From 9fd8744ec4e356dedb7a3b13c26c36ead8afd4a6 Mon Sep 17 00:00:00 2001
From: brainx <12695242+brainx@users.noreply.github.com>
Date: Sun, 2 Aug 2026 20:56:13 +0200
Subject: [PATCH 1/3] feat: replace Streamlit with polished local web app
---
.github/CONTRIBUTING.md | 2 +-
.github/workflows/ci.yml | 76 +-
.github/workflows/release.yml | 18 +-
.gitignore | 5 -
.streamlit/config.toml | 7 -
CHANGELOG.md | 11 +
README.md | 55 +-
api_app.py | 44 +-
crypto_core.py | 13 +-
docs/API.md | 17 +
docs/RELEASE_CHECKLIST.md | 4 +-
docs/SCREENSHOTS.md | 24 +-
docs/SECURITY.md | 2 +-
docs/THREAT_MODEL.md | 2 +-
.../custom-web-encrypt-workflow.png | Bin 136505 -> 94974 bytes
.../screenshots/custom-web-mobile-inspect.png | Bin 70493 -> 49048 bytes
docs/screenshots/decrypt-file-workflow.jpg | Bin 63202 -> 0 bytes
docs/screenshots/encrypt-file-workflow.jpg | Bin 62132 -> 0 bytes
.../generate-keys-backend-warning.jpg | Bin 69833 -> 0 bytes
docs/screenshots/key-utilities-workflow.jpg | Bin 54640 -> 0 bytes
package-lock.json | 1397 +++++++++++++++--
package.json | 16 +-
pqc_app.py | 492 ------
pyproject.toml | 3 +-
requirements-dev-lock.txt | 672 +-------
requirements-lock.txt | 876 +----------
requirements.txt | 3 -
scripts/api_client.test.mjs | 72 +-
scripts/ui_native_smoke.mjs | 111 ++
scripts/ui_smoke.mjs | 375 ++++-
start.sh | 6 -
tests/test_api_app.py | 25 +
tests/test_crypto_core.py | 11 +
tests/test_startup.py | 43 +
tsconfig.json | 2 +-
ui_helpers.py | 2 +-
vite.config.ts | 8 +
web/src/App.tsx | 632 --------
web/src/{api.ts => api/client.ts} | 71 +-
web/src/api/contracts.ts | 68 +
web/src/api/errors.ts | 18 +
web/src/api/index.ts | 13 +
web/src/app/App.test.tsx | 130 ++
web/src/app/App.tsx | 84 +
web/src/app/AppShell.test.tsx | 59 +
web/src/app/AppShell.tsx | 99 ++
web/src/app/navigation.ts | 8 +
web/src/components/ActionButton.tsx | 14 +
web/src/components/CapabilityStatus.tsx | 60 +
web/src/components/FilePicker.tsx | 69 +
web/src/components/Notice.tsx | 18 +
web/src/components/PasswordField.tsx | 35 +
web/src/components/TechnicalDetails.tsx | 14 +
web/src/components/WorkflowLayout.tsx | 39 +
web/src/components/components.test.tsx | 83 +
.../features/decrypt/DecryptWorkflow.test.tsx | 306 ++++
web/src/features/decrypt/DecryptWorkflow.tsx | 298 ++++
.../features/encrypt/EncryptWorkflow.test.tsx | 238 +++
web/src/features/encrypt/EncryptWorkflow.tsx | 268 ++++
.../generate/GenerateKeysWorkflow.test.tsx | 257 +++
.../generate/GenerateKeysWorkflow.tsx | 223 +++
.../features/generate/passwordPolicy.test.ts | 35 +
web/src/features/generate/passwordPolicy.ts | 44 +
.../inspect/InspectKeyWorkflow.test.tsx | 33 +
.../features/inspect/InspectKeyWorkflow.tsx | 68 +
web/src/hooks/useKeyInspection.test.tsx | 131 ++
web/src/hooks/useKeyInspection.ts | 80 +
web/src/lib/download.ts | 19 +
web/src/lib/filenames.test.ts | 20 +
web/src/lib/filenames.ts | 19 +
web/src/lib/format.test.ts | 10 +
web/src/lib/format.ts | 13 +
web/src/lib/workflow.test.ts | 16 +
web/src/lib/workflow.ts | 6 +
web/src/main.tsx | 6 +-
web/src/styles.css | 564 -------
web/src/styles/components.css | 609 +++++++
web/src/styles/global.css | 29 +
web/src/styles/tokens.css | 50 +
web/src/test/fixtures.ts | 26 +
web/src/test/setup.ts | 7 +
81 files changed, 5786 insertions(+), 3497 deletions(-)
delete mode 100644 .streamlit/config.toml
delete mode 100644 docs/screenshots/decrypt-file-workflow.jpg
delete mode 100644 docs/screenshots/encrypt-file-workflow.jpg
delete mode 100644 docs/screenshots/generate-keys-backend-warning.jpg
delete mode 100644 docs/screenshots/key-utilities-workflow.jpg
delete mode 100644 pqc_app.py
create mode 100644 scripts/ui_native_smoke.mjs
create mode 100644 tests/test_startup.py
delete mode 100644 web/src/App.tsx
rename web/src/{api.ts => api/client.ts} (77%)
create mode 100644 web/src/api/contracts.ts
create mode 100644 web/src/api/errors.ts
create mode 100644 web/src/api/index.ts
create mode 100644 web/src/app/App.test.tsx
create mode 100644 web/src/app/App.tsx
create mode 100644 web/src/app/AppShell.test.tsx
create mode 100644 web/src/app/AppShell.tsx
create mode 100644 web/src/app/navigation.ts
create mode 100644 web/src/components/ActionButton.tsx
create mode 100644 web/src/components/CapabilityStatus.tsx
create mode 100644 web/src/components/FilePicker.tsx
create mode 100644 web/src/components/Notice.tsx
create mode 100644 web/src/components/PasswordField.tsx
create mode 100644 web/src/components/TechnicalDetails.tsx
create mode 100644 web/src/components/WorkflowLayout.tsx
create mode 100644 web/src/components/components.test.tsx
create mode 100644 web/src/features/decrypt/DecryptWorkflow.test.tsx
create mode 100644 web/src/features/decrypt/DecryptWorkflow.tsx
create mode 100644 web/src/features/encrypt/EncryptWorkflow.test.tsx
create mode 100644 web/src/features/encrypt/EncryptWorkflow.tsx
create mode 100644 web/src/features/generate/GenerateKeysWorkflow.test.tsx
create mode 100644 web/src/features/generate/GenerateKeysWorkflow.tsx
create mode 100644 web/src/features/generate/passwordPolicy.test.ts
create mode 100644 web/src/features/generate/passwordPolicy.ts
create mode 100644 web/src/features/inspect/InspectKeyWorkflow.test.tsx
create mode 100644 web/src/features/inspect/InspectKeyWorkflow.tsx
create mode 100644 web/src/hooks/useKeyInspection.test.tsx
create mode 100644 web/src/hooks/useKeyInspection.ts
create mode 100644 web/src/lib/download.ts
create mode 100644 web/src/lib/filenames.test.ts
create mode 100644 web/src/lib/filenames.ts
create mode 100644 web/src/lib/format.test.ts
create mode 100644 web/src/lib/format.ts
create mode 100644 web/src/lib/workflow.test.ts
create mode 100644 web/src/lib/workflow.ts
delete mode 100644 web/src/styles.css
create mode 100644 web/src/styles/components.css
create mode 100644 web/src/styles/global.css
create mode 100644 web/src/styles/tokens.css
create mode 100644 web/src/test/fixtures.ts
create mode 100644 web/src/test/setup.ts
diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 67bcc0a..9896c7a 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -84,7 +84,7 @@ By participating in this project, you agree to abide by our Code of Conduct.
- Run mypy to check static typing:
```bash
.venv/bin/python -m mypy \
- crypto_config.py crypto_core.py pqc_agent_tools.py pqc_app.py \
+ api_app.py crypto_config.py crypto_core.py pqc_agent_tools.py ui_helpers.py \
tests/test_agent_tools.py tests/test_crypto_core.py
```
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5eb54a4..83539df 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,13 +32,13 @@ jobs:
run: python -m pip install -r requirements-dev.txt
- name: Check formatting
- run: python -m black --check api_app.py crypto_config.py crypto_core.py pqc_agent_tools.py pqc_app.py ui_helpers.py setup.py tests/test_agent_tools.py tests/test_api_app.py tests/test_crypto_core.py tests/test_ui_helpers.py
+ run: python -m black --check api_app.py crypto_config.py crypto_core.py pqc_agent_tools.py ui_helpers.py setup.py tests/test_agent_tools.py tests/test_api_app.py tests/test_crypto_core.py tests/test_ui_helpers.py
- name: Lint
- run: python -m flake8 api_app.py crypto_config.py crypto_core.py pqc_agent_tools.py pqc_app.py ui_helpers.py setup.py tests/test_agent_tools.py tests/test_api_app.py tests/test_crypto_core.py tests/test_ui_helpers.py
+ run: python -m flake8 api_app.py crypto_config.py crypto_core.py pqc_agent_tools.py ui_helpers.py setup.py tests/test_agent_tools.py tests/test_api_app.py tests/test_crypto_core.py tests/test_ui_helpers.py
- name: Type check
- run: python -m mypy api_app.py crypto_config.py crypto_core.py pqc_agent_tools.py pqc_app.py ui_helpers.py tests/test_agent_tools.py tests/test_api_app.py tests/test_crypto_core.py tests/test_ui_helpers.py
+ run: python -m mypy api_app.py crypto_config.py crypto_core.py pqc_agent_tools.py ui_helpers.py tests/test_agent_tools.py tests/test_api_app.py tests/test_crypto_core.py tests/test_ui_helpers.py
- name: Unit tests without native liboqs
run: >
@@ -93,15 +93,21 @@ jobs:
/tmp/qe-wheel-test/bin/quantum-encryptor-agent health --json
/tmp/qe-wheel-test/bin/python -I - <<'PY'
from pathlib import Path
+ from importlib.metadata import requires
+ from importlib.util import find_spec
import sys
import api_app
import pqc_agent_tools
+ import ui_helpers
prefix = Path(sys.prefix).resolve()
- for module in (api_app, pqc_agent_tools):
+ for module in (api_app, pqc_agent_tools, ui_helpers):
module_path = Path(module.__file__).resolve()
assert module_path.is_relative_to(prefix), (module.__name__, module_path, prefix)
+ assert find_spec("pqc_app") is None
+ package_requirements = requires("quantum-encryptor") or ()
+ assert all(not requirement.lower().startswith("streamlit") for requirement in package_requirements)
PY
- name: Smoke installed web UI
@@ -155,7 +161,7 @@ jobs:
run: npm audit --package-lock-only --audit-level=high
- name: Run Python security lint
- run: python -m bandit -q -r api_app.py crypto_core.py pqc_agent_tools.py pqc_app.py ui_helpers.py
+ run: python -m bandit -q -r api_app.py crypto_core.py pqc_agent_tools.py ui_helpers.py
web:
name: Custom web UI
@@ -262,9 +268,9 @@ jobs:
run: |
git init .ci/liboqs
git -C .ci/liboqs remote add origin https://github.com/open-quantum-safe/liboqs.git
- # liboqs 0.15.0
- git -C .ci/liboqs fetch --depth=1 origin 97f6b86b1b6d109cfd43cf276ae39c2e776aed80
- git -C .ci/liboqs checkout --detach 97f6b86b1b6d109cfd43cf276ae39c2e776aed80
+ # liboqs 0.16.0
+ git -C .ci/liboqs fetch --depth=1 origin 5a1a854b0dc9f2141bdc771c555ee60c37950183
+ git -C .ci/liboqs checkout --detach 5a1a854b0dc9f2141bdc771c555ee60c37950183
cmake -S .ci/liboqs -B .ci/liboqs/build \
-GNinja \
-DBUILD_SHARED_LIBS=ON \
@@ -273,7 +279,22 @@ jobs:
cmake --install .ci/liboqs/build
- name: Install Python dependencies
- run: python -m pip install -r requirements-dev.txt
+ run: python -m pip install --require-hashes -r requirements-dev-lock.txt
+
+ - name: Set up Node
+ uses: actions/setup-node@v7
+ with:
+ node-version: "22"
+ cache: npm
+
+ - name: Install frontend dependencies
+ run: npm ci
+
+ - name: Build frontend
+ run: npm run build
+
+ - name: Install Playwright Chromium
+ run: npx playwright install --with-deps chromium
- name: Verify native backend is active
run: |
@@ -314,3 +335,40 @@ jobs:
--private-key agent-private.pem \
--output agent-output.txt
cmp agent-input.txt agent-output.txt
+
+ - name: Native browser encryption round trip
+ run: |
+ SKIP_WEB_BUILD=1 PYTHON=python ./start.sh &
+ server_pid=$!
+ trap 'kill "$server_pid" 2>/dev/null || true; wait "$server_pid" 2>/dev/null || true' EXIT
+ python - <<'PY'
+ import json
+ import time
+ from urllib.request import urlopen
+
+ required = ("generate", "encrypt", "decrypt")
+ deadline = time.monotonic() + 30
+
+ while (remaining := deadline - time.monotonic()) > 0:
+ try:
+ with urlopen("http://127.0.0.1:4000/api/health", timeout=min(1, remaining)) as response:
+ health = json.load(response)
+ except Exception:
+ health = None
+
+ ready = bool(
+ health
+ and health.get("ok")
+ and health.get("backendReady")
+ and all(health.get("capabilities", {}).get(name, {}).get("available") for name in required)
+ )
+ if ready:
+ raise SystemExit(0)
+
+ remaining = deadline - time.monotonic()
+ if remaining > 0:
+ time.sleep(min(0.25, remaining))
+
+ raise SystemExit("Native local app did not become ready within 30 seconds.")
