From 2a1490497000577b0ddbdb02d9110579e3fbf68a Mon Sep 17 00:00:00 2001
From: mamo <mamo>
Date: Mon, 9 Dec 2024 14:36:22 +0000
Subject: [PATCH] new configuration version

---
 .../k8s-nai-6ec6739e824c8e56d9633622.yaml     |   2 +-
 .../opt/nevisauth/default/conf/esauth4.xml    | 129 ++++++++++++++++--
 .../nevisauth/default/conf/klp-profiles.conf  |  25 ++++
 .../cossa-token-exchange-authstates.jar       | Bin 70860 -> 70859 bytes
 4 files changed, 140 insertions(+), 16 deletions(-)
 create mode 100644 DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/var/opt/nevisauth/default/conf/klp-profiles.conf

diff --git a/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/etc/nevis/k8s-nai-6ec6739e824c8e56d9633622.yaml b/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/etc/nevis/k8s-nai-6ec6739e824c8e56d9633622.yaml
index 5a33102..39f0e32 100644
--- a/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/etc/nevis/k8s-nai-6ec6739e824c8e56d9633622.yaml
+++ b/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/etc/nevis/k8s-nai-6ec6739e824c8e56d9633622.yaml
@@ -45,7 +45,7 @@ spec:
   podDisruptionBudget:
     maxUnavailable: "50%"
   git:
-    tag: "r-c6ca435d69f4d783531c4a0c686abb3dd1682ff7"
+    tag: "r-bbafc0d41c4a5790c953c8b22e97d630f12a4406"
     dir: "DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai"
     credentials: "git-credentials"
   keystores:
diff --git a/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/var/opt/nevisauth/default/conf/esauth4.xml b/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/var/opt/nevisauth/default/conf/esauth4.xml
index 4ab085d..df94dcb 100644
--- a/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/var/opt/nevisauth/default/conf/esauth4.xml
+++ b/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/var/opt/nevisauth/default/conf/esauth4.xml
@@ -54,12 +54,12 @@
         </Domain>
         <!-- source: pattern://b67f81a971e4c08aa79040a2 -->
         <Domain name="cossa_realm" default="false" inactiveInterval="7200" reauthInterval="0" resetAuthenticationCondition="${inargs:cancel}">
-            <Entry method="authenticate" state="cossa_realm_AuthorizationServer"/>
-            <Entry method="authenticate" state="cossa_realm_AuthorizationServer" selector="${request:currentResource:^http[s]?\u003A//[^/]+/token/.*$:true}"/>
+            <Entry method="authenticate" state="cossa_realm_TokenExchangeEndpoint"/>
+            <Entry method="authenticate" state="cossa_realm_TokenExchangeEndpoint" selector="${request:currentResource:^http[s]?\u003A//[^/]+/token/.*$:true}"/>
             <Entry method="logout" state="cossa_realm_AuthorizationServer"/>
             <Entry method="logout" state="cossa_realm_AuthorizationServer" selector="${request:currentResource:^http[s]?\u003A//[^/]+/token/.*$:true}"/>
             <Entry method="stepup" state="cossa_realm_Selector"/>
-            <Entry method="stepup" state="cossa_realm_AuthorizationServer" selector="${request:currentResource:^http[s]?\u003A//[^/]+/token/.*$:true}"/>
+            <Entry method="stepup" state="cossa_realm_TokenExchangeEndpoint" selector="${request:currentResource:^http[s]?\u003A//[^/]+/token/.*$:true}"/>
         </Domain>
         <AuthState name="MockRelam_DispatchMockRequests" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="false">
             <!-- source: pattern://1641a38402138546573b7e71 -->
@@ -127,6 +127,74 @@
                 <Gui name="ContinueResponse"/>
             </Response>
         </AuthState>
