus82FK!kR8p#~b*a%zfrn}9aHk%T7Thskoi6PLxC zr!zG4H{$KgVUnXM_skv;TvOa)#z2}aX^QV|hhCP(&G=&QRICZ>XPS(DoAXP{=G-0@ zS4wkCI7@z1MWWnq&X;(#+y3DLpVVo|t!TDPY{~H@=D2khbs5LcHhhO`3lJcObC`i& z0jblsg@*f4U#V9?zV-z`NtxCPLTbGjt+{S~J2!`wqm7Ia0A#_>NX_xJZ_Qm*ddsfY zAUmeZ+IFD6WI5B0%jB8nHfJb!Cxern-UBc!XZm7ZXD0zx(?8)B@@0GO7$Cxw9;{rZ zTyMZ$Sto7Y0KgW@gf}3F7t8)Pcuk<+^fz_Cb#Jn|e-G&ZO#AQOn{?n$AjEpT#f@bD z#~dvA-U9XNiVI-04js7%QW_3+gJfoT#EZyzJUC4$N@^U9o?HYyfVzRuG<|~c$bvD-5+E`z! zuwD&6c!TgHxX7Dv-ys7#!(yB#zRoZwlObOh$VcySI~p$EzsK+8T#hiNKi!0IbzJ*> zK*1;N-skUdpB4E5ps-ZhcZGu4D2uvsB8oB}avUn##zW4g`gwP3Jb#S@IkO9Qfw%Nk z7k&}r6}{w_qg?>dEmEp0$0`R|EBOC8kG4H#^xxEJ}slZ<8 zY%qAC;&9RA^Y-N7NVd@7Q=6ol)#=+x)AR64eu)G+$M0tZs`sbM-A@6*?UJt-%FMKG!e$KH*QUXcv7u>eU&ID3FbAo$YT*s=&_yJ|b zgM}5)%{1xz1+?2{ssANU0EHg=lGpHW!(_r&T&w98x55FO6Ag>CHx(@W6X6F*^od~2 zZB^Ta${3O8Ur3G6*@1RS8m@(OV(2z0`ZX8#YJQnUvvqY}W zdw-YViC~??Tau#6?-S(+1O@GuKUA?t3iRVr+4kBS$QmNA^y5OVESzSabnC|#6*yk& z&wF^&5P5b0M?UW9du0H`0nfMNjLka=frcqbv+9kn*{qr>ghRVr7oS*mflRJaB zkokk|i;Qv&-rxF3vB6v<&tW%iO%MQ_s05=%!x7wL!%mslU%np9VJ^LlOd8Au5d>R> zA%zAE4Pd5(fv+Voc#XS_o^<#K$r{WFIBAa|T-SA`ze=H7JA{A9{tNo4L_l+%Oc@Fm zJ}R-ppuf|l{V?v#n}*8PVbI)rWbttR#`tX*$&yq=ZQdKfwIhycYF82mV#lNY;8#}E zu6~uY5nO_ojgZSDxFjDPAz>rgQ{u`94bevz-~n+pLtQN+&Z|p!S5xJ!k-RN*lDg1V z)?eU9igePxVgc-Sau99|t!8^8Bykk{3%}p={OEw+l$`CGAluO?Z#z0wli=ulBW;q< zJ4tenhrUNbSGYuv;nran64kVbx@RiDxRI256Ave3^cc){ShkLVt&kzVjp1UECl#`S z%Q(6#xO##hPXaGq87Y;=a>-%}1gDhRB2Tco#XjxUrE)`pag*c%A((q)z*x2v^n(@s znDcy57Jmiik!j=Ll24QC$6>w|yJA!t)#Ju~Jiu3qO(29PC`>)%PzcV8U?Fyi}LFMm^ma3DuOoMs$ zCT&)-L5J*QeG1JXKl$4gWORcqx(%Eb*&^W{vXw;E0NnR;y|9g%_5(k-1Zeor5f=@6@Ky8B zi@Mv`fi{F8o;5=NPk_Z0nKp%sXTR!~od*WWz9}62vVPY+@CQl7iX5*g&jfS_QKD@a zbsL0(GV(;C{2sEZ%B$!BLzD>3l4?_V74~~|D#AdsBxo8(hRqI&2xTSv;m$Qw$q}G& zHs?sqX#gHVE&)q?_)Kn+|GM&Gq0>ev_Z#|5X*lz`T${-i-3x-e=a-Q(WNNtV>dv#c zexBPlux+js5L^Ee_s&#foyOi)nQa`O?#NH!cw?4cccvpHGQ9@ z05{5+OCjV@?p?~23+pL>c0ge#QY?4+7Yt0{Sq8?vBi?0PRSo%K8P`)~+A`?Dg(H1G zFXI{n-IHfI??>*}>E-+rE(O=Gfcre%S3ebF>58xON^VHJv7c|nDugTX6-d+?gsdyt z5d@%1bFP9TK0e4{(>=oQIMlbn>in^c^XCCL4$JzrAe6iE%sOrtK5HVTev)a@9#l z$e24x8Ihh)*vAj#%6eF7=VidRJTAXtuZL~}P=35=GeOF3;5yF4AhVyZ=LY4cL(gyI z`o@5u5Lud^o`pYnWg`&b|1p96z8ahOPl_A}n)4u_`Lf4QaZL~C9AXcDAtevXtD6zo z$&e+R;aDWfgUwv;k%!wq$o6o%ea97fGtl`R7cb&>!~XDxJM`T-g5kd@24r)Pod1p` zr}o0M!p9mnWyBV)lw*%ug8(dMz_i%Ah4(7uW{cQ)GJ7lUE;cymQRp{9B@vQ2Bq$1M zMTrDVUa`J8G$=wso5GPx+r|wZZFGo#qm{RVc(BoK+qp=tVK4xcPVghwkDy6yNXS-MGb@ z@IAkcSj3(0;l@pnmv zk6ZY^p<(Yt?Fit57+bE(hx@olSirI~mB*_rZNHG2wGTm`BeHuRw=OtD(NVA`s7~^_ zxm(9-I#Qh>0v^co`?(%SDRDnHsH_#Ux?HYm+*W*R-yQu`yTHEF+rX`oe;W_?LvEgv zk_Y$)+iL5$9pl7|A+C5(Wj()TD2w9#HnN~Y@|bCvW!khvzXi{Gv+ zE9cUo81(a&Y?j|V47bh0JIA01Eh+dbd~y48NFF;(+{gI}G~mtSh{ev50Vfbzo+&S9 zaHeY}h=C+)DwI&AleqW@pT?nx^K?H6Yka1RILQZz>jBjKz8ePIZ(lMA@IfBex$on_*EE+iY=#{2TteJ&+I51>+Nc!bEs303d zF?#1cE->CSx{u#&L`vE{j*=0fMn!2tMjmYE=qX3Yz+hac8{smUjCxYcX_S!SYz&va zP7Jv2L|qG)@r-qD^2w(kdK~X{>M8AVJ-s@9{6WWVJv|?Ed$&_> zxsuK3BAfGLJA3Z)d)VQLOOB91!9w|sl9G0Z8%JQMI&oF}uZI8C@xKQC*K{}}>j4y8 zw})KS*D=UwO}-pq^FFJYTwd_U{%zgHTBV=%}%*$@1 z3O<#Hl1Xly@9hx7C-{tQv8-h*dOOr8>#LZbB1qq0%9@fy^co7>UkpjKC~6`%%cyU|E{m=$`#< zJ%=L<`+uRnFZLNDJLkSw-{A;G#SN4>P&%Y;USqag%WE9K&_9P!$Z?h)Ax2%P^e2~) OQu&QPoZVk`IQ|d!+4Y(L delta 24324 zcmbVU2Y3`!*WPnxHwj4~Lx&XDgknOGfHYAdOOsx#D2kv)A@rhRO+xPk2Dl(C6zL@x zU;*hxI)tVuD4`=A1f}!8=guw!%jfg_ejm9rx8HM5KWBE$ywF*TLNo5UjQat1t%t6T zT!4+v79lIVhpz<$rG03>DE2QQB`UhmB>i; ztR6{bbxx2CZk7#V8@onQw1GXNtSXfuoM3m@Hqv?+Qo1;*sV~>`^+@Z3&|91}Dzk0w?FISpsLZk@Y8tfHN-Eu*&SoAhJ)7wEjDE31W32vhXK74k z=Q8i*DsXWWd8oU9!b3G2@|HcyI`z!__-x%!Pg-L6+$b_@hlIpCWLxDO_nsIeZ&ycI z>ncaZU(Gq_){}#Vjn27}yrqn`LaRi@r|1UXN`po}vC^a`2FY96XzPtCQORjJ2aUG} z^(Eru5)MzcqhpMtq;Ibao|pk|K$Toq50O*8#@Xth~<_w8mCHW%rGh;+tom>s37_c8aarhu-YaZ{<*{D`WQtQq2fLRjeF4D9M}#UW2DIM;~>@W6sVF_Zu2M zA4{b>%CyCIo$_|gct*;B_ONHb=?MV-iA;=u(U@FgGjfyUFHmuGo@M08o$b8 zPFvqJ{+wo7(M>AK%PUPP1bibsXIX=rG)_KGhFm@+yM;In(6L6b82038s2SD3;||jy z%Yk_}z#iC>494#P6ZC{OjKJvxEu#VdXf_gR3$JV&4G6nACLpQ2!{K>I-J@ApEGHP4 z+q3tSL+agJKR3Bu$+hW=Xcwv>O(?e`L{Bi~q$8R_!Fku7z(eh@+Qor9q4gu&t~YZF zKXwy#1I^<* z#smP%18_lwFpUrNfZJ@+mF67lUXy0D!fM=fIB#I<`1Ln=BdfHARKRM~EGqIMM+dn{ z5HFWIP$*Mho$SQCWc6*_j(OI@ z=5O_)e0Rh0uv0+VF&v82e)`soh8*)rIr($P1(mGlUyi_e)N_fHkb5O|4baAN zsQDdR(@uudYHP#GRdd#_wCh({#a|iw7(_*IgmQBBB67y~*Na*wUnztW-gzY&hlzZ3 ze!?Sw#G=>p(ls^*l-&MGcaBP#RQJ@A2EG=L39G+mPgut4_gZS%N0UCWz8~}^#_LT1 zF0!c#7~l5wV%Sjf>vQoO*D8{hTlHJL8s?QDc3<4_3Ts}g&7nD9vC8`FjZ$*y)81%K z%QLUN(TRD%CF`BHy3=iI-&-T2^gcY5~uYXa|T{#`4)#Af4G{yS-!y&ZN z3TPjLZDf{dA4Ubf7e2^f8ya;*Cos2K>BHPs=MMS!>=`Sy!wb20v4=I=a68Q1*3J&~ zXkTXDq}@sg zSKqqUsls13_;~6Tg9EI3YYOBF)QYP|6Z<0CWx2cTFaDSP=u=U+P_Qhx+sfOu`eSNw zn0p9RRLDy6x~%S9qo8b#>>5iCtrcA>bBbYI?)n8TGrec=JT|gvh=)Q;7~jpJeOPa; zb-sI%|5$Us72V^BH4i+w=0R&}k2vaYZSPTw23Wazj{B!2k662V4nRXf?^4iUMt)qB zc33IBk6PV6%Jo+``7biu5;!gVsK_G>zVOkPf1e_17zCFn8h^dYC+FGt$=}DG{@+Va z_;jh@eDlvDcpX{CC)Tv)eKw|$zMz0dXs2(L!mUwYNu59MgZ*9o{Ha0$Zo_j!BhFI! z3wdZBvC4l@JFiWmcGE0e=}{}?iz87x|0g~cA6U#9_hox9%ZFb!r(ss}uQa##_^WAH zuSjxL-+HI?dh6}=f^g06C)e|>XE!a<>#a&Y7PU*(`&XbXPx&g(Vojk2cz+C=8=cm_jsd`1Pk&L(DmEaPyjF!lT`V=AW7H|= zPyY^x;sbXYU;=tv?jiQL15sE0_n5&;|6$Cv{}@xvsx|a84bsilSHtrB8)kk@XEh}6 zebLamH$3-WyFKPH)kfq=o+mQ<{{uA{SJDSXNKp;da=tR&S623w)q%p&zlN`T-dDfg zQONfMz1f~(n|`pSruOyWj%cU<4t&9#_tX01wYjh+BhPGL@M=I{t+i}av41oL+yrEfw5*( zrrh(t3Kq}UZjZTlsCh{^X?UQ$gCJ{(w}86&5f!p>jSHixR?%^ji|QuP5wm4cn`>la z(RtS1ab=!hGuW!InIN#4F!jq{L8F=B=<&O4b<$%46R4q8iSmx1Xh`XQs13B*j@)Ri zoe&oF{eO{pX7JZ0MeX=c>TWqPg|2ImHJa2kYOSpMuiz4HuxC=9s-U5+5rtVl2-)Zd0h8`?!v6rv#H^;P&iJd&`5&N-+lVa( z(0yR3*)_sik6H<{`#}p5onYjYrcs;z^Q`%&4*ExIUvG6v4~g3TALDbP{XXgYul!vo z>oJKO`_I1L&k%Bwb8MLTa+%ZrYad!y!P-I@x2&4qd`P!#U&bA4_cwpgXlwJVMtP^h zLKI^{mu{3+@!17o8&#P-G6%fQ{I7Mij<#V=N=1=VhFJQ$eB`-VDCM9Qg&<<{zHYbQ zSKxhz)no3D&px0S%pPZ~VDpav*k})RuR-)TEkdq#tF3^^Y!9J;6}2YLi^)mGDcWQS zv>8RHkg@e}UOc5*@$=o($7(rW?7qJ9E5qPkF@GymrIZB=qV0X#gt!|A2wpYQ5+)!0d-b#p$B;$D#uPeHilklC^hnNt*{4?t1# zCJ%eOm$hVXMo*5-=rYG9^roOl=n|XJWsc40{@^US6wWeDb}yVo*9d3P55igW12{_~ zyOXdM-CJ0Teh|*0ALNGggK!qTq#RV&2xrkXLe$f&so4dsODn^ypO(KBU@;s!ZmaF8 z0#?lGcb7rAv)u zaR$KSYI>648!^W)R6T;-GzGJu6eqw`>!%gR3+oo4VDXuX*Fd+8wf3$2gvMD7R}F%L zd;h9r`r3NwyHm16_0>%t?JBUa;olDAsCWXfMd%XK;0Fk|4y`VYp7&N4!4w78G{#`{ zusCej0c#>bLNnHsmFcq9B;Y0Q+H&|?b8X>}Sps^fE3-LVjmpiDcAt{g^tJJr?7-Uk zQW3GP0lL4xP6mxymk>TfA6NWT+Iei?=s2a31h>b9b@gaTX2tb=iPl)lHpGA>V*wzE zE`cORt#ccy(0Z%bMpZ;KeeEt1pT-fu30-lVqt@cNGVQTG-@Yn&F90sn2oj~q*#wF7gNP@M1cE3Utsdcr zpoQ*}0v?ve(J=MgRNgTNF@-S9#t6ZfGh{M&aWO|UyfB(7-4rs(M+wRwAR3L(&=++HeNop75$T6KqA%(vA*U&p zXJ-^HFthE>VZ;YntzS&VtkB(+>7eD=T{iiw4Sx+ReLn&${UE^7nyUb7hg_imON(g% zmhL0Knny7{_y`LIT*^DbJdPJ@0CxHs1YnCPC%~2%25J9j35RuIcS_JtaE8Ho`m@z@ z&x}yKxXe0_DjH{Y-up6v7B*zPPGha2`yz@6{VZoYQet+DVYnS}-DaBAWM4QC_QQP* zD9y^)SFn`6uU**dY(Exgu*kvml9{Oxras$YXO58fZ+H?GVveyo?>|CEtcC~L3EnO^FrSWEtq#_Mr6Dug(E&V| zKB~~XN1MJjDCLfQ;10AUo(6ZI26qF2f=7<)mCKTQ)Ym7+)z>G-J^E;&AarM;N~~2< z55_6pUE6aYJlf_uEA*FlaABQ(5wDeX z@s~|u3k4@_cR#qrB5UohbqZgVD+Fy^)AxXF>QI1=^AryjVg!4=&f!+O=PHHXdDO=j z2nxK58qlk1c90^iZO0PmcPm$Rp8~?*aaMtXJPH=wfM|FV-1AQME1~{oknBzC&Et`= zQel(5#}!i4Mmv4kSo{y!Ah!D_hrDC8@P=C}j_1}~I}$!f;m!At+p;B+ZoxMjZoPdX zFt3kg*qjH0r&%AJhz=KQ1W8n7CnrcKAU*~$8!c0;j1%!R%{qP}mL6EaCtF7Tb%J}c z3$T{^9P**;B9HTDE98HO?1RW7FyUxesezn&~*U|H+)H;UzIrehRe|Kd=W zk8+vJ*H3*#xl)Z7F^;00Dx*8as%l**GN=!16|=7qZkd~_Snr(a6M7UAk`8rv+N$Ej zPg@aZJ=D+2d%j?1kF%c=4YV$vs}L|q#tpWjf3s+am3_T64MmSZLJ$+rpVdAZPZ%PR z@rYK)l>kSETL&(5D<h`tid_byp=uhb4i zBi3JH4Zl(Z4YRIPc~o=a%CnDkScj>MM~=igSEFdW)$VE&nqV!u`b~roGpt(MZGS`q z2&f}r%A;17YxDSP!&<$iT);#D%OrrMn)OA~w`j5k%@hHi)$(`Y7nw_ce~&2LDsuB_ znwI(E&E`Z|minWlaQ8KTR3Q4sy7XuDpjk4{Z2MX=-@S#9=NvuB^xGM^H2Fe;%(GhG zc^RJQ#dqo>u=2;9skAk7+}*7PXtd44VxjY)lK_u|-R!XjJ?w&j$e#~Shd?zB&;cTI z;n=gZh!&}FM73$L`iW=*-X=1I;|;ud2W?fU2D)UZcqc{C64lI!p5LlbPO3neYJ-#Z zvbv&1yXYP*@{SCkw+z~#F6N>=QoTBuQYc-$5JHz|sVW;v@tE(eQ2ID#nGVh2;sHKU zp70dMLDkr4BMX~-yf;EAH_>u0=b_n%{d(u+qhb`0Zp4r|P3_4~iIH9-S|koI3;#2~ zx@EdyY!<6$uJAT5K%I$Jsx<{^DPJTlFV(0*R9Rj|wWGr7*Fxl@t1gGr>-3YVAA$LG^I6LFq9vaA`p+sk3O(0&s}`fnj9#UX5`f~v zXyDlzH7J_ip|$E0ajs5sGjwX!5?$EeU! z)PrwbQ7NTp5Ol6RKNbo3#)+twt@Eh(p8SI9P@0b6)*C)WtqX6|_kz$GiLW14j3@Pq z!`!64dx{#;X61^dO0-2)k0pgQvSKNVCaY<2^a)*5MaxhGT~bxbP!b(b>GF0^tu8}z z=(0DlEUh%?khgdRYGz<$mr9fwunpL0ZdXq|LlcTD^hZ)1p7AU(P|drho=}IMp>n+N zxC*FDrFj2IRlYJVZM*li%Jdr1YPGNmwJW^%nD)oom>^7KwIM>dKf{PKeIuHqArom*?r_;$zR~y#s^e zjP+d2F!ikNTqqz%eo)O{pjot0{qX{|efmekH-X)_(JA6ZCiKL^0!ctEb_}iSuz^26 zseUynI!ezk-R$YBi&~e#8oJoy#+uZ)pnnUVIT$Txa_2UGRx!1xM%WPpOT@B1Et&hh z9c$5GqND0&0+pg)RD_4z^s9OvX(a_8-(Y#iczXd{-$oCW7vNs=04M-%(c1J<+%D(~ zBIn^x(CeAI#a`9B_tjx1<}o8&?YvK=)vDSQoiAJH{y3~H^Ms*0yH(bGidK2*Ag=qP zG~(2RQ`e|NuhM>%R)@j^<~dP6-CV{Xs*ip5*1W48&VB`;#foK z1PX7`2>5KL}f869Xd%UoD(v1-+n+JK6^ zP3Z*`H=BZCEK;vFqiUrWA;&|){ehCH5Qz9T5(CU{oze2@f-V-53xNApecO!67di^m zK~=OP)Ckc}XgX@B)w3yFg*6B3U!-1YPMt%bN014{fy};YM{}x&qnjTl8tC>4< zJFV0O71jE8s3KcVtK$6pDxfVD1lx{mOV#O+dbKT`;jvCzcC~Itm1(R>Yex-uk{%fi zV*^ajHsP?qJOT!RYb=)%%Hv|P@>H#;-hP)B&>e5^d(@5+bszM-i@OtJ=N`_AgTgBQ zi`8e!)E-#7_ob)XH+!tFjQ5pbfOrOaCKB5@&n*OUsdk|h@pO}_Xkv}M1Q9~ zz~AktRycq*jCQE?9{{Re^@9u>sd9ZtF_C^a_+h3?T<|;!nWu`+rNUO)wNRDxA#{)d zs`rQVN`ZmS7$<-|2q|VDxWUM1GKZ+_59zby;iwmWHbP3kR>L2V(=f)IJ{ap8(w4PW z8QhQd2R0}+k??3+m9Y0MF%RfAx-#D1IcH^cR6@JUqhYV1AWO_X+n$()s&h%yorY;% zj)4h~bjXTqKl%_mAs0oeoj_5%jliJZ0#CJtSbfdQ$kCU?jUv!Bx z>9VBHGzC^@jTF8PUFN_J{SM!TE(J^Gk(E9#D(6Kj8xO|&@IWFz>h=c|MicZ^A?d>g z>pxu8ZdUHO2o%X(b?pqL}YBC7aD6!?nXj=m7g4U*CC zxH4VhcspcGx39$U^gE8F+u_2QD&Uag=!R|fxmv#Q#JSR)FvCg$+(>6BD*>%iG)+Z( zOe=Ctclxccb{|uO^~;tJp5e3_+>G)@e*%vRl)7oXDFKr8L~rUs=Tys2>De%(I$}|X zay!G(JK-1(*!7mO+og@yQ9^(f#a`r;4r&a`p2 z$Qgnp6G%B%NC)JSNne;;i&c6G73M`wmGUdt0LsZIBO#NV9wR9l63`ifTyB4VNQexT zJJlX>$u}bS7-Z`r^-d~9qWB_}UM+_$J{F#jMpMsZj%{ zaQHH(fC#Qq$>l@=_l~w^(7tg1_0F%y<&s)Br6sQu4NV793@umP2GU%QSErgep}L_1 zk}pT>b(kvz9G;9oi4ypD`|7_S|3!HRZ-)`n^<}<5{Z;E%;DzZnnDW60NVq^Rf<;XK717=-mf4t;)nG`-7dS5>41%>iXC zixPchQMJyZm*ge?7;4DrH&mN36j5Xojtg;(WZcJ=85X&sMvb9%oOW5=7(+KaTby!r zlByeO7Z4ag|L?Ke@{Z7Yg4d#tik3x~um1suxfQA_YPZS3%&jVJ9L)fk?j8r*Ypc3H zj#@)2enSCIb!A~STmc+AREP28PChk?Vvq}3-hqtv7?%fDZ~#;+>K@~YaI>9Inso}+ zK+Z0RM@tvUvX5m<0D=*$lQ*QodybDno@fO40=h+*brIi!|KsRsJ3R$RU=Ok=;?wcJuaIHB=p6Tj|ZSpQtRb!8f;nJu^*aQ;OFw}q~6F(wd{ zpKk{BBI@rQI1_eGSU;Cv#m)_3-$xan1r=9T!&htJrc1bGQ0#Hoc8Wi_W1dAwP)O@*}X&JgoB1rN)rK z@64rlpF_Q<)TnPFsz{t+ioK}w$aTc&83==D9bQnugv2EP>Zy1HL4{QP(>F~YaZ;<*}!VZLTXQU)b9(CzW$`c@-DUk{-HIxE{iAy=ex3q_Rh2nX(yF1t`)kgBpNe&&!~Q634ZF2y#Ue;|XNje-Q(z79>Q8t=D##$Gzt= zkRL7ba0yK^hTn3iibFX{E%_E|{wD9`Zz+{%yXv--%F$^xc_|3@jCc1^h}jVNfC4Uf z`PM?!UrsND;nNPA9edWpg??7eUQXqs<=Y3{3!g{013UVOZr{(g4+2)n&E?cS{EC6h z`vBPSnxEtERrped9C4WE)F)m@o{MUSmrCR0*Sr+rl7`<@-WAx*CFNNGy1Al0TY;ND zufAUalXHWrwvwJrzTxK}_`K!6IEcT?6C4B+c2S1OfU~G zn8(NL;~OQ_y*2a(Y^~SU(kdJ|?>c&!?#)hIM;v%b$RG{++cm1C=5L@fbXondfo9S; z_4!5`32QH86O6+VYSbo3|50k;CVJgD+U0hs3)48tb>8V&@~2v|iE67Ck~m29+DxSi z?-ci}kaSf>e9Q2ph}Q-#ri{(7qR*&9o8b&Qa78uTLcQHT-O?8(8Vo>WNX%LuC8~~L zo-OM57J9dsuNN{T5~Nq0agH8!8Foyy`<_0I(|x2ZL7K`t;x!lcj}$3tc#c9tyfSVp zmB9U$+zQ75NLt>ms=o4eUaj3qJ%TnE;1|L=t8b%@aAM5d1|9CII=qc4hrwwgNr>7( z0@34**e;m-r<%Nj>gPQ8W|7V34Ex}Bc0lPoque{GryP9jPWqI8x~0rraCIHbRuy(p zLB4#$76EVXf^D_QJ75s^KoGszUcrZeDT1?)>8}iczoZfphP= zy1$1C<5&gvYP4;(mzv@{llD?d!0#}b%o{2ui*^HruV&GVU=bRkh`^GbypJBx0ySwr zTth={tIhkVZgG$ed}QVyB433KiH3pBe~S9TaMwI_fR+I#emMZwic--B!KUx1`3LiZ_IID^}LAFUQjbHQtaP)-4`*5UQ^WRi`egY6?X|VdqKT>i9Q3R{BjAhc%o`^ znMwsr5;B~u2468M@;7+bZG;)x~SuEA&dysZa<-*|_II$|%e}WFv|H*i2Wu zuYjdZQ$bg$ntQT7{$^K_DNhdhD_v6pa2|2et9PzaI&VI$=o%sv)76k`@VCxTVb|%^ zVpstdLoC2 zjW^lA4BU*>8Ij}5(>Od}n#;3p4XZrUxrVBm#9?aM4f?*oHrXKd2C#0&BgtMBjfC11_0%m&g!g&)Eude9nsW;c53Q-|aB% z2t@&z2dPhxb)itWyWOQWGC1oly;33DjeNGW)3mWJu5BP;#47h&*Rd%zhx`qeoXZTwZf5b>XqPiJe8Lp?pPOhtdGZ<;}|Ji${ z^xhUSTdylASWDD=7sngly5QP;zp%RL;tHXe8ohET-=G>Rp>7e_M%@GWeQ>BB0{D4f zszH{D59D8Ig*PmS`*Q9Tu4q9JH}J*{FIOp-XaswNBEFXeLSFlOLJfoQ z2<0Q8NDK%hBs|U}(CJ@NnIqfHH{TZZW+<0~sy{FkqerSaq5L9z(^o@z3XfqG?dB-@ z-rBpSlsb@`^Oby@`|@b^C(~a-%^fON9(;T|QN5Rk>(EX$I}d+^x2Q0Fo-bTht;4u1 zJn{p>_-P$%$F8CA2tqzDDP^MeLjl^QvcmW!V-3PIXH2f3UNN~Poc*&*?&9MkCDgNd z`7=zsG%sg{`;)-%iCcLGY<*Ec7``XinW_1>6b?2!A2-6muIJ;qC?@4+319{mV0a2{ zsH6h?tLy4*P>5<;kfY(1?^=*|ME~%JD~G%Wk!Buqae^CKa#7m`A9Y8)S%_J%){WfxL^Dc8yhMtLRoJX(d&I7 z#aZu^BK$N}f0PI>-#gld}|F5$%D+)z43m)u+zMWtxYsP>yJN^*+UqrUmHc+Vl`kGMiwfG)s= zF1b|q=h%(lIhTY*(k6yS2Co822<@XSZ)>po78}^5ik9Hse!1WEd(IOIMHFNZi_aop zJa?(dF>3zz5FIy4Z~;W9a+Tzoh!Zv_2~^TWG4GO+T%F7-0=z7phP@t0cV68t#TFR! z@X|av{{@$M^>Mpshu72#Pw^&b)mZ7xyuafbh46tBS}xsConpB;l;+j3nB=Bv5eLR` zOD&7zkNBcXE!rjF{4)Gw%|CO%#+TrvJ&B+nzw3Jk`BR^?FAgm_1q!#3rM@c5??BT0 zT9(7}LBxPR9A+)y!22O%g3GbUm;vSZ3e@k9%kxMu>VT*Dk`5UAd%GY6xB`DeuC!D# z@2UmyT-wM;C3PsC8yZ=7h_1+o>7Ke%kxOvaT~)ji$nn0aSBbktEYLmzkn1@)KOlp@ zI(c29OO>#@hbsOV3`+@6uRg=AkXx|m84eDmDzOSbANtVcDP}w9((WPUfM0;y z^+FY18}AdSAlPi|kR@5q^ZQP}G!?%ms3J&A8lBL0Nc~im6T#wYRpU0f=EFu1bCh(|fQQa0ub1{LgX&Xu5Ab%UfuWimAb^3k(i;WDxmrVTc-4L*v5n8eCG~5cnL& zAjVVXIj)CEx}k6l3OxQ}^}UCy&@k^kkKFHY z<*LJ}&Jh9TNHwGmH{q=N>Tn%ymG_=7U}%VQ@TojzN_(I@b-7M>T0nHLG~h=o*yC^q zN5tgO?O6}hl)4Zcqr6w^0&JZ2P!*^T#=lG@*XMmSTD5$Ur;??vy~xj?DAj;tsgG*b zfCm884>jPk=((mLH#5h`EoOkeot~_KBy+5aXvEXu#8}&iw-!~>h%8%KKLz0wPd~#K z3YgNE!=Zq$Y|NFzCfM0nZqZ{6^J{glG5-Js=s*+p6qpnsXsOlzkcKu3o2+7+0#PQZ z51WEsCaU30As8m9)lI>kCaGVV^3Ys4ttAbJ$XJq4N z7HTKIq=92Giu7!5n$;PUyW2AI?A-12P&qXZp~wXYbo8hB8op+LoxYI z)qD$3S*X5z3v73xTK*QV@T2B{w*l-`YTDZ@$pqKm#$7H{5p8%lm{?d3j!?bd;dphU z4K&He6}!Pp>bK?Yh#akG%gb%xF@X1RJ09gm#0bP~j($v+NXrFm7Ym4`*HiEEL^A_# zqV7Y=;V*n1``_hlSYzUQS_V{jA8OD_xz18*{QH`G^qqcZ-{~s*PFKmD7FM+qIXX1^ zp(EM=*?7`YNOelY@#m;1iJa-mNC{rq_shGDS{I z9Z{&rT%kN4@ofXZ4Oz-yQK2>7!O{6)aG0iIh~ zk8P-Ov`M{}#PuP&#Ck2HHY9P2+?(yh9xb9bE3-XE=F*}WT<;$jx~N|51c9;Kd$$t+ z59H|Fh0Esh8@u*5@ia@hyYe)i^|SsYe!05b6)OEdAVU>Zp*ug9<3{7v^6n57`iegW z-2JFjSsm`dg^*iur3Y6JTw`;+ah*&zWeh1axmvJNZ?O>yzQK^;fnM z60oc1T~Wt-0o%^1d%eI{enz;NBa;_o`#Z;SCj@~C+F!h{x`ArZDLUC+S*Pc;!$rCe0$SjGSEWu@_@-5>KH}WG;EdY-5f?AI zE+9rLZ^&m8|EOmhNOHnihq+$CbK9usMk6LbbUR2hag6CCKxy8j-v5|C=CpI_=*Qfg z2mhwZe}Z!VdG*yN{4QtQR3|>+Y(8;8ZSKvn#*K>(b)`4AGBPeXRHIKh0v^B*K7~Zv zsLFlDX2VLI}4pIZ9kS5Qmw zqSexp$y_;qitQA(6%JV&zSxe*Tp@UeZ{hoW)XZcaZR`w)P;Dn8LKOK z+e%3}zOP!H0%dxa`c;bE<5Ib7r9Jj;)(_FY(1OgMsw_XzA&P@IouNA5@A|%E?$x>r zd<1sZh{%bEJ7tZV#D-)%6OS`l-+XTs;4wfN11B#u?*sIbA1*+*5K!TbS_9IECIhP2+TtReUzIKVM}D8C*4i$-y= zJ;0jX@&`W*BdhoTD#zVIHI1TQKLu!5+lz`*v=QN1&6XQm~tUo(KMULV!rQ}p6 zMJkayNNDI(fG)+R2ts_yC0M>&b;L(;0!r;OG3R)LM)Mc)DT0{1`5u1Jm4NxnP98cCDL8 z3LU!RS`beeL@>HrjOC{*{&+Sm{P<0cQ2fHneiO)Vkm`5%<8+C8&JsTgOkrK(zI6#> zUAH4IXnG*p*Tas}4U!j>rizW{^89Ci)pR@;j^Ai#5}7?fZ$YH!3p@Cj_GR5*HD{h zs2yMP$A4MX4yp(Y^)z}_7;V+vR9|oI1gwXNuxc->{u8-$@D(5LOCP9~P2`w@`W=^~ z4H38x<@T1hgWbxhm1B0&DrPcQ%ll1WbS_a}96(f2wq|&fCi5qhe|BJW5C9bl;Kjh;N6Tz=V+vO& zd>L*_RNA3+dD4xSRgJ0mis^cQs#uH*C`#w*!N1!CVIVqHC!JrE#`RA@Ynh%7E%c_^ zosO@E7Y2$95=C*;p`$aO3&H8}CHWRF7%#q(@I}Fz6^vns&aR<2ha{>NKxUOdqe26nrARt=m zt64nAdvQ99Zv_6@&*V>p$dAwDy;6Sr4Y!dp-z=_Zp0)Xv)3Yr&3CZStyf4qBl@xwile2W63kU_W~#ywPj? z*L~y%>jwt!^Mh66Q6tsh4P3go&)~V`b0g@eHk{5kgpk-AsP=4tF`(@oEl$BBZ>pXf zxpMB^0s7SPbq+-K(v7@ZCn{Gh(w&96lqwy`X*cKWJWn@4NpkB}cA8o&f8&=Um(-zH$ zj%cX~E$~SJ1kFh=jR1}<3)GoC;DBdU-o1PP0nO8UVMQYvGG!lEL+Iv*eOwiv0p;G$ z<8zG;gb>Adv!)#*+qoYa!f172Klg#Zq{{&W2X?4o2RNEX4p)m0z(gDGg$J)Jez`zo zD0Zt$C?r$Z?}+rfbC>oQhcpCK`7!wWE`Q-0!(Iq)G*DAKU7EuVKc>SyiUf=~Aud>etafZ=1*)Svlv z-~)=MRjDIzK#Wn}9pU;Y_$Y7me|8yUe|C9dsJe8NFF^nw`33ILnX2QjFpX!Z3di`O zs+tWsR3V!KT{8p2J*2Kq;)p1SLJ8Y@OvKni%GC)$}BnGWL!jl@f)B zeA-E_|EyM8p124bTv~SlfOQG5=@LqgE)iPIQemgKV1Dg378OU=OB5nYRXfF9{BT`! zN_$-npVHnL_i4}>l6X(UJF`fQKg}6%D>OXA#S;Av=|{It_BM7%iEZc-+t4Mpp-XII z2gQK({KKaU34ovdBNV!;>}-eHb%u8ULh3Bm@29fPLQ4FsBF^FMyn5vvZuUpD;2boj z@6?HNxYRQ$?l+)(mTLDKmv)}U#i(m%aBEY4_+R`rYy1z({11oy4~P5@+x-vM z{13nTAAa*c?DRim`ybZ(AC6H8-x25gs|K>K=1+gkIaT`-fOuI=z67pvMXkBSPZzvO zAtCrdj%sqdpoxsYkdWammS5(Rq0UdbB=%5yav9I4>UX)88hMKY)R%^lKXae3A0KEJBsoJIpx?LGo5pE`{Ss^|mw>}H^!vrD_qiK@#39^I%{`wl&NB_?+1 z)!zMH`*uCrz1J(Thr2@;xAcISa>5bPKgj)FyDnY2_Hw_Q=x*okl-NtU^lIO(m;1f0 zofCVy+kGGvN$TMPF7`~0NqV|v5aw#vsZ-Za65r3UK+nWp?hm^5(5v*cfza(C=P&Zk zdtE>3(#zfXqn>)TZe4qJ=+)ulM2C7K$cR=m9wNNG?>;veYZ^n<3lF%G+ItrYaMuSM zo%{X7_qx81MS6DlEYYo}9DCRJRHc*gk~;g4<3inKv4O<*I`;givs*D6rPR~;ji`b+ z+DGj=z081#;!E#s2jPBMAeIoa_WsdMs?%E#9k^bk5Mnu z;rp*5%1Ze64E|Ndzbg1=?{*X$h16$37&(EBJhIc5)LsCeYq(V&rxBqlx{R{kgHEFi z1vxyYuRB5p26-R2j0&V?vyns&)gsVnre*~inQBUqu}-~}%UFn>7wPjA? zwyF?jj8I#`jBdd@>Ny;RvFY6Py|qjunDefz?{Ea6Vk64jD6`a?`HY!Z`2G+I!M6|( W@)=obmtoZQ7AasvlQW^A!|{K1TROb} diff --git a/contracts/test_contracts/sendinline/sendinline.wasm b/contracts/test_contracts/sendinline/sendinline.wasm index 3073cc831ca587eaef57d492cf4ffba4b5fe7b4c..f1f6de4289754b3536f98408089803ea4abcedf5 100755 GIT binary patch delta 464 zcmYjNJx?1!5Z$@m`#$466B}}N@ZMoN#_oa;DFDeS(gh)!NGY&UxWbpjU=CSIb0=4j zB8tgK)YNI+Alsw-TUx9oUJ#sEF%Lw&$2ux1DY#j z5_8B0AQhTP{qp6>uA9cAqyBL8b~uU&(0DZQ)A#A{xPO?Y@#$Ir_3=?mblPeX!<1!$ z#niDGI3@rvCQCKA;1vq`s;VW8& zMV!zce-LScO7&^N%aOq=_>KN_mjVGoYik}~M&SjPFAbKueZw~X6N|W@Poau4{Qy7d zPf!^9@DNkuIRyCC_yLdSA58|*@Y&iaJrdB?SVR&KZ v|1506+Pqub0^cD$BIKW3^xPde@D7gcI&i$SD@D_FJ;G%$^>W_Dl%M|v@@`?L delta 477 zcmYjMO-mb56n*!