+ PY
+ npm run ui-native
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 815f3c2..3bc944b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -44,7 +44,7 @@ jobs:
run: python -m pip_audit -r requirements-dev-lock.txt
- name: Run Python security lint
- run: python -m bandit -q -r crypto_core.py pqc_agent_tools.py pqc_app.py ui_helpers.py api_app.py
+ run: python -m bandit -q -r crypto_core.py pqc_agent_tools.py ui_helpers.py api_app.py
- name: Install frontend dependencies
run: npm ci
@@ -82,15 +82,21 @@ jobs:
/tmp/qe-release-test/bin/quantum-encryptor-agent health --json
/tmp/qe-release-test/bin/python -I - <<'PY'
from pathlib import Path
+ from importlib.metadata import requires
+ from importlib.util import find_spec
import sys
import api_app
import pqc_agent_tools
+ import ui_helpers
prefix = Path(sys.prefix).resolve()
- for module in (api_app, pqc_agent_tools):
+ for module in (api_app, pqc_agent_tools, ui_helpers):
module_path = Path(module.__file__).resolve()
assert module_path.is_relative_to(prefix), (module.__name__, module_path, prefix)
+ assert find_spec("pqc_app") is None
+ package_requirements = requires("quantum-encryptor") or ()
+ assert all(not requirement.lower().startswith("streamlit") for requirement in package_requirements)
PY
- name: Smoke installed web UI
@@ -177,9 +183,9 @@ jobs:
run: |
git init .ci/liboqs
git -C .ci/liboqs remote add origin https://github.com/open-quantum-safe/liboqs.git
- # liboqs 0.15.0
- git -C .ci/liboqs fetch --depth=1 origin 97f6b86b1b6d109cfd43cf276ae39c2e776aed80
- git -C .ci/liboqs checkout --detach 97f6b86b1b6d109cfd43cf276ae39c2e776aed80
+ # liboqs 0.16.0
+ git -C .ci/liboqs fetch --depth=1 origin 5a1a854b0dc9f2141bdc771c555ee60c37950183
+ git -C .ci/liboqs checkout --detach 5a1a854b0dc9f2141bdc771c555ee60c37950183
cmake -S .ci/liboqs -B .ci/liboqs/build \
-GNinja \
-DBUILD_SHARED_LIBS=ON \
@@ -188,7 +194,7 @@ jobs:
cmake --install .ci/liboqs/build
- name: Install Python dependencies
- run: python -m pip install -r requirements-dev.txt
+ run: python -m pip install --require-hashes -r requirements-dev-lock.txt
- name: Verify migration backends are active
run: |
diff --git a/.gitignore b/.gitignore
index 8cb241b..aba43b7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -108,11 +108,6 @@ ENV/
env.bak/
venv.bak/
-# Streamlit local state and secrets. Keep committed UI theme config.
-.streamlit/*
-!.streamlit/
-!.streamlit/config.toml
-
# Spyder project settings
.spyderproject
.spyproject
diff --git a/.streamlit/config.toml b/.streamlit/config.toml
deleted file mode 100644
index d76f1b1..0000000
--- a/.streamlit/config.toml
+++ /dev/null
@@ -1,7 +0,0 @@
-[theme]
-base = "dark"
-primaryColor = "#2DD4BF"
-backgroundColor = "#000000"
-secondaryBackgroundColor = "#111827"
-textColor = "#FFFFFF"
-font = "sans serif"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 349bea6..efd4998 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,17 @@ This project follows a practical semantic-versioning style.
- ML-KEM-768 + X25519 composite key generation and format-v4 encrypted containers.
- SHA3-256 hybrid key combiner binding both key shares, X25519 context, suite identifier, and application domain.
+- Polished monochrome local web workflows with progressive technical details,
+ responsive navigation, component tests, accessibility checks, and a native
+ browser encryption round trip.
+
+### Changed
+
+- Retired the Streamlit application, temporary startup fallback, packaging
+ surface, and superseded reference screenshots. `./start.sh` now serves the
+ React/Vite interface through the loopback-only Python API as the sole GUI.
+- Preserved decrypt-only compatibility for authenticated earlier containers and
+ private-key formats, including the bounded ML-KEM/Kyber migration path.
### Security
diff --git a/README.md b/README.md
index 127b1a6..947f795 100644
--- a/README.md
+++ b/README.md
@@ -10,14 +10,14 @@ A post-quantum cryptography tool for file encryption. New files combine ML-KEM-7
- Dark local web interface for ML-KEM-768 + X25519 key generation, file encryption, decryption, and PEM key inspection.
+ Monochrome local web interface for ML-KEM-768 + X25519 key generation, file encryption, decryption, and PEM key inspection.
## Features
@@ -25,12 +25,12 @@ A post-quantum cryptography tool for file encryption. New files combine ML-KEM-7
- **Post-Quantum/Traditional Security**: Combines ML-KEM-768 with X25519 so confidentiality does not depend on one key-establishment algorithm
- **Authenticated File Encryption**: Derives AES-256-GCM keys from both ML-KEM and X25519 shared secrets
- **Password-Protected Keys**: Private keys are always encrypted with scrypt-derived AES-256-GCM keys
-- **User-Friendly Interface**: Custom local web UI with a Python ASGI API
+- **User-Friendly Interface**: Custom local web UI with progressive technical details and a Python ASGI API
- **PEM Key Format**: Keys stored in PEM-like format with quantum algorithm extensions
## Screenshots
-The backend readiness warning shown here is expected when native `liboqs` is not installed in the local environment. Click any image to open the full screenshot page.
+The current browser smoke captures show the responsive Encrypt and Inspect key workflows. Click either image to open the full screenshot page.
@@ -111,21 +111,22 @@ See [docs/SCREENSHOTS.md](docs/SCREENSHOTS.md) for the dedicated screenshot page
PYTHON=.venv/bin/python ./test.sh
```
- To run the legacy Streamlit UI during transition:
- ```bash
- LEGACY_STREAMLIT=1 ./start.sh
- ```
-
Frontend development can run Vite separately on `127.0.0.1:4001`:
```bash
npm run dev
```
-2. Open the web interface in your browser. You can:
- - Generate a new post-quantum key pair
- - Encrypt files using a recipient's public key
- - Decrypt files using your private key
- - Access key utilities
+2. Open the web interface in your browser. Choose the intent that matches your task:
+ - **Encrypt**: protect a file for the holder of a recipient public key.
+ - **Decrypt**: recover a file with the matching encrypted private key and password.
+ - **Generate keys**: create a new public key and password-protected private key.
+ - **Inspect key**: check supported key metadata without exposing key material.
+
+ Each workflow starts with plain-language guidance. Expand **Technical details** only when you need suite, format, or key-policy information.
+
+### Local-only interface privacy
+
+The custom interface processes selected files through the local Python service at `127.0.0.1`. It does not use browser persistence, telemetry, remote fonts, or remote application assets. The UI does not display plaintext previews, passwords, private-key content, or the local API token.
## Verification
@@ -138,8 +139,9 @@ Run the Python test suite:
Run the custom frontend checks:
```bash
-npm run build
+npm run test:unit
npm run check
+npm run build
```
With the app already running on `127.0.0.1:4000`, run the browser smoke test:
@@ -150,16 +152,24 @@ npm run ui-smoke
The UI smoke test writes ignored screenshots under `tmp/ui-smoke/`.
+When a native `liboqs` installation is available to the running app, also run the real browser encryption round trip:
+
+```bash
+npm run ui-native
+```
+
+Do not treat the browser smoke test as proof that the native cryptographic backend is installed; it verifies the built interface against the local API contract. `npm run ui-native` verifies key generation, encryption, and decryption through the available native backend.
+
### Key Generation
-1. Select "Generate Keys" from the sidebar
+1. Select "Generate keys" from the workflow navigation
2. Enter and confirm a strong private-key password
3. Generate the keys and download both public and private key files
4. Share your public key with others who want to send you encrypted files
### File Encryption
-1. Select "Encrypt File" from the sidebar
+1. Select "Encrypt" from the workflow navigation
2. Upload the file you want to encrypt
3. Upload the recipient's public key (.pem file)
4. Specify the output filename
@@ -167,15 +177,15 @@ The UI smoke test writes ignored screenshots under `tmp/ui-smoke/`.
### File Decryption
-1. Select "Decrypt File" from the sidebar
+1. Select "Decrypt" from the workflow navigation
2. Upload the encrypted file (.pqc file)
3. Upload your private key (.pem file)
4. Enter your private-key password
5. Download the decrypted file
-## Agent Usage
+## Automation Usage
-Local automation agents can use the deterministic JSON CLI instead of driving the Streamlit UI. Run commands from the repository workspace and pass only workspace-relative paths. Absolute paths, `..` traversal, symlink escapes, and accidental output overwrites are rejected.
+Automation tools can use the deterministic JSON CLI instead of driving the browser interface. Run commands from the repository workspace and pass only workspace-relative paths. Absolute paths, `..` traversal, symlink escapes, and accidental output overwrites are rejected.
```bash
mkdir -p keys data
@@ -229,7 +239,7 @@ The CLI prints JSON only and never includes plaintext, private keys, passwords,
- State-changing local web API requests require a per-process API token and reject non-local browser origins when an `Origin` header is present
- The local agent CLI accepts only workspace-relative paths, returns machine-readable JSON without secret material, and writes private keys plus decrypted outputs with owner-only permissions on POSIX systems; non-overwrite output creation uses exclusive file creation
- Native `liboqs` is loaded lazily and missing backend support disables key generation/encryption instead of crashing the app
-- CI runs Python formatting, linting, type checks, unit tests, custom web UI build/type checks, API client tests, browser UI smoke, isolated installed-wheel checks, Python/npm dependency audits, locked runtime install, and a native `liboqs` integration test job pinned to the matching 0.15.0 release commit; repository CodeQL default setup provides static analysis
+- CI runs Python formatting, linting, type checks, unit tests, custom web UI build/type checks, API client tests, browser UI smoke, isolated installed-wheel checks, Python/npm dependency audits, locked runtime install, and a native `liboqs` integration test job pinned to the matching 0.16.0 release commit; repository CodeQL default setup provides static analysis
- See [docs/THREAT_MODEL.md](docs/THREAT_MODEL.md) for repository trust boundaries, assets, abuse cases, and invariants
- **Disclaimer**: This software has not undergone an independent security audit and should be reviewed before production use
@@ -238,8 +248,7 @@ The CLI prints JSON only and never includes plaintext, private keys, passwords,
- `crypto_config.py` - Configuration parameters for cryptographic operations
- `crypto_core.py` - Core cryptographic functions (key generation, encryption, decryption)
- `api_app.py` - Local ASGI API and static web UI server
-- `pqc_agent_tools.py` - Local JSON CLI for agentic workflows
-- `pqc_app.py` - Legacy Streamlit web application interface
+- `pqc_agent_tools.py` - Local JSON CLI for automation workflows
- `web/` - React frontend source for the custom UI
- `package.json` / `vite.config.ts` - Frontend build configuration
- `ui_helpers.py` - UI-safe filename helpers
diff --git a/api_app.py b/api_app.py
index 8d9826c..465d1d4 100644
--- a/api_app.py
+++ b/api_app.py
@@ -299,23 +299,53 @@ async def _read_upload_text(upload: UploadFile, max_bytes: int, label: str) -> s
raise ApiError(400, "invalid_text", f"{label} must be a UTF-8 text file.") from exc
+def _capability(available: bool, reason: str = "") -> dict[str, bool | str]:
+ return {"available": available, "reason": "" if available else reason}
+
+
def _health_payload() -> dict[str, Any]:
try:
active_kem_component = core.resolve_kem_algorithm(cfg.KEM_ALG)
- backend_ready = True
- backend_message = "Post-quantum backend ready."
+ current_backend_ready = True
except Exception as exc:
active_kem_component = cfg.KEM_ALG
- backend_ready = False
- backend_message = (
+ current_backend_ready = False
+ logger.warning("Post-quantum backend readiness check failed: %s", exc)
+
+ try:
+ decrypt_ready = bool(core.available_decryption_kem_algorithms())
+ except Exception as exc:
+ decrypt_ready = False
+ logger.warning("Decryption backend readiness check failed: %s", exc)
+
+ capabilities = {
+ "inspect": _capability(True),
+ "generate": _capability(
+ current_backend_ready,
+ "ML-KEM-768 is unavailable for new key generation.",
+ ),
+ "encrypt": _capability(
+ current_backend_ready,
+ "ML-KEM-768 is unavailable for new encryption.",
+ ),
+ "decrypt": _capability(
+ decrypt_ready,
+ "No supported post-quantum decryption backend is available.",
+ ),
+ }
+ backend_message = (
+ "Post-quantum backend ready."
+ if current_backend_ready
+ else (
"The ML-KEM backend is not ready, so new keys and ciphertexts cannot be created. "
- "Compatible legacy archives may still be decryptable."
+ "Compatible encrypted archives may still be decryptable."
)
- logger.warning("Post-quantum backend readiness check failed: %s", exc)
+ )
return {
- "backendReady": backend_ready,
+ "backendReady": current_backend_ready,
"backendMessage": backend_message,
+ "capabilities": capabilities,
"formatVersion": cfg.FORMAT_VERSION,
"kem": cfg.HYBRID_KEM_ALG,
"kemComponent": active_kem_component,
diff --git a/crypto_core.py b/crypto_core.py
index 737dcb9..9c5aff1 100644
--- a/crypto_core.py
+++ b/crypto_core.py
@@ -220,6 +220,16 @@ def resolve_kem_algorithm(kem_alg: Optional[str] = None) -> str:
)
+def available_decryption_kem_algorithms() -> Tuple[str, ...]:
+ """Return enabled, application-supported KEM identities in preference order."""
+ enabled = set(_enabled_kem_mechanisms())
+ return tuple(
+ candidate
+ for candidate in (cfg.KEM_ALG, *cfg.LEGACY_KEM_ALGS)
+ if candidate in enabled
+ )
+
+
def resolve_decryption_kem_algorithms(suite: str) -> Tuple[str, ...]:
"""Resolve exact KEM identities allowed to decrypt a key/container suite."""
if suite == cfg.HYBRID_KEM_ALG:
@@ -229,8 +239,7 @@ def resolve_decryption_kem_algorithms(suite: str) -> Tuple[str, ...]:
if suite != cfg.LEGACY_HYBRID_KEM_ALG:
raise UnsupportedAlgorithmError(f"Unsupported key or container suite: {suite!r}")
- enabled = set(_enabled_kem_mechanisms())
- candidates = tuple(candidate for candidate in (cfg.KEM_ALG, *cfg.LEGACY_KEM_ALGS) if candidate in enabled)
+ candidates = available_decryption_kem_algorithms()
if candidates:
return candidates
raise CryptoDependencyError(
diff --git a/docs/API.md b/docs/API.md
index b6c27f9..0ea8946 100644
--- a/docs/API.md
+++ b/docs/API.md
@@ -39,6 +39,23 @@ The custom web UI is served by `api_app.py` on `127.0.0.1` by default. `GET /api
When a browser sends an `Origin` header on a state-changing API request, the server only accepts local origins beginning with `http://127.0.0.1:` or `http://localhost:`. Requests without the local API token are rejected before route handlers parse uploaded files or form data.
+### Health capability contract
+
+`GET /api/health` includes additive, operation-specific readiness information. New clients should use these capabilities to decide whether to enable each workflow:
+
+```
+{
+ "capabilities": {
+ "inspect": { "available": true, "reason": "" },
+ "generate": { "available": true, "reason": "" },
+ "encrypt": { "available": true, "reason": "" },
+ "decrypt": { "available": true, "reason": "" }
+ }
+}
+```
+
+`backendReady` and `backendMessage` remain in the response for compatibility, while new clients use operation-specific capabilities. A capability `reason` is a safe user-facing summary of an unavailable operation; it is not a raw backend exception. The health response is marked `Cache-Control: no-store` and `Pragma: no-cache` because it includes the per-process local API token.