+        <AuthState name="cossa_realm_TokenExchangeEndpoint" class="ch.adnovum.cossa.TokenExchangeEndpoint" authLevel="auth.weak" final="false" resumeState="true">
+            <!-- source: pattern://89578db79d2bc15d55e11141 -->
+            <ResultCond name="failed" next="cossa_realm_auth_failed"/>
+            <!-- source: pattern://89578db79d2bc15d55e11141 -->
+            <ResultCond name="invalid_client" next="cossa_realm_auth_failed"/>
+            <!-- source: pattern://89578db79d2bc15d55e11141 -->
+            <ResultCond name="invalid_grant" next="cossa_realm_auth_failed"/>
+            <!-- source: pattern://89578db79d2bc15d55e11141 -->
+            <ResultCond name="invalid_request" next="cossa_realm_auth_failed"/>
+            <!-- source: pattern://89578db79d2bc15d55e11141 -->
+            <ResultCond name="invalid_scope" next="cossa_realm_auth_failed"/>
+            <!-- source: pattern://89578db79d2bc15d55e11141 -->
+            <ResultCond name="ok" next="cossa_realm_IdTokenVerification"/>
+            <!-- source: pattern://89578db79d2bc15d55e11141 -->
+            <ResultCond name="refresh_token" next="cossa_realm_RewriteRequestForAuthorizationServerAuthstate"/>
+            <!-- source: pattern://89578db79d2bc15d55e11141 -->
+            <ResultCond name="unauthorized_client" next="cossa_realm_auth_failed"/>
+            <!-- source: pattern://89578db79d2bc15d55e11141 -->
+            <ResultCond name="unsupported_grant_type" next="cossa_realm_auth_failed"/>
+            <!-- source: pattern://89578db79d2bc15d55e11141 -->
+            <Response value="AUTH_CONTINUE">
+                <!-- source: pattern://89578db79d2bc15d55e11141 -->
+                <Gui name="Default"/>
+            </Response>
+            <propertyRef name="cossa_realm_AuthorizationServer"/>
+        </AuthState>
+        <AuthState name="cossa_realm_auth_failed" class="ch.nevis.esauth.auth.states.standard.AuthError" final="false">
+            <!-- source: pattern://72e29eb80a951e518ce123e4 -->
+            <Response value="AUTH_ERROR">
+                <!-- source: pattern://72e29eb80a951e518ce123e4 -->
+                <Gui name="Error">
+                    <!-- source: pattern://72e29eb80a951e518ce123e4 -->
+                    <GuiElem name="info" type="error" label="error_99"/>
+                    <!-- source: pattern://72e29eb80a951e518ce123e4 -->
+                    <GuiElem name="submit" type="button" label="continue.button.label"/>
+                </Gui>
+            </Response>
+        </AuthState>
+        <AuthState name="cossa_realm_IdTokenVerification" class="ch.adnovum.cossa.IdTokenVerification" final="false" resumeState="false">
+            <!-- source: pattern://a976546c6a56dc04c0d34592 -->
+            <ResultCond name="failed" next="cossa_realm_auth_failed"/>
+            <!-- source: pattern://a976546c6a56dc04c0d34592 -->
+            <ResultCond name="invalid_grant" next="cossa_realm_auth_failed"/>
+            <!-- source: pattern://a976546c6a56dc04c0d34592 -->
+            <ResultCond name="ok" next="cossa_realm_klpscope"/>
+            <!-- source: pattern://a976546c6a56dc04c0d34592 -->
+            <Response value="AUTH_CONTINUE">
+                <!-- source: pattern://a976546c6a56dc04c0d34592 -->
+                <Gui name="Default"/>
+            </Response>
+            <!-- source: pattern://a976546c6a56dc04c0d34592 -->
+            <property name="well_known_url" value="https://login.sandbox.pre.swissid.ch/idp/oauth2/.well-known/openid-configuration"/>