-m-)y{^d>dYj$bc{(NUowmBxhxriiOn#f>|o=s+_m@ncG%n+Sr~ z?kbnMwo6woveczNK-?6%YQdej7gxTqP`uoG58QLOobyn8D1Lvzzv7$_N1dc#S$|Tk$%_}DAKt-0%P>YUMiFoB*qfJ2uCyw zL|CEu^c{@Sv~$9J?Py@eHb$2*S&}ml{COdz-X2EqCYAZ=<9HJNx9|6@a BVv+y= diff --git a/contracts/tests/sysio.system_authmsg_tests.cpp b/contracts/tests/sysio.system_authmsg_tests.cpp new file mode 100644 index 0000000000..f2e046af08 --- /dev/null +++ b/contracts/tests/sysio.system_authmsg_tests.cpp @@ -0,0 +1,134 @@ +#include + +#include +#include +#include + +#include +#include + +#include "sysio.system_tester.hpp" + +using namespace sysio; +using namespace sysio::chain; +using namespace sysio::testing; +using namespace sysio_system; + +/** Wire representation of auth.msg::onlinkauth's notification payload. */ +struct authmsg_onlinkauth { + name user; + name permission; + public_key_type pub_key; +}; + +FC_REFLECT( authmsg_onlinkauth, (user)(permission)(pub_key) ) + +namespace { + +constexpr auto auth_msg_account = "auth.msg"_n; +constexpr auto auth_ext_permission = "auth.ext"_n; +constexpr auto onlinkauth_action = "onlinkauth"_n; + +/** Build a minimal auth.msg stand-in that notifies sysio for every action. */ +std::vector authmsg_notification_wasm() { + std::ostringstream wast; + wast << R"((module + (import "env" "require_recipient" (func $require_recipient (param i64))) + (func (export "apply") (param i64 i64 i64) + (call $require_recipient (i64.const 0x)" + << std::hex << config::system_account_name.value << R"()) + ) + ))"; + return wast_to_wasm( wast.str() ); +} + +/** System-contract fixture with a notifying contract installed on auth.msg. */ +struct authmsg_notification_tester : sysio_system_tester { + authmsg_notification_tester() { + create_account( auth_msg_account ); + set_code( auth_msg_account, authmsg_notification_wasm() ); + produce_block(); + } + + /** Send auth.msg::onlinkauth and return the transaction result. */ + action_result notify_link( name permission, const public_key_type& pub_key ) { + action notification; + notification.account = auth_msg_account; + notification.name = onlinkauth_action; + notification.data = fc::raw::pack( + authmsg_onlinkauth{ config::system_account_name, permission, pub_key } ); + return push_contract_paid_action( std::move( notification ), auth_msg_account.value ); + } + + /** Find one permission on the system account affected by the privileged inline action. */ + const permission_object* find_system_permission( name permission ) const { + return control->get_authorization_manager().find_permission( { config::system_account_name, permission } ); + } +}; + +} // namespace + +BOOST_AUTO_TEST_SUITE( sysio_system_authmsg_tests ) + +/** The reserved auth.ext permission is created below active and can be rotated. */ +BOOST_FIXTURE_TEST_CASE( installs_and_rotates_reserved_auth_ext_permission, authmsg_notification_tester ) try { + const auto first_key = get_public_key( config::system_account_name, "auth-ext-first" ); + const auto second_key = get_public_key( config::system_account_name, "auth-ext-second" ); + + BOOST_REQUIRE_EQUAL( success(), notify_link( auth_ext_permission, first_key ) ); + + const auto* active = find_system_permission( config::active_name ); + const auto* auth_ext = find_system_permission( auth_ext_permission ); + BOOST_REQUIRE( active != nullptr ); + BOOST_REQUIRE( auth_ext != nullptr ); + BOOST_CHECK( auth_ext->parent == active->id ); + const auto first_authority = auth_ext->auth.to_authority(); + BOOST_CHECK_EQUAL( first_authority.threshold, 1u ); + BOOST_REQUIRE_EQUAL( first_authority.keys.size(), 1u ); + BOOST_CHECK( first_authority.keys.front().key == first_key ); + BOOST_CHECK( first_authority.accounts.empty() ); + + BOOST_REQUIRE_EQUAL( success(), notify_link( auth_ext_permission, second_key ) ); + auth_ext = find_system_permission( auth_ext_permission ); + BOOST_REQUIRE( auth_ext != nullptr ); + const auto second_authority = auth_ext->auth.to_authority(); + BOOST_REQUIRE_EQUAL( second_authority.keys.size(), 1u ); + BOOST_CHECK( second_authority.keys.front().key == second_key ); +} FC_LOG_AND_RETHROW() + +/** Privileged owner and active authorities cannot be targeted through the notification payload. */ +BOOST_FIXTURE_TEST_CASE( rejects_owner_and_active_permissions, authmsg_notification_tester ) try { + const auto attacker_key = get_public_key( config::system_account_name, "attacker" ); + const auto* owner = find_system_permission( config::owner_name ); + const auto* active = find_system_permission( config::active_name ); + BOOST_REQUIRE( owner != nullptr ); + BOOST_REQUIRE( active != nullptr ); + const auto owner_before = owner->auth.to_authority(); + const auto active_before = active->auth.to_authority(); + + BOOST_REQUIRE_EQUAL( wasm_assert_msg( "onlinkauth may only update auth.ext" ), + notify_link( config::owner_name, attacker_key ) ); + BOOST_REQUIRE_EQUAL( wasm_assert_msg( "onlinkauth may only update auth.ext" ), + notify_link( config::active_name, attacker_key ) ); + + owner = find_system_permission( config::owner_name ); + active = find_system_permission( config::active_name ); + BOOST_REQUIRE( owner != nullptr ); + BOOST_REQUIRE( active != nullptr ); + const auto owner_authority = owner->auth.to_authority(); + const auto active_authority = active->auth.to_authority(); + BOOST_CHECK( owner_authority == owner_before ); + BOOST_CHECK( active_authority == active_before ); +} FC_LOG_AND_RETHROW() + +/** The whitelist also rejects non-critical but non-reserved child permission names. */ +BOOST_FIXTURE_TEST_CASE( rejects_arbitrary_child_permission, authmsg_notification_tester ) try { + constexpr auto arbitrary_permission = "session"_n; + + BOOST_REQUIRE_EQUAL( wasm_assert_msg( "onlinkauth may only update auth.ext" ), + notify_link( arbitrary_permission, + get_public_key( config::system_account_name, "session" ) ) ); + BOOST_CHECK( find_system_permission( arbitrary_permission ) == nullptr ); +} FC_LOG_AND_RETHROW() + +BOOST_AUTO_TEST_SUITE_END() From be774714db6e55dd6c43d8c1ea76ad5ec5a5b921 Mon Sep 17 00:00:00 2001 From: Huang-Ming Huang Date: Wed, 16 Sep 2026 17:40:52 +0000 Subject: [PATCH 2/3] Address PR review feedback Change-Id: Ifaa3f15b3cf85414c9d1534c64b8abe13dddaaf4 --- .gitignore | 1 - contracts/sysio.msgch/sysio.msgch.abi | 12 ++ contracts/sysio.roa/sysio.roa.cpp | 7 + contracts/sysio.roa/sysio.roa.hpp | 11 +- contracts/sysio.roa/sysio.roa.wasm | Bin 50583 -> 50836 bytes .../include/sysio.system/sysio.system.hpp | 15 -- contracts/sysio.system/src/sysio.system.cpp | 17 -- contracts/sysio.system/sysio.system.wasm | Bin 202045 -> 199181 bytes contracts/sysio.uwrit/sysio.uwrit.abi | 12 ++ contracts/tests/contract_test_support.hpp | 11 ++ contracts/tests/sysio.dispatch_tests.cpp | 169 +++++++++++++++++- contracts/tests/sysio.roa_tests.cpp | 43 ++++- .../tests/sysio.system_authmsg_tests.cpp | 134 -------------- tutorials/sig-em-tutorial/clone-repos.sh | 8 - tutorials/sig-em-tutorial/prepare-sig-em.sh | 45 ----- tutorials/sig-em-tutorial/unlock.sh | 7 - 16 files changed, 255 insertions(+), 237 deletions(-) delete mode 100644 contracts/tests/sysio.system_authmsg_tests.cpp delete mode 100755 tutorials/sig-em-tutorial/clone-repos.sh delete mode 100755 tutorials/sig-em-tutorial/prepare-sig-em.sh delete mode 100755 tutorials/sig-em-tutorial/unlock.sh diff --git a/.gitignore b/.gitignore index 4d7fe2b3dd..dbd166ae7d 100644 --- a/.gitignore +++ b/.gitignore @@ -73,7 +73,6 @@ scripts/tn_init.sh tests/plugin_test unittests/unit_test -tutorials/sig-em-tutorial/contracts doxygen wire.doxygen diff --git a/contracts/sysio.msgch/sysio.msgch.abi b/contracts/sysio.msgch/sysio.msgch.abi index 1a423908ef..d273339ee9 100644 --- a/contracts/sysio.msgch/sysio.msgch.abi +++ b/contracts/sysio.msgch/sysio.msgch.abi @@ -681,6 +681,18 @@ { "name": "ATTESTATION_TYPE_EMISSIONS_BLOCKED", "value": 60962 + }, + { + "name": "ATTESTATION_TYPE_SYNDICATE_LIQ", + "value": 60963 + }, + { + "name": "ATTESTATION_TYPE_LIQ_YIELD", + "value": 60964 + }, + { + "name": "ATTESTATION_TYPE_DESYNDICATE_LIQ", + "value": 60965 } ] }, diff --git a/contracts/sysio.roa/sysio.roa.cpp b/contracts/sysio.roa/sysio.roa.cpp index 3f996c7766..e190daf6cc 100644 --- a/contracts/sysio.roa/sysio.roa.cpp +++ b/contracts/sysio.roa/sysio.roa.cpp @@ -6,6 +6,8 @@ #include // add_sat_u64 / add_sat_i64 -- never-throw saturating accumulators #include // get_permission -- read an account's active authority in nodeownreg +#include + namespace sysio { namespace { @@ -13,6 +15,10 @@ namespace sysio { // literals -- a contract rename is one change here, not scattered across call sites). constexpr name AUTHEX_ACCOUNT = "sysio.authex"_n; constexpr name AUTHEX_RECORDLINK = "recordlink"_n; + + /// Names under this prefix belong to system accounts. The chain refuses them only to non-privileged + /// creators, and sysio.roa is privileged, so node-owner claims must refuse them here. + constexpr std::string_view RESERVED_SYSTEM_NAME_PREFIX = "sysio."; } // anonymous namespace static bool is_sysio_account(const name& account) { @@ -795,6 +801,7 @@ namespace sysio { } bool roa::valid_name_for_tier(const name& account, uint8_t tier) { + if (account.to_string().rfind(RESERVED_SYSTEM_NAME_PREFIX, 0) == 0) return false; const size_t len = account.length(); // Tier-1 owners take a short 2-6 char prefix (sub-accounts become .); // tier 2/3 take a 1-12 char vanity name. diff --git a/contracts/sysio.roa/sysio.roa.hpp b/contracts/sysio.roa/sysio.roa.hpp index 71cf972ceb..3802e2ec4d 100644 --- a/contracts/sysio.roa/sysio.roa.hpp +++ b/contracts/sysio.roa/sysio.roa.hpp @@ -371,7 +371,7 @@ namespace sysio { // to migrate.) enum reject_reason : uint8_t { NONE = 0, // not rejected - NAME_INVALID = 1, // chosen account name violates the tier's length rule + NAME_INVALID = 1, // chosen name violates the tier's length rule or is a reserved sysio. name OWNER_NOT_ACCOUNT = 2, // account does not exist (creation did not occur) ACCOUNT_KEY_MISMATCH = 3, // existing account's active authority != the single claimed wire key DUPLICATE = 4, // owner is already a registered node owner @@ -486,14 +486,15 @@ namespace sysio { uint8_t network_gen); /** - * @brief Whether `account`'s name satisfies the node-owner name-length rule for `tier`. + * @brief Whether `account`'s name satisfies the node-owner naming rules for `tier`. * Tier-1 owners take a short 2-6 char prefix (sub-accounts become .); - * tier 2/3 take a 1-12 char vanity name. Shared by newnameduser (gates creation) and - * nodeownreg (records NAME_INVALID) so the rule lives in one place. + * tier 2/3 take a 1-12 char vanity name, and no tier may take a name under the reserved + * `sysio.` prefix. Shared by newnameduser (gates creation) and nodeownreg (records + * NAME_INVALID) so the rule lives in one place. * * @param account The chosen account name. * @param tier Node-owner tier (must already be validated to 1-3). - * @return true if the name length is valid for the tier. + * @return true if the name is valid for the tier. */ static bool valid_name_for_tier(const name& account, uint8_t tier); diff --git a/contracts/sysio.roa/sysio.roa.wasm b/contracts/sysio.roa/sysio.roa.wasm index 8a56d5de3058d45dab58f210da19ce89274881d1..751f9dcad0ac6d0ac34b3b1aa72d4e2c73a981c0 100755 GIT binary patch delta 5730 zcmb7Id3aP+mVf8Is!Bp7<|Qp;1M;epK!79!feIkDc@YW7k_1FSga#R*c|af<_N5{T zh{QnPumlVtEFwsN#A0g}!3MigS{4@;TLN zR@{EYXyh}FF8+XsC?>@qclQR`MZ2kyn&>ThmwrRPrBn1Cy-&ZR59kb?rE_$iKBAB5 z6S_bb=@NZGf1rP(YxE`kk^V}5qi^W%^ez1d-J$R3AM{W9Pr6G>MWuLEEECH`waC~l z_K2)T(cPnPiDA8^MW4fpvp(}zhx?&p9 zrZKI=tN6sK5x6J}tyEVA$m>{>iSvBcnIBV)Te@|~P#(ox%k5q5s6H^*bw;HPfi^9M z3Od0hk*Rc>*F>(ShCoJCm6I0oq1ZmOFmN~ah(jzn&qw3B(?0$t?r^I=omVu)Epqej zgzL(}LP^kA`eEQ?{0*WT+>|&JqcbTd;U?*1gqvEKz#MOCb@E#`wVQ!qNw>miE7NNa z@vM~jk#&@)6L@x*S_M;TiP%7#ZKg#_xP;nhZu0ijj=?S9YQFW7;E1%Y^g2J1mQC9N z#cA_|h19yNYTEIJUO)M+C(WwxdLd=8*Leq@1u z2(-=WN?k3EA%P`{7L)`MSQ2Fi=i^FnaSn@{T+z9Pu5g>|e7X{NKD#f-1{%6#I_}}J zaQn|MXTT6?0tM4&d6u9mS2;i#i`8OBs<>k4(M8#!3ots9N0)NfTROxmg zxlfo%^SOO~S6aX$^QRH>@A5~{N$%LMn*4mYpWjgzMk@F1U+Q;eDmB9661i|3s6JCs zw24u0li-Iz2I(&2E|q9zB*E4?bx;*8;>SnCeMfYMHtEMF)Mh7ir|#O7cbCd@)IttC z(Jd^9pTB-0-!~Z~z*FJlQHop{Tgglpims-MY_B69NF9d1Zxmq?rN*j{6}jti@T36= zen*T@9*-h-bLK(HW*(@dDyJmcQaFw47Gkdhgurg96fH!}Ytc~foo!;ct(Z2sYc{zU zRdECC_ld0}Z>5WYxS=@vNlY9*uw$|VV2k50$*e>a4ivhohe@t)anZn@el@R5{`MVS z_fU=+uB& zE2&;pO5`-sabI3lwG>OXbP*rilJM5vW*ZgcRYQzIVlXP%yvCgd>HeVlq`-~BOjX>c zNvM8Wkb-bD$tzN2h{3~Dw5f*TQLPW7;R8ehZJI}_0UqTrs6_H4(nX}rj8wYiaSEKt z>y*aEZ3U*0lSHIKfjYz(ZEFdN3V$*Q_?>yq#U3YOAw1IKz)Yq``b1>^C>TYxKH&hy z0#lwaoc*!(+v~{w2p`lJSlnP!gDkqrBL_V~CA@A>GQGgR8nl95RQYqIAo=nr( zS&&6DxLd&xvFa0EQcy@U`EtQ`G>bnf98A~PTQpp(5d8DB^q64OS}9~SlDK*A_)&C* zV<(*QR|<;o>j>hAl3-9*@W`NWD)Bm!ypSbbNR87B9iPw=#1{RNyoi<9@VanbLMG|1 z0RX}uJn~_G4O%2WQG<3tVxlxwzj#cY9U& zoPZ-zNX_|8uN#c%5g4!mBY+Of042-!24tp3NTZk@vJoRjfQ-B&!$y9Th*aEepu!PJ zOmQ2KT6aDGH^Cg%H%T&^#Dm8_&i^RtNvpZrkngiaKxt=(P^^sz#@rTi zcF*SB4e?xWX7c8t9ceayFtnoe9IpdHLywpox^t4IB|;kc-n6+q<;i-Q#}5n}f^qDy z`SclI8P)}3%u|K*IY0MQI{hnWtx4q9pQ@&p+4poeTEdf_ZVlTmd3qTjal<8K;PAG9 zOd38Fj`929PjTZYH}@XV7Kv-*h}xupm4T$q-AU3kuqVP0WYInh#6Gi#=rY%g^w6h# zXrw{E=O0G?IpR~Y4_xM3&mNC_P2h3WTaSzR$fyO>zz>hk#5i$u_xP9OQRLN6&&XU0 zPd^C{B5f+~8{JMUKFgnvzC!2t=r0B%Pe+dN&`r)7lTWvJ#+V!`=iOskQ3by{raSom ze#`*C^T$fKf2@SB8QTN!vtxb8Ew1OL&|)rqZnXDhN`w@MYPvT}vgwq8Cshx_(*>Uo zn%c{J`?;R9B#~>qR;}9NFb;eCFnCSZ!cy1zoY_m4It7MOMxMpl|f*^YpR_m9L9C*H_sv1 zycF7$8=nnTLsBT+@=Z50d6vlZ|Q(e{@BAz_8W0Xtl3JmowGY`>^k3Ap9 zho;80v0fqc<`ZRzSeE-rTGBpcVZ35u=bv)5Ancy2@sMfDv?_3@8YfW)sK~3@GL9*2 z$(?5=a&k!zTF%2uJamBPlst)1dm)W)mn2!MIFP>l>zTWL|UKRcNkgHjc6Z7h8R}6%ZLRzxM-Wl%wiMUMfP5R?Dx= zf83&&A8a(JjtdujOFKB!FfzYYm$2h=}rEsqA0=YH;{O(8DaJf!UJw?YTLPJ zQAgUz^A@#^z@AL5S{-j%^eA9oENVyR1L2Fu6P@2O^<|k$BOp_{24;b&ichmLaFsyup|$5u_G z1A)_3$B2$|9|JCINNHNU-_(FzZ#9*L%Dcl8W(jA<)20P%?x!{~G%VPziSV^D23 zuI3LQ^5|9QDrIdE$K|UNv8r1w>x-MKe{R(mzd#?jY|T*gfqz(2N%S5U*Gxcqzfg0$ z?^PL(WSEBMK5Q!{BpL@5Qzd8kfi>glTJv!f{?K85Hj2!tZnlF2IrJ_=H4RAj50{9%13frkHX zeG2ZSYJ3p8Z0S8DhlG9#BO6M=wT;*Tf z4Cj4jvT(zHEu24PChLG~)K-!k1(S?T!OjV!Z520rD6a_cEM(~r2}y+k7S>U;<;tkN zg5J#LmO_~D@RkmAkiXm_pY+DkH14(aF+lZgtyaG7;F_&Pp^q!bI9FeP)cR})0Ui9+ zwsPyEC6~Ri;lb0CXg31Uvg5GY>ucO)dwJw7vg%HBgi9{*@$Fq&+W*p6I%D)ZQi@eV zT9vQXhQSEeYty*jj^xyxP$qFQN{8hI}a-*|RIIv-Q;*Un0?PG_!Mv zeb{Uh*q0_p2HeCGc8#KXes|YL_e&hdhj*vO{6%^&-qU93(YU*XZ|x37Mf~5?V^5wP zA<-1n?D53hA4|XH_xE^k;>MnMw{HszQ&w;>1`0IQPi}nZ0i` zqRsMs4<+vs!N-(+F9G4dL#QB_fUfRKZz26a_Tk12j@_RIBt7N3j7pdx2hCjN$dsy%gf44uq#r6^IW2i?Jt%*AwD5e@-f51mu`22xEw1Sfl z_CgQ%%)#{j^%RX-5pMKqXt64^SQ}bw3@u&@E!Kn<)uF{EK7BCF`Id0I4+Z{y@Q5oy zQ8GFzic3)fjmP4M-#OkhUNOqgDem%ceR}c4lIhRuW5aQ`^AY< qvy=(XmvX_c6FC3GgMnvGY^5+`@g>E*l=z<~6S&R0GaQW>it=CXr1vZU delta 5552 zcmbtY33OFOn!bPCx8=RW+^}U;?t3ILKmuV&B4T4MErdN`8CIcDaN)5eAdz9q3lJhU z2`2f01ceYF>;j2TKoEz}P17Lvgr_Y(3ld8J4 z{PizieSg(kU#?cKRU6i;YPHzF)#}LT#3)-kHR?fMRD4o9ijPv;+1kY?N2z>Uea}_% zvEm6RMjbcXdIcIq*gR4U@?`9z{q#B=q(js|zoygl8#+V3rFZF{={-6}@6&nu7rHh-_VnPz)u~W1vhCC6jc;&|dVB-zPHhW%b^g=u>sY zZ$$cyg84orQ{0+}g~HGl>dJ7r9BuMrK3}lsM140A9p)rMc^q{KcXcGwnqZ#eyh^VH zJG;jU3i1o#iFB1~!Z*eW0UL3kwZO#W61KA146OfBy`%%?#bHyAKS!L#wjXJhYXr{K&AL z&d?4#Z&*&|Y-|E`r59w&s3(7lP;@m#r2AYskPMv%M@ZeoLZjrOB1gS0{&HAsz!fEw zK@m6$QumO0*w0cQqGU+t$ird^zHSQkxv-J$(h{vsYd1Indnj0v?nm*B;HsOc8^QM5&rIX)bCUkr9?EiIzon zBL(Z_QkT}nv@J!%gob2)g0Ia$3EgM0gb|#3j`xqywUGOy!41NnsPLYVKcjj4#mLT- z&yG=*RKPW(M$mk|Hfjzn;4!&9=mlPpJ4W2P$RFkA(Lzqn`<@C}A3ciBasKFu^a>Zx z?)pH8aw>!*6OH$$4&lY)`Vn(*+z&lA3ZSvVhV49F6N(mfwGu&Ch!EVe_AKTB2V%G> z++H;&g}vju(ThA{d8O*80YUOMf|uqz}nrf8Qr{})Z%FvUYv+<$rzRv(|9 zhVuIKjOZfs)Emv`O**t0rwPof1vulWWO3^}Pkrh$YT}}fB3#s{Cy!6x56 zokc6S$Ba(2k_XMmfQn0J3`hTOXUP6LW`C!dkDxzyW+s@dbmm+t;csS6^R1>h3oyFR zDb=&<&P!jP| zG6&Y|c)p6&F;CJFo<8PX&Y0z;O*~;%E?9l{EU$azWyMR9*iP~Xvo1r=eg658*N{&X z33nB6*S_G$`O%@i$Naj@>dQlJc@?-xZ=0@O;}f%E=}&xV_A+{j$Ii)f?+LR>Wp&LHiwBOtJ*`X>abYV0Y-I#QJuO&x8KL8PJDw=?G_t?N*$6y9XJsdqdLt`*xH6g z9mYKpRV95IB#Fw#adQ*gE~p?Rc{wIEWtrY&wJ)}&c$w$n{39rsvMS+OrdSb$p&UcF0p5+b@v3-IRGiF zXaSv>rS>v;9o%VNa=>{%7r_aVgUl^(Z_u5Rhsadc_yoIJO$nGQDrQ|pmqRO&vZ0en zM1aUu)dH5yxQ=nmRZMWf9T>dQIw%J|8LPGqIa0)9)-s12k@-df3p}h@*u#VnV9g03 zz&cF80!KEZhWs!cSD^>;v)XTJR%u%s&N{A zS3%2K8Q)&ilf{BZsGR#R@KPO5T`&&i*9(&P@`8A?RZC@D^}>fSWpXJHqE5$JnTS;5 zb3mbti(h<@*0Q!(mOU0Hbhh@eW~BPH3Uf>Av%6ob*l_9u=uIfG5p-JZnT-JmMx-6b}#RSNv|C4#KV_A(4k%+#RICyTB}vE1-d9kF*h#B z;WwA}{NGLgVR;g=iMOad)o@19V-d@u|SyV z|Dt)f!ez%a``U`qwgG^0D_oZg2AtzJ!g_`TJmA8LIBv|ikI5*{T9er*?do+H8Y>)P|k(ss0$ zrW084!pHA38TL$O{P=9meOa5PVE@GhUh?W+{^FKBV|$?R+u$1 zP`UiZYv~R0#3F4Y4Ohq>ypMvi#*8<~GnGVDNi1wSwKkQ#4IR0DZ9;_fJMJ|pB3wI6 zObv132=VfUSQceTbc|EVe8B4cn;qvVWf}AiSC$O|k}j8xj*&vl3#=4_sG)82^=rpD zyZjWr&0^g^I>Ce1&7!*Cp>-#T{)zJ|(i|sYw${YkD;P+~teir>;;PCQ@uCc?+5*A5 ztNww`25(mlBz*MR(w7&me?Q^?d8M;-09Ge%SU-TvHvHPWAN4}Ha-+N(eYkOec{hsV z)apTaRxPL=i)YoD>a|3TJZ95#w4RS|Y8w2n6eqE-N$mHxoYrb-Wyoo3WewPvH3-72 zo4{peLq6Rqx#`u*F)Ls)!l9GA_M<>9lfM6VKJ;1!UB{EPH%D*IGw%+A`QYZ2ra?n9 zB=F2zf25)0JgS&F$f%mq5lvGaY+osj#*Nc5x>s#SzO&Z}pPk#1jWVKEmZNHy(4YBi z?KQf|hqk7o{A6otmzy#$NdG>?@FKr^bOD3Be(if{SfXG1E5&iI+5~fb63?wm2j*() z2IKo$-O#&|p4^s=_LgliD35IGF7ST-d;n; z%sNF{=1G!(kzT`nSh_(m%qz0h497{~K0C?-C2eH>BuJ)gAlsDrKLyF0AYU65 z>9}`Q_S+DiVY;dkPYlB%3%EK(IjdFuQ`y-3lFTx-7F9z_<0L- z0DJ&-U|e32WbAM_%<;#}al_UoyshdZR9nrZiUGph%EJ#%rCQ#5@WcBpUUR5_r!OTu zae(S1T(NGO@cbggnk|PytVugKp<$rKpm>lhYw$+>lyqD8V1pMknj1oHQ7yN8-H?nQ zcj6ke+NQ%u+z``o)t3I%g|?HoHx@i3PpFXRM}*Fg0>(%KI0b$)*v;v0Jcx*ndZQ4m zfBKCsKtoeu5=R6RL3F)?y+j-NiO}QC!