+
### Agent JSON Contract
Successful command output:
diff --git a/docs/RELEASE_CHECKLIST.md b/docs/RELEASE_CHECKLIST.md
index 9c96c51..f5283a1 100644
--- a/docs/RELEASE_CHECKLIST.md
+++ b/docs/RELEASE_CHECKLIST.md
@@ -26,8 +26,8 @@ Use this checklist before publishing a new release.
python -m pip install -r requirements-dev.txt
npm ci
python -m black --check .
-python -m flake8 api_app.py crypto_config.py crypto_core.py pqc_agent_tools.py pqc_app.py ui_helpers.py setup.py tests
-python -m mypy api_app.py crypto_config.py crypto_core.py pqc_agent_tools.py pqc_app.py ui_helpers.py tests
+python -m flake8 api_app.py crypto_config.py crypto_core.py pqc_agent_tools.py ui_helpers.py setup.py tests
+python -m mypy api_app.py crypto_config.py crypto_core.py pqc_agent_tools.py ui_helpers.py tests
./test.sh --cov=crypto_core --cov=pqc_agent_tools --cov=ui_helpers --cov=api_app --cov-report=term-missing --cov-fail-under=80
npm run build
npm run check
diff --git a/docs/SCREENSHOTS.md b/docs/SCREENSHOTS.md
index 29f7949..7acda34 100644
--- a/docs/SCREENSHOTS.md
+++ b/docs/SCREENSHOTS.md
@@ -1,31 +1,11 @@
# Application Screenshots
-These screenshots show the custom local web UI. They were captured from the local app with native `liboqs` unavailable, so the backend readiness warning and disabled key generation or file processing controls are expected.
+These screenshots show the current monochrome custom local web UI. The interface uses progressive disclosure: plain-language task guidance appears first, while suite, format, and key-policy information stays inside **Technical details** until it is needed. The desktop Encrypt capture shows format version 4 and the `ML-KEM-768+X25519-v2` hybrid suite; the mobile Inspect key capture shows responsive workflow navigation and public-key metadata only.
## Custom Web Encrypt Workflow
-
+
## Custom Web Mobile Inspect
-
-## Legacy Streamlit Reference
-
-The default `./start.sh` path serves the custom local web UI. These older screenshots remain as a reference for the legacy Streamlit interface available through `LEGACY_STREAMLIT=1 ./start.sh`.
-
-### Generate Keys
-
-
-
-### Encrypt File
-
-
-
-### Decrypt File
-
-
-
-### Key Utilities
-
-
diff --git a/docs/SECURITY.md b/docs/SECURITY.md
index 08941fd..2c5a62b 100644
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@@ -76,7 +76,7 @@ The application is designed to protect against the following threats:
- Legacy hybrid public keys are rejected for encryption and must be regenerated under the current suite.
- The UI and core encryption path enforce a 100 MiB plaintext in-memory file limit; decryption accepts only the bounded encrypted-container size needed for header, KEM ciphertext, nonce, and tag overhead.
- The local web API requires a per-process `X-Quantum-Encryptor-Token` for state-changing `/api/*` requests and rejects non-local browser origins when an `Origin` header is present.
-- Download filenames are reduced to local filenames before being passed to Streamlit.
+- Download filenames are reduced to local filenames before the API returns them to the browser.
- Private-key password protection requires at least 16 characters, at least 5 unique characters, and rejects known weak values in the core, UI, and agent CLI.
- Unencrypted private keys are rejected in the core, UI, and agent CLI.
- The core module defines its own logger but leaves root logging configuration to application entry points.
diff --git a/docs/THREAT_MODEL.md b/docs/THREAT_MODEL.md
index e0825b8..c70c3ab 100644
--- a/docs/THREAT_MODEL.md
+++ b/docs/THREAT_MODEL.md
@@ -15,7 +15,7 @@ Quantum Encryptor protects local files with post-quantum key encapsulation and a
## Trust Boundaries
-- Streamlit uploads are untrusted user-controlled files.
+- Browser uploads to the local web API are untrusted user-controlled files.
- Agent CLI arguments and environment variables are untrusted automation inputs.
- Public/private PEM files and `.pqc` files are attacker-controlled until parsed and authenticated.
- Native `liboqs` and Python `cryptography` are trusted dependencies but may be unavailable or misconfigured.
diff --git a/docs/screenshots/custom-web-encrypt-workflow.png b/docs/screenshots/custom-web-encrypt-workflow.png
index 2b36c3dbda0eba28f0cd358a9197d3a49f41bd05..9a423ed3b85b59c02abca9078d0208584352d930 100644
GIT binary patch
literal 94974
zcmd43Wmr{v^eqf3pdcUuqNIS5B1%e2Bc0Nq(jeW9AW{M%rF5rscStDRAl(g{?zoe4
zJpcE-&vU=rZ+CrRvtjMM)-UE9bBr;UpRBYfCORQH5)u;TD={H?BqWpsB&6$;H?P4v
zww!c$NJw{(UJ3ClI>f9`plB!=kfCk)Y?_5j-x5|-yu+1WWzf2wyJFMNk#5ErTanq%
zQB_ri%YTDEg(#(J>awPF;?U_9^6oFhX+@QDm-UH8{pnd3M|X&lf`Seb>(`u|ocMUM
z>+n@@T!iZX`vM7x+sEVYn@A4W$Y_7x-Xgt*_4nm8&kf?gFYBFezWDpnR
zQ2*YDZ0#ZX3te4Z4Gj$%FB%$}o7mXtVibIQ@vb*_c6RV0Weo*-{R#>SA|sV8Eua54
zm^2dm*Rf1ZO~u)1oW!K1^~nfP9_M*y{76pjFEt%&4JJ!ZNqP478$9H7v+Naar4qr#
z*dr!8fB$|<_8^Di(W9oxNnS=q1nv(kV=PV0iKZr@zZZ3;94jqS!KDz#>)OUk&d8Ye
z36n@%B3W7S?Ii{Pg{zL=mcOZH+uU7ZI+*26GvON)`m$UZ`#Rk55dL?~D{A8{x~zy-iHyw_fV9v$1hFJK|+8Hyw+|UpLCr
za;3?`sX044%lumE6H(!`pOq|%-P_V{wK-X%XKdWqDKI8dwYYW~wkjx~)wgJwEJVa?
zy=Y^$QFl@4nayGGhLN2SB
zFGj!p`Xw86F_dE>`04iSszjdaN*~$%e+TKMl8Y&_XpWkQqy>jyV-%}NMbzx*~^II50$Y
zbamNveCt)b)0JJ|w4bNg)7O`Dz+LvTw~<~Yq_UDzS*!ZUSq;UTDGW<8noYR;DWzFH
zEEf)I{erBXo;y!U-7npwqRRVV3}_lv3f^%9Char_EEx_Lmy~2me()|S*$*UA-rwIB
zCKANCUS{{;!T0KFmn@^v;#+0&S~X5tnVE8({pm8o{fsKlruzEiU%!sPQXVVK!6qG7
zo=p74X}gmojA5i>h$m(K_HBXjpnroG8q
zYRby&U%k489}^Qpr{($e>(`(lGh^e?5K2+g_v`HMN18tNA_=1=85wS!9b@29NzOjK
z-P_lfvgj0WFGsujW&*#OT=r|zDtkmT9W_0@Nt16c!BdTSRN7&-^
zxz6a}atyNN{k;{+Z8&{eHjb)Zph@d1_gv*BPC3OiSs{aC3f0UsU_yIC6k!oouDo4J-iL;O^1
z6w~hUilWRuU?lY6@PE*}*rB$fOPAs$&7R%FE5Oc)r}x%I->vl*E(e;T;B
zXdtFpT3Mypag_|79wO*h^974_&E%3rgOfdTb0=l^&c(c?V>#uy_^7F)Z>jI|^XI9g
znvNYDrbS-`bM^7KncK7_NZ0&9<8PT_gWJbf)
z6;(+|Nx8XZ*{>NY3a+EM;Svy(>36F66Wzwdtf`6j)8}^D8~LGXU14Qq)tA8UN&n>J
z5aE7)B4uE}Z=Xm`PQJ48AZdkBtGd|b7@ZCeAK%JIIN%j$Eyofq}IpC7v;Z-Ly4{%s7*0{wsg;!wE2+hvT
zRR|aw-bW#pbRhqflf!`f2`kLZLWeeN20fP3(F%nzFFnayNJyy9>h|s1+RW)&$Bk@E4%&!0bIV~A5p3eSp)2g-N$ombaRtL-*M^>Ru6
z-DC+nyuxI}1NnK{b)=_{HmBU{KN38N;c?#i!#tIrZ^6OAk!vnz98bpQ=80}(w6d3*
zlXDf9A3shl&=C#LH}6lwSN_I#S+&rvEISsbq$U@V;QEw-VIn^fLs_B0e=rA=V4-{bJ`cTNxhYBKE=Da
zX?E}4y`)K&@+YrmWi=|S0*Sbc`fiL$OGyPHU%%lRC7Z+_kMlPhJD8IlqGK8Nb;t39
zI@6$*=wH9CeXz#xX78LL2&}v1
z_qVs7v*ikU$8wcPbhsVw3|h{$$j?A9|J~KKNE$BxN;HUgfs{rfli$L^BH*4Wol5WN
zSb2g*H7aes%afX#ZcIpG@s}hVKUq^5sum(ck2ITy5La!z*rD^TwX|CEzX_tI&E5Ugw!62-?SA2+m&WaK^b+xt%h`>w4}R%)uAzW(CUk}@ZHqDXmo_+wL*6}fP7dU|@NGx28nlP89V)!{rcQqs7u
zUw69vE>BFXBcH~8Pax_YyN-r6L&s&iGhVtOL+5fhAt284IdJU}b-LJiO=HLlJjo-P
zsoB{iUth5Ulms&D6OF$qdTUCwTDZAOdTS&olv>6Tr{!onl!B5=VXac96-zmaZe_oJOKr5ivr7|d5BmTv(PdPuS
z+w-7nZ0s~P6mXtxe;VdE3IR(yMAo)wd7E%?qq{zyAHBVw|GOSMus0}Ci3te_C6B({
zHv2;O8-xLGYLUpEPba((1XK)(T3LCxr{^IRRm56R{}kU#md@=t>I#t^NG}gu
zUL9;sxF2oxGMQ&rSk9$+dt?5c-=lXfO&)WD*~(9!KCN*+bbx({scV8(Ax%$D@AvQDeuN_c`f=kw
z&0;H&3knJzkl!ZZ{8dqld)foZsp#M^Jaz4KZ>3^C4^y2jFPTXyf4b_AqRP%(h!bWcDd1_s9N*47pVK^GSBhzfMpFW*L4bl&t7p(j#
zTDtx37)+aN(~izq3Mg9G*yzX0z{V;rDb~7i!=JB8QCz%jXsEKh{KbnG#TgmC*@|*<
z1;s4g?VT7{w;0Y76oNcGJ;PJIi;Hb!d+3#v!UqP5$Lu%5{}_2EC3(i?NExa)sHy$w
zCVtM$+B-CqWa}p*JE>7j0O${PQ`_&~iToraB&w?4kB)Ab{qU|(m3;r+%uEXasH&=J
zu|3<+>)?3qg;FUkt;r6_FZ6?%3S8vm&zYGev}M>Iv8>mz(hV^&rLabXh5c81X=UPQ
zG8-CZFrFF}6c#eEA0g^abEnFMQP55+0SnG@q9q<&t`53aqhndxn{&Q9Voz$*fGh|ojFaGGv9Id_4aS4!_CRmB5LJ>UH1b0PN(gHFxn@_
zmgFe+@REPEwUKf-&948!Sm+dXF0lDcfv!+~a(;@fS?OYWl;41dVpu=(9~ThhQfEl3
zTwyUYPQrCr<9a%|uBt#=0uV8&ZArnva?EaX9c6R!yB1FstG#*YZv4dVV%OPzSqU;S
zV`ia2aIWcSF)`m;!vCuI>Db^AwAM(SuJsjpdHFE@&!={6KYfCIut=b$llahBY=lcm
zK|w7Q_uRFm`p1tSmUAM#O;Q>}Q|?=a9V4%p4LZ}mB|~wb_mr7td9ZlJIwRlh=RGy6
z@BJeqDss~N1fHJynKtEN@Ts{dbx3wncf{^zC5eZpiyKX6&fD?
zoy#0Y?+#4V`RSpYy!^Wb1!ZOJ0xL|0M_gP!*|#u)r`c@hTKEW_oNYs%{`2Qgj(W*-
z3!72jui@d~cQ}8yQ$4%(B|b5p>HYi5WE@r$j~|DlmYI#Mtd9Qb?d5&?R7*r;F)xS9
z%6fOX#BiGl6Vo>8O($XvAT5BY!NCD}h5p-^d#bh-emw96_`Vu2DdP>-nfHS8BGtgI=isTI;M#Vjo?-P~$JLdflL
z#ox`E>+A1dYnFWeOe6S!$LZ)Yd$RU;uEDGI#L3BY
ztkk$Cfj1|FDTvvCF^q$tjG(}BJE_Lk&o9SegX2=OT<${vL0+lJ*l1T*nwu;2=y`o4
z|KA<#;Zu9zK?#FZc-`8Xd9#;JTwENujF}mnUOCS=)+ZgES|~oxW**-b`Gh)y6B1??
z!|S>^vaO(ayjw^%;+&AGs;(~mU9ERlRVJ2Klo1ni-@J}wqRKwFT{$^uy>Lnf%Afd92+hvns+Ae@n^Zd=BL9uZ)9G}F4Iz<{
zqR7anl7@rD$oMkJ+35;pxeSMeMMa5Gk^Fg_wyV>#v+v)@8*Ij`gyC^JFN$&qNK1F6
zyqf#*qj5Zt{k5#{`7QaP7L0Ra;zq3`S(`pw;#6ExUZs6BjZ*T9Jw>Vi@bTH^i
zrg1Ocj&rfo($iO!myaY@M3o!QVjlh3O511}oNv$EfN`?X*B^?S8aB|??a7Fb$cbTg9<|>!