+            <!-- source: pattern://a976546c6a56dc04c0d34592 -->
+            <property name="httpclient.tls.trustAll" value="true"/>
+        </AuthState>
+        <AuthState name="cossa_realm_RewriteRequestForAuthorizationServerAuthstate" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false">
+            <!-- source: pattern://b6cbd53b8eee023b6d65f62d -->
+            <ResultCond name="ok" next="cossa_realm_AuthorizationServer"/>
+            <!-- source: pattern://b6cbd53b8eee023b6d65f62d -->
+            <Response value="AUTH_ERROR">
+                <!-- source: pattern://b6cbd53b8eee023b6d65f62d -->
+                <Arg name="ch.nevis.isiweb4.response.status" value="403"/>
+            </Response>
+            <!-- source: pattern://b6cbd53b8eee023b6d65f62d -->
+            <property name="inargs:grant_type" value="refresh_token"/>
+            <!-- source: pattern://b6cbd53b8eee023b6d65f62d -->
+            <property name="inargs:refresh_token" value="${inargs:subject_token}"/>
+        </AuthState>
         <AuthState name="cossa_realm_AuthorizationServer" class="ch.adnovum.cossa.AuthorizationServer" final="false" resumeState="true">
             <!-- source: pattern://e02a36447ce2d3c66d8d81c0 -->
             <ResultCond name="authenticate:valid-authorization-request" next="cossa_realm_simulatelogin"/>
@@ -221,6 +289,16 @@
             <!-- source: pattern://e02a36447ce2d3c66d8d81c0 -->
             <property name="scope.phone.clientCredentialsFlowPolicy" value="true"/>
         </AuthState>
+        <AuthState name="cossa_realm_klpscope" class="ch.adnovum.cossa.KLPScopeToProfileBinding" final="false" resumeState="true">
+            <!-- source: pattern://9c293034211ea47bd3e9c12b -->
+            <ResultCond name="default" next="cossa_realm_CallPolicyVerificationAPI"/>
+            <!-- source: pattern://9c293034211ea47bd3e9c12b -->
+            <Response value="AUTH_CONTINUE"/>
+            <!-- source: pattern://9c293034211ea47bd3e9c12b -->
+            <property name="prioritiesSource" value="klp-profiles.conf"/>
+            <!-- source: pattern://9c293034211ea47bd3e9c12b -->
+            <property name="profileExpression" value="oauth2.scope.${notes:scope}.metadata.klp_profile"/>
+        </AuthState>
         <AuthState name="cossa_realm_simulatelogin" class="ch.nevis.esauth.auth.states.standard.TransformAttributes" final="false">
             <!-- source: pattern://680c047dd9a5220fae3c9c3e -->
             <ResultCond name="ok" next="cossa_realm_Prepare_Done"/>
@@ -240,18 +318,6 @@
             <!-- source: pattern://680c047dd9a5220fae3c9c3e -->
             <property name="session:ch.nevis.session.loginid" value="meta.admin@adnovum.ch"/>
         </AuthState>
-        <AuthState name="cossa_realm_auth_failed" class="ch.nevis.esauth.auth.states.standard.AuthError" final="false">
-            <!-- source: pattern://72e29eb80a951e518ce123e4 -->
-            <Response value="AUTH_ERROR">
-                <!-- source: pattern://72e29eb80a951e518ce123e4 -->
-                <Gui name="Error">
-                    <!-- source: pattern://72e29eb80a951e518ce123e4 -->
-                    <GuiElem name="info" type="error" label="error_99"/>
-                    <!-- source: pattern://72e29eb80a951e518ce123e4 -->
-                    <GuiElem name="submit" type="button" label="continue.button.label"/>
-                </Gui>
-            </Response>