+p{7r^7M9LzDQ^qbcr+NuHCqDJ$9`j(lq#ZRDc2GHDwherqJ2x$3b;@tz%UEM;gdMS7qF zX}@f3RJArXv^KW1Ha4|3*0(m+wKlf$p<_w*2I28+3x0g;gd@1MsT1+rr~1U`h4W_3 zFMLLSYQ~KG!g=@|(pc53cviWBj$g$JPClI;oNyYy(TOuL4x{vn;#t74XBOG&QWfQI DL^Slk diff --git a/contracts/sysio.system/include/sysio.system/sysio.system.hpp b/contracts/sysio.system/include/sysio.system/sysio.system.hpp index e8da39f8a7..25f8dd5811 100644 --- a/contracts/sysio.system/include/sysio.system/sysio.system.hpp +++ b/contracts/sysio.system/include/sysio.system/sysio.system.hpp @@ -341,7 +341,6 @@ namespace sysiosystem { public: static constexpr sysio::name active_permission{"active"_n}; - static constexpr sysio::name auth_ext_permission{"auth.ext"_n}; static constexpr sysio::name token_account{"sysio.token"_n}; static constexpr sysio::name null_account{"sysio.null"_n}; @@ -619,20 +618,6 @@ namespace sysiosystem { [[sysio::action]] void limitauthchg( const name& account, const std::vector& allow_perms, const std::vector& disallow_perms ); - /** - * Install or rotate the reserved auth.ext child permission from an auth.msg notification. - * - * The notification payload is untrusted input. Only the protocol-reserved auth.ext permission - * may be changed through this privileged path; owner, active, and arbitrary permission names - * are rejected. - * - * @param user - account whose auth.ext permission is installed or rotated. - * @param permission - must be exactly auth.ext. - * @param pub_key - sole key for the auth.ext authority. - */ - [[sysio::on_notify("auth.msg::onlinkauth")]] - void onlinkauth(const name &user, const name &permission, const sysio::public_key &pub_key); - /** * Rescore a producer whose collateral standing just changed on sysio.opreg. * diff --git a/contracts/sysio.system/src/sysio.system.cpp b/contracts/sysio.system/src/sysio.system.cpp index d9fdbcfeba..440219ba29 100644 --- a/contracts/sysio.system/src/sysio.system.cpp +++ b/contracts/sysio.system/src/sysio.system.cpp @@ -268,21 +268,4 @@ namespace sysiosystem { check(core == symbol("SYS", 4), "core symbol must be SYS."); } - - // ** ON NOTIFY OF AUTH.MSG MODIFICATION ** - void system_contract::onlinkauth( const name& account_name, - const name& permission, - const sysio::public_key& pub_key ) { - check( permission == auth_ext_permission, "onlinkauth may only update auth.ext" ); - - // Convert pub_key to authority object - authority auth; - auth.threshold = 1; - - auth.keys.push_back({pub_key, 1}); - - // Update auth with special permission. - updateauth_action update_auth{ get_self(), { {get_self(), active_permission} } }; - update_auth.send(account_name, auth_ext_permission, active_permission, auth, name{}); - } } /// sysio.system diff --git a/contracts/sysio.system/sysio.system.wasm b/contracts/sysio.system/sysio.system.wasm index bb4e7e65fcc4586d87a862ffe21828b2039d5782..6ca06d1681d49dd30f8e3411d092cec76f67615c 100755 GIT binary patch delta 25441 zcmbV#37k#!`~Q8ObMKwu4i1Ca&7Es7V;!=Em}?6qTlH;`r6`6F?c0p(Tj=27Ya6m} zjYeH$8A7tJC1l^SE2NPB`|~;XBK57`>)-d=e9rmopXc-J&vR}o=S7Sd6OmJttOWA8 z-I?m2+&YxQxqldcP_fQE-t_e8+@n+bu06VU?a|rcG=6fQw(hvPghjccTrO9n^_IK7 zwcK5+q|51Y#yau;NFO=%Kaqz1$LVw04`dY$^IDIF)rlw-?{bwkoRLPEl+xD7uon_A zlgnigISq=%gOg*6x_l^IhR;Z~oZ%%KmWoVvyL^}^CBm54cl`P>ac^#dZ^P(c2zRU={ZuIJ|m?PCUsUpmxt7hk(7ds#YP$l&O`vtWt2>@ z+UKj9FKaY;G9CV`(blAVX_=G5@(m_(_{sC=LSDq5aSku$&$;`nJ$k*?dnK>p)ttv` zcr6d-5&SWa;?evG3s2zx@?@UEQ~B+8-~X^L^`j;H1%Jr_Udqe(2j0&I_(wj(hq>(y z{*BxH&fglFjLpVYW1F$vnCi-QO>=$fn&FC^>6+!5?V977>ze19@5=v6j_0)1E`RL? zH%5@x;Wyv(QHGDJGhY1;zaxb&k077nb!7MpW%zr&=5th6HJt8czxle?@mK+L!ZT%H zh;{J(c{syoJTMPd2+iXR&10x}oc26MaGvKp&o?`-HsH0F^E>L{0bBA+B{DMow?>dz zlhf7q`hSe=VH3kYrX&M9Mp<1|dN|$gF!*EZj;C}Ys;aZvEB2(C{f;CT-kf?x^l2F3 zrCV0#h~H>bZuE8ppF%Xm8jyOLhUC6l_N9E0 z3r3NjUQ_jvjdab`(}|A?cT&ygIQ;QXH^z#DGv@J7|ibS438^&K_% z2>M{6>U;(d>IIEis7m1z=&xU$vGx_C0<9T<%n9p8wN}=l>QPnuU|D;&x6pd;gzC-V z&vTmT8Wq$V7SD6)`yW$1E%hp@lF=nA&tcY$^?1BQdLm%bDDsg$ofmg;)w)o90M9>a zRk|5(jj9nx^Q{Fn;`qQ(c_D&)*0~y^T$>rat-=o%v&PmuVRubIw;2!DqG8tIhgIj? zTMr9Ge8jO{U||Y7%^XQ{b7|_AyP@_oPMT#UroTs9b0?;kCE8|f@Yjys%h+#thL=*< zq5e4W>dY{|vtsI3q3^B7>;H%LSu^T4p!L?7`Zswy%l20MEbXxBHH@K6xz9F?Gw4|E z8;_PGI&Mv9GJ~dAb(>b_X+K(THmzv&Z1HaKsTAuqa0N!V*YL+@;7@plIn}z;;sv^9 z^?J3G^-;^dmF{+W2JPn^s@FaTx`oEJyj#6PRa;eBRi}aM25Fa;PO7=GPdB7px&( zFGpD|+l2A8lTy1gr5E@Nhaz=75$1HZrX7!^Ppvg=s^4FqZP!n;5}zD<4}j4)VR;3b zXa$0_|HN3wpDYdl{QhJT&Km#J{PerY1q?gn6T#4 z_Jn1v{!jNUcX!f1tslA>6XW%!05-L$N*LeaKP9lC%>T^AbLunkw7_co%u|IHsv&k? zV89}4-ZSeW?t?{+_3pE!fD+lywxk8QSDx+8w9#tUwl`h0cD5avpm*V~s?Jm$a@in{i^^V7;d`=LfjO z>^_MFZ5-3kjxhIF<9k^UW8NOCth290|I3mat)$+6TJqaJFS*H@+B=ocvbCvqT|UQF z{yt;>Zqc3A);8v`DYFJo9kE zVzu7?gxQx_9~PRa$^dVLB8pnpRG>x=nA7ZxcTM$Eg%OruJJ1 zIcifz^MnQecvMAsxb`MZAws-lhNO}%!7_Cj5iG%O^?T7^3HGhuJ58WgLIws;qZe03p4*qKWa$cdcUc4YeazuyWQh4H9jtwIaSH>{~xHSamhg_ zLVRkdmJgO`!Ln+wtO*=e{c8owI>GupNAcj(I?$$`VxxYrruOX@#GS$aLb_h7)2NRM z+gw=Fk$*N&_;WyDmG#Bw694P;Uh9$RiWC)kj{L_ZdRf!`_Vmz;m$25-cmYbk&Eywg zxnr7`(LN{Go_()fG5upf)NX1O9cv~`R`>ir1&e=duY2q}!aS~cX>6FigK%qcpr~AX zgNj@E#ucLeR?N6K=SqXzmVf$(wtDEdfq*O3(!YWuJPES(Z)(G=4kOoEt0ojmnE!9& znVbK=CMA6KuT4J zZunG@fjY;U8Ewk${HJ|rB?D_KjJ{yio%sq~v<;_A*4CNVX^^#URsD*#WK~uI2KIS%-V!9Mb&9O^Xc-3LGk@0Y_WM%2=UKhy ze*f?<@N9XFRAVWd$J}1Gc~$osOn*`2)YY!EH77OORcKBz*2Htt1)pUA(G)p~v!4YvBtuL=`?>HKf_ce45}n4e^C-KNFQFuARY+wUPYaA(4I z{{jZD_57lD0k-cJCDJkL`l8+LUkS4I2W$Ih$u?&*DmY%(_L^Uz?n)~x=K|CwZ;y4p zRAUaCzo`ZO30HD&E{>&&zyDJ=8$#MvPzvU4vKr*R9K8C+{s3^{)yYV9z&oPl@c;$_ zfc;pigdEl-5MrZx2Vv_Hh@ndmv@Su=R&LyqXexK>pFnay24=BUZ)UnR<%=@Gy=3-< zMIYSDDzZ1DC&y-VdEX}Vrl17q5}VQGeVft!!CiEzxXU=Td&OOJjp8o)L2(!T0PfPv z?xfg@?ycC1eo)*+Kd39x4~o0!B^3(l8pU07jk>IH*3=`#tP9HuSwDQ));*Zvaq?On zmKU{J1X95Cryh@nI`1hm0OwVH0vtLb!%yZwwnp`gw$=xlDU+!1(*LNU!{%h`W3#IAu z!NBxg%QI=D)%vRwYKfXF9>2S*uqY$6ow2OVcWe=Qz&IH1vDV%drP1@&ifBwxY~^DZ zEO!!Nat>S>4;Jz1%5rMD9V^rEQg~H){H?nx$}>@c9;(J9j+M~`INt7)Y)xO4hRJrX zYOE^aRyRTSPOH_R(W}#A$Lr%Ne~oq@88|vlX=Iq=t#hkmtY5|!w`Q&>L^G@}*7(4e zu>!C}m%x%;)|oZcXtq^itwbw5T@BTqh@Aiwy5c;$tgUO;fHFsZU7u&MjO}12=dsoN=TCS(TStF>4myL3YDz_|R=;%QrH8B~zihCadF3hBs+`v* z*Z<8T%I%(4lB`P`htUS>y>FLiexp59aP$EsG*u~V(+^6PX>3s#rSb1BA}RdQeX_vt z25=HAIxkgl42Gkz5H`3dYb(hmw)TDMfd%2QXZfTd-+0+#NhfHjqT zLHHa*?B2)ww= z26rnS%YAiw8v@a++3_D5YQ^k~i&lj8CEKoAvzw1`3AhGxfc5y!SYY-mJDbn|D`#i1 zQu@BOV6T%D0M)@XSk%Gv*5@7*L@IS+Tz?Qf z`U5>8&|h&98$Fb~)T{gjPYQX=A=azA4$y9^>28h63wF<^J=QaO8o``UGb)j-R%bIv zJ(@{r1J?$ny5k_Y!))28!5yZ--2@}aua3J=U6wkozCLwaeSPY-vF;w8<)Ua00ZY)d!0!hr{+RTvmE^;V>so`h^woV|(0J_a8r0{OJ6T z<#Jb?h@pI^7%?9XPjX7mYm_22dQg1$X~i7QaI9snt7f%7^-;tg&4ZO=+227Di7Q%h zr~Uks%`kF%pMHnf34 zC~Hq>&AU*Lud%iK!b7OIcwq=%XX~AdmHAh;7F=wUKbK>%99;P;teY20p-a-GB${J2 zxYQsFP1r)NHR4h<>StZ5cDLr(rHAk7Tn_V=^6T0js|J@7+_#m|S5vEA?_Pe0|6uF0 z%QNB>X2FiS%a;|aSK`eH^6PPB9^cV?*qsHV#q4V({Zzwxzj<5w$U5@#^VH8Oe70DS z59coV48e;_Bv7xhxy6a)3gZA&2dEaX^i|pv<7bznPTw{3qVclENy8{!n!Bh09h1>6%E4QGH$6^PV5FPc8Z=AJ=c8?C{3<{7r2+DY zhc3_rDHlOdYR{-J${QvBYiRepVk8IxC_*+;IlKltZA4=8R|;HWQs?+dMv`KOKs)@;0AEq_4QDfC6jG~(~MP7)e8swE$ zy||dni>4TwD(Q7ON)AL*z9L?*LH`^AcTho`1%^3Qu18Zd$`*eNm82x;97Bm-#l@kh zdMVWiuVLW$elK3YVeo&S)BIjK$5Cb38$(~xK4~6LFUrMOdbDs7WQO8%(410u5}7-t zaU5WxyPu|g0rX5GUh{)wCSc_BK=l%Ik!h!tLhud6D@kB>(`9fHwWm+zOcGVbTdWT= zd@2w7=pf#Tm!#Hs>sk_bJtHuoBqb8flx4}N9U>8>s5j3zD_NyzFnw%o`##z;(uvrO zE!-uo4?iMZOJj{>8CsfF0k4{tq35G!>$^rA2~g1vWdD`}4s(utRfd|-dJ8*_DNAv*ORANn3|cDL>TQ{3&!obKL zRVdfJ5cqE{k}?m`gy<#5m7kE)0p0PO0bi+(hR!-6`yQh5yyUpJt5PW*e^M$`#jP(2 zJYAKZCYmM-t5L_Oua0OZqm5jMRGHHZC6ofCs?!&0wF3`R`u|?xp<0xzR(Q4+C8!nN zu0>CmTcXs~NzM#^G4l)c2ulZlmq020QuCN4&LkHqK;;4XtrkrMu}!EAp!lS69V*6K zPD_(IR9cn2>QFtvBc~3<6kVprHdI4XI6bL|*EE;Qk9DX`;+E6;2%wErBadqsrk>oJ z4+Rv^ucXBzG>aC<^+%{f#T7LucZ#+y~Xa`Y6Zu5do^6?T0d1#0Keh~gaGiE`qVo0O9)M6 zbHD)Ci<@67<4zwXSch$y>x@|0e49$k^7@oiWW8c98$e*@H-_%)l^wT1wgnp?u(?7t z0t5sQ)M`KtB1`$4{>)}jgOq3hbvba5Q4J{8J;sTiVTuW6lU}6d{}dWJky-o0dWJ(=@AsynuFDhm#3bf8l}fOyI3|TRoVx>?Eh@e;hhJb+ClG^hrme*QRY`oHXAXcFrfx}j3rN|j-fYOa*c1uW(QBLde=4tX< zOB#T|nXPCvjaKk&2aM1xen9KHEIw|M3&5G=$}mg+iOo-Pfz9u1O)bIZeQm%@L>_BH zZNb30Jw-8w3k-eGQ&drYZbP{MT-T?moj9MOm+cO5VBlyz3I>jr0MV8}(lhiPQ?5*Y z4r}j_z;kq+zLG`HQyuK_-1GD~{UB4?(mV0{4WC2FJ*`yl2TEzN!paG+k;mxYe!GSpgm|xC_VRqKCjZRYL+UJ*Pbf#4Fis; zNO5-nQ~J%2gbomg%jKyKbc%mBY@zymM+jBCK&U>-eVuSuRZfD|4mz=Iq5BNs1q6`7 zz?(@{!RnReg%@c79S-Dwi8@keZ8xFs5s;j+8jj+$I4aD`2h1l^P3?!-cue*51}(0X zU-p`O73A}c#n z{5^d#!aSjy>7?LN8}J!J8ovxkfvn$onUYJMwfFs3JLDPcTN@U6lJ_zdqlNO_%T$H0 z8j}ANN{SDiUzgz7y2RB^CC@xboJ&#Gs4EeY@d_2-b6DyXYE$gI;d27Y7u0n-&5Mc= zTr%Y7EA&q0&k8nRc)zF;P}PtJ%rtZ{YY@8nZnSZ#l@ssXErN?G_qgKsw$fs6U4;!m zN4hdC)cO9(ny3WO3u>tA3sg(YKHY_wFB|ex23Xn^rRfHGc7sNsptig_mHoRbNtVZ6 zrLXc`L&Dqx1`l610`QQ$L9(eQ=x~q3^`aLZyBS0rUE+wkOb!}*Ko6}}!+W61`_M$c z!&{(Bg)URc%AS{S|Bc_W5#n|bAymLbetVe;@gMf(Ay2{v^WR+FRu=DE1X$GV^?a2i z-<`i6h_V77_l6e1{hT&U?RuT6Qa>5hk)kE>4GMcwZ%*G976NwYcig8gao9Yy0dKIx zVf8x>soUWq=?_HFw4fU{+NW&w?4M3Kz-hhrY%;FGn)Ylt6%{H)110WFTAFW=N;K3) zXU8`w&iZk^hX*^YCf5=INpC@Gv@RZtG zOQLS+dVHLhTbAVwltOiq$d@ThRGNb-wFKP`=9eLg=fR zo2|8*T5C^#n>s+Ho%S}RL+BoRn|ja@Y4r|0TnM>Vm=mgtonjT3@D868!+6Ib`RD^$2~b(??chz1!j-{*9q;rYVFZ%e<>`tvHPsij z6C^u}qIkShvJQbsp`45|9&**`H!_kS#ho6caEAIr#{E|c^tDG^2#&~q7+S)3Y2TON z4VCx%(o^NJ#d`|CU7Y}O_iuCpx!o7m!bFKzYQY4l@e%EXJS)&o=>vfd{b&*u{FRcz zu_2XTri{4!0{}Z1O?3y7zsOVtb!Q434eIY@hSVHAkfLIzIu(rIJ5?Sf6w1!VA1B(^ z4y3mu^|*Yh7GCNMlxS!^h_1CivvPOOF*Q*DVEO0^4o>eM%) z5pITb97=6?mQy}^9vq<17!H%tW4K_V1B0*u(B-dSkPZb91r`0~G-r<+21TQcd@_v6 zMA_SinxYP%GR5=(J`L;`MsOQVk%=Sd08I(J^)VHshv#8KkXI2&iYl~M)fqaU_Thmc zga~J%;(l0iqTvaVU|`osI>|I&mVQDna^6{qwxz=6#&GQ z>a8?J!gK?6JIuw<(oy@lI+wXpQpeG!Ai=HUV1cfb+v8xwen=%$uVCUYUrwdu z#snmPesNjVER@m{u~dpYvVv|(t4TD4*It$@lj!jRJC#wSlKen?3#Hj)FoP5cpF%B) z?1Fer;dtDE_BxdrH<|Zpr#DcY^n*1twT0+*Jbi)HYGu2 zTAxh=dC3)NK8<3FedVkVSfy~XPg`;+URO6WRojtNj;%qH*3S-dXelpL0s)EUKf* zm9wawDidZ?^)l!F&H}jXOp4G;re*jF00S;N<=xp-z8C=K!r~zlKph6g)mO9a`D5qM zMNghGvep2#%(W6Z7gxSV+RvpIYolI?Ce%N!l%Z6^RK~AUJ6x1zyhmxkwo#CB*C@a| z2IjdnmzqZ$15EX0gz|RXO1?l<>^qNYMXy(c056QP`P3iv3bks3?4Adm|7%H`PtVah z88)990fTqWhtuSWQ`vW`_-Ch#Zbd~UW+Bk}7u$>*x{$ii3HfCq)rLp@eqnYJ+W=3{ z!mP(4%EI|BEu!swRci#T>8h;^l*^%N^sRKvp(eCR=H*aa$<5l22BD!TY>Tr#z3+p_ z3Rjedt=D&$n*(QZlzVNfTw6?&jGwPMr1CIMkj01WViVC7JTrm(;uv^2Tiz?9YRHe5cI* zk`gPGRWU-R|1xLzK|(6`8ZP-1MtZh4tee>o?mCsEeb)BAnBU5^FR4rH9wR9X;ua>R z;^@KQKm6b@cgb4;2%nv@DL|zGpDO{1bE$^iQg|tLxJ&#?L3w-R-K82oHY|m*IZJ9R zqlYt>U~Q+$d(Xjx%TI5@M~dP#pDWJGP4zyep29xv?}9`Z)kWp#!*?-?Aa!vZaJm#; ziUjk;I0Z&Km1+-QvAM^`!P1DjW8_qQ_BCTvg3{)Ijimw}xg=mb|x?M#ALv zd`$zwZYW*C^R^uA%EkDmQx<(qPdjg6tel(139da(|KeX|@z+#e9?9Tvd3_y~iuwYi zr#Ve^KB)4fvXo=Y%$1yV@H*^}z3ZqqZI&kM;qFM0e(R}j(yD73Ka|d-Q;(p$s>d*U zu)psiIkp~noFa)ED7i$iH}W;oRqs^e4BhQI{)lwk5b7E&Uv8kJRNY_oOIO`0IMOsO zgl18a-0&ZSy1ZxHH&hZRmi&!&#I#p$`=y`#w(1+|9X`tdb}0T|b0c-56*6NZw4wd7 zZzEML1n-o}Yt)`7CHUgLrFY>g8uu-^5g3xmo2c>qkXfhngENK=ncp`-5#J%+&EUqH zWz1#`ne1&K*3+A*46TwvTc`wYIVzR5z(`+n%ocqwY=LWHp$yzYvjLilTj5k)B@?z% zP1jzyN}rOZTd2B3Y=bqq`h-2=`z@gAC%3`y(EUru>}~WEHg|g)Md9GZwrkpYVmmbl ziA~y0S?(Y4ah7>Vd^@N!h7R6A9m0LKvO7yI+m%o6q(|~A393{*^RP_bNq->BFliSk z_>z3Riy9?@-XR6eBT6SwTvjPX=zA2b7S%sWncehRxb4}x;gmzWAyxZI(jFQDMmm2_ zh>?cb3^YYE&=PyeLnEc^UV5^Kj&VYF(TWlT!Z4?d+Dmz@PJ?j$+1hyzFHz{l?Oy?A zbzcRr`7f;*U}JDa-5WCsc`RpS+IO_JgsKHkum>q8nC^$ARFL?L^!*-RP5mUUePH8f z1GV?jFGSgaO8fDN7^)i_fKmHXVA%njQ3>AL2gya9&;1X31JeINdqZ^%+8e=9f3Y{t z{jI%m-nKU&y|ul8QrjDl;{VIuxM15G=&9`ul-k}nr|k`;1~fcOGmB!6L4)I-h9b8Q zQ&bJ5pQukd?o&JP_$U2D<~krtu=6L(i!+M z@gR7p5E%0ln0@)*^@f$YA5!)obT8;FL)l+I@>we`!MC0I10nvyDPzu2{o=`*-k`=n zQM+UFa?EC3I2Mo4VgBQ-Vl^?`XFX^l!Gyz{^7?tIRDUm2DgTLIl|rw)v-s4+g#Z_u z$#}t63HNsP;6%gJKul!G$@BEEr&4Gm=0}oxfoewWb?RxAJ?>P~!ZgIRmE`RU)QS4b zj~Af%43Ksgsg!%5;tGRg$VEid2Fsp{(6DAm>?IU~rNbq9GG+)AcBR?fav_lx1~jrm zRph}ODqAmsNe+|n%T&WV$fd;FI{0zblSBPgU9;Rcg^Kb>`^%KgXATKnftEX5hF*aW zeuNbInVu?v6<~(qBc|%yP|1F01xFJVV{|G9;*N zYOg{gp{b3(Ms13#=KK7%!7c)KakGN`T}evBz|)Ii3+37C^bXkg?(2vJ4whoSLR(xR z?S7?tMMuJMp&aJZX@6<)2h;_T;eQ}nI9QJVK@UX$C)AvXotPrNJK)rVr1KqQ?F^6;cgRZv$GW(_ zfm|G`{7*f{F5~CXP>lE;MBhddcfs2Y;&uqY|A)Cs+<+hshb!k?C}x2@7}&!M=Fx~Z zcXe{9Vk$ks@FN8ff0OY?`9*e0FN2kvaG#SK%1;L4vx9%_{juu3(KA}FtJ2^m%6u26 z8IxRac6W-BYc8%7FPC06-9=!0A>W!E9`=brOV zr{Jl|`!WuL^L-}IMR0jqEQ2C2y1&ec;71X}z8rzCm4~n-d0FLpAr&xLb{F6x$@lV# z?oR*b)S?J;iR3GYZ!QPOO9i^iFJ(s|Zf#6QknfbqmE=j2TOj~6%j6zGj#E+|F3j&@-X(=O7i>9r{5mRx zUCW{LCWgPyTr7Qya48&Yb`frdgZ*5D=c1St$r&&^!-{f8&bufXMfqh={m!ENmTS*- z2LhMPi*XXImY&6UlQ+)=<_%2+%=>AGRr6aHs1X)XjBSQplV^)_J>KM!wy9iN@``g6 z_cm9of7oVOp32RneiZw$R{tpOhc&{ZxpvfPtg#kc8kdbf%5?%G-uzmgi`J{YuZo?4 zDbZY!YU&RT)CZ~Rqf#4>6$#njA=vNR@xC625o%Wvn+@WO<@fWiQ2YpP?QdLG$8J$F zEtbc@MN~76YZchyy7#@^R>_RxL9{`_;<-!yHENLe?x0ceTsi+{m*U?L%n{PPI48@c zcut{f5}m;Hp_V?Mz?*nxFj=Hg39hPMbh5}NC3rBHU0fnBh}jMnp%e=(`|i^$cgT@M zPN3iAk3>#KQP0Z@p*UagazhkVk~pXKZd>@=FWWZ+XVWtNJ~d>$%hM9{0dDlY3pv`A zCBcVTzms-89+`hCFhj9`?_E;(d5(k^%2N`EpCIK+^4)xudKDOz zEB*L@JW>W|9xpGI;gTo@l>y&8C|K;d!ao8t6k`FJX|?W~1Tnl~Qei3rA zXe!sH!_qPpOzN0?k;*R>{cBRtcP?49MWwHlo9Y)6%F4_lg^*bx5#~GYV#aE&l2c8(@R%sKRA1`Hd=ED$=Kv z7Zt=vQvEh!(?3btLzwQYJoymV-`2pQhd7)7=0H_WD11)cmy)n>G2r~?U2?LjzA#TU zE>$hwoeVrTH@a*>{vOlY^(FcO2#gttaWx=0zLmN1&8#lg`z+a`AYjUIjPc z@|UnZGM8mRHLlB-Tyh@MW6MRVYwW3AoqMDOwFNJ0&nBz9PX8~PL#l#unS&XJE7MZv zelC|Es&i*Zu6i}NUB0of(G&@b%&Nf^a6@})@N59|{hB&8m%Q*Ww}mfe`NRAQ|Ll^IwfMQBzbNbkMPghCL9d1o^k^+k20Y!hxg=k7Nx9mb z78?(rxVjdVqZ^`gwXRL)@oKFw8DAS-lq)WeCr>KY;ueJgwm*@;-4z}rftH6=Pn`&d z+x0|a5nQoZ4ai+ZMQ_!kVOH^!bJ!vv986I?DS`i2dch8)MF*}c!ye(XVN;b?48Ec5 z>p9-@?YH0&@ZmYkL^=Kl*g!B8+nx~SHk=gt0@mI1WwZ^DH|?IQ;pRU9t-=G zC^zv_0w|y%B*~t-{8GruYF>|{?fIhQgL>d!+R6&?uStrxNj*?Twj8eqMS5kgepMqau0TA-X`3mah9GTpZTk}m<;7UUXQo1aW zjkz13klC1b!swCKj{*;U^4X*K;{3KtetwjzsIqhuhK)@lud zsGpr&>Qy$6VfL3>k8wR5u+HP4oI&otP|j)#*^)OO=a`s*Ze@4b3J4(V4Tl)+&X5;n%Hh!Rk{Mej_6Y;9xOVTo+REitT98ze#7@yQYJU!Q%F8x*(m zDp|S4*pF}1{B!pqtuoNyDekT^6my;d1Rs*K&)~c9p_2V9mxcMe`B|(*Aj_X47;<;80dC_S#9W zFdc2x;g%x3>(4{m&X&4u*$0K8V_S{`1%A+$%NI}zgWa(^caqV~nO_oBvIZobg&uMbC9W1MR z66f`Nasn7+; z{e`^Wh5MrTqYH3prqt^S;Wj16Vc+e_@4F|t{Wo^pb8(c1?f6m#H|Axe{2|3!HWrVlp$*VoMT)vP? z%KlLg-usgz_2g`n`d2+B%Eg|rM-nBW7XYWl)&Cu}6JF!y_n}#ueEAxe0Lt%u4b-C1 z?@c6B2U(6HAs1MV=UF>I0&aV`H`fT8Z41zGuW~(kwGZTHa^T}W;3*a6{1lWv;0!J6 zXFjFb!g<8Ev`9kbGm2Z-)z{?6>maj>a_e>W@u|b&eS_mN`yCB+PT}r|cNMdL?PJ6- zR4etQyB)%E`cFD+4ePXOQEU|M&|d!0+k(}{PK2sc_;tOFO(#P&mFR6B0{@Vf=TyK< zjeI*ett@|o3-IyN^6eX(7&F)H)5aFko^|r`MsTfN_&JApLT_@jnAwKUt!y!9Zi<@U9Z}QoTa_~)V!N)I2g||?ix-1{Q#V_)XD{|~DJ_4`9*Kb3zX3K@Q!Fl&d zlXqaI%$Jwn;q~yelz$fnVqf|CUHmdxzhUyhdtA5DBDXpxbTqyBHCNSvz?+n21XToW ztP(grQ=7u!Cdt|NI1vIo|NC6pyV$KOvk?Z@;L=Vihxxf(z3WV%<@=1^d9wm-KY+sr z0@qIC`u;6Xcr@+}FjyIMZYWXt%%9VZ~r#y_2jVYJ+f#!X>JHjpztgQGqfj z$M~D|5t+;M_po3Lc8<&VzWCe_5K8}uw;WWc%fo|mcmOAutJJN*XIN9u->;uU4CKVf)$SyOSW}Jh%GlCi%tO`@CzqJh z&)$Ilh+83*(q>q}+HbFzH4sFzMkZknc;HqH#PKG|cLTx6*2*)3xPj{`#(yo@gZKx} zIviBxvYYGO(tj`ygi(A$*1cVh!bq3WRCH_=VVw8mG09Ov){y zK2g?de=D5ttJtI}nP@}@sJoYzN;L^>J> z=AK)wu1bLeYgfLeL1DqIuQ+RZSE8iF$9+8 zpEeaX95tXNi5SIgqHgq6`@_dBw-jXEKJxePPv#bRa}->ct7ZNuFypPVe-s$twsE7O zX3mzl(Oj;Sy07g@1d}&h(d7=eE|ql^j@$s3GGg!{!DzPBMQQh`x~P1ga8HU4yz>dj zvGCBa2V|R!wIKM1$vzABKU{8DU^FAbY_nkC7_OQIO1`m9!ko6|3AwL2qLbjishm@W6Ne3+N~c zN;Nj(#{|&`G}tXUWBC(AT^o$!#tCz6N;)#s#vOgT3d?NXI%^yl&R+Rg_>ndtH$})% zrQhMz*CpoFAA7<>e39 zft!M@@0q}>p_PvLFOY7qZ2B+1S?SNK+R=9WqkxLfSueeWbvLn=>uI`|mpUBa1Pz!_JCKXpHs@NwwC=U9gBu?TljFDln z;ynU0ca&V5#0gQO!|oCkXLD&BLf+e`7MgH!ji%P zrU-xzsbFe=C0D0#rKtS~aiG%9h*D3walh1>ieKtHGywUKteM6|-G|)%)1Q%K??%Gh z&(mD=hq!2>m(*~vJz#8LrnTWrn=Q#TG)>-5hFyYB{Y?`Obo>?`ZMGDi z#Z?N=#*c1-I-LHE`7`kG6LL*m*fkbA2ymjw&h7qQ%4wurZ|c|!K% z$9f-rD)lr;XsC&8>L0X@Zltu8+ zE|(6AxKWIrSAk_?cv8{(4!u0EY7rcnlqbJ`#xr1iOwGZBV`Wnge-97e^u;`c1_a7~ zj*Za%K=WK~hF_Kpj9&tamSzRQ12Be=fcV-{j*3+%jp!LJWJP#VepN0FPm07rmdo^| z{4{3!Z7Dw&ojVAwq56)bqB@aQ6Y@rQ2#!m)Wn3-tjNAMv2umCG=2^*I#_0g~)ny18 z#Cv4I94;x(Ea&nqVR|U!faeW9om3t?7)hkzURV9BtgJ)QkK))#aFQ3bE+$^Kui!E6%eH0KbtR`)zT)=$U)^8uTR1$el*Eg3AsNsN{z}cp zK+-C{P5d)5r}7}UR!i+Xeg?v9OdhvXM0P5V8{G9oTn?E9kFLS3B}kVw5J5X-@ER@? zGC@zcZTFteIf4u9h@xyZe{sw9H6Yh`Nm$EG3ThKnYZl<#ho#S2u38}A*3ecSOK2}k z*78;*6g4kaxIg@B-XvSH*%K41GRDcg=DznWty#H|dEG7VuH!fFZuVMevjx|Kdn8C@ zRqT`}*R$9BHMmRgd8~E=y3u;L5yr`y^<33R^c)eP0O;7k{CfgtSppc@j{e`yvr+=vJU$o_xNQpN<=E zlR;Sh?B%o8eWI~jbyj2`CAUGt!smS3xM?-59M~EN;>21zfO`FBnFqC0FO9giE%fBn zHt+|eL2l>WeA68`wVm;4*#Mcc6TD`ie76&PXpt1y#pCn+0i;siG}BHj*u0Aq`46|8 z-^G3Tj$3-}=6Gy*_-^p3?XqY$)Q`S8y?4QANJv|~r(T5OBq19<6w{g+ zki8shMA_=9L&0ni@^T4V0TNG=jr+KFr6FNDG2{N&SZJO*kR?hH(j^p?ndI@wnn&Oc z$@+ow;c|!m5HjYAi3)qkksqJ{{w3gr9He`Qm#`m*XNS4sleCWxF)bhavlv!0_NMiB zHnU{ve$?FaWX0Q66{XYx9t#xw>Hs%J!3TL%fl44c8%FODzQihyB)z~vE)e<%Cd~c_ zX1bg|2qYdU2Yy5(Xq0q2#9!mB(qTT2BK`=+x<-Y?`bjQN;R^ zDF`Cl8G3~DIRa-eWd6=}@M&gy*(L3cLJJrhCi#zXl59K*;v6fkW86diu7FNnJ|^!U zxb`%Y+=qW2{G5<-{L_D`2{MD@p4FYQnM z$Kd19PJFyanLt+PPhC6aZP zYw!({WoIGfw#(tO@P(X}TIVqPe(7_LoAFJO)#u=y!e{2^I3@G4N)N=*%^yM!KZPFF zxq?mSLN#+j4--O78$%EO4Ly7n>T@*oFgNtDD)ewA^sp~8^fW#+es`!QH}o(+^sp`T zusQUwI`nWV^l&Eha5(g^CiL)K=;6!I!(M6;JYsgJ>Q?CCeCXkjeo)#4`4u?Z_-sUD^+~%rCuQ94f_uKrGq&kgW((?~aD)@5O9v!=P zeYbOOZ@13xcx78YqpIw28;=)t`1c=kcm{-b_TK9v(SL9$IeiCTLSgV|sfhn_z_>e{ z5bY?3mCEB^B%(Mf;@?X6Hw}wpzK5jO9gd7_|5DF4dc5v^^^HESdtdDA?bWkSSLt9F z36f(NMG`yrc&TTn&Yiq3cI?x+dR4ubu6?|(_w4EI)1_zc*QE~`73AwXoIKVv9yVU- z{JLDZ&e3B#7`4eEuQL__NTNOVBz c;lDkUJQrDAn&cVA6M^WWMiM!*nm8Q)4~ofdiU0rr delta 27187 zcmbV#2Yk)f`~Q8OJCaE7AxI>`O$12^u}2lx9<{119g3nVMzz&JM`Bi~`N2c&QAN!L zv3ISi($ZQb)T&h!)mHhxpL6d;eLH@yzwhgt^ZA_58P9pnv(IyGhmVa|H$P%YJ__-q zn}2p*O3bWD3prQ#>z#XcYS*=A_pUuVJ6xIPoXpPKp5N`e?w73um#bK0j4LvpqTEq# zx7+UNsckRzJnD7nzeuO~M=m%17vpjzkiWu};Ieauc=NbpT`qLG|IaQNQX`^xA-B7P z6P=TiOW1FOw2gKWxttW^b~{}hlh2)i((O!eK4SkIQnYaK$V87j0plhoyPPq}$vT7E z>5O#hsKxBm(ENFl-R@*}LW0xnN{$4;u4Mb^(6Z^tC6ZkUP5@0&RLY%5XpWvPH$^&= zo$h1|fFV-M(2*{uJ0UVTlJHF-L(9m7qORi3w+IiM_&iRvbnR~f=g?puYl{<2^dyRXod!2i| zdxLwUJID0x;lJBWay(k{+;H+beAb%@l$OAi7_UBu&ymF0!zsb(b)@-nr}=uln&7C! z+4j;LQFPAU`CuEyC@X1YIM?zwxHa6q7+$;xswy#n^#TI@>~qAs@#gYTS|vuC zvJqaoXg?A08)alZo^w}z8j=}Rw5F5x*sY7dN@p^67XOs!)~r{Ph-~|{c#g1_|9x9Rq06$;z$ zRw!rxQ6bjeS)p8L<_?GTR*Wyfc2+E5zg02+Ge`f@32)em<2xL_Y=`BF2Zm}pD)U~n z!Gx9gARhDuA2U#u#QV|Syt-oiTZRgJ#oG7Vrz^H>g2oACp!EVzrnN%+I&r!m=8I^5 zf1Uc~@NINiwajMg8^GD);qL6b4aa6hz{79zDMb({j;wC{a|})m!o5L)!MD; zxIMad9Xf9xsQm|hXYZ@?EPZd6s#}ouW!A47>!hDDUu;m6@O^N@+4P%TvQZ@-am?=6 zsC4>5$jfwkzbF<&-4a}h*hnuYI~}z%GBS3o8MN$BrIv;SHXU+Uj&M-bZICtgK?&@l zBTe@Pk6QFbL6x}^J~*m5l2D{q;x;JGInv@8!#a~VHNovmub)#pho<3AQhJ)#>2>?K zw{O%JjWv7LS(mj=(p=eYn%}3UB(!srW4Ndb|mMg~0>azf85-0lC zT*16}QEA@2=#QmpgF=-!)y!iCOiBY)PB`xHO+T)yJ>}5lhNf9F0!v6uaDphk<+0XE zT*2!EP5Rf?+yBATzisNhY|SKvC41K2s=nx}rE0YX`!0<47?Kyeo!T zG3@kWNs5`d$M0bmb!diu;rh7@Rd|#tctPYKL0=WD$`wKS1@DdocQ;>^9tj?Z5@7t3 zF*_5R=Oq8gE-${N<0E#ccY<4Y(d%py>zj>6m~za{*?AkqdOhGBEP56sSrUgTXa-4t zfj2-A>?;Bk0bWB555SAMAiQ`C!0S{J39V%S4h8g1Yc}D}ClnJ7_`JYVZjgZ0&JkXP z2#k)+(2b`?z>KLzAM&}R?MqZB{UtO31Eh9K@FY6C9z`6!g6Nz8$ZgFbQ)hjuTjv2K zB)E0!JfKLgTdBb9-#mPZ4t^^1z$dg!)s2gFpueJ3dpoQwHZN9fsaJ=R?OUgw2dfue z_Z)9x+1r-#r5~XnYi2vTC4>O95Z`{#5h+S9aD1qjl*YqQ4TuBKdOg-fjwi1&@WStg zkDD~_DW!0SH>@%^D-^SXDMI}mj5SnZ%Nv@^E{qbYOzgsjoV)Gt^`yhg)qSGW)+eR{n%@dZq&EHJaB;%P+~n!1H?