zkUQRAOTi?%Ogb?cHY+uoXdEn&)7RIJS&sPfb+)hj-VB}4zT&jgG9I4z4R2rHUv>8D
zgxnc?_K(G6Ww$QQeVQXJRtNr6+Lgkd(`lqGJ*%11RugcvJ}+=%Hr*&MpfqBnS@@Gb
zBZDr~rCmOr@=7P_8|J&(TDKp>Nv6q?^9LKwo10Puu6*V#9mk5+yF(Kf=ckVzJ?g`G
z^EV%!J$hW(kofie`}aVCM}>$HywXtL?AU%!5IK(vPwG!Q8i<8zATyh3z-2O&E+
zbjz!&KQy-cCtcCv~Y5Aj_-=|J=WCJR8ktOuYZY3CiY%(JX68Ie7suW1ob~|lr+t-kY|yRwWVi9&-_at?l&+W4&^SBVo|B2O>{%t{ar%gX`S*_r#j7`n9|5j-
z^5h55YVghLl>LK)8$F4FhK4jbVSm#+QkeWgdWLUkM1-BC$t*krN
zw?Itt5V086D;XOZ#d6wmv#~L8b2~KqFZ>gHvX-y!HNaW%^%-)MZWqVtZ8GM%x*gLP
z%nn=idhHQefEtV;9NorTlYQHpgp!*Zn3<4~@xp3;3sR(m^J&j?liwTxgBnfLMOSQ<
z>nYY7_--Uw^s5x-1`#Hi`SNyFb4SMyEgsR{hk9r@I3er(z)ZCOanVk+wz>I~ccjPw
z`{}f-vNFNtI4cXwKR`JQ{U2JKEH*9e6OfAzfpwPw%m!T|qOBHQ5)o(f^Yd?XbQDxn91hkioDVnu
zp-28br#dV?zRq%Pai>L|@_R#M3NTNzUI1Tm)XQ-5{DOlIw+wUA(xM_o<4t+5CcuME
z07&(EiHeE}`qw|QI>Ol4hG2j+IH;+Y7TO=u-M@c-4>2{|)>fFGzdZ9(l-+#NKQJ)o
z4S7@)VJw$@VQFcuQub>&Lq%oecWC;%caIE0VC`6)xGNJt1sxO=1XU!n?yol(7y--6
z%a0}83d{27si~=>sDKLQ;SqetVP{tgyF01D!=oOS7?b@+wjWZ_L!D8qp^=fvzk%{4
zASETQrD0}fh7602)kI%XT)a9=@CXa2RY15u?ivmgvYXA%^p3Z+tsd_#4d+ccT#V;2
zF&mqh^y3(g7W+BqNlMSF7s
zyc!8RV@cWC!1DlqbX;w`lAof1g!Hv4fJEId4Q5$&THTy?=2!Z-n4AwfREzY*_G(t=
zcHh@~G=w#tm4%Scs``B#D?{w9^v5e@@Ozsx0?|jxtwgneE4W%e|(+!D3=!K8}cq
zk9VJK`VG|t<>J+1A-qPia~)~m2{6W+V`VZc#YqO;n@~eWW~8+2#&WU8#I8lg#eMsB
zf2zW|=&c~ZYb<}#*EuJ`E|ZOo0-K&FIDQgDzY_S(c~HakIc!%YGxdtJ-Hsi*VpLP(
zp9rdU{PeNMynTDb=jBXeg>|}kI?>02_Li2#m3~p6UJJW*2ea_q&r4EmD*2(PKHXni
zTiE|{jq)l^%U-_<6B(-dol$a=G@_zD(y;X^SUN!R+Z`n
zrKXiY6cbv=)pUN8);r*`)|(#7RcGt%Sym?VefZ&LVvd+_sQz3JH{C~^*I>e6l-h6G
z3jt>*0~C681kUMvOE4L`%TbSidZtqL&`N*n1GtKpm>wW_c|_8@D7V|Na?C@%K5027
z3{Xr&L}cZ}ad*+T4dx=;aI9bB;)3xJXT_I@2(2nRR%Zgax^yo43rb5$$vU_5CN!A+
zX0$T%%c>3(|564nuByEer~Mcp?lY#>PPysmI2jpbT%b64s?@jk8<+8Q?W<5KU+g}8
z;EPsam)?!_=!L|d2j2|!_v0ee6*XSH`dz5k4kV6|mV|^l)jHAaih}vJ
zQKjt~1sxYBr?35Y{y;n9f+8!~QOKtwnkjaVkmA$(X=ALbvb@}y)GW%{PpR)x)nmf;_>*PLww
zF`(rHyMs}~#B+r0&QQPX7$?#18UjLBx%x1&Q6vW^m2
zmcreuiDJA*ii?3HTeLpq{?f%_ICo;A(iR`n|0#NYNeNE;dT(;;-EQ>nFD%=>Jx><$
z0v^C1RhErBM9%_9(u-Cy6JhKCrPr@Z^Yd@sx|L`JT10dD6T}4`mDsC`d+uN8gr9NQ
zt;cX!S7wOd4JpdJeLM3*^|J1*sDy+`y~hP4EC3N|YEcmp5$i=?mpO}p)xGN)DP|KV
zKzq0O{Q3U?Qdvo?2jGcmbL?xFtwDEXg3zn
zsj2Z??U2&qj)cj8+EOi?r>3Q)h0rhecw^2FH@!{$Xk*O&k@2HV!OU{!0dYtsRb~?i
z&{D!0^BGYWWbZmtyRl1sHzatfUE2s(fK;n>B`Z77Qd1j1B>S=2CPDm2>{X2|wvL6x
z&Fo4~&$As7(~t?6NTUz=K#KwPaH2c$)(%mMjqVkZ}(7>RTHzS(eTyF0r@(p&ww{IIh9;*7v
z6uF)Tp-1$TTh7rd=lTza)%wr4_66Q!;D&Ymx{_BWqr7~+|FDYu>z6MNe6LR_gQ#^Hjv;8MCQrx355-2h-6}we5A^0Ez1$)6TL&P%s+E
zNLPhyhK0JZTrU*Okl;o-w~AFa-yUj?SGk&$H2
z->Eq2?C$IwZj5zL{v0h?gKR)g7#1GR9XWu(^%ZPyO`4bmwsj(3h9Fzaj9IMoPa1hbmBDS(g_KYg%Kl~j1N`}*c%rgcpi
zh$ggXc6(eN9MI6?V2!+qAA~rYE`9D!{e;;-+8uUki3xjo!(!)za^8i~fU_7}fwVN+
z6~;QsBA?H5|N0F?O|8xLkJATB>s++tv0@N02*aJV7Wk+nIH
z$^6p?d!cQ%y#prD{i2b}fSrY9yv!WCWb$#TPm$%^r8)Vnn>X>WWfhf_u3tZQb#)CU
z2_L`cxe|s8P?h^nhJs
zc+$~KeX!#c6&Ke4*NRkY4D=MNofh4M;6!XH;7-HW-AdmIplhbi5QtsmSf2`zs6sW}6
zoetImE<_=^Cr}+NBm00iAvah0d-^c%a}p9$M@NnWQWlm0z?1ip>X*L6$9MDc`VH*>
z8pkAL;dI==D+zs^_T=ePx1%k&xfUr3%4DJNyP>@->zWWispJGPDqN1+xC~M}bQ(Xt
zx_gX~v%UVuS}M9S((UDY0DH8H885KDTuGq7F~Jh@SEiy)2iEyD#VHLPU6z9!3d-@_
zG1})Jn(m^bPjaUz&r%S|@fe(+1Ol>756;|k>kT_S*eEN_1x~5?YI2N`GTZhZG3Ek)
z0Hq7?s(g0qk1)I9`6Q&J&5n1pSE5w|?sck{zQ5Sf>-lh9)G+Mp*S=pNQ-Hjm&9GNA
zH4R^$6>%{lI@zngGpA={WLW5(+`Wf`^UB&%8*#F?Vq|V^f4o!Td`Q|OkR~1bkde`S
z{+FfuB@$gnG`oU}^K!sGltmRzCkJ&_dJm}gP;W2m7#Tr9E~t0XR%JewI5JXBw;?f6
zS<2&VH%IzQ^weslZxBKN^EAhQHFfyhy2eyX%csU!PtV5bX=PYJj@?W7R=FA#aG4La
zthZ-V69q-X;+UR373Y4+{w$*t|NZ+Pu=^rILQ->_wx;D)3b@Ta&xKuo!R2@7lbXDGkY
z*)tL1?fDCQ7%ee*KEsNmai|{=u?S2s6DzB}r`w9ax2?v&=Q^KEjE(#J$}=(yadCBE
zuZ2+hoF6Y8Ty`*_?z?GScu&(3=I*sjUfe7PzLNGfr5q3}n%
z7oBt46ckBKYZ7a{$@H#=sfrXVERx#V!L`?5DeD3e$;`w=U&jbSLBe5u{X$d?CITc_x43=09=f(_B?rb%&exfK;gVq)J6jeww(mX^*`A1*bY(gIv{cMasJ(A?av
zwc%Ik(lxf(%nS#4br<^KFK5JRoPrdOmg0FdzA;(OUKKL-hx$w1+FA3p-@Xkbn$N7P
zte|0|=PrVQrlhC{=;o^uRF>!bWS@j>J(@{$qV6)m30wCHlX(#4wz*n_g@wWPk@cFY
ze+kYB&uc*QUsF)Pg$Syrml_i@-XYmg(x51afPB5Q+1l0Bg?0P(-9d?IGt!Xqfj>h-
zY5ZO%VS4N1w0~No;j@yGt{rBT+harK+KUSd>qsS%?CBmSamrIjw_7;$zI)F}Sy`Ek
z)mWuSKbKMK#`4I!4F3OH7=VoUEg-Z>+2PEhgq`
zM1+}GoMB5kk%P2%Ee2P`_BtI4L(@Vm%eM>|OVD4?$1W4%;lP&=DkemkkW
zTqsG9m4cd@-Jt7suFKB+12VEHtJ1Is4<7VzrQT19`uI_ZsvJ$dXy;Vmd21k184ve3
z1U%uZFb^^q;*WI#Q|uBl(n~$r*=m3o-WUY`NMjzxzz5;nKk6GS2}w?_f!zk^OF=<_
z7SC|9`n$zIbX7v=*RO$rYZkvzMAg-!&+S=1`uh9($HcrLYWztFayuzG#?ay^YUc4CCKRCcaRCrO%RZ_ZAZ;IS)Q-#%Ep8vBm
zhZc7)8AsvRwIKhQ$w)r3X$P<}E1=!6i*uGI+(1Ignt>Y2semqu)AnByk4Dt?S`g68
z^YeJynjMoDm|PglDf
z)3LIGYqH38?OxF+JiG&GQdw*k+t=gNwueeC+XqXX#cl7a#@cJ}1ot3xF^@3w(!`sZ-5Q`*!G
z+g(+9hP#JK(2j|U=EGDVP5*6cb|y#N9>_qDh6i&@vQtvNefd)EdMfSbMqf_dqE$`v
zixnspv0Et041~6um8sLI@33QSmeP3opLY7jz?Z
z5Zp;SC%R%d;^X7B2fYM))ep^L=TPqcd)-&X*U^V4-#xdBv&T;9vI$x|XyP|+-`*p*
z%>S&^yY<%Vk24xEqV5hzMWZ3=WeBse(oj@NiX?D9nNQWWW~Iu_eX{WdjrezadvwET
z;?U_Tt2-V6ei62imX;f+EMX+?M~fR3cq}K`h)lAiUsz-UbudP7!?&2
z7-^`}z!XqEgTk8yBqNvx!Hip6%)*J&f@FN(SaoB}U5ustB6vztO3KEj7~-OEIB1wI
z6%PEO>H)XZbH?Aiem#^bp{#0aDY1L#-Y_i)+$+cFjz*njw#`EN<@ZY_Y^Y6;s+H>j
z4#66MP#`r`fqVBZ$QBsr==bYIDXFQ`DN?etP2Rs>Usw?4bH1IBR_TmLG-$QM!m@=B
zpnQ4IzQ0zszOeyzCd7n$xn4UPdTeXZgSQ3-f^{#pw{L;U38ZvfP*B%Syt}NTV#=S(
z@tsy??Yh85=2a-!5Pg68>tDuSYl1M0m@LvRjxhgp+s4*ZjNc9vpbakj!woLQNr9&Q
z_1+S|kRXMGNt~Rb{g}!Zo_!r<)K4{JZI#lP5hCb=NmBf-*_gpJ$GkOA?XZ<9O6#3b
zF{V@$OVT4Aa`F(n`If-3ySP8ptNg(g6l`0!u(Tu-#}v>8I_mO3=JgFlKnoCg`7TeQ
z(G@S-cOFA+pP88nt1;u5&La1=FfHAc+peK&NCb-a!hwmZLq3q7*Ng}t_LSQr
z8XCM#`=7QpHRWoQq-jgqF4-oY!p{R>Ahvli0b$%)e*$7Ic+N7eEt^`m9EpHM0p{;aNv7Zz@{F`UvL
zT1N;)i>j6EB~S`_gGIUr`?I0MvU=0!2cfaVB!-ju`CCeLxeGxCj$Fdjau+IxYYXke
zSR}kHB)dOFgANhH(QbI6fpHHnuD1kE6g#e631;NQ+APDr6%3{vS-x$_(?(?*DJYv|
z+g%hTpR>>Xd@o#3m1#r%43y50c|qP8^ftE02zjz*!Dkh{+==OJyV}S^qw(RA%6CqM*95GoSk=
z0&(dX6*SW=VLR-0kn7IhlKj
zGWtifu}U9w8m4zm><|o~Sav+;^eg>NTJqA4ygjxdC0wD|AvuD12J^)KzpB08(OI~ujK>omJYg4?`9ev#8`hd?(
z5?Hk5FT4&%-%wX%t>dp9&h+&e4>KiQ7e)i7yJY(f_n#!i_3;nsn()V-%3?o
zt|#fdt9EtCe7XH#LqO4nMH#WK(LK}>Wz59P3@df1GgfX}x;L1UK|@eM(58b{HQ~&+
zRD2d4%WS>lfkI)C_400#Zi-BNoT*xw%Tn*dz2EYcGfRh_yyBx-C{vwjikesJ4U2xs
z{$qHa_LNqbOK&${D$(AqAX-m_TMbBqkmCS_pU5RXM)UdD_dMl}5Q}m&8-r1iELc$YpL!rw4l*P#L&Oe`{e9y@=!=u5h
z-?h~BK>-03NpNtgOl^_GDk($unWek!p?8Q*rh(sW+N$QoB2t
z`Q5)zDPFdobV`oQ-FnQr+Bjt1j4@yOf$18ZY~@>BT`^HVqWzzTdt4JFQ>+LN`*
zD=Ta!tAr#ZMQ>(;#}hAX2fO!ZiFusl_h$Oggb<38wWgsabDzdjS;9G9;M1GCKfZy2
z!g#r$OecG`-QOqNxa4=kc5~o^)yFw%X)-RV5oz!$j2<#Ar7Dnv+eVK64DFMfw0^g0
zz2+J}-=pHkKlQ8A>r4Rhs7I1PWyap2kItEGTG*31D!wJ^hOGq<0U54
zZInQ&h?ALp$L%*)b*!V*(|RL@krJ7~_|?u-y`P`U?QG!rOgQ1e0SrVJ@r(SaG%0tv
zh?&(on#Wj-{&_;HAN-fjk!?abCoxhXA
znpq)tQOQCKxUKg;a#%}l1mJ5vlA-=B9J#IhdF@tsmown$%cf*Qwng^CKJGR(;YZ`|@Bh$;ix9%2!B@v?ypiWyK=pY{T#C?~mu*H|k4y-u!r7
z6C5z*HeNBjuDLP@(ujMD3sRCHH?sE-V%ZT4%U;fBBN7AsbcfD__ejY{RXIz?%_&kt
z@hpmsS1jk3Z=F1cOk4Nb&j#ix;ZwGB{mksFK#n--mfp>qHxuH2Lx&Nw2cbt4rv^D2
zTTmb7W(Nl}5U4Ar9VO@Ie<74eB8-Z=hJ`!F*+8B+i&6ZHfMqgcqFI=lf-0>AFIkqH
zi7rYBr=&-}E2h!bzai7^hLM?>2qKo7t4E@Gvi_y^K(?@vewruMyReZ61>DHe52L@w
z-vHcm+`Tv$tISlOE`Gnl&&c`7rYpW{vd;R0qyu*Bk(H2FQmd(AKI8ZfCFNzEi}^v-ozO$Us-W5WTsj#&#LPC!O!oq>DxPDap(`T7Nnr
zRt-rG*U?AYzssw?T8W6eL$VP-7R?@F$XFcRSHIE-=oA+`egeD0#l^+I5QyyZU^zWx
zR1ORiw{G3KJ)JGWu-dCbRVXedF3rZogvS?}mz?}loOSXet0&rBphUK&6Ln_yffUdn
zK>G9vRZgkn#bRf4WYl|tL7sewBxSHzf^v87?KO2*x$cn{K
zxReH|OQ3vvL{(eyA>?#@c6P1;i?xl5(6i!W9W4czI>7I{kmHH*mF}2pc4POmz)z=r
zV%jPW`wI$O5pEkKgKkw>jk8N$A^(7>8zT0IiS%Hviw`E#8jOz~DcZPRd0oQN+hRW(
z8ybr3eZ=1S)7$;%T$c&y2-`leCL>gU(`bF(Fg`k3B0af+Q0_V-Ev=uM7x0HL-CsWf
zTh7frJ}@wFrhPL`zc1I+r1xFAB#-&?Gg6J(GqBUd2{I92X@6Z@_l)YadkNS4H{)q56Tsz@NS5XEruK7&T
zA)eM-8y~@#9h2V3%ed6_Jux>|#8Rf4RFjs5)H;zl`!NzFKac`<-T6d6J
zmv)_W*0iAojb%@7?_%3i%+>xI8s_DCPD=>ia^P#u3TN3*SRo4Mg@;cY2SIn(^9ChF
z{iImafs7Acf|_P0VB_mK?Md`nCfL{sU(-mw(d4u#TilHQ^J#Z}OAq|fAn58K
zZN&rSVzcv}@BPRdT!p!#qmQMgYI4gK%UjVVEXyf164#f&Z#`aXdsq>F*({;F9JW&!