-        </AuthState>
         <AuthState name="cossa_realm_JwtToken" class="ch.nevis.esauth.auth.states.jwt.JWTToken" final="false" resumeState="true">
             <!-- source: pattern://a1e5d0192e082e689465a0c9 -->
             <ResultCond name="ok" next="cossa_realm_Prepare_Done"/>
@@ -270,6 +336,27 @@
             <!-- source: pattern://a1e5d0192e082e689465a0c9 -->
             <property name="keyobjectref" value="tokensigner"/>
         </AuthState>
+        <AuthState name="cossa_realm_CallPolicyVerificationAPI" class="ch.adnovum.cossa.CallPolicyVerificationAPI" final="false" resumeState="false">
+            <!-- source: pattern://5daa6d4f525b11a4e9b0ea79 -->
+            <ResultCond name="multiple_profiles" next="cossa_realm_Authentication_Failed"/>
+            <!-- source: pattern://5daa6d4f525b11a4e9b0ea79 -->
+            <ResultCond name="no_valid_profile" next="cossa_realm_Authentication_Failed"/>
+            <!-- source: pattern://5daa6d4f525b11a4e9b0ea79 -->
+            <ResultCond name="ok" next="cossa_realm_Prepare_Done"/>
+            <!-- source: pattern://5daa6d4f525b11a4e9b0ea79 -->
+            <Response value="AUTH_CONTINUE">
+                <!-- source: pattern://5daa6d4f525b11a4e9b0ea79 -->
+                <Gui name="Default"/>
+            </Response>
+            <!-- source: pattern://5daa6d4f525b11a4e9b0ea79 -->
+            <property name="evaluatePoliciesForAllProfiles" value="false"/>
+            <!-- source: pattern://5daa6d4f525b11a4e9b0ea79 -->
+            <property name="klpURL" value="https://klp.agov-w.azure.adnovum.net/api/endpoint"/>
+            <!-- source: pattern://5daa6d4f525b11a4e9b0ea79 -->
+            <property name="basicAuthUsername" value="testbasicauth"/>
+            <!-- source: pattern://5daa6d4f525b11a4e9b0ea79 -->
+            <property name="basicAuthPassword" value="testtesttest"/>
+        </AuthState>
         <AuthState name="cossa_realm_Prepare_Done" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
             <!-- source: pattern://b67f81a971e4c08aa79040a2 -->
             <ResultCond name="default" next="cossa_realm_Auth_Done"/>
@@ -281,6 +368,18 @@
             <!-- source: pattern://b67f81a971e4c08aa79040a2 -->
             <property name="script" value="file:///var/opt/nevisauth/default/conf/prepare_done.groovy"/>
         </AuthState>
+        <AuthState name="cossa_realm_Authentication_Failed" class="ch.nevis.esauth.auth.states.standard.AuthError" final="false">
+            <!-- source: pattern://5daa6d4f525b11a4e9b0ea79 -->
+            <Response value="AUTH_ERROR">
+                <!-- source: pattern://5daa6d4f525b11a4e9b0ea79 -->
+                <Gui name="Error">
+                    <!-- source: pattern://5daa6d4f525b11a4e9b0ea79 -->
+                    <GuiElem name="info" type="error" label="error_99"/>
+                    <!-- source: pattern://5daa6d4f525b11a4e9b0ea79 -->
+                    <GuiElem name="submit" type="button" label="continue.button.label"/>
+                </Gui>
+            </Response>
+        </AuthState>
         <AuthState name="cossa_realm_Auth_Done" class="ch.nevis.esauth.auth.states.standard.AuthDone" final="false">
             <!-- source: pattern://b67f81a971e4c08aa79040a2 -->
             <Response value="AUTH_DONE">
diff --git a/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/var/opt/nevisauth/default/conf/klp-profiles.conf b/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/var/opt/nevisauth/default/conf/klp-profiles.conf