`ZOfwSeM5`o3szf0{SM zT4?j*3AEZS_IO#EX}5kn4u9Wxym;P4WZ<tyZ4fO_K2n-JpHsRX-%~vRstdrSQ1BAt8HJiSXyJ>ZCdHU>XoK?mEE@4 zxclpl25_ZxRnZE4&z1%4_~r!wdzI$#0Q1@ApOw6~)Fia3u1%93Sid(|>DB(JE%Kpn zy%wqX`(_LO2#?sCTlBj>%3mf7V$s4V1_~@)p(um?Q(G1W1nXMPD{LT8`l@U8imRiw zQmukxEw=|g@l@^=I+A|~Y+#ms?uo4rE`61~vQ;tc=&@EUXnAItC%ZFjmB~-PMz`$T ztw+ZBCx9Gw`bwl(Ys^^YtvKH7HLYW5x&3|X)|P)36@tEv*zGL4Mw|W^byJ&9?juwY zV)`0{y!%WA%(3*DX;@IpXX~MH;pbBA?a$_+_4c7>>zel}cy9gNRvzk+_}?kYuJC+! z+G5Xm{st|wrEM9WW9kdpr`o=cnvO42ikRzx9C1P>S(`|H{tc|Y=Y<9ln*sNOdY`sr zHf#qKJ;mmx)vikJc7Da9fs0MyY7n#G(EG+ix%bkg1}&$;xPQ@RF<-~ z*?Goz?aw;q<+0iJhK`Tr{E~f;1S-uP)^0njQ$5<7*}PLK#m!ZCuAs|9qbRTFC^7bm z&O^)k@w}B4flD~e+G#NDf1mr%`*eM`Uw!G)!+_l%a>M|S-LY{jkeJ@MnEh>+q4cHQ z;oY4{Lm{_)xBeFxvm_PgPM^-U+iu>qO3r(HXo^j*HM6hGjklY3i=n*$XuX}( zJ-Wz4heRjLA_7B~Yd7#q{?NNgVIqil$#`!_W^%oEh+u=P2AP+yXqoz@B`^TPF{-bAQ`@KPZ4T87Y z+4J0S1OJ1%z4o2Ked!D&(c5;lw;I{ihU9#htnW*t+;4l*CzBt+^Hi1p{~%WTB?b@; zRcjDlDo~~d$_jz93g}$hR|}NT&;AY@A^uFyt-*&K<{|t8+b8`31UBS9*FJM-|2%%F zZMe<%DadS%!NtO1o&E_AUi-*|{(&h*{^t~XhHKlFBZ|-k`&ILI^oV_NpX)aMqe4j^ z+3P{|e$l=%Gd9EzXQ*T!qwE>p;SB4FN3i44@xU^ zFb;-wnC$j1zXi{|!=xq+F%ddoSo}o`YwEwD3#tn$8Y1r~C$QfoQ+rjr+Na-2wOCn9+yhzW6usl9^`=)cVfaRY|T7@W{>pkC+ld$CQ63Y_uJC!F&e~m=d&aN+or}1WMtiW^eF8In&gr z#?v>OcFtoe4f5s^G7Io$qHJU5Xj{dayfGd3kDU59 zIE)d6xmD}@YImN}1x79+O^5?spK_B%+ZU!bE-?e40CiD4mca9@fewVEThav~z2 z)=c~PX(J!N<>`N$))*V-re~mi*BM3f+&0X&-!RWgK(f=GIOF@Oe^LU*NOrDd>xKuu z>mAc-2>p+3s++sbZw|r)weG+iENE|@ned=wxvP=|f+=EFW6of^&8#BakL^CQQsKAF zpH+co*~e#X=YavA?9lAK@v78=thN}#`n?H1>nXa_rhVI9IIOHGoPX`j91-}Kf){NY9AYoA~BjZ`5EIWt8|*c7G&DSWN( zU~f}`BuojmHYM143WpDJl1n2e)1CIK@71?AblPB-p5iHGja2CVNwPdhjziggX-X~o zi-jfp;H3|{4_;90nE3#oDIb8#zzG}2lz`8a55Q;IL+qGR#m;nHkcu5sqhiNAsMs+N z5Ic?ija2NI)+%<)gNhyVpnGN>RP2~3b)BY0#g3^_CZBE}U6es%?6!-2G{T;?xM<#y zSenrQ3@jtsIEwvV%f-cw)zPc6q_q~KmozRmf;D`CNRj1BZ;;br*^GE5f-D$a!v+r6 zpw`qeOHV|Z56Zb3o(4tvKaI6-Eq#l|*}Xm=f{6ZapQqDAyHDmR9lhPM#|<<^>@Syv z<(kGO1OcdEp-e{vBF4VGtauEj$50xv@k5cCKmj=H>dTwxFdr_j1(w>iyrjPTYF?_W zC{=VOI^wV(Ey3Z72i%Cn0krru>k}KT#(!p_#+LH6RCa zj@VsSZK8E{$1D2*A4yhmC}QKk(-z<3DC<{>zkxi6e`u#fP4ipKx^ z4z8ENgBGso9-5Z!pW*>NH&eoQFeUiiln?V2cF)v~tHmx;e+8P%T)+r_t4(B~GfbCmu1 zw#Y7LAh3hjGaIPbGY^VAV?!(UcIqB0_KZEC*fVVud-DjSVwlYjvH&XR3p2-oQ4qt z$VUv?vhC)(3OKQ4vd_cOp!I&c8n(W_gAJ=WA~2|m1W+}m-wjyj1j)kSNf&0Q!7qCJ zd#}eZ8dHZ6d$0cp+xunyf+{0)9lH9dfoEO!6ua4%1;C>Cr0UfS{Xf)V0RG_1BXrpA zxVwW=@V4Eb(GmN#uj*BrM>=&da?HkF)`>LsY#e(({&c4UI1W+c_0m_-=__4MA#>4J{j8#NSQvnnDr#C2c|;9_Jr?*5T=6^s69_uv_7A6=T6#B3w^86k7vo-IT} z?1p>aptJV+y|w9FChc2F^kZh`H;*x-#?}2zX`fy5z{F?;9doMm#Tj=uUy&w;HmBQH z4pcIjs=+~T^fuW)LD4K zSrN7^+8@#p>j+pcuu}BUT0T}u!WNx!Z%SHTluSwvX@pn{!PG$5CDnwOe(GIGa{~GF?I8(uq zH~Yn^BfN{;9Y6(hzntca?&-_hJsx3vUvv-gb)&K=d0_{8xqhrFA4hm0EF4No^&Cpw zNqt16^$UlOC)>9(zrEx~52e~a?<_7Oh;!s(9OvEFarWe$UfDqG#?ga08}ad9*eSfx zy)y&WGXqQlbOq;w=(?_J(v!bhwJ`urEMoPnKrs;j#?P2OcX&bF9P)DkuyjKaiLq{S zcsm>ni+d+USyg&G$XvkV)tNCcQ=le=c2X>~%inze6%qTGrvt+WWG+DT4?ms5-^B2+ zm~iZ&OF+Fj+qy^ls(Y~lzwXs{CYbFShyS1iASp3#kp(Fn=f$HkqujyNQHA3q{@ z22hMt>_$y8%YI*wC_~0!3(we+tbfimY$udt{r`-1_Vg!Lw)Tfrwe4BJ=BMI zu+x6=NNLXp+H#1!=~QL=t0T|zhfcf5x@T#qz4UZ`d(zR@Rr**zoDGEgsvgV5A35zt z$6hI{a+}r6;DDK-wscCGH5|uv)(ZQ(V>XX)+TD&LSdM6aF+214BW951Jkn{G$u5tV zj@cjbD5rfnyDX1(+VLmqlSHdjKm*MO^I3iXnkUcI%T>@4F-pYrJ&mh*N_3UGv&soU~Y+HZ_a3e?D2BCphgj zEBo40e|)643Oqzm?in3AjS)bQj=EG6sy=0JI$YE~yyjh==v2$Y^Rc3D63}P!WIyVr z0CjHyZJEhuIucE@ho3Et^MbW!n-hI)NBoos8!NNiPi2T^+b^E4;`u}en3FmEdL_34t`?b0+peJC^H@-}D5c}}jSsK8;U@7hj>H3-k` zyZL@|_zzd-!wdzjsUG;s{_|>2oUnDjb~+qx5Ke<3&8!9X^S>;jg?9M$+HjPbUEhRf z>qZQoOWxRpS?phLEG)7Zxb?a!J9nV;tt1={`n+igZoKS(0l388a zef>@=T4p!A>xHYBnRYjVX!-KD=u@O!WEF8!Ve(9KCLl9F>UgMgp%u<}wFw|l@INPX zw#IipVykdHD=TZOhn}OTBIa;c4@tq(<_vnJ69+KTauyYk$3y93x*#L_a}n``Q3X6V zf1RVHRTw2X!TKs;Li~&uh>T^1Q383TdN2BeR?0Uys4~UNl095Nyx|m0tK`@oj*d|r zEdW~LRgKIAvW#3=;Ivjrw{U7qt7Szv6{Q3@98N{(psdMBg`6(ym>kYYWuDm;YHjHkMX&L} z3vwfhhR`f|KN{W1ruDQ?))%DbqBfZf3LNob!6qo$7IGRhBvJS`5DktsF8XHf|oB;jDM9TDR2jN>gWO6Z@$lJ2* z4wduq$`jJGIF-Vyyi=TtA?rtG7N;cIk@aP9dYWjBBqULXs4Evta*dy|REn)Z9MrP2 zK2DCxfYB5HDe4^h`J<>q=8`MtQn4)hz8t zjdsTvI3Z`>N=#)CV@9v5gF`OF=k;3FetDt{wJI{)c`X6!^{ZQ0ohuH z=FleTmP+kQf9DJg;QzP@2{`D70g*pZNg>mv!3_T%$tIx8-%=@FVJlRY3Tj!oEH%j= zoXzW*>LOvegvRia2B9*Js7tR}ibVh!Tk%HA|G~JNTs?pi-PhkS;d@f%L zX*q*l;<+x9up$MkQ#GLQ$?DV{qGD5ZFx3(Hp*j`zV0kVqj~=7PLK4*>w@ymE$Ea7S zg{}xU#3RHOtY7lAf%Wc+iE!Pka;Tr||FBq2JO&}MWPA-uq(xG!1|6p3<7+}@9G6x# zsax(PuJ{l?M#3=LBKfK&y#QHJsureQC~37Ij~2?VT2#6CLKo6dC@nrjcQwQW2;A0E zSG>Nu0ZBp_kiS$)_$Z~o5zS9aN{e?yK#uDZJ{@t&-AUlNfj+8@F}M4uM?{A18jK&Z z`a7joZK{j452{V=Lh%7wA~a$AEXs#Eszdog{6>;f3e^E7Kat1kK#(4h>vd=}&j}!N zQe8-~5-RKS%kOompkLNUNy&N?mbb)T1pQ<;1bzK_)B=KD>Os6Lkd5`|dC21I22{}L zhM>RQfJ#f3`jiP|9cxH0NS_AulD|PLq&q&JpyOHil0|eTYkXsRhj|IhdyOG{&r7MM zbTjOLs(n|ABT0G;8gEHnZb8HI{|dPY0S*)W7TTI@5lD|5E$Ov__!RKE|K@X|tZE4yjh1Fl zQaP#k1eN76E_wM0kf!aDF;75O?w4Ip&>0@A{Yg4Tzh$LAMI9(T*z9*~vwG}*V4+wSBI6Im64cEjBvM(owWT*O za8jU54U}qS=|pNO85dcd|397a>aeKIhv-c$csxM6-zAlHttl5DKd(7NiIU!qVgoO= z?k7e>SQ#!gBeck(x0LDLP0zQ z(P>KT{yYkwuV$TU z%cvKrZPRhO8jz1Eu?kZr1_Bo#5@UiR!e+_`h{e1kqGn1Z8sM|7j66uO5AOeX|Ne{F z{~A2Ozb7&OyeG1u9j)bw0jNK|2X#2}lmO#2=mN&Ui!#o0&p8xbekcs)u^RAPcs1Y!9lM8;8A^36_M3oBxn? zv%Fy44vzIc_^K?o0cjmpz!Sy`{q<76FIr_bxuSdIsh=(t4o zrf!h<>AfkcGjx|G1XIxE8Wd%6w}oANLns z{l$hi=&4A+c3+A5^{T4RNRN45EVbTLRVwY?#BhtG@0)Z0ilN0@s!X$Hy+xBLS3gFA zsU}7Pihi8cv=7iinbNN>`5sxO2t^p{B2b&eSJ+ynz{Akd#A6idzv7R}S|%6!QnYiK zD_lmuLy;2m4t0z)y~DJP3-o~!%|^XL3A9`?-=TSRR=CuMa>3}spQJS3h_8_>i`BS% zOG5PA3Sme^@EWDB2k7sDzC&hTpm1B@C3KXihCEo0`=&MIWXXJw@*;wNsLm6#UJAZX z@8?{p0!NSVF~};J{XVsVJ$~zbs#LHaw%sJZ>iV&IwT{+mI=IZ(PBmq4IyIvtIgm~z zqWr+ZlU8sw+tPr$GAlBJb}7D&^`j${nYFq<<)R83Fa`u|gbAV<3GWK7#sp>oNHA2i zTonfIrj3E>oy;&1^ zqtlR(uVF}_8KZ$mFU$TRP-GLN(uZ`zx77tallrQ-B4To~)p4}G!0x6vBI+r@s@1AC z6=9G;@PM|#z(wtLU5K?!x(}sUU^iqcV9IsM1tM$=+c!g_5P`N3g+m z$^vAkJ!zo{Z<3Ac# zLj4+iKr?@*vWuYTH%iw<5K%*~$+SgOk7u8eyTc)hH=WfoN>(qX@zQl9piGvGCG>}& z_f-Doti*l}P1@X-(k$jj)`!}^ZSv6J-{uMgbH&%ch=KFxbrg5o%Q7e_|?_`chFeQ3F1cA zjvrH7&Tz}-kEuG!@ssEUeQiI9DwW7^|Bbyo$Q>VnU2=o)6LNwY2DxS3Br263n9#bQ z!K~0(yXDR#|L|=m)8+63>Z5!IGPAyyr>9U8D8`vn=tVjp?x|EH_OjY0CjSQfq**#J z54E`y&1+7jrV+ma7Xb-lF3or}XldP&ty8HQA9mSSeEA{C3rsUM@axm)Svn+prcpg7 zs972hL%6%ybgIIG-Nw`TbUIDr58Tpl2ED>V+Qqzph_ZWevbAG-Y(X8deWAzqAy*>g5kL{e$L;pgX%`lrD(}Bm(u;u z@w7uS=VJU*l06qBep+A{EXKEu^JqLg+t%}`L=L?M6{38zUxv)5R=GFg+LRHfzKw`s zo{{tOsYscU>NUE2S2SG;ci)0taOKGx(#@(1v5Wxe&xZ{gI^b1Q`3y+9EHgf%eC}I6 zIjpm?`ZK7I3zBmI6_3B{H1}`dsD9-1hIrwWVReDwwe>l9asj}-C<7OOX)epU1)zkV zBy1t|0zda%NL6L`M^u!ros_E|Q5`=1qf{D>CV$K8)g@suOyvg{{tHUZ0X(&pl21$YDtZkuv|+2@m?z7&Ra7H>#SOE4=IV&%vcT|y(Gjm1 z8|dtt1LJ8mRY&U+t3hRbS5w3zfi5skYH4a(vhy6>Yk%Vy7}072y772Jo{+Musfc{N zn)3JusG4m0YM)x#1?fbFhJqs+^TKx&w%=u`vxbTSNnO?eR>%W=`&qW>+fPDk>9x>} z>VT?{eP=C=xpg8+@19);!nW_pUQO06xh`YuYFErwl2Z=t3@&G9Xi;kgDE%KAk*Z>7#)_%F9o`%r}R z)JobY<-ahM6ThIxa;Pd(lLvly_7`-AK9l3ys5mTT&vvR;1PlwEWZm#vDartdb~vq@ zY9}$mLuuP-ai~9hGu$olJE%5~cT2y*h*0$10p$HAmv`J3mm$An91LMR%!oGTE|URi zqV(8FPv$kJ+^|WE#RI)|o8{Y`w6WA}7tR%?n;^E+y7%Jotp#;HP@y-oZp(&Ul>fm- zqmb|Pr<~eFn+t1KbAQV`Al_rzVQf7a|5LVpiCe^Xq~UJJ=(}0(@1|dfCS<*~2N$MM zJ@{*SgYIPA{u+8*m1eDd6O|suFb`7fdm%*12?8IAs_%Ro0xKP5{n( z5{AmhGUFr_^Gs3>pDepi;#g>kMEywha17E`izzbeM|!g0RK3fIfaPsmZCnPmghW1# zq+8R(It9r%U7DPt%JGv8D!01REPZn5Uu~MNE`uo9Sj)8Yzy3=5a^2HfC6|-AeOt-ocS3!Y0`PHFK ztKdvgww$G>dGr0P3E2V=7^w`|<2lAN-R;}3jvvyMr_Rx~eA^XL0Er#ifk#rHW%_oG zlOsP-s{;D@fnZ~xiPSw$jdM)|lcJ}&eF^Vi@_Fh5*<9cP4!ovFn+w#CmdT6@RI~YP zoKPB+02g{&*WkhtUKO4`PW|`d9;Xv=J%z!)ht?Fgc`#6Yq7DcmD1PK3@SP~H7UoAK z?IIBOsqDRIeE$mVQwraTuW;aH&UNzX@W@7l@{fS~k@+)R z19XnOLQj^NanYC)?7ISOn$wyKib3Eb4d`OuEm)R;Ll*<09=eRbLhHhcs(Z)2Y^N+O zhp50SS0Rdv$}d;x#qfDhlx1Ob~cZAO|^J<3V61n^vqS8yH$nVrJ;&Vf=CXiy>9L{vxDRraa zST6e=jJ;P1{z27)-ih;TcZ_|kdqElT2W_FOtS4^M07m)U9he+BO{OR$goYiz7}u1e zss?k=d`QUqpG-27c&Y2UpM0WZs=c?4o5H1N+qhle%@N}+a049KmM5OdHrpK<7cj}4 z%g!S!G*JpL=S{qyHg+#jEtue?1gBSEcgo|;&tNm=FxR17a-R7OytQ|7bs8m8oS5%` z>~eDHSbtBG0EM2_aXmwYo*I5%N~DXQaIVFHRkE8)%XqxuVB;qj_Y4T2DH!rsH)ldj zL;9;kt)7 zj(sY6lG3cBZo6gIC^?mj$HUKhCpTBic>)*mgV#t;%I4hs0etJm7QdY1JMH8(ojP=n zmi-o|=Eyd8<2A@7i*sTKW>Fxc!tzQK2huVUWM>qI`;Y3pc}zM6OlUMR3V9X89Vf_?HJn>2M{_^1R#n`F?9PeXmGHET}wA=EQPQ6uV-%PsG*xw7OAVEzPl# zR){O)xu$v&bAi;1hWbSo7vkn{8}1h3YUsP>X=u;Zar`J<7dwtS(XVnVjyvZ2-z=C5 zZkfJ`ACm=z`TH6-AK0Eis@xjFs=>$RbO5`*lY%*VCNhdICSw&}zLrfzxE+Gv@m`L} z3k?W4b&!pIh7N*?Y3gNFfjhlC1zM#`Jhy~rvMQcOLOV1{;7cYEAlS)`4)u!iPPELO z$kR|PPUJ`3*?&5$-{t2-E{?pm0>!vV#PmD(T^*!;!A5Xs({6IG7zj8{au(+@h$1{z z9N3&L9g3sNZ5dLWd&Pcc93V)TbBaUY9)HaR7`PviCAb78d$a@>i!5r)aCIuRo#r>) zk=ILLxVs`HAQ<;&T`j?(1hoI2#Bq5t%oP-aBR4M)x_}fs5$LAg7Nq{{I{i3_68C5Zonu08;!6_WggFP}mg`Y>@ z=Fb%F!XJ3#rPBOt{vjR^C%6;+g7o>JN0t=gX24Wp8BPTL8kOOqJisG8%W!H;oc=ro zwgDEHBgphRv7hM+$$s>45B7wI8y0Au7Z~~r_1_=;Z^++Qmh)Gw1Tj+Hcz#wTm<{E_ zOFH~AKNK=QAV94DWezNGWLfSSvJ8hz&=``ZB^Q#|a-0LHU&YIT@lDQGe(7G03k322 zqDo;cI3xUvj41`52qLB)1k11GxCjJGRC(?g^r%LaM*_OZ7>kmPm$s!2Kr^$@Y zhs$#lbS_>2#A%WUV&vrt{A|GK2jX{C;6(n+<9GVq75Oj}baq9~pKr-;Y6oJ8;Z_A) zxd7o@`AxzqaYY{Hky@2_J5`j>%7${vR^|fykw+R;2IIs@pUT|AJ=|lB@W`IZhK{dm zF`44iA7sL9Ab zliM}9LhcFv{6{??18q!{nzgtl)|Xxj^gsE3>3``EBq`MJalwL;NDNDN7=ckb9x4Ay}H%{_2;MlyMcuX2o zisPVv+lO708Vx`^hkuZ#8*mFW`?LYy3>@*{yhlM%-P~=YDw{ zSgIf?O?f$X^~a|C2&gMpGfs(|>ak|%-c5%z#m>TCnJLYhLH`$(ks}&>=O8}1((XHW`VzVcU1k>f@?rHRA~uAH4reF(DL4#u@^Pc za1lz=u=u@sFKW=_R7+rPHS%S^i~$~h`w4y>0(p8XZX%Ui@yq__a}c8+KFP1*ocNC? zv6scA##8*de}fqtyy_{l!MC5{X1JW7!rvNwUnCGi30oD>#}YW?ld z7i2Yz-|<$~2;BbgY(pbjbj=z>i~r`D#+HmTW_6N+p(7VKG`UiRWN;-z5&?LXFb`A%!5ylTkfvJ@?nzCRHhCW(8SFWXNBYs%2u2{@)l z>oGsd<*rDU;H!irznc#uZ0aHx#qfIKX z`Mg;^P2)Ft*J&xzjhpk&XQY>wH_ytZZu}yT`ALd(=WLoUo*q!Yqa?Klr1K6L)&m~O zMw!=xzkq;!r6>HuVd8m(SMo1IW#cPcBli}M;uZFofp(ST?8Q-GTNMTX|BAtiVU!o~l(_ZE02&W*%d5n1- zw)a(a9v_eV;ks$>x3J9(gDtY?buJUOGcfsLIrBRFqg~RsH|XjsS=Jl2VLv&f#V)zi z8!GKfiGKr@!fvVa2A53z$`8mD10OaXp-}xjt!#)iJtxCWHWdc_$l7B}aq>I;N8aE$ zij4tp@@`Gqev1o--5V+Et+yb#kPI;TZSD~Ay(h+ZF~cc$;<%C2?!(2)Zt+04EAW+_ zqX>v(-zbR2t$siT^jAcofvGjyxKAeb;ndKb{suE;UmuQkuSdIYU5tv~R?AZ|gx zYLPa4!r**&U?}5Z>SafaiD;L$*htp5x`#*ruVUK%(qEeQw=b|V zObWgO+4sFndWY+{Phrr5^5Z*vDEyEPp&8Skl5BsMhtgqr;yuWkBQp3s1YtJFrS~AH zb_=fKO>+J+l;rz4un9(|!>&3i`_eg|!N?DCJ{_dISn_3XNeoddgX5DgePlqtmrWED zb2Gr^nq^_iBn`O_&EPL0CTd2IdN+Ze=?vUDGoh!CL$ENrQ6ciuK&~h}h?_^9>j$-ho$*~%9C&c=`Z^wt z%gcj6?fYfQAc)&+**%Dh6*{3i6`JDcr8|Y+s&m|X@rmRd%q5HI9-LJ5OWsh;{rS;j zO7)dOaTu=`3z3)6b}-wDXA|>OJpVD6U!l0HZXY0yk!MQCL&{7(7y_j~Rdx-*5~j)d zA^fH~y&rOuR8X)Hk)U8b4)*`_-d_nAzPd6`fPjyF$SL;;IL}Zn5F4Nyb?N-S83(z5 zvt#h#w^Dm3R=-7F9m@HV%+(Kwm7xRu1eomHfgi~Q?yz%bJPT`M0I#!l%@3r;RxT`G z4&|6gkiAw&q>Bd{8+1CyunZg@Mqo;oi`=s z`C1htqF<&2rI-@oIP)F(jWa^<9jxX5p!tm>#TpLJ_fx4coTF1WISrG2?_WY7HzJ6g z&3e`iZz9^OKUt}|VxSBj&UK^K8=)TjK~ZpA0P+*V`EevTlpXY!Hp2Z+BSkW z;KXI{NLZ#bW$j3Qv&>&-)tDb}9UR8Y3J1K3m+G5Y$4G}!oFDPKw?=XCu*(5?x>x3m z;-dM@D|#E}8wUouc|XgsQ5+o$b5KJW_@c)q`E(96P>Fd(@{H!?F*8GAOrE4(6U7Et zY74#%>0!;1?9m(-H9I5*{t9q_IE3DOP%38Y6UjG*E9aRV5+7zlCLmpg zoH$IcIF1|W#};ox2aO#Er{Ox%w4f_~kdx!MHMX(ZcurP7rt^4i8hce$fdjcNfjEY0 zLhGu>cXlyJ_9hsbr^ds1pC^Be=Q_|_HHGUvb8C>HLX(H%7p!0+zlg2uoErkG>>$LY z%QrW~zs*6aIOhp&(9FR)g3?N|GXuKGZ+aZh`a$?zO?-HEA`m0;%|zaiHx38F+A_tl zGSuv@$gGbMNfU8S;&OQeKRpd4gF8<-@Viu+^I3lq*JgzDKAeIO8cxZkKwd$=y*-t8 zhTk#{F~T_z8IMon(R4{zU#8CB zgoye6Y4dvXSii~c8DOgUa%l#~q6nLbSlVxrIuoYbe0h2%B4YEU?@a8(eEDQ1S3+@g zrfGR=CJ62~iJ65!?0k7*7S}6i##OZJ2#wG8z@q18Et!RQCG^0>**qIA$>>io;9^<( z34c$&%h);mAx+CF{3!sTOIbDNa$}s#R7JjmbYhee@EW&|7T(}IIg5%W2i@8))xFxEP5pqLHWisFT012O=UU%(` zjEqI|Hm*L{z>D-g5WIB0kwMq{R3I9JvzR=QZ zFZ#^u47L0}O7wMBWG4Sfaf3k2UZ|3WkmD%4U@nMI{Ds8bFDc8p4K(54<=jFU@ZfT; zb1!l+Amnc&7gbkaM+?idE1%$P~zKY+xw*Y)6@XJGo4dYjv$V*WzHc9=}?6ro%@K7;}=>Wj65P5So zViuoC=4!6s^oAdm_xEsFzhjmlHP$?IFoCrIBY}g7ch(?kIA1ocVQ-OOFrrYxyq;j z2L28Z-r4}C>@#^`BccoVwcL$7Gi3oN!SR2jngud#6ORg90A=3_&u-yH6(NGLDr1S?(tYrs zWB*le!YVa$;)FXe=fN$IB4@<86+c%pA|&hJR>n=L2{LLMB+^9Lu?^B{i`?CY|E9s{ z5Sh50>u7mwJE(U|h;-P&g^(Wo{tig74KjTPk0Hq_zZ0Ru>Y5wkkNo|^ZwlaNm;zsd zZh!EEYf;vRyEw)f75sq&*f2AYSxeBjAmKT(`YV1dWpao)1$gkJEI7^>HDF-qm=Xrg zB9g~Calst;-8iIP`y7^6-rW=Q{8RpN=!KM{`?Qt&YZH;yqpm`KLt8<@vSsww2z}j; za}}~oRcVRZ%i};$3-@w;6xa9iD5St3VquO}-;sXZaLsA%KF$^Rg#sEQ$M*4MSUg{S zgF~NL()L^4g17knd=W*i1HkJnNj?BUFk2cOfC8B*oev-|3}rvM1(F_HdG?f>>4Bx^M5<8Dg9vBd{YYLq$S+nk)*s~UU#!M| zu@;ThSOrF+&>_wrX%4&8Ry6f{^+A#kL6Zi;EAJmN@h{x^j*`WPf`LUnS~B>)sDZ^@ zhfH8G@8Jgmi_hQZW#Bto+v9FY%fo*OEIyB_p@(@1e3wU$aN#;wt_l6zBPe~xT6Ss) z5;7$S!<4XmO^LPaqyz|1b1hCLAK~bN=7TO~C&jCWW3E0>_}E@{fv^vJcU8iu_Mot`o@izJx z&N(vW#xWc?e8^JjI7n`tymp)`bAOi4jzdo!lzqn$%D672vN8IP(m9(O!|Rfz*$4`3 zlndFMl>WQk-ofgulfj2yf)9t>floJrHA{mJi-Mni2tF(hK5PxPIUjuZJovCZ`0z*Y z;Y51yX<@Mc(O}Km;KQ=u!}r05{lSMF!G|lshik!ybHRsQ!H46)hYi7pW0W3P;{0IM zU=GyW4Az`A4{BdzWT<`7GACp~ZL%ur4|l4xter9Y`og6PW?WyG4r5f`^>^r3uD&`u z{RzEMqFu9>e2D+B#1lE$t3Oj8c(pDOW|Q_OAqy|ddndVczMm;P9KU~78TuGxV=abR zu`X-FN&YdS=qvgk{OQ)=jovSNdvxgI#cLn$8@)Pp=-t_?m8Cns-CKs-;PNu@SFRcA z@O^jK5k4?f_Fd(Ia`jj6^|UMevOIPPzrK*`3P;NMtL&90uW}^`xynr?$2AaD*K1rs zhF*nt{`EC}%5pdyt4i+uyb?;s+)L%kN&Gc#C~dAI%VEkjE+<`n#<1J2bFTug_wLZM z(~EuDz1Zt@Z;v-#@9llDv$y(VGW-`#61jt>Yi@8PfI58A5k4qX_S^sz`0W|5Jbx2| zy?Y(kl`?K}Rr&k^*nIy@q=4NCamGon8vs7xGJblcRxy@dn*#9z3V^-|ZK9lCez z+xazbx6XaM4u@>I#U-;k-Qv3>H-7;ltZOhEyi)sDE+z$Ub3LoU`k%K=*_3;?!*}|c zBm9HVte&@d4QG|Ti*RxjF!OrP4!zoS=-Ba25)k|C_>!(n}AY8o~IvoEGAB`rw diff --git a/contracts/sysio.uwrit/sysio.uwrit.abi b/contracts/sysio.uwrit/sysio.uwrit.abi index c9d953a937..709769d98f 100644 --- a/contracts/sysio.uwrit/sysio.uwrit.abi +++ b/contracts/sysio.uwrit/sysio.uwrit.abi @@ -849,6 +849,18 @@ { "name": "ATTESTATION_TYPE_EMISSIONS_BLOCKED", "value": 60962 + }, + { + "name": "ATTESTATION_TYPE_SYNDICATE_LIQ", + "value": 60963 + }, + { + "name": "ATTESTATION_TYPE_LIQ_YIELD", + "value": 60964 + }, + { + "name": "ATTESTATION_TYPE_DESYNDICATE_LIQ", + "value": 60965 } ] }, diff --git a/contracts/tests/contract_test_support.hpp b/contracts/tests/contract_test_support.hpp index 05637c0cda..7f89f085cb 100644 --- a/contracts/tests/contract_test_support.hpp +++ b/contracts/tests/contract_test_support.hpp @@ -117,4 +117,15 @@ inline fc::mutable_variant_object svm_outpost_mvo(std::string_view program_id) { ("source_deposit_addr", std::string{}); } +/// Mirrors of sysio.roa's `nodeownerreg` audit values (`reg_status` / `reject_reason` in sysio.roa.hpp). +namespace nodeownerreg { +inline constexpr uint64_t status_confirmed = 0; +inline constexpr uint64_t status_rejected = 1; +inline constexpr uint64_t reason_name_invalid = 1; +inline constexpr uint64_t reason_owner_not_account = 2; +inline constexpr uint64_t reason_account_key_mismatch = 3; +inline constexpr uint64_t reason_duplicate = 4; +inline constexpr uint64_t reason_link_key_mismatch = 5; +} // namespace nodeownerreg + } // namespace sysio_system::test_support diff --git a/contracts/tests/sysio.dispatch_tests.cpp b/contracts/tests/sysio.dispatch_tests.cpp index 1b6d72e458..b4ecb5b45b 100644 --- a/contracts/tests/sysio.dispatch_tests.cpp +++ b/contracts/tests/sysio.dispatch_tests.cpp @@ -14,6 +14,7 @@ #include #include #include +#include #include // kv_index / by_code_key for reading sysio.roa kv tables #include #include @@ -38,9 +39,12 @@ #include #include #include +#include +#include #include "contracts.hpp" #include "contract_test_support.hpp" +#include "test_symbol.hpp" // Canonical-encoding + header-derivation oracle: inbound envelopes must carry // spec-derived semantic headers or apply_consensus drops them before dispatch. #include "opp_envelope_oracle.hpp" @@ -330,6 +334,14 @@ std::string encode_swap_request( } // anonymous namespace +/// Wire layout of an `auth.msg::onlinkauth` action, the payload sysio.system once acted on. +struct onlinkauth_notification { + name user; + name permission; + public_key_type pub_key; +}; +FC_REFLECT(onlinkauth_notification, (user)(permission)(pub_key)) + class sysio_dispatch_tester : public tester { public: static constexpr auto MSGCH_ACCOUNT = "sysio.msgch"_n; @@ -1951,7 +1963,7 @@ BOOST_FIXTURE_TEST_CASE(dispatch_routes_node_owner_reg_to_roa, sysio_dispatch_te BOOST_REQUIRE_EQUAL(reg["tier"].as(), 2u); auto audit = get_nodeownerreg(CLAIM_ACCOUNT); BOOST_REQUIRE(!audit.is_null()); - BOOST_REQUIRE_EQUAL(audit["status"].as(), 0u); // CONFIRMED + BOOST_REQUIRE_EQUAL(audit["status"].as(), sysio_system::test_support::nodeownerreg::status_confirmed); } FC_LOG_AND_RETHROW() } // WSA-005: node-owner registration is bound to the EXACT Ethereum source outpost (NODE_OWNER_SRC_CHAIN @@ -2015,6 +2027,161 @@ BOOST_FIXTURE_TEST_CASE(node_owner_reg_from_non_evm_outpost_is_dropped, sysio_di BOOST_REQUIRE(get_nodeownerreg(CLAIM_ACCOUNT).is_null()); } FC_LOG_AND_RETHROW() } +/// Node-owner claims on a chain running sysio.system. A tier-2/3 claim lets the NFT holder pick any valid 1-12 char +/// name and control the account created for it; these cases pin what that control must not reach. +class node_owner_claim_tester : public sysio_dispatch_tester { +public: + static constexpr auto NODE_OWNER_SOURCE_CHAIN = "ETHEREUM"; + static constexpr uint32_t CLAIM_TIER = 2; + static constexpr auto AUTH_MSG_ACCOUNT = "auth.msg"_n; + static constexpr auto ONLINKAUTH_ACTION = "onlinkauth"_n; + static constexpr auto AUTH_EXT_PERMISSION = "auth.ext"_n; + static constexpr auto OTHER_PERMISSION = "session"_n; + static constexpr auto RESERVED_SYSTEM_NAME = "sysio.pwn"_n; + static constexpr auto PAYER_ACCOUNT = "payer"_n; + /// Never created; only names the key a notification offers. + static constexpr auto REPLACEMENT_KEY_NAME = "replacement"_n; + static constexpr auto SYSTEM_INIT_ACTION = "init"_n; + static constexpr auto ADDPOLICY_ACTION = "addpolicy"_n; + static constexpr auto SELF_POLICY_WEIGHT = "0.1000 