ze{ZVXQbI{8P_24^yUJpQiM0&SX$I{Jg997RV~y_LA=11G3Na?e;!lK%SF5YJbJcy^
z&Yk*I?ZG&l>G*m>T@fY&Y@^X^wyB>N!6!U46rm9x)G8B`>(Bxwa@&p3l_fnsjViYy
zI|fQ@Z2J>I@>Q`U?t!C}&a@mJtN9l>sn!NES@Wctay2Ngt+X@ZD9D#i_S0md=a()8
zwj6NOO~f;oDW}a;9OAt~zke4#1rdwQv9Ijn0(oPsEODj68Xte%TyMPUGGC68z$xca
zhn3-DRf_N#Cqc;gIQQsndU_1wv8hU1<+H_*)eS|xo^H|w8=E)kP#Ihs{%MFJ>LqyP
z#7zQsPi96|vH9?)gS8GY=;nCZrFc$-^wGT4D0sI&+dS17%j`O|j;fSV6GHQ(aM9<+nT6(dDHdVqK>FbyqBNGB`yE2n+~s-@2u_
zd-|!bo!0I2NH!`tAp7s
zZh7(=nkNZte8bLSD5vyla^G9U6)V75?Ci{?_Qd-gd+rp-aKhh_(Kwveg%DaiG~(^Q
zyJoIoZ7*20eosHXwZG*)W!FVq#2HA*R^{QM=;Vt!EA;+|)|njSjpDOUb_^
zPy17f&!r9dx(!>X)f5%_s&d3mdqQnM9rUqd6K
zdw6)hq@mjvdwVtt^70V8vRMdBMWCuuGS3Asy`1b9nWx$99jgqo0w||RkbWjawiEBs
zBth$Z6$P~JYs%okE@JUzfX}3$fH7m3Y09YVnbrNta>QULQHK%`FBNNjR
z^W1wUWQMXuZXG`8{KWP_YmsMi!$%o{ui@di`%7vM7S4kd!H7(pN|$Ot#_MuZFO2?m
zuG{vk)Y9f2kq?(Q5IAiLvFRBw656tJ`5iW1w`7JT1{8a08H)T=76pXF`F3Y{{5U`V
z__}H;648UEk?;}yAeC?hHG8~)7D4?%sk{!~H(18P)>Me`k^uRS>Yt#X0}zGBJMk7W
zT`C*0PW=Lss}ripCeVXWaVI4jRR*7i(U=Q|^UEbPtpj9YP-8LgZPeV_njpAzw;|~R
zE2RhemCXprV--qfm9w8RI<23JOACR$PF-HwSuha|ihC2UF7S?GitKPGBP77bM;-i_
zu%h+gBv}qnR%`G6Bd@}*2~^oTI`6JTj;o`V<^R|H&MQYoywnv7gK~LQoVZok5D<<6U6$TvP!XXw{z6faoC;B|I<6aHJ^2f8^?LnBV22vg=RVmx^WsciBX-QK*vAXY*XK|F{4p5ZT$x
zFLt~6%B*yt!XbF_4H}dM79jdVLpG1|!RIz`lmVM70mSdn4b`OB9(;>2lE(G-k~-8W>mi~kfGd1YoAy_s$YC?_cB
z<$8LNqma%P*w@pOP+(@(nQ;LsG4#2EN&w>8e1ws%uA!M3DY)^ajC6F)JJ|&(C@9X(
zwZZ22MEgRa#%Z5s-vQL#f;;$|6II>+UIvm!Jg;UwSOcLOiD6qA+O&jqF3;`lp-Z~T
zW(8s;f7I6iy4OEcp3>8wPS{T!ZcgNx49C&GKBHq`;IUoB>%9i7hVcIGqHCF6yS8F~
znK_x+fG^I^Wl**4EWKEUTLPnv+IU@0y1z3A>uc1y7|F}`!K4>@XVf$Nw?dAVL$w;@
z_Sm*JpOu=ON7F+^7;|e=(nuOXMb!eZ5EQz3=tJAjt8wM=XD)9jF5VLjCbfo%I$B=-
zR%yFI)1J@({k%&{OW=cxAW~OR5kp2(=CxiV?ljcZ{YMmq`-T3SS6mNFC##hlb$|vf
zzhbCX*%)1b@%{AaQOKe
zK}kg=qM-1zITe{58fyE&)&e7w-Qh=z37TkqZ*QVRWEZq~fw{_01bAWl<(@ctt`{Sq
z)V8!z`?gqN%l|iO7biAl8K5QPXq{&}bb>$%jlh}>PqLNsCi34-fDaS=BE?~NYePBo
z-Z-%57|l;KtL*Yrwu@j1%axJ53sAFN?DzvBBPma1Zv^mz-r4T^bR&N%E)F)_NqAl6
z$15+|KT9
ziG5R&i_12L*^Bfq)JApGBVxJ$XzG{gDIh<#mmck5gR&D>k4FTB1DiRamGAo
z9RJRsRxAfZc7HzxHZ~(qGU%wykC(rB4UdnHgNr~rRrS58>G|2&KLRHb($-XZmGFWq
zXs^}QQHa`TaL!Q!k2{#{&S>okeaKAxm{iq2y#5<&^KHuMjL!{TXz&b#%`yAwy_KTb
z{XA`IB`UK2{^jDt=^7SwI;!3f%$eWcck7im0^B5@{5ysqWBwCj|M_h)+o~Q~Hoz|2
z3V3FZ*)Q&Iz%(udJsTE1?Caap5(0dod!c`y0g;fF1?PZr{o_XmoP%cpg2>-aLEvtP
zEo7PHMMOR!yS!R90G&Vl-%EHYrL^Ed$;+z+kO`s))MjAz$Hxb`7x&863CDoqprb!L
zVnGIO`+j}o2RFhM1CWHTj+dCPV?B~VGy(7ndHMFVb+XM|Z?foLD>3|sasFTL{fign
zVAL#EM&TuplInywhKhpHD?|Bjyz_{Xx)Q~dBEh8+5Fi1$9=1n>EI&W;^&>;Dd@Fv0
z=Y)U`2d>Q>-eI$m(b1FRLazzxRxj9O;UOF_1T}8w
zgf;&E%5NUOoKc8lZjfJ*FjvRccg3QA#EYw6{tuejmQqOgIg9FAAch!*9%P#Kwo6Oxkp4~0-f5R*IXf7B?A)^owsk{&83a=
z&&V#4WoDX11qC>m`UVE4$H#}z(@ah6ql9xlF27a)f;g;(z8v)>s41ZhtD*roc=yW*
zWoV-0O*`3NGcwG8#?KpQJ`wDg=d}(_rRj~Jr>`gnBO`4+$i2EVA86v1uLSk)4l(i9
zZ%1k(B54NQW{Zny>&c0TS@8C-8P7K&@iJ|GWIJ~d6>WviHiZ~?{zkHTS#D9*SpM67
zFmH_(uhb*e-iJ1el)BU~GhKcCmgZ()wWGg(hwu~PioC3id!iu2DE<>xSNA`rHd0wR
zIcSbgYK-GK6%_oL*;8RH3SE{!ew8;2<*2h6%F0MdF@UnvOPL2<_hDMTH8q;iY&jrS
zfnq8kAP`K3@iQ_E)_D^A|PHPYwTW)f4a%fl>EVgo^ekW_|2E7A#iVb9K=VPYjV{7x1
z5Af)bSm;0y+E>ogDl9I3;eIg-i8bQMF*yfE1;1B|BA?Cj7pMe?9z5vHTuGOyLBl)&
zmh=)V+@qtT?U8v$yWKg^)9*0&S^-ZGAK}=aZU*x-r|;
zfwUW2zd~@KyOfl4lSM*NaSu#OE8RyaucorHv!|-;>$G^NrKB*`8pG*_&(5^MCcpMw
z%J=Y5{Pc1E8A!t8Hq*m%BOox6O<$Q1Nq=>@Stq*X
zY4H%Uy-!F>15VT%lc;pO!aAPrN&?ObhkS`DC4vAN@?gs%R0SS4umW|={+Ut+llKYj>d
z=7Uuh^qR1nax;zIMSEW2e$h!u?_f)OPcSD$aXzhNaX3H0G?tYAu!E6>7%gcxugl3&
z%D(r%czf@7to#4}TZ5t@S=ncUj8L*NlTg_svXktL?Chk0>)U^&F4K{h7poR$qNov0<4<%uj^=7Logz
zc7_kbGJm_4>N`?G0rRuvdX_nat9i$Qcw9NA&}p2f+L~Y3v~KrG
zl!BBq4sDaKF)@>bl-%vo+0jNPaUoOjw-IpX*j6dt&YJQt^-@Fz*YlIJzyX9@
zGeQ9;yYj57pAD$(0Y5^d^SFeli(q3<&y9xXV+yXxj~Mt*Q9KXdLmnK*`%xoq`s3b#
z)6LDz5s;f^Dg+ft-Px(tAY{|?fOM)w?bb$56d9}+^9W;J+4gUPp7V*8gnu;!^cwB)STB5e|t8w?W{3&`IvnZ+ioSjh9-LJp*$i8}rN*
z6vzbFH_l%t`-QA|j2aR+uNaG0%Q`S6)vkv7Zhzd;EnU9H_`}|m?W_ayN}E$~Mo63`
zSfv=SZh9_L<4Ay(i`JlMqR#U;n`3}(3DlCuC3vHk65vGCo3f!@Ias&T`jf{LS61qA
zZ;|SHB8d>(5*$Z!lljIR4Hpy@ho>lC2p*yo+{6(XF*9|LZPfqh!?#fT#mWZJFOIc#
zSIaa}Pc2T0veJB7|6*oha#M1qrv&+qk&#i4B3HIqV`3yi+E<3<4b9DOQZLK|+AYse
zkj#AZyLS&)T;-Yer{NJ=yRZzMTPpEOYlSRJ`9-Otih{>itWJ>eo=@0dp!!acw5jQE
zD!|-rcH#~x%c%zHOPlhKL*_IqX8RYZZk7uibl67Z@r{sE&iI6dRsVf>N19B&^CZbi
z%SFR*$QvM4;CPLKa-y3^xAV7mtm!E<`s*u7^SxSY#T;m|*1*kN9e8$%%?{-jD4?G`
z1M!I+VF9#XIXiV4@PeZy{p~M>u*3`L(kMO=N%%uW3ZZmTavQni3BHpjNBhhBp%IIb
zSb+Tm`Rq+6>koeGyWyj5uCe6YT!25@XI3tdGqJ?}C6VXr&2e58;<?A0O#c`63y)a^;!&rB4WThzQ|2IpU5M7xfi-5#tY3D_xiBp?Gpy?9Z*`H6(!p
zeLs`PGbKW66px1rK4v@~w*Upt5yVHBI_&JPApEx3`=
za^sAMNE1J*l4TAfQ`k-gZS<7O_bW6d+}0X%=yG42h?exWc|U45_-`#Bn7J2~bc@@B
zBh~^ZRm09DkLV@C+A9zxtFG<
z;Lx#I@jgfe^5~|3aHObmoqDPM=q{@P$0o&g;4}QJmzb?^q
zyrP&Vmfn}AnjkCYxia5vd%THUQlN&tH!gM!0$likqNCL23n*2C3i`bb^Nl}B&Kn!%
zXEG%*z;vme(h#@%jx3X~-Gium#fQ#2>ej*;PFHbX*4t~k*Zr(yfFAiJg)iQ7aC1MK
z`RMieX~w)ul&oqIDsuB{h5a=lW?weFkM^xhvXj?W`?(}Hu~^rtpZ9crpfST+4Z#xo
zMBFWCJRjuA!Ef+HDn0S~ceHxPNC8_3>85m+of@TAS
zeC-KNFCsr^Dm`!Wc$S`$Ib?7DHs^awb`yux^VWNfO3KQ?e8QGiZ_=}0zlNYc=+Pr1
zqS!Fhbnfn%Phf98%tN_2e(~$BPIZMaKxG(ZWbU@6G>W^;pV!yVsFNHT#8!K5P+5F<
z490;R@gyN?qJhA>y3q11AA=nB*s)h7ZyXzfO68$=JR{F$(&+2Bqim=DxmP*}cn?+3
z{w0%Iry6=x<7n^SGYyV+!ZvyDR>isnyyKd)CBv%NGTkC)F%);5xuCDVkCuHK(aC>!
zlWR^3Kb?>Oog2MQg&!e&{qG2s63yxwG(69cn>2(0>w;3r9bW_eLVNKOV!oc+Py!q4
zg<$R9yqDY)&juJ&X`hllYmMn^X{BUFXGH0$yIJ?lcZMI}+RGsF;PAlK+dvYMp-g3W
z^4nboK#yql;bBgaTjDX6C665(($&zY>I)7H)d2Qw2hsASGs40riDKsF=D4zv@<(o)
ziM=f~$u~Z`i?M9`@cOo0%Pk&7KGI;hnEmYf3i48ORP5%S^fzyF4xNk(j)))}Bv5Ht
zcW>6z)(*1$ki}zgva&PI4<3T*sw(V61Y0~(B*??T1M2afxgagwTc9*acX~wq*}M7z
zz+w>AXOEn?ve-HZ&VY_;er7ZRW@F=_{VZpuCf60@uM8)C^6
zJ`FVtP^zn~-Lg9KP5QctiMRGF1MR83h;`96g{Yzz2oq=#`F{p4M0t96
zSZK5+!=&+WX8wjZbdU6PSPG|?R#ENdM74f#v@b~}@P}T-x8@SMQpDszy3tU`BIC%?
zFTZFaC$~!1dYqg=#I?G%y?e87`1`Q}$G^$`r^w_$!U&?oeCA)g%G1egA8>Y%{UY1H
z=wxw{Pt8s=Gbl)anDK+tPo$;}VX_Y37G
zQ+Y2-c!xyN($LtCksv&i3d8(eeN?DdY}=-@hL~==Hn0*PZ-)0{ACYDGCZ6_4;Ce3J(ynE}hx2
zKi^dGtG7`4cUY55OtSPAikElZx>Yz2jcP(h#^o9lwfIwxqj68UBge{vpC%W}iq{OpU19v;5S
zSN^S#tR0)PpkL(HZIG899>y>&Me^uKi>sjeCS94hs%G5XX$oMMIGLOPqZ{8dO=(E9gn=~FRm-S*^9-f#FI@-D&Y5Lt2
zXC=YfJT)tDCsImFOX$?8$N${AP0x6=;4WPnE%huG>=}ShqpXoduf&xVB&(ORAO{(L
zEQjUdXLISEeSn6c!xZcOZX7vCo^}5j^Q+~V`l6@48LJE0_Fby==wi;`ej)I1DmPm5xCH_
zy!ueS5!zHl(~3GeU0(_w$<3MGoF&D5<>KKnCGxoAv%`{SCu4;i^pkj?L`1r3YB&hj
zY(N@9_0NrsLVSEPOXOFHN_-_y-g70$N`EYH*Ny>d
z!b!Xqmz6a#_VwFnbI8_98FO-Qd@Zsz3+G{KZ@*b8IYVlrdOLDYekxIUTe=B?0(ii-
z3cV5%+S;hfKL^KWp<6rtHbF#ADE%U>%`Zq4eOm)cP#~keJSMe>P
zSQTiHG#vNt7$Bv?W;a$BE^NQ90UAE|LWz7zakWpx5byJ81R
zNr);r`O^BTi_3UNSS`+Ipn2nI35T;Q1O6qm)bRur2fU+!$3LC;L;#!Q;*$5T?aT`C
z+V~ybou4&6I!Y)N78H1)J7@I%UJJW&W9GMS-w1E*>|VS=Sp_w2vY1M#k}S9f(_>#%
z2ivm@S?KZn8M~41-hI7Yz;))V?exd_bgeAr)t?@{?nsnWZXqah-MMwsN|cW$ppcII
zCcblS#CK1)Y2CBQi5_#Ppq=r5^a;
zAt%WYys~)$S0ltM?UTjZ!c
zHY|Vf;`(BDI?CZHkNyTSGU9VvS}W{*7HzoBFd#R^mS4SgO|9HZ919p7O&HDL&uzYf
z4M=ihxfd<3`U~AO)YJk-@2=Cgqa7Q>uzA4dOGBBbJHw$vj1nG+=zVF-O+-w8dTg9}
z)}nf{yVHU+n8kha%bSoWub~h1*wlfS0sNA=z16ho+UIUu87#mjo<%-)$|fGsiTCvN
zDIuVG=^w0orPS0@P3_=n&p!cc@g)bR=?)nKW?Xy^GQt8uu7mB>({sHgfk3>l?xM<6
zctJG$7dRu?%CQ@$iJosgL`MgDo`3R-@)?Dh{G7@>Yi~8*iuTrbyY|t?y?lAv>E~Ym
z%M*R;*qpEe*fiqG2OY?5
zZ~dsN$+H#(KDl}7q*4A+emZJ)x|&Abrna^NGSs0iO-0ZC`sKDBRyt|!2J4aCb%1L5B1T&KR7!`}WRzYi}exQgU)@SbYsU
z!FgU1qM4+w0t>E}JeKh&EtodH^jr<#;ZN$=XiE!8J3vc2@}nc(d$SVHe_NN~n`?#3
z*Wcd@>MC}T)Y{lst&WNDbFwK&vtOa;f9N#c(Q0o#sc9jryS8KEWnF9cRPf*Klico}0w3^v5Gm=$O`H%LzY6A=h8%p`%QE;cjRs)g=}%
zDyommD=1Lud(%=p-@;kTBrtNdMly2Ud%w0jq%Sypqh9rCL$5hXk=7jQ~;9v;KPT&2Jqh{E@
zDY<_PPZuf}KWaHRYCKoT+%zU}dC^AzAUKVYnYp2N&-)jDo76|N2d@;~l(l>3{L}
z-zw=Wr#vpazqjuZv*_1+W#tu9v8iqjlpc{JpcN1v9^P12SLC*^;vZr*$}rc$y2oOB
zq{+}dfyQ-%8+|8)6)*WK9BvhMt!0cac1k`RcYu8Jfm8hY~$)ofj
zlo}CJ3Q=qnn!ZcCV-W8)b?*_`v&cyMa9dOpZwe^KmK9ECd9CL&pTA~n+el5ae}dP*
zFh$8)HDWte<^dWSrER+?4IUU-b1yIXZnwH5RPaVO-)4j?{ZWgt}&VPQA8m@;A7u%g6&
z;j!QS`|j5U$1B3K7$+uW_inNs6@TCTQA_(`#P$c@-rujPu6B2qM6t+xs&Aqp+8s9T
zcwVfGx)*Ing@uoCadlU|n0o%TmFC3SDOT3YX!4dlQonZ2K~?XZ;RCaV=hv)FE_R=#
zeze~SW#cE2k&DYU>RYMdPQ$^pnV(?;JJSLKPiI66KKl?E5t(D%eMwdmX#1tGd>6z+
z@?LspNk2D!)Fg|qtKZk8`RX^
z&Lnt)J)hQnv1H*R8vPHszI-hm>w?4fIU&X%BKHjNkw)F8%%??LSTzWdQFP#{ZK_{c
z%FoeJl_IH;^{4A63h1KBN-}i{AD-Jcz1eU@ZT_`=JN<_R!KL@xBcJ{970l38E4umX
zdj#e2#-`LFCu_6D$PRRcB{w}Bl%|(w)y*0V25LhcmsfW^r&3BwO8SjNZ0vboP*i^Y
zW@+F#%JjtTLc{P_**iFl)Ehp>!FflLTfZ$m=_6PGi0Up)Gfj52um%=5LJOMi`!&m;
zv^l{&oQ6BnVcUH~s`Efp3tSQ(JrFJK{_RsUrN-Pq<Dv7DaF0zu4b?1ndpu?1PjrRZgN?{N~Ngo^=idyStwgTHHV4hFEes@{x)C
z;@G~Qm{@9aPWxIvM_Roy#T|3I`Dgx4cT*a+8YtS>bR`-kZzxz`OYUYt!a;VP6nq$%dEp}`-0?EA{jn+{f&
zQZA>d>FNfu;rBZMy0E@07-l2_Y@mt|vRyv+dji2^+GQ|*Jy~LpQ|a0X&4x|gA4JfS
zZA!`<44Tn_0CEsKwadMZR_~m5f%%z||0pWNSeCw|vvkU_5~2t;#KpzkSVWz3pbVzH
zHT`8)xw_l=*LRCZ%xS>s00qE)?Gd?H9V7Nh}MI
zPoCKSY>VL07g24hV5LHrLrYT=AM|-Z0NLf1{tqDPN!=-X{Do-cb5DkDqvxtKCac)%
zyEhpw>|+pQlJq)vZLX@h1^#jL2g|%SnbDTfD?)~jSsu?JsN1v0LGuxW0S?NgNhYYE
zzn=ess=r+n1p|YS>r7Mzcc}}Os{kb-SNMJ2unP_pLVx>nT!-kszKv=7hmV-L?6vlM
zJbtWcwO`bkc;`<4MtFAgmL^B`1SF_CP*K)x+MHTqidNUqxZ-vR6G|@8V1@zQEcAyC
zg~r6pj;EUd2Fzpdnw6YcOvHXZ(N#Qu_~7UsA#S??pECH1o}YFx0;0J(Tm64(Mx?$`
z^5L17W3U_-4ij#6awb?vupC}Ff1b+a;%*|Mmo~=}AcW$u)hKpmk{PDv@=EILei>Ek
zw|)2+40LpKaP|%=D?J9WO-YqlrX3z_n2reU5Y@#+
z+l327*K3sL5AIW&YI!>qe=P`cPly;u*5!;?OyiE*~|k8O#M
zkkJQ}YmyL?+FTM6I!#?aJgC-R`NC$5!`hlSze2Cnd8jKl3N{OvVGoAe1H)-YtaAaC
zm!KeO&!8VqK}VUG>I*GyIe+etr&;;An6%lZY5nt+hOZC>8}8iM1%AUm8D_m$CL}m9
zOx>+JfqZtE=wU*b*VDWuM
zx62q~WJrkgx|>oc@r{0-g0aZrt1m8we4yeNb6c%jz#^e`8z>
z#SUs=vU1f0g#w^#m)I}3jjf7~?mbqTZ`&zyTvSd;DNmkOdG<|~uQa`IXUcF-sY8F`
zW;H7D7FOYF1v5YDyVET#L$zDJo+IO{?S2T$)t9edzjR$$8f%^V^mvH6(QCNYNn}5C
zmPp43E!nNdIca+M6~!
zJ6Cx>J9}W|J0@o2jtjman`TbA6~6gv{QJeB?mUZXzmcyt{e}51Sp(bC4=#4-p&mme
zKL4}bv%*J0!8KSxn%1ltG*X_nH2q?WkPmJ}B2;#aB900dRnsh5KcIU}naOJ1nw)`h
zg^A4$Gf;-hGj%!&)ptR!6JWM9I}3amBGd9;hPzTh?S<2Lye;khCko$`LqC4}u<0ui
z5D*C3Mzl5(;>5QifDQK(nuzBcr72u6bHi*zmQV)hBi>rrVYf!A<@91hLn9*6e0@Ct
z!z2W(t*|;KCnjR7g{IdV&^d7+A(fdf`TH4-(whqr{Vve1nLA&)cwPXQxx&I*NeMxh
zI31h;efgh)q5l}(g?ZNL)7ghS4*nyH_aWC~5K5Olo`5$%H2r70kCzZW&n~rl-@ZM&
zU9}C0D*ebGWT+KMflOxr3r(GMOU?{I&Nv#Kb3v^4>N~l74bfh9hsB0ykrOLk6097A
zf}*&mr6oON;Owmko(USsisK_+-!P#ZB(^dY@)K+ylT(o4@~l^B6Mi$kQU!N1#7(*5+9Gl_$+Lb5Sy}jJkQ$<
z^a0?^!IM+S^7~*{!8i2gQR6t2rSRqdc3H7S(6@;TM`N@baZoj+(^8e4KvU;oA
z#};dHZ98QzUmotrCLDVzR=vfWD)H_&e%&HRp~}NVY?g|8
zfSgbVG~|XW@AsT(YI-^wE32g2L|9bF&{SVtbLB?y?`$uF4X&Zn0XI-)58ue~We{_n
zF<03)ntXjk(jDn0I<5BOn#>F1qT*h^LS4QQ8hRCSz6A2%uJq0t^UqJ~IeJkj(_Wn8
z%>2F!{ve43yC_3M)(T{RvkLqk_b$xOkKUg)xUc=Z!IcY59XPm%)`Z4fOP2
zu|prvXS%6|eP%a-C&K)NP#-9AQ+hOC=G3jEs(AC}?8XkcWQC19)%PUvJ_$DZ-C*WJ
zYX-?itf=>FL-eX%DY|X2a{X*eQyl*EDK$Y(SyooYApwP467rw;IgII8U2$p|=IUe?