SYS"; + + /// Parent and authority of each of an account's permissions, keyed by permission name. + using permission_set = std::map>; + + /// Deploy and initialize sysio.system; the base dispatch fixture runs without it. + void deploy_system_contract() { + set_code(config::system_account_name, contracts::system_wasm()); + set_abi(config::system_account_name, contracts::system_abi().data()); + produce_block(); + base_tester::push_action(config::system_account_name, SYSTEM_INIT_ACTION, config::system_account_name, + mvo()("version", 0)("core", CORE_SYM_STR)); + produce_block(); + } + + /// Deliver a NodeOwnerRegistration for `account` through the Ethereum outpost, as BAR.commitNode emits it. + void claim_node_owner(name account, const public_key_type& wire_key) { + const auto eth_key = fc::crypto::private_key::generate(fc::crypto::private_key::key_type::em).get_public_key(); + const auto payload = encode_node_owner_registration(account.to_string(), CLAIM_TIER, + sysio::opp::types::WIRE_KEY_TYPE_K1, + k1_pubkey_bytes(wire_key), em_pubkey_bytes(eth_key)); + const auto envelope = encode_envelope_with_one_attestation( + current_epoch(), sysio::opp::types::ATTESTATION_TYPE_NODE_OWNER_REG, payload); + BOOST_REQUIRE_EQUAL(success(), deliver(fc::slug_name{NODE_OWNER_SOURCE_CHAIN}.value, envelope)); + produce_blocks(2); + } + + /// The claimant issues a policy to itself from its tier budget; PAYER_ACCOUNT pays for the transaction. + void issue_own_policy(name owner) { + signed_transaction trx; + trx.actions.emplace_back(get_action(config::roa_account_name, ADDPOLICY_ACTION, + vector{{PAYER_ACCOUNT, config::sysio_payer_name}, {PAYER_ACCOUNT, config::active_name}, + {owner, config::active_name}}, + mvo()("owner", owner)("issuer", owner)("net_weight", SELF_POLICY_WEIGHT)("cpu_weight", SELF_POLICY_WEIGHT) + ("ram_weight", SELF_POLICY_WEIGHT)("time_block", 0)("network_gen", ROA_NETWORK_GEN))); + set_transaction_headers(trx); + trx.sign(get_private_key(PAYER_ACCOUNT, "active"), control->get_chain_id()); + trx.sign(get_private_key(owner, "active"), control->get_chain_id()); + push_transaction(trx); + produce_block(); + } + + /// Code a claimant can deploy on its account: it forwards every action it receives to sysio as a notification. + static std::vector notify_system_account_wasm() { + std::ostringstream wast; + wast << R"((module + (import "env" "require_recipient" (func $require_recipient (param i64))) + (func (export "apply") (param i64 i64 i64) + (call $require_recipient (i64.const 0x)" + << std::hex << config::system_account_name.to_uint64_t() << R"()) + ) + ))"; + return wast_to_wasm(wast.str()); + } + + /// Push auth.msg::onlinkauth as auth.msg; true when the transaction committed and the notification reached sysio. + bool notify_onlinkauth(name user, name permission, const public_key_type& key) { + signed_transaction trx; + trx.actions.emplace_back(vector{{AUTH_MSG_ACCOUNT, config::active_name}}, AUTH_MSG_ACCOUNT, + ONLINKAUTH_ACTION, fc::raw::pack(onlinkauth_notification{user, permission, key})); + set_transaction_headers(trx); + trx.sign(get_private_key(AUTH_MSG_ACCOUNT, "active"), control->get_chain_id()); + bool delivered = false; + try { + const auto trace = push_transaction(trx); + delivered = std::ranges::any_of(trace->action_traces, [](const action_trace& at) { + return at.receiver == config::system_account_name && at.act.name == ONLINKAUTH_ACTION; + }); + } catch (const fc::exception&) { + delivered = false; + } + produce_block(); + return delivered; + } + + /// Native newaccount creates only the account_object; metadata appears once code, abi or privilege is set. + bool account_exists(name account) const { + return control->db().find(account) != nullptr; + } + + /// Every permission of `account`, for before/after comparison. + permission_set permissions_of(name account) const { + permission_set out; + const auto& db = control->db(); + const auto& idx = db.get_index(); + for (auto it = idx.lower_bound(boost::make_tuple(account)); it != idx.end() && it->owner == account; ++it) { + const name parent = it->parent._id == 0 ? name{} : db.get(it->parent).name; + out.emplace(it->name, std::make_pair(parent, it->auth.to_authority())); + } + return out; + } +}; + +// A tier-2/3 claim can take the name auth.msg and deploy code there, so an auth.msg::onlinkauth notification is +// attacker-controlled. It must reach sysio as an ordinary notification and change nothing: not sysio's owner, active, +// auth.ext or any other permission, and not a user's. +BOOST_FIXTURE_TEST_CASE(claimed_auth_msg_notification_changes_no_permission, node_owner_claim_tester) { try { + bootstrap_for_dispatch(NODE_OWNER_SOURCE_CHAIN); + create_account(PAYER_ACCOUNT); + deploy_system_contract(); + + claim_node_owner(AUTH_MSG_ACCOUNT, get_public_key(AUTH_MSG_ACCOUNT, "active")); + const auto audit = get_nodeownerreg(AUTH_MSG_ACCOUNT); + BOOST_REQUIRE(!audit.is_null()); + BOOST_REQUIRE_EQUAL(audit["status"].as(), sysio_system::test_support::nodeownerreg::status_confirmed); + issue_own_policy(AUTH_MSG_ACCOUNT); + set_code(AUTH_MSG_ACCOUNT, notify_system_account_wasm()); + produce_block(); + + const auto replacement_key = get_public_key(REPLACEMENT_KEY_NAME, "active"); + const auto sysio_before = permissions_of(config::system_account_name); + const auto user_before = permissions_of(CLAIM_ACCOUNT); + for (const auto target : {config::system_account_name, CLAIM_ACCOUNT}) { + for (const auto permission : {config::owner_name, config::active_name, AUTH_EXT_PERMISSION, OTHER_PERMISSION}) { + BOOST_CHECK_MESSAGE(notify_onlinkauth(target, permission, replacement_key), + "onlinkauth for " << target.to_string() << "@" << permission.to_string() + << " did not commit as a plain notification"); + } + } + BOOST_CHECK_MESSAGE(permissions_of(config::system_account_name) == sysio_before, "sysio permissions changed"); + BOOST_CHECK_MESSAGE(permissions_of(CLAIM_ACCOUNT) == user_before, "claimacct permissions changed"); +} FC_LOG_AND_RETHROW() } + +// No node owner may claim a name under the reserved sysio. prefix: the depot's claim is rejected as NAME_INVALID and +// no account is created. +BOOST_FIXTURE_TEST_CASE(node_owner_claim_rejects_reserved_system_name, node_owner_claim_tester) { try { + bootstrap_for_dispatch(NODE_OWNER_SOURCE_CHAIN); + deploy_system_contract(); + + claim_node_owner(RESERVED_SYSTEM_NAME, get_public_key(RESERVED_SYSTEM_NAME, "active")); + + const auto audit = get_nodeownerreg(RESERVED_SYSTEM_NAME); + BOOST_REQUIRE(!audit.is_null()); + BOOST_CHECK_EQUAL(audit["status"].as(), sysio_system::test_support::nodeownerreg::status_rejected); + BOOST_CHECK_EQUAL(audit["reason"].as(), sysio_system::test_support::nodeownerreg::reason_name_invalid); + BOOST_CHECK(get_nodeowner(RESERVED_SYSTEM_NAME).is_null()); + BOOST_CHECK(!account_exists(RESERVED_SYSTEM_NAME)); +} FC_LOG_AND_RETHROW() } + /// Regression: a non-advancing advance() must not permanently strand the epoch. /// /// When every active outpost has reached consensus and the wall clock has passed, chkcons triggers diff --git a/contracts/tests/sysio.roa_tests.cpp b/contracts/tests/sysio.roa_tests.cpp index 7eb4c8dc20..5fbdb2ead4 100644 --- a/contracts/tests/sysio.roa_tests.cpp +++ b/contracts/tests/sysio.roa_tests.cpp @@ -6,6 +6,7 @@ #include #include #include "sysio.system_tester.hpp" +#include "contract_test_support.hpp" #include #include #include @@ -1940,6 +1941,9 @@ BOOST_FIXTURE_TEST_CASE( newnameduser_tier_name_rules, sysio_roa_tester ) try { // sysio.authex.active <- sysio.roa@sysio.code delegation that authorizes the inline recordlink. // --------------------------------------------------------------------------- +/// Shared mirrors of sysio.roa's node-owner registration audit values. +namespace nodeownerreg_audit = sysio_system::test_support::nodeownerreg; + class sysio_roa_nodeownreg_tester : public sysio_roa_tester { public: static constexpr auto AUTHEX = "sysio.authex"_n; @@ -2004,10 +2008,14 @@ class sysio_roa_nodeownreg_tester : public sysio_roa_tester { return fc::crypto::private_key::generate(fc::crypto::private_key::key_type::k1).get_public_key(); } - // nodeownerreg reg_status + reject_reason values (mirror sysio.roa.hpp). - static constexpr uint64_t CONFIRMED = 0, REJECTED = 1; - static constexpr uint64_t R_NAME_INVALID = 1, R_OWNER_NOT_ACCOUNT = 2, - R_ACCOUNT_KEY_MISMATCH = 3, R_DUPLICATE = 4, R_LINK_KEY_MISMATCH = 5; + // nodeownerreg reg_status + reject_reason values, shared with the depot dispatch tests. + static constexpr uint64_t CONFIRMED = nodeownerreg_audit::status_confirmed; + static constexpr uint64_t REJECTED = nodeownerreg_audit::status_rejected; + static constexpr uint64_t R_NAME_INVALID = nodeownerreg_audit::reason_name_invalid; + static constexpr uint64_t R_OWNER_NOT_ACCOUNT = nodeownerreg_audit::reason_owner_not_account; + static constexpr uint64_t R_ACCOUNT_KEY_MISMATCH = nodeownerreg_audit::reason_account_key_mismatch; + static constexpr uint64_t R_DUPLICATE = nodeownerreg_audit::reason_duplicate; + static constexpr uint64_t R_LINK_KEY_MISMATCH = nodeownerreg_audit::reason_link_key_mismatch; abi_serializer authex_abi_ser; }; @@ -2309,6 +2317,33 @@ BOOST_FIXTURE_TEST_CASE( nodeownreg_name_invalid, sysio_roa_nodeownreg_tester ) BOOST_REQUIRE_EQUAL(audit["reason"].as(), R_NAME_INVALID); } FC_LOG_AND_RETHROW() +// No tier may claim a name under the reserved sysio. prefix, however deep: newnameduser creates nothing (sysio's RAM +// pool is untouched) and nodeownreg records REJECTED/NAME_INVALID. +BOOST_FIXTURE_TEST_CASE( nodeownreg_rejects_reserved_system_names, sysio_roa_nodeownreg_tester ) try { + constexpr auto tier2_name = "sysio.pwn"_n; + constexpr auto nested_name = "sysio.a.b"_n; // prefix() is "sysio.a": the rule must match the leading segment + constexpr uint8_t tier2 = 2, tier3 = 3; + auto& rlm = control->get_resource_limits_manager(); + const auto wire_pub = gen_k1_key(); + + for (const auto& [owner, tier] : {std::pair{tier2_name, tier2}, std::pair{nested_name, tier3}}) { + int64_t net = 0, cpu = 0, pool_before = 0, pool_after = 0; + rlm.get_account_limits(config::system_account_name, pool_before, net, cpu); + BOOST_REQUIRE_EQUAL(success(), newnameduser(owner, wire_pub, tier)); + produce_blocks(); + rlm.get_account_limits(config::system_account_name, pool_after, net, cpu); + BOOST_CHECK_EQUAL(pool_before, pool_after); + + BOOST_REQUIRE_EQUAL(success(), nodeownreg(owner, tier, gen_em_key(), wire_pub)); + produce_blocks(); + BOOST_CHECK(get_nodeowner(owner).is_null()); + const auto audit = get_nodeownerreg(owner); + BOOST_REQUIRE(!audit.is_null()); + BOOST_CHECK_EQUAL(audit["status"].as(), REJECTED); + BOOST_CHECK_EQUAL(audit["reason"].as(), R_NAME_INVALID); + } +} FC_LOG_AND_RETHROW() + // Valid-for-tier name that is not an account -> REJECTED/OWNER_NOT_ACCOUNT. BOOST_FIXTURE_TEST_CASE( nodeownreg_owner_not_account, sysio_roa_nodeownreg_tester ) try { const auto owner = "ghost"_n; // 5 chars: valid for tier 1, but no account was created diff --git a/contracts/tests/sysio.system_authmsg_tests.cpp b/contracts/tests/sysio.system_authmsg_tests.cpp deleted file mode 100644 index f2e046af08..0000000000 --- a/contracts/tests/sysio.system_authmsg_tests.cpp +++ /dev/null @@ -1,134 +0,0 @@ -#include - -#include -#include -#include - -#include -#include - -#include "sysio.system_tester.hpp" - -using namespace sysio; -using namespace sysio::chain; -using namespace sysio::testing; -using namespace sysio_system; - -/** Wire representation of auth.msg::onlinkauth's notification payload. */ -struct authmsg_onlinkauth { - name user; - name permission; - public_key_type pub_key; -}; - -FC_REFLECT( authmsg_onlinkauth, (user)(permission)(pub_key) ) - -namespace { - -constexpr auto auth_msg_account = "auth.msg"_n; -constexpr auto auth_ext_permission = "auth.ext"_n; -constexpr auto onlinkauth_action = "onlinkauth"_n; - -/** Build a minimal auth.msg stand-in that notifies sysio for every action. */ -std::vector authmsg_notification_wasm() { - std::ostringstream wast; - wast << R"((module - (import "env" "require_recipient" (func $require_recipient (param i64))) - (func (export "apply") (param i64 i64 i64) - (call $require_recipient (i64.const 0x)" - << std::hex << config::system_account_name.value << R"()) - ) - ))"; - return wast_to_wasm( wast.str() ); -} - -/** System-contract fixture with a notifying contract installed on auth.msg. */ -struct authmsg_notification_tester : sysio_system_tester { - authmsg_notification_tester() { - create_account( auth_msg_account ); - set_code( auth_msg_account, authmsg_notification_wasm() ); - produce_block(); - } - - /** Send auth.msg::onlinkauth and return the transaction result. */ - action_result notify_link( name permission, const public_key_type& pub_key ) { - action notification; - notification.account = auth_msg_account; - notification.name = onlinkauth_action; - notification.data = fc::raw::pack( - authmsg_onlinkauth{ config::system_account_name, permission, pub_key } ); - return push_contract_paid_action( std::move( notification ), auth_msg_account.value ); - } - - /** Find one permission on the system account affected by the privileged inline action. */ - const permission_object* find_system_permission( name permission ) const { - return control->get_authorization_manager().find_permission( { config::system_account_name, permission } ); - } -}; - -} // namespace - -BOOST_AUTO_TEST_SUITE( sysio_system_authmsg_tests ) - -/** The reserved auth.ext permission is created below active and can be rotated. */ -BOOST_FIXTURE_TEST_CASE( installs_and_rotates_reserved_auth_ext_permission, authmsg_notification_tester ) try { - const auto first_key = get_public_key( config::system_account_name, "auth-ext-first" ); - const auto second_key = get_public_key( config::system_account_name, "auth-ext-second" ); - - BOOST_REQUIRE_EQUAL( success(), notify_link( auth_ext_permission, first_key ) ); - - const auto* active = find_system_permission( config::active_name ); - const auto* auth_ext = find_system_permission( auth_ext_permission ); - BOOST_REQUIRE( active != nullptr ); - BOOST_REQUIRE( auth_ext != nullptr ); - BOOST_CHECK( auth_ext->parent == active->id ); - const auto first_authority = auth_ext->auth.to_authority(); - BOOST_CHECK_EQUAL( first_authority.threshold, 1u ); - BOOST_REQUIRE_EQUAL( first_authority.keys.size(), 1u ); - BOOST_CHECK( first_authority.keys.front().key == first_key ); - BOOST_CHECK( first_authority.accounts.empty() ); - - BOOST_REQUIRE_EQUAL( success(), notify_link( auth_ext_permission, second_key ) ); - auth_ext = find_system_permission( auth_ext_permission ); - BOOST_REQUIRE( auth_ext != nullptr ); - const auto second_authority = auth_ext->auth.to_authority(); - BOOST_REQUIRE_EQUAL( second_authority.keys.size(), 1u ); - BOOST_CHECK( second_authority.keys.front().key == second_key ); -} FC_LOG_AND_RETHROW() - -/** Privileged owner and active authorities cannot be targeted through the notification payload. */ -BOOST_FIXTURE_TEST_CASE( rejects_owner_and_active_permissions, authmsg_notification_tester ) try { - const auto attacker_key = get_public_key( config::system_account_name, "attacker" ); - const auto* owner = find_system_permission( config::owner_name ); - const auto* active = find_system_permission( config::active_name ); - BOOST_REQUIRE( owner != nullptr ); - BOOST_REQUIRE( active != nullptr ); - const auto owner_before = owner->auth.to_authority(); - const auto active_before = active->auth.to_authority(); - - BOOST_REQUIRE_EQUAL( wasm_assert_msg( "onlinkauth may only update auth.ext" ), - notify_link( config::owner_name, attacker_key ) ); - BOOST_REQUIRE_EQUAL( wasm_assert_msg( "onlinkauth may only update auth.ext" ), - notify_link( config::active_name, attacker_key ) ); - - owner = find_system_permission( config::owner_name ); - active = find_system_permission( config::active_name ); - BOOST_REQUIRE( owner != nullptr ); - BOOST_REQUIRE( active != nullptr ); - const auto owner_authority = owner->auth.to_authority(); - const auto active_authority = active->auth.to_authority(); - BOOST_CHECK( owner_authority == owner_before ); - BOOST_CHECK( active_authority == active_before ); -} FC_LOG_AND_RETHROW() - -/** The whitelist also rejects non-critical but non-reserved child permission names. */ -BOOST_FIXTURE_TEST_CASE( rejects_arbitrary_child_permission, authmsg_notification_tester ) try { - constexpr auto arbitrary_permission = "session"_n; - - BOOST_REQUIRE_EQUAL( wasm_assert_msg( "onlinkauth may only update auth.ext" ), - notify_link( arbitrary_permission, - get_public_key( config::system_account_name, "session" ) ) ); - BOOST_CHECK( find_system_permission( arbitrary_permission ) == nullptr ); -} FC_LOG_AND_RETHROW() - -BOOST_AUTO_TEST_SUITE_END() diff --git a/tutorials/sig-em-tutorial/clone-repos.sh b/tutorials/sig-em-tutorial/clone-repos.sh deleted file mode 100755 index 4ef2381f24..0000000000 --- a/tutorials/sig-em-tutorial/clone-repos.sh +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/bash - -mkdir contracts && cd contracts - -git clone https://gitea.gitgo.app/Wire/auth.msg -git clone https://gitea.gitgo.app/Wire/settle.wns - -cd .. \ No newline at end of file diff --git a/tutorials/sig-em-tutorial/prepare-sig-em.sh b/tutorials/sig-em-tutorial/prepare-sig-em.sh deleted file mode 100755 index bd70e9005e..0000000000 --- a/tutorials/sig-em-tutorial/prepare-sig-em.sh +++ /dev/null @@ -1,45 +0,0 @@ -#!