z|1~IkMznLh_a%;N9hAOaY8@8c{Q6%1+S%;A^lhC08<--Yl5m^QaCJRDW}TOxKi-)S
zwVx^a;^)pCvG#z}e|aajZh^~Gk7|L-el9OJD^V9m}Wt7}`x}8dRJkZ=r%s3be(X~y!O*95vLAz`rf1Y#G
zbmQMzz(Q^9r9j&Ha+m2Bxw!F&GMKjwne>8*h|E0B)W$Eg=CG1JglIXA`dj
zJ*Lk^T^oaFwv)6detP36!>vj+IG)fp
z(@3JUBIc-}F<1Zhwu=`z5VyjR=(#$dsN%z!rYL%=ML2*2aC$#Kzldjt
zlw;O1o<3y@dh+;j#2I5gRtkUrELe6`*w)eUA#fB(NRK7^`v=V}
zP>XG{i;EAz-=^Ap3hO*nBGoEYUg4rHX8Z_~QDFcEkQdD)t%6Ne2SYBuPHAh~Ya?y?RwerRgPEM|@)H
zc}jBnw%{YAwN&iB76W>=-#^)2;egtfpOxDDBgf6S?J|cY8a=eNMQ-J#C5Hl!&dbB2%aXS8}>ndkJff2)R_RY#&>xq*_>exq*`ZJ|l5H@?1&)|uuH=qfrY
z=OL}QKIuJeIn}2Cy(cImJ$h|o8(!afZtqy}+Vn`1mo`iPTI6)xW%B|~;6g#M`g2l5
z(c1@k9CGvWo(mhD$W3yY?BXh8<;Tp#rKHcD1u7^Re`}*kY5R*~Y*RTU;V(9f4>5XA
z@&cNf%cOcy@4j3M#Zc|My4;>ki?5th
zZ^Lgnm^Denh&T!I^2UOp6|_~?#~3T3icbHoMTMphJgy_5F4N)zWPK8iqrCvX^jUTC
zT~bya(HT;3tvL$>3*79fH!R>0iC>jMJ9hhaL$zlhjnT5io)tJMyBE{x5HYoEaY;nj
zB3b!3yFidIXi;lvTNa|}dv$mUW^->B3^5a_X{-9u*Y~K~l}!CgE+UG+JZ%G|7+niT
z#}k)zt~`@h(5#HHw*j^O$1e__IJ!c|J3WQ&<*#3>cx(qhkf%4bP6rXg`y__%gGpTT
zHrkfzFVBY#C8n66n{Hvgo2S)vWYGbtCC%v;W2+g-;
zSHfo}BG*U=Q59KIvew$Mqtrzy;_1@{YS^)NZc_HWe-R&lkcNgwLK`xqaL*>u-0w0O
zH`z+ARN!gEWC&zAQBe`lQhT4>l$eh%F~&yJ_WXw_<7u~oX0eAasU?9|bt>Z-Gw;UQ>$XnJuY*1k3@%;wrP
z?#=|pB>yb;iwu*^BrR%>1GZiyhfbdoOm=Z_Q1{<)rC5nuH5rGyz_zXa%2peuef&B<
z`nLj4I0Oz%YpWX=K)Xf*wmEc$)OGT|9~73-*-+zQTqj00s;rv1qkBWom`aQ}1%sP{>zSaQMnZu`!-rb$#PLlCm$8o`N
z(~xFySc-*ZwTbh$)XB;ejw{7@y2ei1I`!5rtfP!1u#514D$zIn)9xv35I$bwNm8cO
zn2G$s!qQwr%vMjYBsrOcn6BsQWS1gFKhg|bJcf`g4!t5OebNZ8A=8RF@DE|sCt5156!TOqkkHW>CH9lP^|=HWCTIg
zjY6yBtzZ17Prt;b!VfL3!)9edz=*iZRLk;gLW**fD~KQ#bYnEkQwS(9vLRj-=dx{Y
zZGv(vbFL)=FlXPVI^e&2JpSZ;M@LtNHf6w>sh+Zww4{rLdo#FjEKHT|LTPIGN7U^f
zG^RJ-%p$;h77@``%rXklUzg<}maO(c_&%A`eqBk%PB|r!M;R`iFYa!ZT-}
zK?7QC_4L|w?ev)F{^sBEkQ1fQS^Op=`{l^U8M&-)b&8+=nV{1<=(E^u>|R4$d(rQ8
zLdP!^*Y6X0!H=k!KEQdHU7PlOS7qU?aiwuh;DutGH#ekBsKZeFgTtz~;3mSPvx>g|
zb{{?J1#Q0yy3L=I-{a6+%8b3$+q!r5$J7&{Msd&av6P+zxv@(V;!O$ev{NODva%mA
zQl!w}7+jB?nce(uZ6`A?#)gNxOs>>_emC+Elvi1K^=un`-Ki&d>_R0s!LJOx`D)d;
zHTCg(&~i>yic?gRvxuL8X0obds@KKtXDBJQ+~z=eBdjnzH9fV(GI;w>v3v0Twxxxt
zwyo6NO!*tn_mL6!PsRQkNUFNV`K9%sW<&a2xB{MwIOR#-&+GYx(T?qz`tp}A%M{%4
zr3;h~;L4_HfW2MUwP4|Adk`t_(wEn>S$vCEUafuicX3z(Z}%QziqO5nRr}w0Q?vH4
zU7nG;Aht97x!5gDDT5cP2_&GSQZ_`D8Gp1<%}>MDMr26OArf8v-yPn-vRJKB8{zY*
zlibI-7%1pie+nl&L4)OM_qs^{PMdpk
zIN8}z4|_w79Zg$FNwY27l6c%?c*3F@T~ov$^3yk1JKu>LJ}pj2xfFQqowQ=?x#1Mr
zw7Ok~&*_FmMcp^wf#%uI2VCe+|Jip-%z*KA@veGpnHE=Rc;(6!5#&i$+kip*{QPd@
zAhOR1eXCcpwJO_YB{aDVcwau{G&x0`m6ZNwKhsakM21)PEIVILX`=Joxs#9-{!f5b
zu}6FR*TP%35IziizVq+;nW-RTSsqEKE0!DP@QaBNDD57%#3&Hl{dX^$h0tQ20pt+-
zD$(-yh6M8c1LR^d#FjkxkL!7mEeU0AkNuG4{HH6w^}C6dPyA0zfA+tUGYUdVqH+|b
zM_A_2*+kV4uT1}^H$R|yJOOeTcoq;0;tGc`>t@9qEtPa%T=S$+djsY6UdARZSy}MG
zi1EB@B%lFm{c|V!o;JQ(m4`tH8j|&olCXxW+TZ*n#>~K3bEm(vMfpCKafWf3hRp;6b=lyF#lmp8eI
zK;nwFj>lYm1)o{U5|9l|1P&lE@m*8XWPV;;q|{0tT)&M!z4^1&zwoa1a`L;XNTRuk
zF-{tJxo>`O*4HUOPr++gNGPn+d(0lO8xBb7&@^%B($UlN_&I;3c>r*SmoHz!ocrVZ
zcd)^I=+nTITU}(j4ne|J@&#d?kns->O_{lodIjai3(Cqa&Y4hf6kZ?WMWqdekK8Tu
zbkM)a%udCzLA7%4@;=NAvuaH?fr=L%Vy}&D?u(4*-wo2Vqh5;rA2Jqm3j<|O%rjR1
z!Ff*lJ=#U7F;6>ET!P!JI>1QykqplG6+-0*FWr{*l
z>|gX0bYan9`hDj(KM>QQP|t$!JoQQ589~7*%qg(>`^dw#Hhyr-YEPUzA=Xn_#>2gh
zAWCSv@*mZPM{ZktJM8pn2bh`ZkV3-m>)8c$Ycz~!6BCSxV9|M7dwWelU^$E`jNR=J
zf2yI4O$^Au@OEQV6D~38i}y`8v9<5he-1ipteYh0idO9{(n?BGGv9`iv?y3ufP%5U
zc8wA3R0M8T6xIruYzFl|n4uA`$sfIb{osCZ4BTwC?QegVx|3rXpWI%SSBZ&^zrJfz
zhKLMvCtfRFVvIAFjepX?+BbY3aj5Q|$g5S||&-mT&6%&E@D
z6R0fL@>YUJM-Or4&)B6n4gtxfXKMuh2IcXGlK>K6dPbqYgM&l(34IvmD*VDtg}-zn
zJmKQxjCVW=Z1!+^f5dC~z`J{X6ch{KJS5CKuHxLSDEXyo8Pkh`nQ!^qUUYU|?DM=2
z0%j5)bwO=;-qbT8mk*$6ft7UD9|YNaj4^Eif7~#QqUSvLyi_sCtq7_tuyriDY+sox`89^eNRGWfHfG@)y;QT-8g-
zGarl+ng)QW&~+@}D$O1TE+ZG}a2~_qpK!8g8k8Q^iLByG53r}yc^eZm1wxAXnd7xJ
zOvhCIdh6Qkfm(^C47Tyyw>dKl3v-LJ+_sSqA1b&(tD@eMfRc(^+iS~LC^iqg{7=}9
z(6u^a;XNv+tmdW`0fTM^^cYS~PE|t7(K>l{wqN7V)W0S_ZxAf*84C=UJ-h6A9ZH1lQ7%GA<`MzAr3OZ(O1{9P@82Ag1?8
zhg2kcgruemnk%1iQJ||7LXPX4}gVj51=4jPtiT
zs#<7qTFZ@m-=2|7#&0D34=r1skrok?ayxMAdBi0zZtjsrwdA_VW^77e|LlubulViG
zqN3P__W$_U7?2c2C3hd}34SmS86szWPmkkhlN9#v@{K$tM{*?-ew&GR5_+M8MNY&*
zy=C^iZRx_tIrV=BS8Z-Wr%#tUt!AbkRYsrKLjAay=gLDha?EVRr9t~KO+rNE9?8dt
z%*?=sRldkfO1fokEvH6R9&5%7Ytz3o%i
zHT2xvJ`_m`swNLK_XLryM!7DJ)_~VC&vx?
z;L1p45?xX$Id`hI_Hw!WiDTe{U6vtT-Be_!>HsuD<+l5|j8B*f$+~_2)Z54C;o09o
zE0QXgQQVpDuK`xV@svh5l^?P$GIygSr
zEeP|zW9tv{rsqDq5l8?a+uAX(12hFf)h`0M8AP^74P;7HvHyVOGxC(Xdxs&3g{38u
z&hT4Y_n$u1yhUph$_ARmF#Y`T@OM8zYw26%RfJZK0?wC|J)l~VmSNr{PH
zXz!Gr@}8?d3pf!@YZiiz&r_Jn0E2QvJ3B$r)w#uVSwo`tulTF+j(@|Vp%LLI?Qs~d
zgsN}zPBB1naI;KEuaEo~-U=#+yjJ#Z`-p=yB`HZxRyNoCTV`C`-%p+t8NGk{dS*9$
zQflf+m|wAPK`jPkEeM2SUcWT>17kM>ZS+OKKKS_I1CxZkUfbQW^z@&ps?w7;tntCY
zOhR|@SkY`%ZOb*Z17OC~coeMsrNl%RRjEDXOMoz_DdGSYvbo~0JTnVv+|&GA2unXa
zqN89uScIvf^o(Mua{Hn4?czQrM0^?(H`XwYe-s{%fLVK(~M7Edj+*#67
zFh&qg9rpNJNtSD1a!4NkhtDjy)yJk|rUW6!#@M*M$Y~F10Rf~)ks)Vl2*LrKe8*GY
z(6D@5$VOG+q|v)8=s@RUZ8RzsR$qyLe6P*lKh
zI#L%S`#BK^H8+PJ3V3KefAg^)J5~qB*+&+dCLn~3J!8aENFlR>KS)jN@-8*tH1aS=m29QjC
zuC3j8hlb*iKd#8Xp;t&IZI8E4OUjM*EQW&CbfEO@wHnuQgp65KoG_h<62oU
z2_+>Sus7!LYTXUD$8RTmRiwY5qcASZ!`@yV_mLjXngYPyn`0d8%tat@A)q;t)nzgn<^OO{&Y$A
zSH2Lpgt41syLTUq$9|c$2ZjTY3Rs+_2A|$9s$A
za3yAkQmz>fiHVD<45ODCPim?Vi_t2%fHEVNK`F+eG{69)ZR8h_Bjmizd-x~-B9v<;
zCbx!vE}*Q(a>nf%#ttLT0AZg#$baYYwGK3oX3(
zvU3gEf>`(Y(G|W?YMDc*wn5RCoH~s9yQU`1f11pn71v;v!y@9u#9pvMJXGMf!OU7h
zXLEoOnJ+|uP19CFTLMBYy9;{FGaXlJqUgz(1Z`Guq2n+tLp@mm<)nnyGau@^do*B~
zKt}^5v8B~ChHj@4?9$a4vGiT6Fy68TowzqN$BAdISUkr9A2fWScI=fdyd%+8_R
zb{qQjKldfzk$(`+h_jauZ&UaoyHH4F(NkYlqdPPT;K3uc2*s#8WUTOdk=J*2Dr5Gl
z=2I5$9K4wUuDFa07#1Q4Gh$o^44Vifuej|HXCkde{_(Jz0(zUwhqWs%5G!OMqM+TJ+XmiBf<1%>NG
zYZQ!(mr~SmWnmsf(+UksM0Eg_9KskI@w|gR5b&R^zw5JO8T}kKkmF-QjPF0PzN^n?
zc60(i?nC~rtM)CryH9CM!R!S6=PE238$Z!?xpy#Vm7MwB-TU2LIuKA-efZEAc?PHq
zKiQ1mp3>K^x6NBn{$mm$_(ixRm*+4!=vV-NIg-VT`0-OjUJy-hDgW`C@Vl}|@WgKY
z5e?_%la`Vd^;60U
zgE5IiyB!6#XHgL`Vopyz`5lSI%zMf=Q-5Vc{oW9H<}zlzNCa|eWjTbYvjw}{yqR3}
z0;=G)wCsHFMyyxtyxvjfxr?w|&Ib7rN-P*ma|B5Q2at;U5@_tt
z4tz$st|@~@3R_HX$*t88Vn)=50PC=DYTqLaC~ZqsZnNAz;Uec*1vG9vmq&=R&^2L(Gpn#NAsa9db-crct3#WqJv@nE&X45+iAyV-TN+iqasF<&tG
z5)24F|J0ugBntJK6;Em<%xVW<(PcZ{LR`}-1&)g{ftkk#GQBQG_
z99N2Y!N;`E-Mt&bp42LuF=QLXg5mPDTK!z9RWy(D9jn-LI7^RCcIQ%%3%f1;WRq}y
zw|oi)Qpf8BQr??B^YeQ-n;JhP2bBX)bYuW)%O{dFe*%8`XC==WiMJi}Jo_w?UVR8X
zwVx2ywzaW{TNXrT1TF6@Yh0g_JfN3ihd37v2Nk2K9y*?TDrZ0aTMOW6fNW2~eJUPf
z=T0H2|8U?q24e-+-WnpU(O{
zrZKPcD3^4+_|j-9~lg{RveU}$CS?ws7*@>Lr_m+24aq;p8$LS}n+PdIq|
z-a17OU}$Z*OeTdxf}BZYarBMWEjei^)yI$SJ*_Voy9F(QlTNK-FfOXAZ-(&Ifdb4uvK?0GM*vY-s7
zF`uEdr6`8$=G!eVfO;9okQnMGFN7Tl1!P{I(yVMdK@Y;ov-gAsfaScSQ$e5v_*Fm8oC){|E7q7eA7@eBFsg>00~KZZMXoEZt7sE5
ziaI}WKWG=hEIB*4GEm^Wp8V?JLu5Z&BnOq#ga~4}OC|ejRYAkOAaDCS81>WAqGqC0
zBk&8wo@QWC;K<)j={OsQ1DU;f*KxTLUUHP*3krn&N$nlxU^y7?$Q5;;I-+H4d5w{Y
zk}J}uIN-1r`;jARIgdp|L?G7J^F1qd_QtELHCqeFg2`W%D6
zjS5bw5?koduu+qs>__BbZKGE%W4(+@C3MOde(BNMbr~Z!9zSE#Tb_A@5(I(r-Zg`6
z|32on{@&7vggfgv!V5{9$5=58VIOl(e^-}1+NH>ag=~8{#OonXgEoJn{bezH=Q$RX
z7H_TI>4M8}2}(c&5o-CF+?4b4vpF}1?uolQ3J9G}x}2rG9{AGgJ<1R$7eP_u%I}iE
z{o7_^0%YUsWYa?r9zKYle_?#zxhHpT2%Bd&=4Mr;8xr4dT8+ECZcdH!=>_Y9;K{xW
z2Q-&c?VFe8u;2@AG^<&Um4Qqrt-5{qL~yKYvs9e4)SKPbb4|7+&8qR%#?xG!ueL+T`;c8E7v+se7Oi=fyg~bRMTC9
zQ1K!-AMeDRGUoFfG#VucFX6w?!}zEQW7ccIGgsdoxZTGQbyCc}1hGNel*zl86B}y|
z#Z?cH$w3s`CMYN%5OKz8<4MwIS`Q(!o-38c!iefSUTHV#^B=B6&}I_&Ba}~NXcN<9
zdWJ5@U+U|+2jGUP>gBPHTuPA9%vGea>|i7@7oJ
zWsm(j4lywqo15DW|8$~1LBnHsO`lP9Bq7HThBU)+qdkO+n)*2LSWL(+6^DPgl|EVF
zaBCoKbp1$|gr3d=kto<@5nFw3Xy9*HH8l5>cb?POAp$F?H_&N=KoR&jnldQ_^
z0=I)j4l5QTRqlm4`PrR{Un>gx;FLw21@(~yy-x0OHO0bnMzi`zkE%wfBS>kw<1ImH%IIAK2&EIk*UVOfZtIW#yP0{PJ9?Ms5-aNHqfMF-2iUT%yiIyf6j2#434negM
z;j^n2*hfcp*lsk`I!B}1`8L|Fvg
zz`!n~7|M6aK?^_`VzW@C6+-nUR!qI9|D1v
z$p=lZESbG~_nJEck%kLYp}R!{h<`
znVgLx;&
zRC0cg;9r;77%An1Q#r>w*_i=rX7urNzt7`C=v(UF2t+7J0||vZ2#>Jj=7}skoD~E}|oD0YCp?k*0->4Wry_HQN{PWJge&1T6|3;}*>sdOU
ziO?N8_we2O#t%=6z4L#du{k@It`WjCxF%877Yljot_eTMpCN|Dp@SueyV
zaH%bcgO~&uZ{ObJEMto%;2s$*4OjZqy}95;hNJ?k?3w1+BYceP@8V({3O*8)J5VMh
z#dLhoxyq?|NmkdzC1R#C<0ceF4Glq4=K>XE6CvBAkUvfwk!n=4;JoWO?rmwJVHR;M^)Th1vtAuDQ8ox>S
z<#0t^+PXf3+fxa)RGVMDShJ^av#m+Dd(11fN}V4H7FT+oOw%r-RZ3Hxr_TFm`=i^E
zdu#6VnY6FHy}!k;VynM>GRmJ#>G7O7^N1B#4x9!Q&R=GC!;~ElrKTqC)Vf^4WnH7W
ziKeSawg94{GSRrl#*T(?Gc7JGy!nuND+`XhTsj7q^|9#1a`>yv6T&BJw_?mw#uj6Iuro&Kl0|Hl`F1W4(Ci+OohY`!fY;1CUPP2$iR_Y8n
znl~$-+@s?*(8YM(gEQn1$&dcR)m-37~_;-prM<<_QMd`?aq
z>cj%_nSnAoK65w`70@3e?hZjL6Zqc`^hLAon*N=<4YoEm3GzQjM!q}|mMXSCH23+S
zCql%V_YP&Bx(b?LTbC#k=>eHeFh>|npI;HEd$sBJ&n?_xF=AHk6RIN@*GD5HCyu^4J|wydb&qgIKdqtp7gJr;Z(P%I2b0YO#gp4xPOQs3K}yN4f-t^kJO`tUu_g4P;@ew~v8Hok4wk7KgC9SGxy6&@
zU~PAHWsrwiH|i5GY;;iN;}&25&5^DRB8@zRDN2pJfhwpCu&XOb-C+gAY-EkzMGcSC?#!
zrDbk^oVs$QUnA6Fu>2#syKl*mbyCz2tt3rE`T3ui%u`ZOD1YOdg3kep%-UT>;zLp5
z`x3vwCm+3(@?JO|!iAXfNbm03@lMNW6k7cJohs*rW5s3WUI!S0SQYsRs|B#^z5aq)tvw+5_W(Ah+~CHH8Ooqv*Cm
z|AI#0WoXI@uK1rdr+q6eNm_F4wiVy-boU}>YMAoSWLKna<&uoOeMxaRk-XNp;~xeE
zGHwmVDloNaPga>N-|_J&wP|;@&ixC-{c5m;#~wP@RsGnNg@+FxA|4WbXie`oG44eh
zk6tyv4#zZD>nTL^cC~u~ZEbg}@CCSb-`JhZec^)6ELbVO)%OM5j6y;hJRn58W|jM-
z;HZW9sb%yL2ZS3V)?dg<&Z4oo16vZzDRFtHr*~<3^}{=oSdf+%y(ikd)7o#}
zx}Ny+B4vR+eDbHoe=xTXKun}e5ju!lWX{BUWB1KwHSTpiVDZz^%hgT+13
zLt;7pHGHI=J}oJ@s8{v+GLJbdtHn#aUZRJ%$jDDl#qa4jV87N{^vFvRw&ho%ualp9
z8yTa!zLZKq`*WbIsBYoOf%PbHQ7#?M(>=MH;+0cti=n*D%
z(}Vg}S1pDo+FpTsp93Jk%WAb05=U0-4({iz8(r@DVH5z@ofWhZ`W(VBl;7eb#
z+@Y)n*?m7v
zrk3XX-{;vGuqU%Cb2Ms{l$4Z-kugvUi-D)V$3;?Ix`uf!B^_(V1(@c#Vb6@e_ueB~
zC0CBfy}9C~GUj2K)zTE5@My2uA>+OzrCJa-QBiqal-1G-Zzg{`24`&;s16!LJ`vC6
z1d@0cUp+z=c?{L^jX;MC4zZh9H~M>b_{v~Jm|F>~369>Dle4h+5dT%wZu}|#%hNO`
zPa-0nd&O)G0v^W+Dk_CF#8PWD@6u8&>|02lnd*PhO#Z@z6`N|8E9uH^>s0$iEX|7E
zf&3^SKvDkEsVgQJrNj+J7c;hmzkT!OTX@hdb(Z(h(ddZ9LT*g{72}8Oi_oD}y8p2D
zA3rNr=MC=}CT6-gHDXvp451+#r3Mw~`H%nO#_j%=gOfA8_?eB|&LYCH#5b${5HrQ%
zLc64uhC>Qk#|Fp8wTGM^2_Kye$oBJl(&@xp(ri6`3+TPoDA>jHeYglbcjckDu`$`Y42Hk+Pk>K!s$7QRt{?18Oi%@I&WN8w_1_ddUP^f1(Keyrm*d8e
z9vMe*J)Dx*(sKNksP6cOK8FNI<_xneA7cAcO7pu$|Lxi(^Y%$Y2|mRj_uT)p*N}y&
z-rz&dT%tOUWTo);Z^T2&OZl6j_zwxYfS6MD{pSlLq@{UBMn1e23o3N{t&=gatIOs)
zOtaLp&VtXImzM|oxgR}w@u^6Ja~|Asp(t8($ALpu!xRvVKBPp
z0{@Y5i0=kH^xyPkTa3%EK0Cm}#|`)){^R%Wcd;%?@WFK4ALQ8f@INnseZ9_H;nM#Y
z-(UL#h-6SARQ+QSU9Li0qO?_f0+|FosSmBw=-5bp5uY`N0GN_R1aH@@ygCyKh%Ht$
zb#M=mVk*U*h3C3f8)><@k4W()^cDt6fSuwKAvCJVPn_7!`To;k;7$>JGNt%H&J5Zt
zewkcgyWWqP32=2bwz`4`TyzM$uw5jYh8WNExmAg9NqM6ExYMTO^tJi>_wSPxBBclO
zA%rQn``@>jNKjYO6lRie94Iu6Pl(IUx8Ht9fBURkPlC=)`1s_dnWl$pLRW<~_Qbi#
zc!Nt?e_dU+p$`YqLfQ(rIY2A==%@mDA|0G`5kChI$Yt}=Bq7iQ^kB>AcVRykXWG!W
zq=Hf1mi#(wdwPiD!h2QB!c1VPI
zWMEKUJmigO+5<0+^`x3GVW!q)eXLpe1s++sJXmsra|U8lHe-|{)aVtSV*^FY-@3aq
zv0y{CxY%xXi_Xbz2VF&uhmP}ij$P0HKE&`BTYiy=Sl}W1{rl!kdRS#>6;za!`UO#^PnL1sT
zMXUG?%{uDBAU4fJw^=J^`qsYAO#Py159i~@wlYViyXF^vbQpC-h437vq_i8WTLqDx
zmBjsu0rd{j?8ld{?-1J=e*d-nq&?!d{%XCpV^*`gc7|1sYeV@C7m#ApwU_fUGpF0K
zLZAG>b$cyax3ZX_shoV<-QE2?m%fzG$#pB=Gv1k1U%u!yv+6Rw$afR%ZJf|_wVECJ#;UB|MDp7D`$uND8cc&-=8!Ey08#)Qca*q^EjRG)b1Ql
zv#PeX(F#frHFfm}VY?wbL}q4b>9;~&$70z>BqfJl|29N~OB<`6d1eC_xVZclKK6eU
zk-pj0b3s?jPi%+~m~1!eQFEYH!%AKa<
zj_O|ZUGBPnwV4aRR!~u0q-!nyxxDV%aqZ2p+yaZ)arFFIlE{8%Y_D<5>F%)
zla*sZ>A=XE@BpK&i$={Kz~Lq%dH-7Hwfwz54J}CA_XvGF72RBrlaW#CFyBsZLMvpi
z_p{JT;a=x^t=ay*WaU&E3Ys&Tszy5f#dI;t9G)@hg7+uHCa1RNhB>{cc`dA1GR+4r
z+pS1aWjU!QeTPNy^KD}37hELe%*&({&|tt}e0!JLAQt)9)n
zTcg2@9!_ThVa!vcJ5I|R;4t*`bo0^R)>CJ`Hx{)>{xv*HcPCldtNi`niz&Nu8Y46Z
zN`)Ekz2S8-`}^+?G9t?w@niLGTT|pWTPL$Th*v!46Bb!KIQ}jyvZF}Fu6keT`V7-v
zIlWBz&ugk{+i1RLZ*Je=IxEh{V%)FpYpeiulTwX&v54dW4MO6F591p02l)ahpzce$H3dcxbv{o`4;;Y>kZ4`7p#z
zD6tf`s}Z|<_imyBV~j>_O1#jIbW&*XORW~)J~?M#V6Z&%wEA7-RnpdU?aJfG033)^lk^yJ;IS?X-tlwJ#_Zf|YC(yzpXnc^qsYL1*!%6u}N
zRS;58*aWx!8W~WNe;?1b(#>a9_qG4{Q&s*Z-VaXhFLx`iW`+H|!WagU1KD
zS&`S>4*utG5qgRiG&MC|ie?%>q^^e54s{!%eY`Zl$)K0_Xgfn6-8y|WJeDba){C{!
ze>cmzBFoU2Bb;Gm4=z*jCN2MLxlQY5$EH=RQP?u|lJnK^yPfY#N>=V@!u{kQ??BBU
z;f&l|TH&duevH!0+q(pIInWANJsFbWr_T`MZfBq<|P
zv#mVSTVNu0K#6O1X)RCd8O*{z3;UKRZQV#G*wedi?`M_@X^tK3YH1O!-FGKbajy%M
zw#@sF>rqf$0cVM7PVe!n{xUj_Fg;1~{SxgMx|ugcP1c9zacCC$RTldBboOlPEAE@z
z!*teQ$rV}YU6?1z;rRIYWY3or)k4*0rd`JtDatqiEmcg_h#dXFm%u8zj>ty%VP1??
zVf30mmPJ>1gf|;?*qU3i4nzr9hz-=87LW}Sc(9=dtA;+&>)!TUR)02YMr_t^lr_jG
z5L{v${0Hf4UmiZAM|XlJLj9a_ac6{n-yK@Q(z)$y=h8z`V?`kai{K`h^)3WQs<&l`
zl8`(lef;Xm)%k$Z`_WsfX(B=Tthj@mykvZ0;?!l2ORAYM
zp{c1q`-(ygk0o4HYfV>?&_ti0+*DL-GkD~PKlTGP$4Gw01REUhgyEYv!p{h=y1SoZ
zoR4u=@O4X2PPKYUHkx@q+h)@5@LxBsS#1`&>FFu15=H~cFu*)dO1l2)m5r?@_|iy0
zI0`}A^!1^;{_sFVfrI*w8Rp$ou#A+k4iR
zpk?pia7{uYnHMbnk=+4(%J`CdiC>Z*6FHv2y?ag^?a7@bETs)jPHwe_-iEOK2qmR<
zvNCyyjEsyB_O|x_Fzd?H9jQ75aT0OkL&gisma|^y+4;=7PJ3dxMt78hf4Fc2t9&y%
zss+Rt?8cpXP1D~$N_{bb=|W}XV+k5hekl(6o|i9P2s@A5@jP~u^ni1JOD+AvObMVF
zNBev_e)~Ia)~anVn2dcId3BFQsa0E^Bd=}wbEaH}`3C||I<&&_&9@_CzI;(mecRL3
zRex~n!nVZP^Wb|wyeY5m_dOcx0#hxAlZ2#=gw*`PLYd>DQ*|Nphxrtj5*a2XpPRjJ
z@4aC^@<7#2Ty5
zF*5?gK3DG)+UR$ro$UE>0LwH-^9I_r3ar?rxgBVXJp5|oY&SMI%sW36nD!_euVZT{
zr)uUCD6D5lxK(5tZ!|V4EB4q;n{~%vyPPIP-z4pT^Sb5%iTiRQwo~_quajfxj??0F
z5bxl5`$JoAd?RNRXw9z$g$};Nh8*=b>KK7zM;k|>t*-0Zq{`-pL{!I(RP?I?(mTi)
z&CSgr#N7SukEY+F
zSb1{v#Yoc-);rdQn=uz!?>KXYb|n9$O$D9Mb4A*m3Z@$;2!Hc`HSX_G3a`@Dzu;g#
zYN>nDAu-}qpB!QNI~~BcXnU?7xR