/bin/bash - -# Issue tokens -clio -u http://0.0.0.0:8000 push action sysio.token issue '[ "sysio", "1000000000.0000 SYS", "Issue" ]' -p sysio@active - -# Create accounts -clio wallet import --private-key 5JJPh8dLzbz1XYnGoUaCr3LQDj9aWeA52sqGQgqgarYKYpYzsbY -clio -u http://0.0.0.0:8000 system newaccount sysio settle.wns SYS5bVXRvVGsAfDWCQ1v5m5JRx42AAy6HtskiBpYXxedW8wxGeShb SYS5bVXRvVGsAfDWCQ1v5m5JRx42AAy6HtskiBpYXxedW8wxGeShb --stake-net '1000.0000 SYS' --stake-cpu '1000.0000 SYS' --buy-ram-kbytes 2048 -clio -u http://0.0.0.0:8000 system newaccount sysio auth.msg SYS5bVXRvVGsAfDWCQ1v5m5JRx42AAy6HtskiBpYXxedW8wxGeShb SYS5bVXRvVGsAfDWCQ1v5m5JRx42AAy6HtskiBpYXxedW8wxGeShb --stake-net '1000.0000 SYS' --stake-cpu '1000.0000 SYS' --buy-ram-kbytes 2048 - -# Compile and deploy auth.msg contract -cd contracts/auth.msg -# source ./build.sh -source ./deploy.sh - -# Compile and deploy settle.wns contract -cd ../settle.wns -# source ./build.sh -source ./deploy.sh - -# Allow auth.msg to add auth.ext permissions on accounts -clio -u http://0.0.0.0:8000 push action sysio updateauth '{ "account": "auth.msg", "permission": "owner", "parent": "", "auth": { "threshold": 1, - "keys": [{ - "key": "PUB_K1_5bVXRvVGsAfDWCQ1v5m5JRx42AAy6HtskiBpYXxedW8wwJWhhS", - "weight": 1 - }], "accounts": [{ "permission": { "actor": "auth.msg", "permission": "sysio.code" }, "weight": 1 }], "waits": []}}' -p auth.msg@owner - -# Init settle contract -clio -u http://0.0.0.0:8000 push action settle.wns initcontract '[]' -p settle.wns@active - -# HELPERS - -# clio -u http://0.0.0.0:8000 system newaccount sysio ikdfsdhpun.x PUB_EM_8exffEtJ8SsyG5kiwAPwACqLf29ygzbtxoqBFdWTrWB6qxCYGE PUB_EM_8exffEtJ8SsyG5kiwAPwACqLf29ygzbtxoqBFdWTrWB6qxCYGE --stake-net '100.0000 SYS' --stake-cpu '100.0000 SYS' --buy-ram-kbytes 1024 -# clio -u http://0.0.0.0:8000 system newaccount sysio qhzesdrkcdls PUB_EM_6hx8XEjettHeTg2W2vaw66577g1mwDg2oz4mtkpfx54UqEM99C PUB_EM_6hx8XEjettHeTg2W2vaw66577g1mwDg2oz4mtkpfx54UqEM99C --stake-net '100.0000 SYS' --stake-cpu '100.0000 SYS' --buy-ram-kbytes 1024 -# clio -u http://0.0.0.0:8000 system newaccount sysio .pbqcja3oeej PUB_EM_6iPWEcH1tgQTjPNCRYfrVBx2MhGv4onomyfybupcUmW5LBHQqt PUB_EM_6iPWEcH1tgQTjPNCRYfrVBx2MhGv4onomyfybupcUmW5LBHQqt --stake-net '100.0000 SYS' --stake-cpu '100.0000 SYS' --buy-ram-kbytes 1024 - - -# clio -u http://0.0.0.0:8000 system delegatebw sysio settle.wns "100.0000 SYS" "100.0000 SYS" -p sysio@active -# clio -u http://0.0.0.0:8000 system delegatebw sysio auth.msg "40.0000 SYS" "40.0000 SYS" -p sysio@active -# clio -u http://0.0.0.0:8000 system delegatebw sysio ikdfsdhpun.x "100.0000 SYS" "100.0000 SYS" -p sysio@active - -# clio -u http://0.0.0.0:8000 system buyram sysio settle.wns "100.0000 SYS" -p sysio@active -# clio -u http://0.0.0.0:8000 system buyram sysio auth.msg "100.0000 SYS" -p sysio@active - -# clio -u http://0.0.0.0:8000 system buyram sysio ikdfsdhpun.x "10.0000 SYS" -p sysio@active \ No newline at end of file diff --git a/tutorials/sig-em-tutorial/unlock.sh b/tutorials/sig-em-tutorial/unlock.sh deleted file mode 100755 index 86135837f4..0000000000 --- a/tutorials/sig-em-tutorial/unlock.sh +++ /dev/null @@ -1,7 +0,0 @@ -#!/bin/bash - -# Read the password from the wallet.pass file -PASSWORD=$(cat ../bios-boot-tutorial/wallet.pwd) - -# Use the password to unlock the wallet -clio wallet unlock --password "$PASSWORD" \ No newline at end of file From 86d28c461588fd940b461fa0e4ec97b3cdc7c9c4 Mon Sep 17 00:00:00 2001 From: Huang-Ming Huang Date: Fri, 18 Sep 2026 20:19:26 +0000 Subject: [PATCH 3/3] Address merge conflict review feedback Change-Id: Iab4f4f73ec8e9d1969d62c97f3d82e3c97dd8d49 --- contracts/sysio.roa/sysio.roa.cpp | 6 +++--- contracts/sysio.roa/sysio.roa.wasm | Bin 50836 -> 53132 bytes contracts/sysio.system/sysio.system.wasm | Bin 199181 -> 202055 bytes 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/contracts/sysio.roa/sysio.roa.cpp b/contracts/sysio.roa/sysio.roa.cpp index 0057113853..2c5ae9266b 100644 --- a/contracts/sysio.roa/sysio.roa.cpp +++ b/contracts/sysio.roa/sysio.roa.cpp @@ -39,9 +39,9 @@ namespace sysio { value += ACCOUNT_NAME_MIX_INCREMENT; value = (value ^ (value >> ACCOUNT_NAME_MIX_SHIFT_1)) * ACCOUNT_NAME_MIX_MULTIPLIER_1; value = (value ^ (value >> ACCOUNT_NAME_MIX_SHIFT_2)) * ACCOUNT_NAME_MIX_MULTIPLIER_2; - return value ^ (value >> ACCOUNT_NAME_MIX_SHIFT_3); - } - } // anonymous namespace + return value ^ (value >> ACCOUNT_NAME_MIX_SHIFT_3); + } + } // anonymous namespace static bool is_sysio_account(const name& account) { return account.prefix() == "sysio"_n; diff --git a/contracts/sysio.roa/sysio.roa.wasm b/contracts/sysio.roa/sysio.roa.wasm index 751f9dcad0ac6d0ac34b3b1aa72d4e2c73a981c0..cc20763d1c947e5d0ec220791eebcff06fe23ce1 100755 GIT binary patch delta 17237 zcmbtb349b)ny>e&I^9Vpq;e;ntGaVT0^LcvlRyZm$PGg976dsANFql79UXxV2#5}9 z;33C|8gB%JC>}VYBPt-?c%aBQE-J3h47Qf5|?>f$O(W=U#xa#BuiMsjXmzGi4in#0IVO3GC=!|h2@nX0OqnwgZJ zl$2DEq-EtNY57^2rWI~wdCBAq$D*zMNQ7l%}*)C zyi$6W(!V6FR8{FSsZ``^S$3DIy42)+F+?k3`JzSZuNCCx=8BD)FSg_NiZiH~9lsav zYTn@UJa#TqOy=}I&7NV;vgg=u*l*d}>>YNHz02NX@3TYfL-r9n%sysE*eC1{>{Iq{ z>?r$;{fYgV9cTZ+{*(QMeaF6Mr`SK(Y1YA)@#Xv`zKY+>S98JF^E>%QzKL(<{%84a zUh^D}JA4vE(-hs~T)-|+gS^pD5)@NObeedU^5YW?#ni9!uvQNb;Fr~UY@$aslvXpb z)tuk%Q3CwfL`>wSzQ|C<&~$vWRvItfvkk91ifM)%Whz7PK0eVIU_1!OjQ)?wb~E0n zHX2MfJW2vH6}Mdb#6&S6COxsh8H3rn+jU;1bO)-(W0@0;i} zFxKpN`J(}IJzT!8X>+T*(HbiL{E2Ff<)(MRKn07tm3Zbfxtjn0=|yJO9&C*3F)k;8 zZ1pIHYIeS@%=Iwy^l7!-JcdsmJYytQiP$bj6g!a)@rB*BS6=*MMF~0 z1{6bpRIG9iK#o@D5tRky=9ziN+eB|{j+tLXzG7*M*pIbEEY4abUD(-cacZ}=1!7@i zL@6|UWw#)xQ4m0!W6Jz6grKAlK&uw$A8kX@<0rPESxXaPL+oMZiz^0)H*@c8F=wD) zGB=Os#3zoOsb(;mQDC4%`}AX^&50$DYnlsZ$Krx?>9`sQ45 zrNhw7d2Xi&I?{q1n6pJ5r@;;9m~8MfaRC^Q4Le6=yPZxW&Tts9*=~p7)C=4k1k;8= zOgLIK5_UAiSPc+WyAdN5Ks9WJ*6N9CbH}1zHR6WLDHs7U#l%*_)@sDc=>ZZP+3(Pc zBuxU`VJL>vWD5eEtoFqupc6_NZ+JA4MA*mcVET z&?d@FLl;I%#l{w~ecl>g!2(J2!Zhs15*-c(fKg5Z`|IHuhRFT45iAv}64jYr;WR{U z>}1wo+!#ADc#<*8_!5SMu}1@%V6TOuW-wsbv%8qc?tmnC1lY6#^~@c_(6-$+kOcFI zbv6TbJcjT9GYr|zXlem1u1l;ddtjU!ToEot=j)yVeA2*~Z* zFf<~v*gg=XHEnIQC>8)EY5O60?gJu%eOQOZ$UMa)mh4Q*GYjbcKlO>S4* zpHi6KKw2K)2T9uxDw5W<*zPAO{eZM1)ku-sRZB6#qe#1^7mGou?m`C;ApxpUcawvI zWR~K!9ds=L=csA>E21N{AbvOoH91x_X)7RvJ5$|5Mi7n_N++}Uw-Zxf8qb~!q&ffv zyTQ9grHz&XJ$<-HOmp>p! z5NP~tQkoPXvo@og-}9b$F~iT_cu)L2V|YS{*3|$2Qjf~aof=JQTGnC;OrmN?NpZmK z!!AiJhD9%x-pfQ>Tc|io6_622!5BcPI^MUG3hNun@@CoA^}g7jd3*U-m)WrgHW^?x z!J9!2N_i(YU3yqj)^LxFBn9#*IBpG{>}^*%hJERB+c8Y8o{;U!I>}&vVYP0dI4HAKe}sM;t@=rEY4%Ju zQ~WMFJ7R)XN2|0nL959GfovfY#By?c4s6{L{8D^zNTvDZUPT`d@^Sb-NviMB0GTGK z)JKYOIT?_^nK}7&A(o{|mO;XGOTcwlSE#>3T5BL_aVVOb;&(aeY>YURQ<_9}SOSid zOKsdI`sC&qWB`HWRu(pbJNAXlq8uA9M&}l%gz<#-T`eac*(Yww9a2Fu2q}OnXwU<0 zGTk)P9{H|OGY!%|Ajb8f;xD;5siEaE5eV_iC8!hoM1Ee8GuB`vuoyT&jL&nkp`tyn zq~Xj3;ApV`;bj30Ssp?`j{(ew<{ zzK6~6;tiviT`2zBC_s>&?lv74NqG9j;!3y6S0p`DDffD0c#X&>z^g%S*$xeYQ;<4C z?U~drwz;bS=u`J7$0bpKvd#%eO!xROVZFz6TpFJ62ahXi0vTKi-DqWo74(7{_P7{X zkPlOTb-`>_E8Z(8y66!o55-nmt9~0t7zirEJPcy~r&q`eg<~Sn9!V863Ci z2_&1ciI!rN+e5Ii)R@9D1S$!^;zR;Zz%8vjDYg~%?X~At5m!_lzXPKoOaQ6Ziax<2 zwo}Y6Dh1QR&SxYf08Eo6H^MZ?_dmmU<9TiG9lk#bq9H4EdBq7#7&p~#+ z?Ao?pOe-B+eTDq7f4`Jj2WcCCbxDw$0CE*v>SW>{87)h`PwyA+l~$Fn`yeFxWCg?a zWy`CfM#NW<#^1aud}S%F!?Mqy9ydHYz2XS6K2S_4bMe2wDt=iufZumOY%lB2rideD zg?OGW>z95d#exosU+^$4l?Wd?AR7A)i=7IIf@50tnz+4hMiR`2ge%uD;$Uo^>3f%- z!rRf3U~Xi!<^f7Z&)y+gP9TJrz3|J3omTa`pr`>2$B~L)*-cERUl84+D&9wlKvt{x zp`V*g6Zz#AR8M!Ahu1SBE<6ndF`MBi<;O6klz**S&JdqRRS%Lc7&#|D~K_a9c%@YX%6RRVbIyrZE}Lgfa(-@6ZZ^|IdeFW<_7#^^rJTVc2(l zBzY>vR%G%wKM?Pu=hO$(!`B@W?*4r%e{xl~>NMeiDPsa=&@~yZFX>-DpuvbS*Pt+A z2Ss9tBIFKzio=aM0C`1-CSqgj8)L-R{rj>~kusqFuxuw*!kvO>ObG|k2-+oaulE)+hq%|9nHqMM(5DVAW$*jF;tg*WhdTYccW|Ml zP9MA`NpCkhAt!e8gnWJ-RwpsSS84kWLt4aA-+=S}6-5eZmyLEC8&cRrbhMuP+sZ6~dtd^-!w}y8&$%Skbw^dz$Kogh66|N`mD81QGh* zMW28r!JnL4f-eqG4tRZ_;=GFSuJ^GzPEiL85AhEHi+K=sQ_@6Q zBFkg6;JZV%qgRTJtOx;EfFGbqc%Q<#iYeZ%iG?(2<|!Z!&u|&IDtk`=7xM(1k<}=^ zt08GRzc$}WJ%Q&5-eW_9wM7*U)FCaexQUW}IGifsRkV8PZB}c%&O0%+j(?-V_M~GYY;9_mfUj ze^;n~!&{QhL7+CA=e$^KZm6EdFX9R7ePj@Un7zm`$rrUqTQ{QgF-rYQKLWh3M*7v@s3#6SePMa z%GA^?%h5KIFET$kBHn7u3C=NWC=Ww+x4t96qap$dBFaS!sn4}0p)5=)27yz}-8j%7 zIn(PA0w4>M&7lUwJ7R|b((kAejUDIm7wGE60svX-e= zlh;7zK~^kQ{PnyF+g{MGNfZq&Nh7Il!t4`}TOb`$muW+*!lkyuWW9kMP4_~mwhbli z`EaPwH(WqDtXavRM%oh^Yt|AtZ@9E*3`>iT@c=?;s8(eTds^;fp7?%P7Mm~9hM$Kl z##b>>Hlm8(%*5mo zxv9lYSQ)jH$K#w*8A*0VPZYP0=pS8Hu*x4_yd&NjaYg6LrRhMaxnfiyoF3H168;e0UX$wf z5cUIai{Pl7i2fkOKWTXj=+DkknUfb_Z^U@g0+X3o-8{|O^@VWDpn%j{h8^U}@Odemrf@0bD z3;5O##i8-di5;>Efh+^X4AuFKsA?X7)J)oCO{csJRSdGeJ&8uJ8S*Z=nuB~96UKzT ztXPbhP(XyAKfw*cubbeH|266*a^F_9BF_ODQXSTuP!QK_lR8=U3IS1EcRTf+3<@gHEX}P{~)AhQn+O(Y}4-}0$Z7yTgv2_ znObZpV~eA=_^hq)pV3&t{Kpy_zZ~gS$hmziF1aK>CJD!L!O^1ol2mcWC26pN4_(qP z?>LJVLoIu&CE~0u`DoB#z3KF{Yz4Z zVsYnXW7xlo&n_!X`-(wI=tP;M1mT!3~cwpRS<@|@xx#R^CE zYHyRvC%Q0s#Kdu!ykR0ueq&-@V$Wo34=9|RI1R!-aZ=78=`V0{_H$)x$!}T4mV;rO z?iWu?Dn;$@$fPa&dDzjm%-G*UeXtuS?B*+~WY+yW9OXHb;ZIk%SjH~fs z?}$H6tEP7*FJ$AFdJoyE_ zhVAjDJ5N6P-Nt7>z3ZOfVvnOKZ?)lA+4S5S;;VQ6W9?%v2A85OTekiAfxVlbcy`^_ z>(Lh5l)rkVJI;hzY@?%YkcKW;QErT5>3F#51m37N0__;n36y7}xRnsK($bYi>`L4c ziAO5vblX*UBEu2Y|IcIM04Bf~SmrN(#O!)kG)ymGC1U#Yvf!_XBOXVMx*ByfJ&tU8 zLK9o;NoYDo3P$wWiZt_>qF3Rw6HG!S$7)l|V;?JeB}nBUCq{7%GJ-OW!>>*izRCuS z?YNdg2`PvOvkWT4)4@6bbifY*QqY3A{)nOv=nYT@%7Q-u$YMEGv-}?{)F!xAa@vrD zt)RDbi)ik)p&2#@pR4Jr4lU0X7@8NQCI>O6-DA(D-W52Vpz9v?Y(1HP0D%aQ)woY1 zo}7Ljx%+RX2iO|Xe?~gHO$?jiC$F@4Mv1(z0NwM7X){vAi!Nm9?&R?Sn*UUt? zw!Sm{$pAwRKx@K*_HL|VI7Iu*lx#GU5CS_qyOA;Iu%r??Dv>kOP)kNTG6pMt#;*3x z9GLPVE@`xcw}H}0vpZHK%}NQCvPl8O>ai5n*u==I zb6SUz5+K86)(p7y0Pm#gE12pGag<0H-TzpqKPKE?q3ne@4J*-`IKl$i%3v#CmQa^+ zP%!5ZJIV`xrplf;o2u+ZvweKuN8+;CKn_Ow3LRvc{B zUgP0r@FP7YfSs*n~+p`w{sn_}}0@{T$Q zmptjFpRyPVw*UGXV^WV>>?XxUzKmyg)X@{n(duy8M7|6h4yQ)=#8u2zN{LLme}_CTlgpu@8&;AAF=jgF7EMsS4GH^M9kLm~x>lRj~ zjw7RBc4&|ggOd;7x?3Dx=s9bqZ&7vTM%n{e)2Tq}Z*nUL^s$$Y>vGu!q2EBy{x{_0 zTbs2;lq2(!d$)e}Yt^@ii8qWDjn_I-C-t`W71tK^vL9T76&tQC>!pXG=Ywm{-s!)B zZ-_Y-f&(lB$ERM^8**cQaW-LYX)hCR{UWY7LL6^|&v28nHN%JX zWPx}PI;xr*QQ6xf2Hn^<<9^9}s}<5hX-K*L024nf$?{N%(CR^PBzj=E9Ouv<5YOH? zl(mafH|CLH%2`|%*Apg*X)9BpJTn&e=dT_TV)1osi-=p&H!9I1B~i^jt)^R#AvY`U z^~tu8%^j(Gb(I3J(h<81xFjF?g z+w^p?c4;~*5?hz%oP}~CoyOCpH)KQ;;334af=nCk9qICF275$Q2Oops{VX_&Jt_Ki zlqABQax6l(O_5($i)kIXXrKV+v~QS7 zDudyE$Ev(+>zpXcmcr1&g(3foS$A`$xNe2(EE)o(JPRd=5H9+`0`hVY&NAlEYQm)| z$Hdp=7Cz-s_}~_(g-@a6yR3FO2Y~Mw%20R#g~3!S$U%IwX=NqbCEi#$Ax|D)LNCH6 zornM!)lr^c&RL9$_O29h{;Fj5l$g3I2N!yPkQ_{;(?#d6QpLTiiqN}nRdKYmV6$}k zDmOcd#q1h=vxDVFNfQyH$-df66v1C9ASHrawXgo1?cR0KEna3X9p<(pT@`n%o-Dq; zwXAj{VTFa|8{yU_`i&cYFED2oc7}!Sq83zhen)SNc#%0LGrn#`RzehOUS@)IyZ9?i zo~E4f2W6H(xH^ zzN3r1Cgyckq`wX(=x;FmZPFR~`ebJ{CVbU7j=d=YYbPbYMH)s0mvFpNBpz7X!aF|{ zaqG4a;#=1Z2R=@Ya87YLh=w1CAJzp*0?>b_Q*OtEMRT3;J<@9T0Kqf4b9r@$ZkSczqgx;f-EAacGLcoq$UCM~ z9PG79ckf1*2gmI+ngq3%>9S1s`;8`ZiQG+%D7#MCGyzoU-c*62@u!;t=_rX&uv6$k z^x8;T0V@IG_1#>;|L~!>aPv%Dkr%(+oP|k;Hh18;=l;UrABnq^YruGi?$m^(a7#$O zH_#hqPreZX$oC$^N%8~w4}*3F=b|~97U7~PZEj(!ULM6~$=16w*ATIYcn~6bAciFk z`){%HEJZq@O(2@G`7S8^9{$?0V^f_X)k2|IXC z*YN0mQ~>BuQAPi^UH-^wSKQZ#@4N5I#PgZ^`mtNZ=l2z6M%hO>kK%F}d*|I>6%91X z70$uJwPCWU>M9g4$L`)Q1PTRI4VcDmMBfDnJTZV z!MciZ4>prbbv;4}wh6MxzXgW# z99Qf9Z5v%o;@itT_j1yKfw)ux8SMR!Q<}HC5+j$8FrF^|->{v`9&A@dSCqJ%C5X~? zLD1wIr%YRzSku4aT<2RqbM^3n$NI-dT|JyC8XnIUCm-t*7dmE+L2*NWJiSjY85wvK z#3T9xT&#Y)Dtbiw72a>)OJb?vzJDDHM zdyG4;3`JzecZMP|wnOA}H(Ajc&UhAgyOYii=)MsMIyp9J@up?@pt8}83=1O>}rPwKL6B6(fpJhUza^KL;fCLF3UuS zyHl-0av%`8R38qH=uZrREKFTLQS)^9Pj41ZI%=~|iKm{f#)LmU-Ip{t?U~8!X|eE` zO5+($WodBV3kq223z-=5Su%YQ`<^LrlCtB^$`$kZBjTH93IQkQ+1!`{k7{l`B8EKM zWMBX^jGiP%bTt<>NwpEAL6iXP5cfUnuZs+#O;A99;0(cKi8b&hW?G;g7EH z$JX%2gW->R!ylW&AKS#v=Q2|BoKE~%VSb3GzvWKnt=ZzpbDp4L{quUgK5wPB%3JOA zdjsAYZ>_h^=k@t~mA)!pwa@Ph_-cH$zPd_prLVHGvZ}JW(q9>0sjKzY`f4j{t7@xj{k4JG zn%dghx;o%khxO|KyAIRp(6sB+b6KhbH`5O&&gBk~_QE^6j=!*-b7ha%v}YAMZaSzq zZ*qvdm!991^YS0rF8kgo49%+!E6yWawCuZ6@cpCehEJP)P0LlrqIt%wmbonprY&kQ yrWx1Ho!x#dK4#3AckSFo#@uOh@MGqpmIWZ|v_*?r=FDHTP>kF^QtPNtl>Y@nuZ$`H delta 15178 zcmbVT34B!5)qnTBH`!)@HzDg}do$T4D+$?Hg%{a(LQxP<5CIK{sJJ7E5D?i6925}5 zP&X8iATFqgK@kxYK~bZ%7F$0{6$`e0tycT>`=9$}CPRqY7Jt5Z?=I(_d-ikg&B}+g zb*r?-C!-_l?0?FdLl@~$cwh6+vQ(YhMBP-iZXuqcPAr_NEnK)zQIG3sG(eQ>StN1= z9aO)s+o-Nrl~|#~#tIRu3U`twVuf2vj&*xd5@SzR5=tm)2j>#>@qy3>5_l) z)%+0&M@iitHF~a4Ea9x!A$E$VM6=i}o))i*L*fl_SiC8Yh_}Ss;+S|x92Y0Vd*Y;c zUwj}w6s_Vj@q6(H@wxaP@rC$C{6+j#{IB?%_`CQ{d@ueX{we-X{7WoXSEwu1)#|-! zqgwcsx=Sr?R%1?`2DNm>Fr7Du8m&(4Zz`P>OX=dY@bs&jCz^_7-0TyzKD82GcI&!{ zKFw5WtuD3Jyz6~RrMhk+CaRV(-&BV4bi9jN9#3k-pq`DGX39~P(ht9zCps&IS_jC2 z{~w;>6>5L2zbTA#pVCQKidU}PG?DI#Na*5qMqsv)VgF?Ac`PDX(ETwt2rorDdv|tt zoTf0;yc_C{s5a^nokKz(_O;D`pTnqKr&(bxNX7J53UK z)T{FldeE389;EM$LQzUN?!xHqn2+slY@tbRPp2}=sI68^El-Ow%4m^$r{nb&#VDup z*vE1!09MJ<6rWbD)O1n|&8s=BKQ*hS20FNEP1O&&8#;-u!`0W0)2Oa#QI!(*x5w$m zuBCaQ`4PeS5x`VJh%g-t!4ZH^KRQWN(HC94>W=sKM8_qIfew!x2MX{q^(qftCZAX` z!UN3E(4hKMNev^*34mZh1BO_7E$>G$Dri=G8g{)TKHuBj7Y*t}*n4lq78NF%qq=Uq z#CY)mIv$@9q=s%&Esa!Ovs)91#*{|>SdCYuOFacp0s$IFq$Nn zW;Hr&L>G9nL%m9ff*}z`J+8eMYGY5jMNmBUZtYck)l7{kvdd;@>M#NnyG&F zDt(pe^Oga8y=iV~NC`1+co#h@#@OtilUMMN}`lWq}W4tLyn+%ZsgpLlYLJ zUFt0ZXRO0Y8(jWw4g03QrR7L{w#b{Fnac}EZMU(g{w_*_-uUWD293{ZrCI?pv(pRJ zWhZE3dWHJz2|AuWs4_s;asa?c;`A#ZDb|5Offf4lgsq8K+*B5gk!{Q0rKXJ4;$rG%CUuoc0{*X5eGcY7B#3(hgDI+Sv5naV*x4vH^tDz!B%W%#y~@rA4{M7a z(3T4f;rVkN80e-~yxvI6lUV-ITbg`Uz%EDC8n9o&N~$%s@V8lOoTXCV%mGt87H~Yz z#I2MjuCdL;Eekge(!{Y91k9j``;9MkXru}KmdfDAn`-%Mt@~e7j6tBZTBJzFXYD`( zy{agy0IC)3OfXQ~I51lndY4>6zh14>ywO$3eY?<6Y0u};d$%IO-!7n*ssoV?;7P08xlm1P!! z1J%)?H>xF!9<(bfS@fnivr^*%pp$&MsZNyBwjQMKv$CC0reI-))fz&1*y~!NJ-aVwIyvF#}roCt!ns^)+;9oc7y+8XE%x!r7{S3iG4)E7X_qP8onI{p^l^K6upRmZw;|Pw z+mpDR8vJE|zSlpr_sIVqI`zpb1(dmYR_{^mps@W#6XPftM-hgj-N)_a+)iKSRf$Ka z(<2#hoz?l*h;FnaKijnhng;EGzc(7_xA_^dqfOygbsu2)RoIi+hKo8EB#2DPF33X+ zG`b+C3(w&hwqBm4hJySKd+wso3(8%OVl;#ZK#guRrXX89M#BpIQ`?-+5XcJ{Da~+* zk&xkklaXFHJ1K!aN0k-@Fc2Qq7)I|FGH3r*Xhn^c3m7A)Uy-L&G7-!wu>%H#VN4*^ zCR_wFQHDdZJ&xOHc@dL;Uy+qLDgcO;kwrw3SPFZH{A3m=F@uLgm)7H3};B9>-s zlXNrKf^Uyj)jDlqCc^v3*}kYO5QvRRBtlZ#2(=0`%4!z1c(#f*`Hm`5nuQeb9j}qu zEm{4|LF(PDZ`3&1_V1uiN(Yu+3V1MXPro4*GRiuIjY8tUNZpLF6gDZ+Hp`H~ zjDZ1aEZr3F!X@232^<*x3ZyybU;-VEsD;Z$2sgERO_vHZoYBynr)?036%TZeN1XIw zcdwX0-*>MO6KO=5X}iQIzj{jZX}mWLF0rnxsH_5ljhI>*jgU(W58YeWF_!0r?!PO` z_FRUo>P5-~-WGrbB1?%>I;88f_o;t*zPj=QnuD*0KA_d*Y3g(D(M~je@t$n_@jd#X zJiq%dA^>mKZv9Iu`Zz1h2x}#RzewzOONA$fzv18bv+0?9kwafs6c0>xqP0S8AUt1FRg>|tTVA|nzr&i{rS3nWYV7XA}zyxaxnjf#sM9_S+ zvdH&4I5rNNC;Vj4Or9!FI>*P1FNesO5)6?MnM)GZROJkbG$RA5v5k{~dfu$H4KYX1 z>qQnR^{Nyr+f9Qb5pdkTC=)$R>PXoIb!n;Un`NuZlEYH`BCSSSBvaSs2$+~iF&q7;Q zkliH76vx(;MQ_qBbTKlMfnG}lBe@~67A_XD{!PzunVcQ%6H>trtk$M(bIa@WQQ$q8p;I72wcNg;8t4Ko0aRi z-Zc>uJr)#%_V-E&Uo8}L_UV)CK3}z?q1rS1c&A<7q5gpXyjKr`fm1T@Z6~%;e1A@C zmH07f70NZt|9wtt=jwAPz zkk?#fg6+EXBentSJpoM7nJMQ0+d9Xwifp8l7ctv&`vusJb<=BKgVZJJMIi*`-mI4qF}_Z;5Q2| zeyb51*;R;zR+4biddsig`xYIrl0_N)#;QRU5rZ>Sl}Ek;fPD;AEZmh zCA9eBo(`$xbl~Ey<f z(%b9-S)to+sQ7d4{BB(b`y;%J1~TYOe7Gm{h znW!}`rBOrgPkSAeD9dTOOy@!`?>so7UXBpMHkSlO$WR?Sh8W{Nl!HS#V4ik0BRPa0 z6Ho?udsvayMg zYZ$G%on+~(O@XnpYJzaZ*4D5>4+<;{jdj)si2gvKC}qU68N8F3rq(vNN^6Rgdj?v@ zEIK>lVg&tVBdeoF+CY##EF77Vm5EjT>ghlw4fV51^$eT^(gzGX9?7El9KAepptzIt zQDtHw^&FKJmnEs`S6x07u!n&5!stx3ql&{bcDuqr$7uVg$-aZ{Lb4EL>o5hNFy}NZ z?6O!@!fV_{FHQDU{2K)vj#oRV;MCCrqo;J$;CigTALQx@msqSQ6ry9sWWhB+sS<6a zVwxaZvNTl25wd^(7EK?oF@!mQErPKw4n+BRK8lm|rTv4fKa!jp@uuzz!%=gk3ea#&<;~ zG=6-BxRGueKcf45kF_1VX9#kXU)=#(`qf9k5x=^P>u3Ce(mJZfh~q)7zmBgmSaWXT zOag^^Na9KAbxEeUnJ&MiMqT$lJ$=cT&bM%R0LcQfTFv=4a$njlEnwAkLsr0g)Ti!92YkjZ=*J;4jUTtA`0wMIR!ijYpnCq#<1)H-2i^sx_> z+CoJ!^7jm$cuxFs3dfsnmqOJ}$`$v~+DTVA!xJen`Mg9bdom|dVYxf8mGk3byMPD zEtgCwNWI;MfKTzEpo+4K>6mR8fdor8?x15+n#2N{cX_-^8ZA4ruA()U=dl%2tkha# z0S?X-=cWh}Te{IdE>9AP)b)zu9-jzyk$m<6lLyEUVOS2oit`3xeS#8FB3Cv!dI~ff zpRm+t(QQ`@7r&*~ukcrWDxim$D+K@%ntdh~3GK8VevgGwNc#_<@CAaU2;LP{;du|G zQ}xtK#ND)UYPncO$EK#{wCPt6Ev*CKWK8oQtS^{03X^Z2#*=qVOYhP)8I~I;ell&E zm`@j7nc7>r8hKO}%98>oW9OHRr3}b2vK$P%wUO?-(vKqB{wp_&Jv3>0a`d~<8*CP8 zd*}2rnKti(KmQ3eI5yoQ;`jV%x?6~k=!dJk;$upi(Vg=jMTYhoKaJne6*C@+W$!2J zbhblL;82X2d7cEejm&eK#8Jk_vPPvCAJMp(*B~5wd1h+ef4{*^TsKFw3%w_|8evzk zPDRc3>Ckm)+#}(xn7370J&HM!m&jqXwlrNYicwla0olx16_s`}zT=n-rgS#Zn0Od= zOSf9!yk#;DzUoEFIXD#C4edBaCuWr=-Nn0uSNb?O`5-0><2p*aIwxxBI}Fk2M8mHx ztdmLP^XQGJ^+j66y%YtJP6SGC78lz1oEdcj984qXcI>P+mwIF1ej$}we=HqgIkBwi ztiJENC;qYi`A;`(sat5qERlKS5=3p$C|^f;BQttI7x1ld%(c{+fcj$_1GDS8mz9uhsku0vbs&fk+c|f6p*kHwJ?xVKARB8HPE%Q zE7-O^GCLPF^|xmG>`C2IK?b9PNeyz+MRR(@g{zFsWuJ?d&&d=^=&3ombG*JtJDhs< zrH$RW6dP#*X~ZwqHe|1X{LB|EYw6ZLq_y^|8Cj|BWlRsE$zd!-P{|Xd*M<2y=TA5^Bn_L&H$M>;EIJmbz_p-X8dUdzp3M7=%3>%OY91tf5NT~%25y&F8 z)~d7(T!Z8SL6z1hB^WY;ZjRmY1U0SK;Q*IGuZLg|LU-m411MF#Q@t@5gOG3=)POgE zFrM>sesf9JhtjES@tlw?*u14*ftlo;8=va76&VN5Rhof0@(83J{@g&Zr)F-&3;#=v8TDjz$RYm1u9IGDgTubD0Q4IjZ7FN_dHw_!4z(l#)tqFPVPQU$ zqIvUDab&e>UQz_)A7NTW?R zx?G#j51O(&g`M_1sM6%=NiN8r?V#ZB>4nKz|4vT9yS*?n5%0s(71 zI}9mi^4yg_Ik&^Tl291a92GnYsmDnN58GUo9SV6sS&P7fz{pNu=OBoxO)1ZC&JaB>l)qsr+<^^=@=HzN=pAgCPv9kj# z#P*4^21GU?`-A~z*nq6y0Jcw*cgui2Vd@B?63-@aF`Ig}L?biHJtYlaeN){1PGFYR~ zwF-HQgzYp)2^}Ao z*2>-6p9QrBVfQ0a3%L_tH62iZ8t%;Q09(EfxBt$(4tfN7e!R2&K7Izp07q<`y4g65 zj+@jGE;rV--}>&`@|*!?_5d^2*2f#G!x+pv4lvl`?ZMlGL6n5Jq9gb>)whTLpW^MA z+5udaqIyAHmZ!F3+`V^r>54^07aQerMlF{Kuy9d%+?5>wqC<n5m+eAT925FX!_#(gpHCab}J`dND2y#2k7C&x$)s$EDAW!N6+sT z5Aa@%HSjsvr&@I!*vhjvCLbgj0S$R<{H|+A5gD|ip;+B>l3r@KSrDy!IX^7% zV(Hhc&b5};kOp2}j+42u@fa;y^7Fg;a7mkdXD-bSARLrw#!vymQ& zh{k3ti7ubK-iBChwh?FVC;aFh?T8YOFHLRRM$FxTYYJiuO}={v?0NLEq2dV|w=A~{ zOtK2tS-9K^6IDR}ygiYcmPN#$;6j{j2B7J(Oa?u8X<5O~vMcc(-q?tHvNLTSd@j{A zOY#6)Vv^ZSnasv@_w*9W>79GRP>o*RUSK;ADUjk`h*U`uPS=gW9f{SK%YU8${Z^FW zl31JFtO7b=pOuW=niZ+y*Ywm1OAMuRD-z=EpgSO-^1h31WKhb=92f5uwvek--RSJ< z^c4GiC(KyFlA@Ri8|$E@E4%+J34t0&n6}DZysU(c+!&k9g<&@|aAOh<1?@qV31Rf$ zDo=DE!a{J>vZ}jylK#4CY;y3(J9u{ZxPUW8$zvN$S)DJo)3Vj6(dc89Ft*Un)&0=+ z_3E5(Nx(KZN#Jex?;VPg%Y*AD($RZ&sVCm01&yg_*x2}cv1`wQH6;QSqn&G4maXPh z08#!TQoEPGahdHI;Y_yO&RT9kME5NJV#ISahtfNR(ewpD%U65Ei}W;AhPOX&x9=rm zT|e;>jalb|sW^YNeYAL8g?NQtST_*ru=c(&Neox2DRT<~iFd2K*4Rf^-*-T~O!@a$ zi~V%%{e3S`j2G_5wbVA>7;t|oNb%ME1E5kR>*q*0D3p5lyRKYf(4 zH&x~qaiPj7x575abKd(9yWI!u7Ht{=ypC>?z%F~Vj5cq6TkN9R2R}t^Yv`8Z=umBo z>bE2%%0d>ZEv)i>^^6`YWbN9*g{&X8L+;&RVc|;J`j8kQ5N^ zRs0M4C4UhK%ik7+-SP#I8SKz`oDAo1e2A+SOsa~9;Sb}xWOF~7_VDFmF||CL5cwx$ z&5H9%YJ9j*PrBClGH?g3=#eY!d~0GT6HBr)vF{$4$|85!qeJr89AbY(N*7BRjG_@p zB=uP03H_BD!$ydXKI#v*5dm+(@l@1fg&p)TZHIQ)!**r)V>89K^vz@cBhJ!?j~C*p zZ{ug_wnXO-OgwD*N8zD~kEM11n;|r8vtYRnZ5tHc4@w|?fqXc~`$RJ!fUH z1R`duAZl4mX5=|%>C-0)#9b8gWELB^k|(*yJm|@?aJXTh-EB$3haR(-n zC81(xbsd8vRQ{7RIx#81gDNqq$$V1}MGn5~ z@Qc^>66yEPB#LDE$1~-{f%D!7%oEmwM<69I(_w!ElmfwlwL+tAJfKqZvt{1%rtJLV zg;OpZb>t*mOgq4&KW9d7VPZn39-^Y>61&N-KKN2SmL8_QLB>M~w}SDk)QH`-(v8ne z5lwXBx%b-3OYgX^1@?p3=hqxyW8TB6^9q`}+C#~EJJ}(bc$5b0t+wBBKuPX($+UlO zq`Q4I_h`67N2u2HcMvNzD!i#AM;l*RDnqRvX`bKa@zmW_0aH=eWUTL-#1;p4=Dq8{iFfQuPPP>&bSl=FR?2uKD+}~d`-2y7q){m5+g!ol#G!n5Mlrl#Pirg9dZjuN z6A?`urRGonB4c^Ve6CHHtg*4p6`A zu;N@4HSH=I{d(e_9}lfnMIkl5xs=k6>`NUq?V33=t}^FeXU>{2cg79V=Fc#vDc0iS zigR%krM#2kEHkIgpFiW;dGl{n_I!NgPh!u3x26ipJ9b~BwX{`nE*JFjv0-%aI|KD* H9FzY)BXRo9 diff --git a/contracts/sysio.system/sysio.system.wasm b/contracts/sysio.system/sysio.system.wasm index 6ca06d1681d49dd30f8e3411d092cec76f67615c..c2799df03c42a9ec30bfddd6e309f19eabd5cdf2 100755 GIT binary patch delta 34492 zcmbrn2Yi%86F+`4&)ucNgQ0|kz}-;{N|z=UxJVNV#RB@Oh>A#PQtahIM~Va=ttLMTG$K~RFC{J*o$T@ujO_xJz(^us;-?6YNdc4l^Fc6KvrT=a%{ z(Ti@nj0^5_)-6}S`pA8$wqeA&TvZI0&xNNm*0?*Vin9_?xpGeVFV={6#&WErkRZe5 zGORga=2>6erk=c-&2t20*9`t%4 zjl2dx#IwF+MsX9nKyI3KA*xCRWYuQ@4lu}Pzr*Xon^S{|GPR>Ud?d|!DmtI@#%4Sb zv#Av4kIjgy_^?46t@c%V)6tAgRb~@ip4mHzXt>p<>KPiI@%%lnMwA?Bk)L|Y$o zXS|fq8Tbm)S#MdV>$Q0trG2E~@L=+EaY12UfMO%@NC*Jkzq~p8Sx&QwCQEq(JXubm zMavpczvexAkXNb5h&@EQC6M)PUG1@~!}aguV_PheQftJSI1Y=lv(FWet|lR;z2nKkZNDtgMUCk{o;g{XFHAwe5ag>g@f) z>!$5+_^X-Dc)(c8jEd$c@QozN=kPoG_*dTkSt!s!|2g$J!aTGr$VKUvitt;gRT&3N_E1mc6IGg4d4BARVg ze*9bdPGE4Z#9&o+TdL`b>tTM+s`b-U+j{AV;n)S+}0> z({!DlVZHd|O`4tYeCvm##phe!W36rTJ2Jj+>tX5Y*i$Q+7vx$~pY2VTGm5ugEC5)e zk5#fxci2onTZ^A7@60B0T3g$+w(ftfPAR`9#p6n1&?iI#W|-?XFygH2F=dP-^EVX# zS?X8#PfcsX^Cf7Rb@2J7c18odwExd~%14>9R=pRx@xU_~GhV1fJkG7Wzf(Eu)QjIl zPjE}4=)?S$)a4sg)!P123tmC0ZGWys-(|Gy2*i%Fy1)D}PdaQ}csX4jpLV(jdEa(g zAOm{imEu(Ldo5wBI~-sJGzT6rS6L;-daSQry^GUwtkthR6!Qc7*-OzB<#CulS`n`` zqs%eyj#6rzj!Agg-v`q z&~3fiDnW3Q+NzSZyUTD|XLb5;Q_^rkgZY2&U5|m{g_5MZ^;YYykMIv&FJ9^t>b?p8KZ!YK!^!`)#s&w88>(Q7lSS@<2qg_^1&-t{?+V*ByT4Sy1 zbHw_(SHzv;4^2e8CF4KeD^A8Q#8&mqnMLa+j{G+)U?z0~WBU}X^z*-Ww!iOE>1-A-QI3TyRB7kA5L8HuLSX8|MJ$Jcb3yH)~I(Y zqYKrnI9IX`yt|3^S~K2z25scOcP#NcY2&|5t99-D5p>f^{h&?cnzKQ1VP^P8wxPt8 z|5{H-y30okAf3j1y2dMHx9neG4I(b1OrRLB)pQOaY|6XL^R!aQo--=i- z4s4L|(cmZkg(LqO@;)5}ue@tDdgoEA(Xg01r?HS{ioff&J{b09#BNyz8>N`LGp-GL z|Gzh#F=KeIzkLn0=E*ob@p16_|DZFEwSCkKI%)O(v;uy|e7ZAnnvD0qN{7Jc4{${MkI7g*`b7>Rp$tY zOPOZ=6Ty`KR48#el*kPwE+C;n5QOTcuZ41iS9WK7JH8bqF8W`C&1j@vqr_$ZqgZgt zS4lBx{hvghED|3xp?%DHiooaE7-h?qPS)HeLq05%HV-?D?u1)=ohFRx7 zZ*})D!=4fS^rV=>3@;1<4^?;6YUC)6$zxa!=A?`lraeQ6d;hIBEf#ar(@R{{OVb{` zG%eRl(WL47@4rSq)UIkQXY*&b$8G+qOAVvHAwuS2mA%qnc{6{-N>kQaJEJ=NCWH+( zh@RPsu3PPAda#(kJF_-@V$GXb7b^a-nH%^IvXzsAvnFF15Vl@0qPdmzqSLDXW%0y= z{{w!HHQ>w1=pk|TZg)QU*gRtWHoKB75sd1Ne)e)MjXHym0d_U zUY8b**9qZxoscQh3E_C%rBIp95sue6GJDE8@^vZ*>cxeA8f;BlSn;kQ7@7e@1O3q{ zelmx$t>;`=*h+N2hKt(EW6Yvfl?QV?H}SwMGW~%TF%EM$L+^%#h1TQc>361>Q^DG@G@{r9_HYtM z1FE_L@U17}t(!}$#G`vO1-r{>Ls82|K{%`jzj;iW`Q)1>G|Afh&Asw+UB5J3R;}VB zRD?a20yD-7xM9`+G;fOenLI0{m{U348q=keb?KWhyJ974)3RCs==WvKB_lbrC7K

StJwQOv(X}yX04Er}0U=`DwftfF!fLy`4(}%G(uuk>$6B#`R@5$F2Yq2U zyREL@uAwijdsigGNa(pDmuRl_>8a}OdF(OFudLxPhv!@6zyA*}V3qwMm9$2G--*W^ zv#Or{(OSN$8ZFKEdDTLLHdy1=t_W7l64=r-OA*j*H1PTgh6VAo(${eCAi0OdL#Orf9E zf=|u7Hkx!km_!pWG!gxLFj!8QMi(f)K9myn8ONB#(&4SNHH>K+v#3(W=j-1f-o`3z z0GGF_{8(4gZTfN9#yz;f;g8W|Zi_FEqj;1#+-kkKv;o|zookqa(TS}D`4irL=af}b9 zWqQY1Pi`p<2EZp-h;-9`n^q0*&@G2)kM-(SO>94I{R+x;pKYC?rXSeW*v64SvfJ`* zuLv`|*>+}5J8eCh-H(o2tFn{nLcv!0NXskJF^*-Jlm6jiWBn-J8HkVp_;>m(^ z`x8y+PuTutta)AUvVJ&W@?UJxlX2GN6Zg?Au=@wr=O-JK1*+4UEc2Ki7%qQ&cTwmASBk7w)%mFFXLOSGw4o4q4qU zHsFm1;TqEZAK0baE!tHTXH5{g8y>Rtw_z9w}CDVB8$!lwnHh+yr z`rcnF*qv9k-um?cbiVl4rqcQKUl&xE0Fmx-HZV5Ida;~RAgMhmJ{Mj#LZT{b-EYY> z(Q;p}3E^A+`VKyH#0ty5iKd-5PQy2J{>D9kzx3~|#KF|*<{-PDc#Hn5Aw_HdnF<6h z`SW7bWJ4xcW_Y7D@2@J-{jvr=>)KyW(G;uYEvQ-1|6(?1vMVS>`RG!>J3?G(D^@y7~mz!#MMQ}h?;(r5-?E#;TWHYgu`FZAg zH}xRbGy|Rx)pjP8R*#1hv@kV#09R1%2&#*8>%JVPo{FF(1M8f1Wk!5haA8(C2dHFb zMg)4KX=+y_y-w-s=ysHD8%1T2?iNL@Xu4V!MUT)f^<4~=Go0oDbtr~vt5(spj1DS_ zp>OSPg{KX-4tvIy_oGukc0s7b#;EyR_d>kP@Tp%n-7{5!XRY{=uP?%2rQaMW=5Z*q!A%s_Kp zI1lQt62;5q57g(tO_nm%9b4IU_aYlgHp;`vs%t~p#+xr9RDU_t7MFh*x{UC1KYuFL z1AH&x#2O#&zXcaKoKH4L1kGk92;A=A0Bc~AQx~0EFgI((fffynbeAXK@@KnKl2h?t zHa9S2G+B7ZfRRj2T|TL510xSuNFFRDkew?pc7Bc|R|jhzkQaR47Ax+J<+PBhst28!h=QIB>19HF#72PZ;YS3 z;ZdGQ=`hkGgO2jVBnxcRJHZ=`&Z|4p*c)NvCp$cdRsSA90Gy*BP!3XZwD3lFqLW8& zcRcHjvj+cMtH(g z;Kqv~!Db3b)z+l}$4^p4(AF@;hgL(=3|VfbXo2C4Mt`8O<%I7-kmR%b_C#p%X^Tc9 zFw#(MPoy^jqEZN`1O}0VEjf*E;HZ(K7Nk&ggMg8QFSSy? z1JWpj4y3eM+6xp&kLf^)e~v3iir!*)J0NdD;y^}05@q>SZ_E! zL$rxP>y1M?$CctO3+mCipdh=|a9{)Tb-L^M6b6o~28>)?QJ}bqinGDu zHs+z`BPBf}6|7;y;mDKFC6<=?2&HvbFrNJp~j+@=udl}|uQ3eL`5g_BYmGgB}p zrGq$&^TZZRM=8un(b*{F59r0to{dt$8u6Zz!FiYi!YYGC3(#Lir+_LO70{OeC-}si z1D!C48vQ=1Oo$FPe>R% zdUJ!C4%UGp%On<*0!8OeF>bG5cQ%hEvm)V&6T1~Is1t-ub7-o0hy*Yy!FW#&pyxO6 zETZ1MEUqIBQU@&y^qwUYbuqZ-AzTB>ESR!`{cs4i$c6!y9=nWIWxvw;BX9uKKH6^x z3m_Hl;pU=e7HOchL$`p>=6qS{4Q=2r&@2TnYm*>i4e|N~$rufl^aXcQp&)7DtLa;I zA(Ztb^zyG&Y-@V2+(N_W5c@)V4;F&&9imaOxI`DKIj!mC(vRyP0uN$3ItaTs?B3Pp zcGSQ+u%nsUREF;1_2<>EWoQ_ssgL6*j>crFII2Q%{yHVLs zQC)cv=Z#8ynrhK#_2ko3M|l#cQq)`n2+-TF{nXALTvEN7KuapzlrS7kaPjx2^oU8rezU7#`5K9L5{tjt4+^o` zRVORan^iA`;yqxIm(yz6+-%XgK#Ium_+y|ELJ>Q@Q+-&O;@z3B)XnAUv&uAycb|dH zUy`q#QBPE%YIs#2RH4dz@vNFrg_3Bw+ERt?;~Tq|-A!Ji8OoPLP3zv+9c*26l>%MV z?4)}+cS@^!wykSm9%mTBh-z{YJ-{RPs{Khcig#|we7!22<+6Havctr2KItw)roa?l zO?9a^ssZ*w@a9ybN&?>YYLqD8eOi~|RakW@5g6&jRkys$J@Ct+6iMbR?G1nMAtQAmkv^3!Aj$tfLhw6@SpSzC` zx!q29idU)XRJ~HFkpe>r{jgqGp(Qc4^}NOLz{2e{<&!#Fohq4=j2IX_=nOI&zo{y* z2K|TAoa((Akj%qC2AHZN=QR?!s&N2gcq)eBa|xvQ+|6Rd1lHgbDHnnc zQAEDw;oXDgCc<#d6$d$s#(>{k3|_-~|@If+FfzYcfS@+%E1giqD+3 zyhCy#mSHXMbVH%`>}DV`bX&IAGfi9MVK~{rwL2gvIpDMfK9aMXK9|O}%*7lma*2M=-f~R0{a+5@S{u6Mamo z6)w~ogJuJ$aA^B3DCzP9VCm96wBAMX4kSZ|nB%lZ3|vaC;1sn0DcMyj$xsA}MNZ^_ zQ*Ah&%r|UEZW_M3S_2XxM*;b3h+MRt#Q6ry8fdkKw6B4_hM>)E{#re->S7PW<=;1N z?>((SF@RmA*P?p^>kPqG635-yR-A51vcVGoXuW}-AFv{Y2x^#3P$9xG(PxM_?U4#O zfmZ&8c^R*?3)3hG0c+CxIKx&a^e6@)s4>n{+*3>&JvwU~vXVq({X=WuUKvh`C&v6y zuaaml$!@N=t(gQdiK$D%bQB?)SLr}{K^-hExrSO?hhhWc3|W(dWAP6YC!~0&^jOD<2E+bSEc#+_ z6=(m2B0egXg#z_uZ_1`L%@gSmM0C4G8f-FKGd!dPqY6xw00gV)(|8gQ0x5;zK-qJ3 z^C$K2JH;0ZIc07X@dlxYNe~%m^RpBUN*$*ZH#cc`b$#6q+H+~EAC&u9h>-c3;(5r-2nOok=jc{mFKU4tiXU(!7<(-PGn*5 z7!5=-3$70!8!^C_3#a0V&3Ai*>+P8ZcLei5h~^d{Az7h{)uZI7tyn0`Z9tQ`UHzvX zJsP!6GQde>{-74tqi3qFK^hB*@T>F#se*+~2lAQ|Fn^|Uiq1~{T$SA%s>z-_YLPjt zKGh@D;C}kS_``@-(@Sx@D%*(0&>!lnMsy}>92600#_4aP+D@m}dAw8a2CA|TQX|@{ zo_>(J(^j?SK}x{ePY+UgH(+!EMtTTt;2o;jL-b~~$-jgzSv20b{LI))=(RB+#fnN$*a z7cB?xcLsf>7d4R05*O?*hwk1qXQ+Q1Wd43t~>=Z zAaFmniZ%E!UiPWH=RtvMGK>F*o?!Y}z4#*arqi;am3it#*ca%&Mn}5$pN3RPWp$+Q z=$!iSWqO>?8&MRqYA-En=+*JZE)BlIk&t?=I#L(donx@H8*0m!G5tD)njd zsrO!|ujx;<_$jKOT6DpZ@~2_jE91J*-F4Tg3p7aWOrbqA zSY__yD#j-#F^xOw&Pt4*cPIc=Q>cqpHvWLYZoa*CO>0zwLD)1aVsD6KyzT;6& zz3a=LI*ZKH!0z-ieW^}$rzRlb$~{0*$JMwVbbs-E+AM=e*HI+e@y+*o4yC959~wt(L|Nmhu-6f2UMNDw9`C@eO%bG;;(_b$~>rI`%yQ@ zmOwu$(-~4y6f_TL^?5C=*qjV?wYZ2$(n(RT;5*Q^;q%b&uo@yi3gOKVudb-Bu(zcw za;G@GqI@F?3`+riq(RxOo~-`pN9EAtv0eIca~Gt}XR6IxR0f$fck9f@?MGMpvHC4~ zCKj+2ifdbfi=d8m>-1-;$=f2dRmZo{+!Xcx+q4&)+~yq-+nF=pAp|RYp{~D6Eo1Vr zGXkP5C!X#6%*Wruo+G4Q|M$s%&vaR9oJo8EcuwLxHmA!Fpq_~Sf`=?-_;H%k)rI#d z&Y13uQe!@#SQY;Py&9`)W4}NaJdgHfOjl_ikPo(G#s@UF)J*8V@~xKeOj3&f=yr!W zOZEPce9Gs5GY^B zSe@F%38f-;hw`P;2PIbRc6h@uaqi|Z;vM!+%|y@?c7(C<+Mf z(OzK!aX)yRQ9)+YAs2u%#B84lcLTQ1GH(u~znB)NKZejNoOeNW97|&hUQyGBQ9|583>_YxWD*i~0MWWbNS{5!z-)VdQw=_$YyQPfpqfNCkG3B| zd}J;Gc-0-zVw;fYIkJosTA2egKLaWea+k_T%vGxUaGFV*6;!{Pv`RG@LI1&4_-7+P zo;tIP${qnIZ){NwMp8dorsj_%Pt+hBRdLD@qEt(*T0n78qjI4I1~ZN?pxBZq;dKg+ z0XTi|$lu>m-cb}=W>_#B+r#n&<$~278%6bjq^@5>j9$B|f+r zMy*EeGwrcJ~@{h|_A8khCOMenm1^1;YDyc_sWG%9 z=^7jK1#kKy?GPlD`e&Th*TvD9&{m8l0hC*n@WSR6Ru%=u+l03X?%sGB;18PpEia zful)kXlfV#NmKj9Y46v8O?)vRieJ>qDO9}_ zMyog6f|{B@Wqzyvnu0aO7AlYb4Wd)ubd8+2OLpFt0Vf-53I zYuXug=m6STJcCjJZ=IR6gMSOU9KEwZdw9_<$DXsGuy3|nzgA9V%>of@RTpPbLd9*` z4FJinnQ6N-nLhMknStejNefTGCib?>d%wUT7+I&jq|Z3xy4v?8m5&-xjGeY0GE3e1 zl1kT|2-*<7cKRp68o}8?aXRKi3YtN~NQQ}{!p;+dgiG)lHD)%{-W>JPZ1NUMhuh08 zfRdSN)NG35bVGHVO^ITmyTob|0Y3-p93o>8>e)w>nsmblZN0b8ogg1)8KS$t?QtiV z+E&*Ef`+cHYkO{xog=lHiD*ya+_1vz$RgR1VwZy;0w8*LRixuw7?%htalqGww=@hj zq+JcO-Kr1*hTmm7G{=XIb~*fE{%>)-t39N$4gA@ILO$^2d%^(3zmCk65GXn{*S`!6 zjY}{Io8Jh^p@Z2Dego!=$AHOiqso;a*_wCW_Mo|)D2zdYUto(iMMXW0Xb8@2voGEQ zKsO$UPSGFDU04bANMurzKqVs8o&HoI7&|E+Y6W*oAzB+ba%JG~wwwwxnjnSm9u(2r z1Yxq98s@Jn20T8E)2+yQT-`Cp(A@+;NB+6zu^QZgvD`>$3m;nJjW|#z6Xj<^6>41eGIr!7i2_L3(?tcJ3|Qa?Ns)w6*nHyfry9XG`34V_9Na`L`-o>)H`(B@ zk*H@`D%&|Io}*_eID2+3&^#*|bF8TY?m(Tcil=b8wghlOHQ09+y!gANsDPDa=XSt` zyWxj=rTH$)Y2G6q0s9Rw$x%-Y98QCJ09;dG3nN;8*mks=Tbx>V12Hx60aGObNtl4? zbE&ppQON*2lyP>r1Wa>JcmpE`#3Ijha9nUhLvuZjtbha_N2Hq5zfzMV?61p0BL;k@ zA%uu**l@&Q?h(}}ED64>;7n!RF;no#i4!bf&;0VjX+pgaci%8DQ96_(2%7*Bgh{~j z3rtS212r7byX!NKWVtmw5D)kkf@d#=9fU^Ex-V}EdAM|DKC7YNRR zJz309RU;=7IKpJ=GN$w;lO|T3<{Ob3H$m}OtyW4YkU>rXny}GtASwgd0pzEPwANf+ zn6F=@X>*^`zxcW%87!$87tKmLAZ65oKz7-?x=5zGWD5XBip?sa;Y!7&*zzl26RDO5 zX4RPQ;J=1tqVOA3Ky#5cS!GYrE+e1g3OEcL8xpqp9GYE3<`rqg>CcK*i$_vI)VPp# zmv*OihYYRVp+phw4kyI@WByUQLpjmzQ0>2KcMmGxLTu0lRlH27cpW*Y-F*bRaMBW5 z0oTUU8PNT6XV1wXhP^ZQ8|p=eRM}-Tiw3Aw%V;!QI8SEM;IQAtc#3*grRGv8Smt?| z)ZY0Q6dCo?1Wt6@(=tJEBUN)bg{jn+I9wsrvvQeCs3lsW*XJW*aA=pP`Hi}|9Nw{A zD(+kA!+A&5$ZzRg@2%^aO=aH@A(DDeSCZf8(egOdPC*>_YCzMmiEZJ(l*)F)h%izu@ntb|>>N}X8=8~TV!_@3$(htt#u zIZa_AWWMx0^(W|_2%v6W6j5-A8va}`C00-M&}ym-M7_G2`U;{Btfu!G-ias#bA}L= z4rfa4NsR*b>rdIretH%q(ZbA4S+ENE)^+vM8fw6+e-_K2jKW8sYQ2_X zc+P3Nc>EgVsI@dJQO15$t7*DHNFT$WCKDr?zv{3K+WTcSW*t2NWE@*ZsqSM=pVQ1y zo!8SgTBPp#fo4XEg&>xvd0gfEK!3r#aO_8_!i(}%*am7^0qBQ^z&wG~Lc4y&;y~e( zVz07!Or>m~Z|HaB*+`G@K$q%Yo=d6sH&S0HrI$7qDy3m(&;aUc2TODZX6%+qzh;{1 zv5B58p-%`vI%%5{rov#gYZI-hcGii_!*p?|qtAjDw|^xDStJ8w59jIX%~YyrAz;Eh zr%r9AwdJKMu!B;PfO=;q-1<<#IkkQZ?({gXT5g3Rd?EAWt#p-m&$Z0H+c6=?AF_kq zqVt(IcfbsSDbjc+xe>2#dstx1-05MtSmf-~T$Lreb6)`R7q{tWJ!p}FHa!y>;J_w)d=FBG! z!gWCF)C-5GyW8H8Q`-;GaB(hdM{vWNhhf^Ks}YB_L;A>JkiB+D$EylQ;NSj3&HagL zWR5uk&k_BRiI<^7H&yLp@D|*1s!K0%X)E`UM;QAT`;XC++~1|{&VkfQQ;+9R+p?N= ziuffoO^FjwEz5y7biX>2LrH%tH5f~_crV7Oq~m~Lkm`OMY_nf|ah%?#A9(Ww%;y0 z^CUf8c7zME3>x-LC^k#sVM7Rv><^kFm3ay>Ym|EI6gBXE;u2tItw44w?ME;wnsR4~pb56t6 z@rnB3G@Xk7RzftykgLxP@xYxk55mrCm}0I_>(0=#ywFvE?XX1vfw3Q(GlApXqg?*g z-}4>o%BfuXvE)*L6hLAEzCn@%XqCQ!6V>6f^i*m2Tx4?~SVT2FN3Fa=T-rZ@odi_V zUJVFGEhUi!ZE=8Fc#dWTQQqM^wd9-mYQ}lG`}IY;f+)|`$OZvxWRH<;L>q~S9W98a zy5A0_$_@onNgpEn*c|TC2@U;NOpz#Uc74oZCDpq;KcG@BP<&u#ln(TWmOzg*S2rKS zF~(xqOw`UM@VVH?*e-{bs~rLO#=#;Iz$sN*TzL>!oT@KVY1nyPq_szzd49ix&BclGQ=x-U$YE~hzO zrCp?ic6mXKMmsN|E=z1SzRET;8pSRlEU{qocs~U*HVdz?nM849JGw+PGHxP$S9j#o zgiBPr#07+k;94I)tP34YlBbd{Ve@5@O1Xsnq;$3O5;YCvlV0WbAhHUa0qqeY>P`sL~(!l$6`d`)rh_gEs}{DhskJ9wGSR$3{DW? zHDF0gM776|0Q4{rI!d`)sK@iDvx|%<+&$05}D#Xp>ej+(1t|!VTa(5la@{ zR)i5XgHEO)QuFileq-e;RF4k?!wd%97G{tiItZh~3|=|-n5bU<1-pww)YxC>K@jeaU#MMB=v28%_eDc?3vM70%t@;ARVV|Ws5w`$R1Q&h zgN3k4w7f>i2I4lY>4$r%o7doB9;!P0ip`p@UG^6DnO~vY4^GyZeXSR zTvhm;TJkj5(75>qmX}q%X&fB5OMj==;IS?H2R#^a78)yE@z&AqW!0yD&^m-DL-d;BNL0)`B zeQxl*v`uX`_+dGKOqdoh;Bpn~gbr)yE7mVXU zJ3LyHVD>}SWvKOTt_*CSb8{;ISuc#|;&CjDQ)snn70#VFFHbE9=cBH1Hymb`N{e7` z*cybPLw!;eKBkA%uMs@dyH;{Qwg?V<7G45#i!8~o5X*udv7~)-Lrsn3hk2_@O-tk| z%824R?rc}Qf5aB`XCk*!gQM7w4mU*c>N2y@(Rx`eJR+@hL~N}TglJ5SX4$GYUmqR&vyHT|$#vewml0_{E=WbnA+pcBQsbV~VhyAWTEYA1GY)ICn^F}YUcHXYO^TSIDLBv(>(NI4_i7KkvJd zIjsb*!Zl0krC6RHzY}~V8i7{Lim3OyT>4acDo&-Z_#J24E2*U7TvAg3-ml|*c1a#a zdsMAb+!T+uO7Wsndu=U9$HIDnQ?Tqtmpc9`m5$orifV(4%8+wV{iifH!>ms)&7&jJ zF|VLU^Po#z_?CU@g)$tBj;O4DFT+t-mloGS{?zZdxM~o`B@rj_cpN`WC)9{I%)fq= z&%74L4aqz#*vN(?GW>8CVN?IXc$|)%q_X3=EX*Tl48mhKAm*yTAk;rm8=+XY^QAgeL;Tu+fi`o6 zLjj@+d{3nUgY>?ixMH35a-wet0WH}eJLOCaL|sYQ9c+m;7NxW;1t0}BLF|DD8?*@3tymuxnN9UG{7Q) zd|}Uq)G(P8+>R+ae<;XTH;NcvtoyQByCg`^2`u739ell5=Ogi)gQr*)vm!)!)AOwJ zV$_xD6c>oW0U$f(7oAIdF&^RGV!#uebh+d!E{kjNpzj-DlEJ{hNIR@hJN5P9E`aq~ z$c>)F-3$EPZJ^)iP(siPbnysJaarRRh1U20bVQsr>ZT#bWVf+9cKV9hPV!>nB**a~ zLda;4GF@7_Zr*8|1yzkK_uoU1HL{A73z79k?Vr?>lZQ!3P7M?up~W7BO;|W7v{4RO z0$13lfPEJcR5CHejT{@r1A`}&b$gnEQONfAiqyG13R$K$+>Sy7F)Q&T7uxp0sN;B*Uw z`qCqn9ua+vifO{Nf`cR-y(!N@POSKLjIi!T4)ti)HHzs4LpuG3IkH;;fYL~`D6mM$ z$t)27Wi`>u>09VUGI(9ei9_2e%E$5dVcmMm7Y-7^zsC~%asojPN#)}i_Gkh^bi>Rc z2IAMzG?YKxtm@!nPaxb^Ofn_%)K{XLuQ=q0sHG+R##?>_lz^tuRSA7mM5>AdQWL(e zWV69F!;2^yQ?nqj2FxN>-|(O*kbs=H)peo~MXv{O6WeECF!_Gd2p~~R6jJmF`j$~6 z16>yD=Eu(0yS*{qdBm((vaaem#Wt3HL;Q9T zW)@k4$tcRtdJhkL9B3o*1FlG$jSB=U&QjbaV1+pRH}%=CP|JBZRjy-}we-K~)=E?V{jvfzuXdcgQlVJR-+}F#Mm$vOvge{=XAu z|0l9cFGN8D8pK>E&;02TDS-ll0}nu^1yzSUEFAD*fN%@Nnn+<;Bt@(_<&1iI5VgXL zwsaBs_7CFC#z#=Z3HBvC9VG`jb^k4ZbIp}Sgj|$AJJ`BEbpU3tkZt_}lx93o#Q!sG z2SiN#Z{kLo|6jCimcu@h)>a9fhNLO`nxP)osra$uxT{}fRnDi3~b1v@Oo z!~ygI1Op8hU9yu763mJy)H&^(BcT3}>@263RqV6}IYKm3yVQlSK+$6UtN~=!ksdKU zc>_cPhVtScHjvCq+8wMrH!s^(mT3Gt5L&9yA-7xD)L{obXx0mSarCRA8;ev+=JXRC8d`bABvj{9)0s?If7;>AbR;QLBm z6T1vD2hfB}vtPAoR$Hc#Ma>f#;*mE0B-^!|%H4cUxP&2|;bxpDkph^>iR$dVTpgBT znQFX5)vL*|*i?G7CRfBpOpltdRQ#GcawXRZhp_Vs%s)6d133g6OS}J0;VGTN zdm|3XT%2T+05ufK(?%gf5CvOEvh6=Tak)|*);WGPAhz)bD77MFA69nQj0EpSKcBd`!!`^gmTXL+)}{&Yx&f6w5ibzdmc98rP8Ti~rN5?~H-+ zwg_nSL?-x(+4cTX#~X56`YZFk``JgF^OtJhh^rv5_Txr)->jxL!YoZ!Ya8)Sx~0ZF zz*F3EmO9m~>OIIcLg}s#g7)&&m`kf=ajoFx5#|>*bmrV2wC-@%h4;FiptH+LXo1+D3b{J1K_L0&u zpL~*?_*)Aymh$S%>s(iT(V9Djghcr^z+}3*zYVv*Joaw`)J#@cZQvH0tZua7<)Lz$ z+Ujzr+Oixus@IMSc6i@y$9+*M{V9G-HF%2Ou+zB^W1l?Dz2UR|<7r-I<4v|hzkLQp z4l3WXoa8}(KOFDotwMpUxBJY`1j$l35%*)oS{^E-Y9UjXDck-t+yXl zPJ6DVW_92aIFEq|uB;Asfb^Sf&+;65mS@|uJX>bDj2iG9d!rWJa(Ly`sz2wJ`uaJp zL*v!)=QyKeI<$MG?S<-&xS-0Q<~$EcdP7}%p1V{<=qt7!v{#JGsRoSCq8F&ij;Tl@ zIWsosKfD&_99q1&QH2r@glX|L8XMP|w?>9Pg2Roghdc4m6!6bypt(9wl z+n-$*JImD~1S#NSbDrwfg%<|ChNRE}4lzJxa^M+_=d1e8DPa~I4%RuibSqdabd$jT zqBjZXGM3&imRdOJ9BOLFo>0ZAMy*ih>4Ho(=?#tvjM*ivE-iAfK zNhVGfG{ISScp{A6e!ydg`u0B<`drm$8ESv$xx&mgq0BtF_DVN|KYroEWgqrfFCK9u z*qwJM(s>)Z^I=C-ldkM7zZNl+cHR5v4G&_RUjI<;A#1B4Jg)*>xpcXuCs9T)*4++j zbNYV{!g&3pTHKXOCC&Ib)C!h8UG?kJp`4oZZcr~?ct&07%H?=*u8L0K3T5ZJgQu4L zOZBpjRnNa4rymxmrYYR2>|(=+?ubRS8vL5z%Ob| zH-3ftUsaX6a}J-ss=|6;86G}R)$YO1@!ElEWDhQfOGD=NfY!E9_3FtJ5FO|4g}=yi za+J#I#SfQQELYer=TyPtU7p>q3zZe5Hh zXI3a&5j({=If~T&FDX%t32HJQXaFCV#XhTFx}e>H?UCt5N;A0&UA&&>vb)#E38~ zl~9#y*#SCp2jbfZwP_&!&Q)rddVLUgA z)Ek3A^=sAC!O)Jf)z-mWIT6OGuGCTV31RQr37&=A{#KavHcVS4tt7bK$rI8+)BRS&O+g0*Eh zcSVp{y%F3zalXweS)=SZ#(ZIRa74?Npc6-cY!0Z@k^In8p^d%JcB+0ysFHr7pG~q* z%YLmqK@R$ftz!MXZi+c34EY$D{Q;qA<`89$;_9rR50Bz9wH6zin>Gy9posAbEfHcx z!?HyD)zGoyJY+9yIYZTuQQWl5eC?!h>Ro58i3dSHJ_?5EAywm3egb3t@Kb&i$FqO@ zlvm?~?~u_jPzI=#qxtP-xA!Xh)Ic*tMPaXSDm3(9Q$)nV0H9ukF=V^^h_4Sr|4F@* z##JJZ1_f-^Ff}`keWmofE`cBHvI*rKQ%BP{E&*Dlcp5-+(nLw=69q(i=BN^5_?!5# zVe$H)tV7V?5U&pT--YlnEtNBd6U&SXi-%(gIDxwiH*)6tUvyws*S^6sXOjg z$0KmT!qsuyF!F@WIS9g4^~OW1!^bx7VpSS99vc2BwR$|(k!>T@$?^OwDb;8KSB1^- z+5~^OeXBOg)sx?q{PfdWaF-iR~fgkara43S|y9QAdaKiXB zK6b+Z4GXyBwkg$7apmW8?dgDhhFv0it%GS1TruXz(Vhd^)jkJaC!y#N73I1^6FT-2 znNT1Fe(hAOW46k&U<}cTd2LI$VHElY31CxUog&RDgSqzSoh)d@Hj)@cvyUWJA%-BX8 z#z_;AkD=lm2M)dg8TwWxcm*3d(q(4w+!%?c3`llFb*NcRjFc{@qghkO-UR@m$e9Z< z_LeA;xw!sTZ;9T~rf`@&@i=}G6WkHKE4YJzfu$EK+;*N*EVx~TV6hlqB=kTG0JzPM z@z{s?P&`WT9tgqdK_QGWG|C*DIn_j_4_Ki$?1rL`Tq$Kkd?3aUpWu%!< z3*K0}?N~j%kwOt#aAJDDoWb=N&!1)>RtwJ?GuYGOELg*?ALS{%z>7CriWTmQ#df4D zTR>roue2xji3EMkNzwK+dCQZLWsTHdJJz!LI6fPrp41jFK)oEUD(1yQ)i zSnZpM5EgGYZ0X1K@cE>xNdH%R=k0aqJ$($?^mx0;H`7o3d}UDw|FGFRPs(^qKOXly zn&2~~b#Gar2QySZ0?D}UW)pAOC{*$xEmtRFXW2w6vErEq0OC6A5{W^+(L)O0V%)O2 zn%sL9iN!&)9Z(>afK_F_SS`SKR5VUq{YnZ=zttQ$kvm z%!zK1p^{pOE%k|N^K5Q@uYo(RAZj6Iu&Zrj$WEb6T}$d}S^tx2JcsX>>r3YF+tM)v zv2>h22Y=i3>%nToT;5K;%;)F92ai(eU-5I57h&UFE=Bc~^2C9Q^~Q%(a{C|)W#n+J zj#K65bH!qMj-4KFeaxN5t6IxrXq5EFvCk zZbk|>ze|SGR~lLlz{djPiCloGc6iErDykjjsjNCSpPy_{LC>+QJGd7f_r42r4T})o z*F%PQMblcy$YN|?LtO#qV9qb#DhaVNuvm`(2PBsBl>EqB4(-blr>cF;W#g>j*dr1s z1+n(x1~bS!tzP_^>&2dTn-_w(#b=S`7u6SEbI!fF!{Kd5WJxk6{A+#dJgzO*dmope ztN;!O2#D^goHtx8TF9kv<E4TtxcJ+8H`5(H%2q?Z zful2D?f-_G7Wjj&+Wz1c%NV;XY3hSzT%|(Lg?R>UNKrcV={5w_o&GxLV(_AS3t0ARiV_`JZ@Vg*+y{(BH8?LIL7P;af^hv1gYSb+)B2X`u~Uf;3A zN`CMiP&8Ss`3`e7al%S?w&l018o849!W;j}_uK@JncwpkoTKTrieG{Aeb*}Nvkg(+ z)i69Ks{Ga5nWkjEl!Z`B*JokSkJaZ(;PwAZO-f=n+J^yu9n={4`wpm$ zYl_X=%?=pv+QWb^ww|gEtb@?nr;PRZgGYa5?q3ftH#P#&e&hz&0oeE>{IiSItsn9C zq5FraNgJSZ;(2rf_vZm&s?$a|sMe^D@y8)};iqc)M)-P$X5P06Vap{##(RMkm)UDG z*EP!6_PQ7vu;+zN96|?E)rxIE^hi~GJI6;35DO0G4!UT&ok!a9QwxvcJ1{jmc=bNq zL57MTtAT3F4sMSb!J~#Mlg;CiUXabr@wk=^ce8z)5)T-qj_rg;YpmL~i${~CUfj*= z@aEma7w{;y7e0MURox4Fdz^Z7FX(@)>b#eCisdn;4aKQ8`(TDl3{yAvVHb17K7J50 zeSIJ7@{_9Pe%|7S{b`t=sm2Gek$8Eudi?;ua=*4o!HNY~5S#U1Y}ifmy&+6jMF+W5 ztd4aR3s&bN00|$e9^{@jM#`v#xEBfO%?I^{#a)L$u~SvsL)fsGs)irpMc8n7;4s(s zt|5&r`(`Sb%=#TBvwotxHCCJLacbUSjx4LQq^C9Hh2e&I!cH$mjVh+L9p)wp9(}Lw zq3jhW4kp8ID`bXCalidx$)HKZc#k?^{;{+Q#4p(B#w$*A{%0aRTq{V(h9Ja+wo8*acBBSWuSU>k|(q zw~K+fj{d$X=wkM+Eg6|BY#8N03V_V~ZI+s>bEK)%6$10Y%k4(m#@NMDQ}?W&A&uZ_S+sd!?ULE^3c)#JgA+jS$BqubkPCXB69lhq z4DO+o^<=`f^LwNn+(#>~smrdTaA;UL1;di)zuY4Q&Ey1IZ5xC8Bc)!J?j%%itqpZ0 zX)yIHss+m}8nNr^;m4)@G8%3BQBEB{%%y9i73t#aU#I8R2~F?llV9%|yW*G4{|RN> zx;1~_sPR+gK7$Ok^C&00(l(~N?mvCT<;`=iKiw{-qHcGe-G6H80=s;$*rE}er_Q~y z`9E!AD%iEw<<7%vyBMFY^=H9oGlne~|HZLk0*QL^7`Eiw#&~s&)YJomHy!8{s&TBK z#;sdBmSlW4Noq*JrNIW;%5AH_PuBjNvkNBG3Dr9kf-f~&*RqS{&9i3jUB7)Uig`6a z=R(c5zja0OH2e1f8FV{kl58c#*v`dzNh z#CWf59rnfUqXkXfREu)B(tk9QEj@5{Ud9PD7V2kt0XERisY}<;sxFAPtg&bC-Y&+Y z@o_~83cKA1C9*?_A63oc93MCwdS4n!Y{npTozFsvm7z~3LW#Md#OhGumr&whC^0!y zeNQOocqp+Wl-M2!rLsba#i7L6P~xXhVnZl#B$UVuCFX?^>7hg_2ZwPnl=F>FXxyjD zA0m=d0;($PEJiXrR+^18&UVS`W`+9oz>gVa)y=#}QuXOM1c^!G3UhC1dZ{M!H zda7<``9n1{7Xdc4mH#|0ldOM^Z>opSa!u9bJb$9jpk=zx{&f00R}6RfckgmU4GdQi z7qF9G_W}=$eydM+PrqKhJl%Ws?4p)k;GycS3mmI_mvDbumy7)PJ+F7|*{OTi_W{+b zoq7r|eL8pP+P5Fxd-Uql+0*ZhPCY&KJl#6K*HYhLwK9>1d6=3*dQ^0=#d{1V6C^H1&C z4fXY43|)J^jd8vvBfyQ*Ekvbs^6WKkt^8L2W8^PfqMXMOg5d9fsz1Yw z^6IHyamx6|Yur}#{*~igHqKZ4iZR#vjoYX$m)RSK-n(?~+^<*9JJDVIH*6Jk>D&(& zO0tolF8>B}mledP{>JyKX?chj_~civWB*LL&c$#^=CN~*s3GAUI}5$3TDj1GAG(M? zT2?HNOV)nt&F)=a?bHt>SwJ5cR3neWQQzTkG{C=x_;)}4;rOWI0f$2^K99Obe&?su zs^7VMG;$06Q)}}1-ptqXvFjQ0TIW}Lz1I0PPhZfSN4@k1kW}Lj{{JQlOuJ7%F>tqY zOn3eb+>VvW%q%ng?QdWrUHcoj1ne*qbJ}#VKTICe)BZ5snZA^n*$$Kje5UXJ3$&E` zAJFNbbP3E1JpY&^wyXYQ;$)nf2Mh*K`eL=Gy5_f0+!KN(@2nm1Ja?{)d^lae6BYa|2hF8v}zl(8jfH z+xc0UxtL@l-5D4-fC5QCniohH0BJ4;$G=^S+~-)g>#;K@FtUI$@bthBOn%#6a4;(} KvOMr)U;qHVB5Q~M delta 32032 zcmb__2YeLO7WbYryPKX2BtS?A>@LNCARr}xirLT+DfX_YSb`!TD%J$)(gFkAP=qKT zMZidq08)a2g0z5ubOO>r41zQfzW=$i8v?%P`+mRg^S$iM+_~l4bI&>Vv^)GbCvwEt z$lR+gl>cH~zE~r{8OyQqfEzLlL;tya zhRbldVqGqm({NdzhE$4mIbF^Kr&CIB#l_{ac7^OHgQ|uRi(0&|@uj21`IFI0w zoW-Mg3@e_%6Zun~!c)2Ldmnt%kNVR>{)QKEJ}>4ayo-199^S|M`2at4i7)drS9qQA zld;~|Xlybz8&h35uFqW4T+>~#GhAP|X1Zp%X1nINzI273%Z)f@bqv3&<)sniarn)* zeU$Fw#*9b5!|zDu;t}LCJdSjKOuD~kFQ22alyItt{bnDJXXMNB0!GW=IZklBP&1;7C# z0U*E_K9al!V8*qv6h?5WU17*b>-UHnRZ!HJ1zG?lul)|M3r|ixBy$}{RH;eq# zOHkpbW)6AE$+EUJ__AJ(e$h(aB=f8+GSea=>Ny0gI*w&GHIk>?EbFU=N%e9|H(Gpi zqYXDTlBa?!>na)*ly0>4=0Hlhqcg##DHPysI!NGfmUW_0 z=MJduBaJ2x7D?9^RJ{pMY-C+UiyIi0Cx^elX{Ks=lqUdG;1nXvvIaJ;TkAZ^s-aG1 zfx~Q`5E0=a(mjEmZyM@+mbJfegL?foI7|l!#zSeD_J914Ue47U122r4#$z6`3ny>3 z{3%}k@}T9tP}3Tb5-qo%rX=v5gVvIi1+MjssaVvsoHek?VY^zTXb+Zrg1i7!s6MV~ zQy%uKRoGOwI^FaWDzM&ZR=M2i%?^KU)0u$z)H5R@g-re5TXUN2;*VLa7{T?Zf8L_I zx>M4Utpb_HQPXgEo#4P+SGvc*H8kCS`RBam_Y^XHVa24rPaE@wrPdDLYezk_SO)h_ZyN1T_pZLXL-rJbtJaTLO*tQY>w$r-Swk}WE zYt?Pnh(Ftx_foq=;y;gA174|?H?w^v(F`lO!;<)={~5Gzt;-!6(K4&<{eJr1>UIBZ zXgdB`s%EXY|2F#E>h)^{RkVqmA=5YkV>VF-AEh{}QpejUr{o=dW*fU z)17KrYdT*+K|vP}qd#@zRk}Sd>Y>rhYmZqukMyE5d1W8{T0^HQ zO?_g6fd2ZEsq~FC|H+p2L)|bp#x8KAo8MTqpIS|SqV51*c{J~xr>hZV5ffu$I2Z|QDlpu2_M0urRIW{{SD7N?t~pL68dT9wn+TJiE* zw?Y)`BEj0++iku4N}?cYz$^3VJFC|x>#VDD6ep zRhU)5%D~37hSW!oQoOa{^%y#Atxs=AN5*uYL))w`yIT;`y*^oC{ry_J_uu(yvouxs~EgrN&m(W6vOcYo5_`})0f%Bs}kd)i_Z^_WW=tPyWi1fMSJwKr*~ z)V}mj+?6bao_Imec$xU_om48-2q5t+Lyi+h<{wKabeF2j=&P zSoL)PeS&8_8cjV-T{;w~W?y+pvo8=WdznQyPe98=$UAbP7_@pxJAtDJ6q zo&AOt)A!k=+wY2}Q=vw#w zF#5}S_=C>8?0DYH4<4hW1^-$de+H>AJ!`}Eug_6#|UwOF`I#AN6|3%HhiPJ`YPKT`4 zqpIN7M*8DPpUS-ds|a~0>wU=0!mKB0Kwj<9pHkA7|7%$nSmi0{tN*cz9_zue@6j;; z@vhZoT!*AtB7OfW5VGn&jf*Z*AV>=p8HTGVva3>N#SGjh2g>RNu1x~h0&us+^jh5L zR)xVE!JsY?*41?m1#b=qZ;l3Ujt6f}<7S48F0krW=c9r}!W&!jMviY!N%Q{Kbn;@d zU!vT+`M1%v7{{2xlD}Earo2pN)Rt*f zgMPQxO}RjWt%9lTZyRjb>!7cmbaSxbg(cykI*xkH95EiTDq_;j?7aFp4^z_Ce;ZDw zV8vv+t?xgZSmqBcz_#fvYq8#gU&Y#wrZ+~#>*YY6=VC$col?QIC# zo_QYIP;2bxg;|N9`h(Nj(*>*cbPrv$?w?+thFBTX8}d-YqV93ly6Fq}3R(5;uW!wt zF%jE@@Q7zZTPtj4nWP>63w~j+M`upNAb-sK*?p0GZ0@qw&#Gn%0;7(jkG<6kF)g=@ z*}q|cv$NMFU6zjj*ViW;>q6#0 zER(R3CD+Kn6)d$@p5p^oEUA75d+96K%gU=TFP?6{`ftc6O*@%v-8CiEnmGTq00Cw6 zgO(S7Wd+&5=*|I*zLo+)16L^k9Dvc!rGU}(!Rz`eygpu_7hcyT!t44*cwOIs*W25b zgxPg%VRn5Z%&u=_ee{hmyB<;~N|&4umdJ9Ax4!-=69jZ;uAc^2{l2ME9*P_gEBY3e zfq_;(nSqq6%X-zfjldo&k8^8%LSzut9{){$J4s$5OARy>^7P`Sz zH2bl-N4vPD(K3>f?_pcY`gj=*2V?z&@ii2-Vm6$oANSfl+|(J zVHvgIHyt#j$#LV@!^s>8NE^!3O6lEOzNwJ_sL&hCIHwI)GWNeQ90a z`y|h0Xy8Eno zYafe5fy-=R7v_~&H-$i_xj#MH_!Et4u!O@OrRmxh79K}Tgl3OLYGJ@h8iTte2jOte0LU&F0pw^@*=&a+mQkTEiBTWwtrr zUUHd&u%ML7LSmr;o7?~_WF*Rk(@i~`>_&Q&f2^ngZ#}hP5B+R4*{JDk(#9{LU$@!R z4Ql(mP50XP5}>wP7dBO;ZFvcsnK|=_Re4JvDzdCCX>>4e$Cj^&_T~-w`5xvxwlcR? zwvKGS16F<9j$A11s>-We%PQUx4%7Cp9nS(2PyQlyXx^S*S`r<#Ji9uC9uxXM4)*K! zZ6j;;u8#pk?cMM337ZS@mhFC*=(N>%Z(a9qQu7QrB}J(#)WR~4R>bx%EK?j{nV$RJ z1k2<1*nW+JE3ol?ckoVZynh~S9g)Wg zwrgbBajW&A)?m&NhgyW7)Wc?;^~<4-CHJ*|ZAn+*325s68vq6U1FL^+K-a+d?^|yk zPKgHdYkvsH#t8&2K0Jr63%7@4LJ>9l8P;>l$MDC-n0-%hf1@pK?Jgky@^7u-g-Jb=LW3;Ng`}v`uA@QL=V$KW3&*X4XFAcjy!yYtZGiM={ZTnG z3nCm;CTy2yZT+JMjkf&fjzmC}aBDA-ImW7gem)!tMd#CKtX1{TRh29w(O*qFn>-?8 zUCBJ0x&upK^|50vRMEqC!|$LAEoI0J7v|A8>%EIfG~UX-m`2LlbFnT&YQ&|@d}xog z_tI7LzU%T)tYg8IT7d4N%2|hu0Kc<$0cE1E`HOTqKGD`4n+AhNI98apmXXKrfPI9e*{w#1CKwrs1ALR zf8Irv$vx2UVdqrwA=Hf~tB*n`fj-Tj5JIn$Yl;C^i1NSB6_hWGCh#HB;z#WXqlR=y zncFok^WDRz!zU27Sc%ldFNh zF!8_Ugm?G3syWP8y>5@oKbO*hBd-Zn3{LCDyq7ptHeu}i5Ib@YtpQTV7b2xjUubuK z6YQLJOHZizxdGNl=1{Nw-Ww{;&QMQC>x?Lekt+B8deYv{?evyEsIsBu1(y1aCcIU82Yn0+{eNTyNpw-VpTQ2}?1u zvDZou(qTag0sFV+qQMxA*Z|ADwaulDj7ivZ- zmelV__eP-@GPSeEm3BSw-^z>>qb-WJIiT2@9lX)F9{^0=7_bipblychadD>@ui!n9 z`y9qC!7bk49;K)%iZ(C}wQ7tkgeOC4A({XOn+AV4*&PhQ6)tfDesA63>UJZ~9Xu~mA@;)+ed8|xpn*Wro5lk@>(>;AIb z=^6e^Hp_eC?9nn^Qr{II6mK~^EtV%6yW2``#aX{W>H=G9alHv$1ukrRURi)lG{6q% zEsy&GSGufB#;9}ODhN{68C??~)D_y#jCA@m$c7PkTnmJG^m>42N?6`}L%XoM$ zlJU{WPWzcp%kycB5|8UnTtg*#YAjnlkSL6maf)0qzcnarw! z)XsIL7>*2&U}zbL;{F7%5%>c$aHiKKOxJ+|-LTM^jx|SZFdZ7Mm4+Uf>t3{*2IjQ! zjn&4TjEuWL0~;$MZh+w3@<_6MK0lb zn;|g_(2p*0ZRQx@))d^BiwqP9lL@7IqOdL4k03hz%EmoN!yG4sj5Tv+Xt|-aAJoNk zl$dZXVY1U=0=N+BLXfSO*sm`CYNu33a0mCZ^u5j8!YMLt95BXx{F%@hQLl{CA>M0^ zg3!RqMBZ4CvOsQ~jNpQl4Ir$%C%R-Q%3wW8uS6NNC|QUyfxCE*8CZiMAgb6KRa~A} zT?J^eQIW0JN2Wg=JBbZ(hF&^zJZWN+(o$TC;1@8O%*PG0j9wDKqc2o&5elNyCkq#0Iu45G31Tze~1MCrc#x752V{8kS!K&6Zni>*7r2^W--~Nx*F}`AKfo)5+A2e$GFTOy3x(3(@OR zElQkq9J4q;AWnZS2bma6uaXYkVnUe!MPlq&dhoZ?U!0#)8%YpA>cYCzv*!HuqEldK zDBG2^mT{yc?3&CTf0V6yjNGK|uSW^)dC+Ig`Ret0(9;(Fico7De{onYRNk{y9ITA)VlgGbD;y7$WYjMP&?GdQc*ICf zkPkxxGxMR*dR)LPrviOk$C1lEmv~A;eeT{u0b3p6RJ~vmLckp?olfc(YS{| z^~T@|{RfH$-l-)`sG6B=L@{*#WS$GakfWe}YeG+wsoFQCyE1ZFFVlu&8h>2V$TZR% z4@R-a?ME=q-71QM;FPKtgmH)_M?r#tEvYm;V|WibE8rAkv7iII%d)iwC|IVfOEc`^ z009elEd?XVoC?**3{WPp(KkStc$29~udJV1YwgKs?Tr->levS>r4c1)go-Ex8tW-5 zBK1E^Apl!<7D9JlR%ENpMK*kCb7LFPvu&dL@|11N z)zCel@SqknuzL1jol}ft+3HxfW0c7y0}5d)=+U}*2LW0}uZJRVkv)8l(;k1i(^s|= z01$$K4|FcVfZ9oyPw6W@tfjp(?q?(`{grXVAEU--|&6Na})C_4eVcAyDnDxlM*jB(6 zD64lAMKWwA!H#Nv54{1N`syBP*geZudL-M$L$(UQ{$<7u6#%ImMnDD7C|D-DDEo&S zqIw1?-9J{hus2fnU(y0u9IZALY6e=XIyR?@8J9GZg25T@MV-d5K8-42dI%QGdKSp2 zyFdALzY{VTL`3E)kw}nZ7+S;_mPvDEiJWjsb@Mw7n{KcBL4PjW3e?rf{N88-pG0!H z$S>Q749Yo(wPBQIj}FKLin;K$bvI+Y!A?4Z(8 z`@NKK&)w2RlkR@k+t9mhTGO>*9m;--mp9cY?NqUacY@k`FGW5v8EHw7N;SbW-T)Fr zczcW##v%(cAj3f`Vg@b}@r5fQMjAop_oDl1jtG>2_{`NpIkJJAy+~g5LMnM9)`*Yd z2e`@2AJwQ-Y8SCg3cx~Su28?G(!*X5nCzv(w=x)niuO@KlQzd<)y#4EkNYW`REv|; zRQ2`2Rk2-t?W5MTLtXOGW3j(rP^Y<5e#NN7ZuW@v`-^o$hd^>0<_SaRfvB@-w8q$D zB&du;PEf;JQj{ucK?7)y>eiBu(HM1qE9yy>I{O8cQ$M$&X0%O3x2D%RCJ68R-(x9aw#kz+>s=1ZP5|v!uu&?r{6XL^Y`m95<8H z(l$`RCa42#Xg544OWV=|xJ0$1?lF^`-VhrVVHjzG8r+Vap=@=u9o>UVwf6KZE(6+A z3ND2?6jx@l(B3aT^V z<|OmDx_lqC!W8fAfbNf~sU0XWaT|P$@Z!Oh0-r-;P=xrUZLg@>-T}%-mb%yh4xnvn z{{1wXM%$QsxFhwoT}bijXh*6@Q^$9r&hQ|0=>+vfsrNe3Q%U0FM)WM8M+)XVf*{zS zF8G!fb)h?yw=?AdCD{+qGpa!sxTUtJiCwS^`t?Ek&3Nn3mKG}M1=>#=@~^%??{lK< zE(P33>_pf`awVG9IFKe9`XeuZO5UT~c)(rkZqFJ^C-{>RF}u;p}5nA4|ak1o1oZfo)I4W zT`hT>-b?*MAcf>PCs!a>PY?kgJp-)QK`f;fD&|y3E(qV62Fz;@`VmQE7UaMA1l`Y6 ztX4e*S@(Ru8{!Ve%K0y5y!TM9p zUZvY=70B9o0_hmZfh%HEI?)0#ssTWec8V9MVXxAiJkY6Dz6!;?V7Fxbb%sm1aXKxg z!Rq&Px`T$~SME-a5r5)Tr;boNwdytc#6XBg+Efnfs1=JH`y6W29~B^@i7ZhkB+r^`IiP zu{Sl1L7FDI!KPzpXXclClR7i4%YW%D3P)%`^?I9zap8V-?QL2PJTH5P8qj!E{0_a# z8-7vU`_dM3Cj=ENV(~M<$z$$R9p0txDcRURprDAUs!i7?p!vz_Kw67Z3EAL$LbwU0 zuT+I=QomJa-lYn4vz-yhCxldYMZ5~`lUJxW!RZw@50Wd;3O~{w^E9*7b35Tj&sJUD z)0ZCaQ9{LuuxU`)DV3##R2I6;R-f6mR@j$4_T|!h^l&U-yRmK9JBfPkeTsKY#D>CZ zY8y(ZGzqs*FAI^=4Y2f{qc<3zY!-R%({{+lp&!V8lE3!@dXVTxRqrEe8-)!y6dPnE z@eg0jANUc%0Py%P%^-i-sj>pFZ%<<_U?8(ORYhe|g@mb2K@?CcsunJA#>kHo@0({* z-&ox)OiG=gOL5gqRqHaz2WfvglV+Fu%qj9p^m6i$V6qfraU>#nd*Z9w4{a&ktAIKCL;*bG+9-rb{|4*&n{F? z4y5jZe3alkN>L@)rPN!Wv4qs06!L+KFHm#X1#dY%hTs_fz9mFu^|saxP$QQb9y z9*~DoBd|#no>99;P-6T%Odh*Y8VS)m?A;RsY*SGqA!u^WtDYn2y#Fisb}%Arj7a+; z|HY7&Y-v zO+5-d*DfF!Y4o;^0#PqHvVdSq7I|$dl&4w9b^lC44T%sM;PphaB}T-Wjk4`_t;Fg^ zfe{Mxs4)=y?HFu|$B(PCW2hCc{$2UMp$e*#Mbr74VtJUC|M^&2NBmu}dVM@~sJcZA zK|?eYHi2qQC{RnK1cU8Gru@Uot0+ztkEhynOeHB=P`m#YxVErC!Q}&5Ftq+)w?-@7 z8i_79wT{V#hiAi9RapTXbmhtKlZ|cPosZRpKWN$nsJe^Q-U%=smZ&Nd$xBO>eIQmU>nhc%wjOsC&s?h2Dk(05S^n1QBg@#hhnG$t1 z3T$>-O_~aI^_03Y73%6K)g%Y{6~wjH1lZR9k(OMUiUo46MyrRWO5A(jO}G3z!b)L;?Pg4y!k2(p|UigGW^1OqvLg zyU(J{d|vPFmDLloA%)M|Tl~z~)F_a&o~SO*rrPa)0*|FRV40D4mSB-#X#lKV)b-lU zflWzs?FMHWec;0m7_5}$FxO)z2?!)ZeLV`q+J6rHMjKVHFKIIWabCsDrOI8th+?Ph z>dlJm?sGzV$%bi$m$+f!`qlCUu3WfC!HweQ%?+330cYSgL=(3z6Y5qU&82wG4N*mN zDd~1pDCS@V)EvCcVLsqkC+>N;< zYQrSbO<>cSZ`xSFFPxkDomq%2RY2A&ken_g0zk!`8@!dJsTT-fLgY4cESBnUH7yJ= zQuW%Y4f81>;w95shj5B3>XyrIyyykB& zTniqULAj_Qc?v?@@?0#CWCFj86apx#;)=sB%&Bb#=)w)>a1aZ^*1L9L$Aj*a;Rz{O zG^ao7mh~}iIP(BbaBVQ49YwOk-&hYoEdWDb+G2>_0yz|fQ^N;1OW+H_B0_5&%rFJ)jg|qVr%XkYo0k{=n{y#t}hzg;gpEp<>w(1P=!Y(oX7_ zGLo=@nVw;z2X&Hp11KI;Fgy}(A>ndMFb2C*0?oR#Sf~IPluiSs`bj!Aw>kY^UxeV7 z?n6)|S$6{Ir~AL;w8N_?E_O;_0!EKouz<>T7yySw313LF0&u6ihtQCD23f`f+?rn) zLTAYw7pNky<26U2dRC-5Ihqn976x^-+*@_ET)g>*u7>KRbTu63^nd-obu}~+T@54r z4_&RgDp&|V$T!9LP}tt)fUZ_e?aRlZz3nPxF)f8@`Nv||0Y_)HUP2u5i>MS?tmqVM zhT-2*Em%hR-_mr-R8K9VQE*0`UPc2$E{Vw%(N~>aPUYw?HF7x;nXam%%gN)mmqOL) z$+gu=yjJ(GpgI-40ViomEy+pPK_nO`Vtw=q`1A_Zq7~Ge*Y8!eR#IQ@ia#~0YGRgL za0m~f>kzw{zu$iK{YvUuD^Lw~Vk*>MT#i#oo$R8Z9Cmv`9#ETC!prk|0o_+qHcdr>U!`cc>-_(K{=CN8M?e z8u%Sd?cHk0choQj-d`i={e@kSfAu@+hXhOY(Q0a48Xv30v^uT@NS@lWnyLdIw1(ak ze7wB|Hv5V{)mfZ1;tdCt`2&^XRflY4y!j9C4$jMe`3D$$QtAC4DTTNHDjItQg_l0{ z+m95*D-YY%7fVT_wKP3RX0=xce%E>E7pr zrMzDmKhZ`Qj9Y%9Y2l)^d$5w`0rk;(x(5Hkha0E{|Nf_%v4L7vf$T%D$t;2l)rz8+ z1E_ou+ck>!snCt|4P16BHp08r&!xJq=W;536TJylaQLPYRWRfT+M}sHwyCafq6iwL zA~w@QWpv^#tT$~YLMb1ndTypwU5-I|`E$gdkHJbF-2P>lU8w>P`9I!5lEQgjstqs# zC-29F^j&2s1(xhavSI6b7)la&kE`dm;K2O}b#x0gqLcZRw$eG`oImo*Y{SB!yxMlS zs7~Zh+zy)rHo(3eM~E~-@Y5!i zFFoACxZaWf)~^tJaQkjP3}5Bns^SrPg0DH%TSurPUw5iCM<9(xsgp;jOGQmtr5q8O z;>2^O9y*E)&FyO7QA++ttzqKPKrKuCa1_ITtiq4!*h`CJ^d9V+6~_p$tGsWMmV$<4=>bU+4$-2}Z`bvopoc0Bg&`{% z@l^zj7sB&~b8ZsNG(S=EPe5c1QzuSPif6D(m}oUJhvd#7zfv{R4abYlbVxl(IedJ- zN{QgA%5{pm(QwuM6yiK1RPiZ#xH5*pj+o3Xp=1Yah_?1733vBk^}=a7oRIGl^#JBp zV~GYzC;{;_1O?5-s_Sp`2+worqv9d+0RsC?bsDyzdzj0=ayj3;SA?pM&(IHX3j|a^ zi51AhEeX`>Yzsd^1h-aEkM6^SNko!a1%PVj%b2x{wSb$>BU z58(VlG2G|NE~wPAblZy~>{Ig)#~Rz9Uybci67saMm`MSo;V?~8csZ+zAF;d7fDtIe z0Az7`4iSU}{A^j`6@fNrw=Z-k|3 zIo?w&buUToE~iQ$^b)*Ha=ofn{XsRuuOjv+kC{$&{ts#pB1wKu5cnPEDDmM-0rf?D zEujfFM#2x?N?0774w3Fp2fD}eX@ss9;Sp|A(T#O9L1(XsqQ$8)d>uz7t4Zgmei^Kv z7a!e_ok^#wTvGea(QWV;yUruDm8)JmPc1Vt?I`bQX!CLqsHRbf=}QiZ(|;Z=SPpin zw|TpkU9{6qKM-t7mPzRZ6iLpJuCkDTpc8a*b&7z*YV9N{fg6CKSaMKMuBl{+o>-jB z3wgg#Ng{9LptKFx(0J2XkmHsV6sRVCq@cKLtXHzNN|@`C{2_Llq-AP@JVtUcV*Hiw zixLe~qbM*RaI@r0**##P^w^ouadn^{Q&4dis7{Alu%we)qf84D16xZvxW!)oKn{am z8=b?T^?}>%ovl2_}AW&uAq^f&FL!hH;QY5PS)yWwR6jE%~=p?71^XEQKoplgcbwg^|Xkw zE(wkcKaW?=iRK08udPO(hEtHyuPyEIqj{zb3gsp3^Q_QtBdSLx2gfdN?^Dpp%C zGz>@#K(gj4tw*qS^xtr8^;eg#QA-tmjg|z9MoQ7zh|#(SIpH=*ZMaVLjLEJ9`F6y( z@?4icb?L7}@D!I-uVp+f88?Psq;JPv)hOi zhN?0l3_qyK4dKc-0;7-jsq-P+2>$L`q5L=yHz1T-&^KyrD8GfL=3#s{FWRF%2;|{@i`3aLe!##P1{D&)cc?z$`~X7UKZbLUz^3*o`q&=9d5Fd#${;Sm zyX{16(P7yS0{vQj9?8`K;o3-U571(xcs4G}qky61Dmj|Fa={rjESmSbwq0;Q1?dsP zURtTLV)!R-0TPf!N=XuhxboKtN5ej=2s*@e^XCQizRAt`Czl%Ck87xdCf^yd$(7(A zww_dRKW?X9D8qgXGouWztZ)q7e<#A+BO*q;>CmOj@74Qd^?;wsWlR3bvivZWS%c*= z{D<{kCGqVaRP{LiAbgqZILYbek1pl8jtz5d9KI8^_M&>C95;HsGGx_N#G>Da#44}t!s68eR%udmSc*SI1&gG9l@zo@2_xD`y;j7mHzd@7a`WN7~4QmfuTxZG8xzub7ZbW>r$GrPjy(sF{)f;jzjpZR%LFE2_+wIe%+qZbIfR zK};bGR>NNaTG^(c!C2Ub=6kpz9Nud^+&^}^%iMjVnwSN9)H7cGK74Npaj1SNz`~L3 zDkp{SEVECP8uW-2)=JKPHNwZ8U`Flpq4NW(S5{W zPpa`RbWlBCoqZVv6j2d$2Yh4;ZG$EBIYF$%T8`LPj$@FdDtby-Ku_@?0(Kl8a(Jxu zNgIG6+u&LxeaNckaru2SWC-xn0Xe{CKXPW=y!rATHARO5PBhox~_)41dkU#niEBB4Mz-Jv~v zQg5$;z=j%KixV0+{rnaVc}3%BO7wk+emOfO9=S`nhO|pWo@IzR&_K>GT0yJS9jpDd z*pq=VqwT(Y&hEZ4-F-2lg94s1e&a12utsAiPS=QyFO9L}xXQxV&FqCbZ^#iSQ&SGW z1pz^kH9Y7{2vg1s6zNGEMm;>EhpX_}9yT)UN>GFiPqb*f7#WKoiV+GhaCCP+yx4tv zVdj^R?q$c_MO)BRtP?uXnI>SDBym_T=$t2+fPx`Gf2fF+^`emn!&*;*tCL5awLg<^Qh21JuBV(eic zc>KkGJIo`p<=)_%t@?Xo!XGFW`J^WR*2%ht6cFuTk@`aCkV%^8d^TkWUwBE@4%U~4 z==-`<2f5vad|7Qea&Nn0Yf8aMmAglzk79n3K zn6yu&td(1sI7PB=L1N1U^x6Tz=20NjMrn~Ylpt?eys*OH#|@wbicRh%NGA~)=t!D2 z=52ZlfB=N`tviHU)66(l(icRnCceP72T_Ur54~zhB=oGsCvJjeIHE>g*(O1ZhjA5R z01O^iGl%R}0Hzov5I)d%0*#^gjMrX61n-XPrr3?~P6K2f*M#E7p&wzWn>Znv`;;a~ zy`t~~+*D6!CBRr94AZCeC;+Qr1PaU(E`Mc7lD2o$Fo77SObc+MjV_HR^JIWpF9nVu zftCTkh%XW4aw}V~l;W7Hc)+C;x6zng7fy|K)dG~*)PjWW>zf>JS=w}oVsuI4Yk<}mNX5R1do{W;gM z!2Vp^ExztBf76~XJ-B(s)?$T&Hc2Y5OkNI0YhuE&&wmipd0@*H)54>=T9Aw~>;q55 z!ev08mW#pyU|B5>LHNfp=@J$eTnN3}NB{`_VLv&{-)({q*wiJH6x1A+c$D5EN_Gh7 zw|m`h)EnM3f2swOhl)k3`?Z9V0~x?q#7o6&=*Wj@oE*rH-;~1_>qx;xxpsV zenS>X^or*ur^|Ct&272#7)+ibuxtkFFKYx`E`dT_=0AtCVz#?QQpjMEgi5r*&hbS` z3!-drt6+14cLkwV@tC9r9WWA2!W3nnhjNLGDS0n3J==pN`ncZcon{8A=otn96A;OU zBXHEmqjfI32h-=kyEy4wj>_TNi*O=|-z`p<1s|W4B5ih|UzW&$_zWZdCfkdc$#yCU zHXS$+$06Jx`wma7#m@Yd4cNO0H0teR{I)oTe#6{G{grF|4^qJ@@??cPEFwk zap%OU00ba|pkZ-d8x}Q$dsq@0M6`Hhjoz}&d|4ur92OXaC)MW0Toq|c=NiMTD#npE zT+XVD6s{5&p$sS-Rd4P7hTZaG6Yk(T3x0PfZ$G|UJ=7GRr<|%Xn)1+~E#_&)<#7)K ztQE|z51aAV_M3XRJa-r0hr+pcVNN>nJwcthi=V?ZJKfFIdA!>W6%D(a6IF%gys}o# z<-jHs;h*(A^%N9CG8IUvuv3KD;C?NQGOvuk7aoQS`Hk=8P@;?K-c+P{Uvin3)#_Ak zm=IJMJQ1F7;0HLoPq)jxqRRUD<+8Zt^ytHx=TIMhCf4C_EH=Ek@~5Ewp^hSl1q^; zfc;lA^jryqOA{>zK33=2a>JPZZp~$wr9{XEsK)Jh2OL{b?LoSOaLii=0zn+@Yy*3+ zn%9-9tHJGI=?+q#wTF*np!%^r-+?Fp^O(^fRpCA!78W$U2djcNxUyPzAAim#cdOSs z@QF|y?gu^MKxOVTTwe9LpP!;3YRmoTYNWa-my0T?BcJ5Y-1f(0KUXhwf_Gz-TG9zB zN0wUzIed^iZM^R&3al)`!$tVCb6N%tuw%tD^E-3~SKOKnyRr-1U|*=2f2U8>?ngkk!<6e$t`j@dZ4Q^Li5&5K z%OPTOM1HGB*-5}0=KFw}{1|t&X}E$a_c+TpK+Pwi9FX+KdRO6?>0XGWjsY6fkr(n6vr@0r- z#r*L!FS4=BHkMxjvsQeTlRd~^hIllu-jE79uwhP+C6UTqpXEvBL_GNs*nsZR-nZA7r7aFM!=Is8cWS%h3wD5=<;nspLS;b1wovpQ`s? z5P2`b_cK}5f0?@@ z5A@TQxiv0_U*?zL2JP?)xB2(JkoP$1Rh|)=BOgG3OG*_~p?mY+Plx-F=BSz7`F2Ux z*Um2cbG+M6=+E(PKVg54calneoks^(`X3b0NWI#F?<%#TL+tyvfnU(mD-77Q8RmTdPZT%Iq8~)nU?XeMx}-Lp_X?L{x)(8bofwMCwQFtXyJ`I9^I-~ zyBDNRO(Qwj)edAd+g;T(>IDlIAqUYejHzif5w5exowh?w?S*xksh0NQ$}Lucp@MDO z2J6f^aig$vu<$feje<2FyV2jDdsJd?e7Ek*UX{|Dy?pe5dZITcR_uQ;SRHN`*umv& z;XLAy8rhrUGmae!zQ##%|L9E)TXi~gI9LqbUeEX^{V`mbab4=`)A`u`Q<6-r3+zlB zCwv@6FMovH$FG6Y&1snnhs+xnJaNyd=tD;;%-L>Vd0S2J<3PM!=-+x=J{)k@o7}$Q zOvBDNg60AiL%0ZnM_$iTQ{Lpa`Q#Z@z7KceUw>CG%k^lnTHJ@9=R$RBAFr}AlYqE@vLxZbLQzQ|lVn#mzf?JILn)Z6UV4YeV^{e59bU}+hpGI& z+`Q9#;Xct0G%8k|7vuywf(@l71TX7XVm3gaPVN^NNLq-$pTPy$kj6+aKqRm zHaJjUq5A0o=BpVWaNUT70eDvSBX!^daMd@e*N5EH*#4(O&HIpjJoJLv@*!6>cB8_@ z55bm;RQyNqap$XMAAwO9+mK`qRXsl9O0LY0$y}mFeT0va0Wa@m;2U$Bhp4uhoOGjR zeveG-caRiA`a!OLr%v`m7-GJ9?qe>O_?6wAg>E$V*q;R}Ru*)b%KDh=J+aWPupm&u zUx4`_yrzFKH~%KQSS~A}wOp7zxGB^bPF*x6#|{l*QobpVFl1YMgWLPDO6bp(%oVzA z9Y+&gyMKSxx<6NmUFn8`iOSjHZ`J54P<{JDAkONqru63uEcc_&5^o-=jts)8=Btf^d6Ln87%7}BOHxCI@VyCZwK=M@u?Y$mq$g7R1*&!G;1Har zT{&Du4&_>Wa=2Y@C+@PKv$qf+)8aopE&_?zBNUol=Nfs!yj-#jG z65dhxp#u;8nIn{I6xXUQ)7~t5Fu_L+o-1_gtLW^Za2|{A35omKJ;_Fz3*OI!36Dt}3%nPPg??d+aYO21*Y%LSVPp=y9w3yM4dO#BqqsZc$$ln;FLK4)f{aoJ2!p+|OoLFIW2u|L~W&mdxzQO7dI%ji? zikQSHWk!d1!$ijeTS$Q29F_mzBz}ittq?ELnmv&i72Z~9V5xnRxo(Bs$fQ7_eac1d z^vm6<>ZkaparV1azy3Im9GKYQWY0swzgz2 zkKcgVkaUj>W)tTY8&BsJjKs?KzTn?v(|dI$uM0mS22CzJ3~SWgvv^FSpWXVKeHb_= z#8=t=ELdn7Y)Ugm@x8^j7gic#=N!dXzDnn`L-mK7gUTW$YgD zyBHQK;(vMo&>`IU8XB;r7pETlg%R>4H@iq8cL?qXD1N!Gh`b$dnBU>`;TR8`PTp8J zJ;7g#-QIA!iNs>UVJP^?8!o6)OJ;La^>V!fK29_V_mmGjc*+HDDgqVR>eOtmhNHpe z9BxL5>b^N#H`Wub<7Tkz7l&$AS~^0hIqYq})W&03M5qqCWN@kBEiVfYXro67w6SrX z%!OfaK?qo-`&;%cS5H3b2HES@LFi-#GPj&CUpa4iv6&oxjDGK2PHb2%_=t`JLkH@5 z%h|n@({P8&1cPvooXd?WYq-H$Sjx3HpRhInd9cnwd`F|rQLMh6PI!c;{5<%W0mbA{ zUpai>WnP-Y6DtWvZ|GKZL3>EJGa{HX^j!seV#$mi@kFUGDij(^Qe^&-PD!BZ9Y=v+Q-XQG!_$+`gm5<WGSqN+55gB?=^xe8g8vm=zT9-pV2KDUCj0k;=%Dg+LZYzd4B5$4Jj{mzv= z-`5Hg^oeINRw|bF#zuI;@F^rYk)c@)`Bhj|5sXf?em;MmG1(0wM;8)iAB(GhEW&13 zid?r30}Bo$#E#q6QNm4lD}pfIQ`zH^zef^%F0d&69!d08_IT3n9qg^9d-Qq3gl)7{ zABHxKSPn;cJk`wBC>0f3B#b)!6-QHL_19PMRd`j4T&~{k7zCTFu3Ny2OQQ#E?nvfr zH!vw=qI1i_Jz>}^1d|{%d5J+9bhOOW^a;Uz*9zgk;2Jte4|o#z6>$m$!hA?+`6taBEmGZaGMJegD|U&75ff@ z>Xy=8<9oL<7jRRms@gB$w`FihD1mI<0{pXSn?6=g)qB;i=-O ztVS*3ml4AeBU)6ofp{EoJA^fO$OT zF;yp@Yb2Hx9GCS7p70%{N}jk6y_GOU*<4hQe6ARuH<-*j1yO=L><$7o)*K&H%jZV1 z$KB?Mz%tv@f$#cQJ{S3i3_)B3U(rm%Kh!l}e<2SaXVfR8PC+{m1xFmIj+&e$6%p}4 z#iB1Jh+*%+`6Kg`3S9!zd7GNL1dgsMYX1^`xV&gPr;%EMmH|k@@lRK%c1ty z-Y8%dt=)Rs(1JF6K*g=%hEe%$J$-06228q#SMf$MFl;qnR&HAm(3-AoqxeuPfw%>ER5;*^~;avPZa`gb`h3~ma%*6nJ(4sNmB~@)T z-vhtp^Q(d3z$cTDn1%1%s9I~lgG%*W1Eh~rU#;QZ_62A8f8gzKbC>y%Q*n9VM_v!V zM&-5qJd*4Ct>unLm@HfiGj6<^xekuX?EI*okj~|rfbR)AH2(3)ppNS~EAYWbvpx?iT7!YKYuk)agEvA>{;U>kXn(UCax0plx>U$+7o)^KbitF8gQu!OEaJeewW z7e9(+#N`h4!!90&`=@quYh0%7=I=_rr4nj?OXc%V)W|*j8)5+;?B!ATcv9p({vJ<- z`}j02%lE_en5A~^=PF6CIpma#-}HunR`m&WnF`XLU}C7a1H47df%yp>udW~9Haspw zeObg_^=c6^WXGv5iui4KeUlFIdN(Xd11Yv=4svw^Uyx8gna~yMAL7<9bTJdG_YM5n zxcF~2r!H>-Q&Z(0;&QP%Jx?r7T@I%YUhF)?J%UJl=2smOc=uOq$2n@%ui%A=;}0Wp zFi|x<%(-y&pFGTsy#=K4Y5x;LuyFM=EL?rXXa&lDgnbqDqYP3&UhpoEAyK}FLs9C3 zBb=Hfgqe2zt6^K`e{yhF8r->df#i2x$X34`fj~-B^^S5Acu_DQ;$&|e<(3)tL!lf< z;DLB?DplhtHfxGtEMH zDj0JN&kq2LGOc2%C^x%;Hz$HOt6hOtr-CK3f;SU_uhs@{CI)Z5l{y*H|pz!gC%*vn=gYmn}Rp%gEuRKH%Egv$MsDI41XY4v?_SBBY3kYc(Xlt zlM}qT8oW6jyxFg!Pb2nwSUq~0?b7(Io*MfnJlOSBG zzy68l(HFRCsKfvBR=9pbRs9RxU#+^pgVa-3u(xa|=CW$QMed+JyTGw3`VtTFcIxrk zyPo^%dun(dsPF0C?cFy$U0-|cjd!}e=y6U?_z_k1GM5K1J9axF2861f7x_7L z{t8-uPDXhfgnECWS_=Mo6K>{Fb^k(M{IS0P9va50j%NTP-ZfOOUF8PqjjJe|dX?v> zuxnf<;nf~*cYW>E7d<_DzwzQ*FLdke>H1cmSKjFTYM*yi=HEO}<%SszRpvD`jJeJg zV;%n8ha3?DL%VridbI}{zSpg{D!9g-R92YbRi9kvF5^}j6Vz0=(Duk5j)=jbs!xcqSDlSE>Z_5V#*3uyG5P_5^B+^h&``B9#>fm0Z{=`Qz|`(