new file mode 100644
index 0000000..c9c07b9
--- /dev/null
+++ b/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/var/opt/nevisauth/default/conf/klp-profiles.conf
@@ -0,0 +1,25 @@
+suisseid_auth_address_verified
+suisseid_auth_address_required
+suisseid_auth_mobile_verified
+suisseid_auth_mobile_required
+suisseid_auth_phone_required
+suisseid_auth
+password_auth_address_verified
+password_auth_address_required
+password_auth_mobile_verified
+password_auth_mobile_required
+password_auth_phone_required
+password_auth
+email_auth_address_verified
+email_auth_address_required
+email_auth_mobile_verified
+email_auth_mobile_required
+email_auth_phone_required
+email_auth
+autologin_auth_address_verified
+autologin_auth_address_required
+autologin_auth_mobile_verified
+autologin_auth_mobile_required
+autologin_auth_phone_required
+autologin_auth
+default
\ No newline at end of file
diff --git a/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/var/opt/nevisauth/default/plugin/cossa-token-exchange-authstates.jar b/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/var/opt/nevisauth/default/plugin/cossa-token-exchange-authstates.jar
index e338e174737b658a2936b83a3b6b8e03447ae56e..c6546d7bad4fbda24d322bc268d4962f7ae563e4 100644
GIT binary patch
delta 4354
zcmZXXcT`hbx5X1cq=gcS1VMTa2%&@)dJUmhuOdx~bc9QnpcLsyF$sup35fI#B1qNH
z3`L|D1)`t`0-_gCfiL0SH{SDoXN>IM*z>G4*FHOcO=2a@t4bOsOH*nZ4gi3T4qy_K
z%_L4mUX@HmO=4260LTv&Wg$P*<e$6uWop20<&PyP<rA05Yc3F|Kt{7Nu!f4l_tdNB
zC>*38qNXq#WN^kg)=3)5zJ@agNTK$Hn6tWW-Yv#6U83hq_m={mr|g5|#m?U2lrK}$
zQ%+^>d`D+1cS2PWZS$S)G{$ssRxHcfTKm!v-Gc5_q%d40E>BszQ4yCX6%i^J=}&$0
z`e^j(*SSLV<wEts5m`8VP&v!&{$y&%n18?<r+_g&wT&-7CznH-c6PeTM$J+e`ORVn
z4-SrR?~t&XCtu@Ps2wdXisrGc-=lTv3qmaxbKgo-bYkg<Lbu%Z@k`^eA?fI)nM#Ng
zhk-t`ZXImtkPgs;`y#f(6-gPEo$z+8kEyio)Uxl2x_pKNZ0piq3JuWq=M9v<^<ljM
zv9Z#_K^%UPsx)ztf+da88)|4x<1A1sPPR|5lv#o9!fqq3Lkr(&i@?co-#c`Hf$YL>
zx;3FDmiZxQ<K3fVE@2eEWyW?D+ZG*9UmPa+o^AiYKzSWlF7YTi;8L)Mn@f}DDldJr
zhXhV92pb1=)yHF2x*B&IxKbeMkp|*K7plclHYHELOkcg&?^Ov^%_x@U^cFz}D6B=i
z<lf-xkE^%2Fd~0#JdmH9^6+^hG6si=aHYe-H{8%g2@b<J7V*ApM&0{D9pT<{DmOM`
zo=zM^!p4jc<E0A#{>{lXYFWfWk6V4U=|yf!Qjru?1bTB8{JKG*95Qxd4BcYNFH{$9
zjFr*6QAHdU_F7sS%QRFp@y0ZA%lJjjtI%`$Xvji+Jl$s#oM_V{M3h(9+U6Lr35++O
z1T?JwC{bk7mtC(u5y>2J+;tsYJiBvnL=QUm-KGDkrpq5M86eV)sedsIPOrLLYi*H<
z`&Fe${PMDVBam1xr=-l9QYour#4u+wNigdI&#+=V`<bg7jd2KRE_d!U!dT|te|yWp
z%EV;`lcw+c?YcZl_zqKE(bc^zDP~mRmWu`@9D@6)R*~nJ^97*!%6>T$vZd75`=8?{
z($(F{@GolyLie{&b<taMcWc3F9)7Q2<70cJlP;D!_AES9ZKeZZq3k2>&wEcW{RLe8
z8sIPvd6wLkA8%b0OBPn*oecp93^$SBS7!3Fx%2|oxZQR@c1x@#TC@m>d-e2#1p4)C
zF~=e%=I?h(H%oWvs@ty(aJJ_lRJobiX`897B)!MhH>I8zIBDcffc%FRg4OH0?Gxe<
z{ik{f29Y@8^y8pt&SNm`4JIM$msK`JGa<&w4fw(EZ0z<8SDkqCdvMWK3quY)zktGy
zmXEQm-g9Frw`rfKsvq6l0+}HD+0o#demmYr3bQQw>3x4gP0||bU&$rZqg>r{8=P+}
zQHB0-XVJr>ZY*WjUytg%2XDVCM#BBm7HgC=uL!PIB$Ii4g(vf=Ct|`UIl1%_6R62^
z+TJMxM)HX;y7oCse|oHeZ+2A)d|jFp^*l3BCB)KfpiYgg)7Ht$dXY)F1c9cHpKg<@
z|M?y|zZ>;jr~jhIbNWEBnnK&RJM#G9yvsg0ZI;QE#{R5H3>VEil946{5KhZfkT9&Q
zL(Mu3U)NzZaCJ{v_E;b2wxG*nhPfhF36YP84#H)1^TACc?x`G`_kXqaaB)Q;SAGmY
zYea7l+`gN4f197;v;obsV$tQUfA;v+*AcEQQgwgXOE?Z#5?V#T0to&IZQwcMC|4f1
z2|fokx*GA!#({*#nS3exmBH!_MUKtCoV#8^5Qe>#&dGK<ET|Koitw6CIv`PlH6=*Q
zG06?(ww#YYX%Va?>R^tUt~9n`kME`3BTXUqj2#N5y&$HS(lp(FpckWigZw+oyb5Ep
z?oU2~Y2M8Ok2M}HmED@>vLIoCqVL?T#l3p8x)$^P0`q-OfzS_@1ASlJd7pkgXPSon
zmNb%-MPdhQN|FMWUYH{UtIZ0y?Ba<}h@91RnHKvqZ#uWzS&DOZZ$b`8xc06x*|C~D
zqP)?9*Xh06X7ZI6($U4D73Gd>4{C9tnODSFg3@x62bb8UKZZ9O#}{55RR~~@N$DGY
z$EP?w=T&FSEeMqjH7e-02{!BZ&dwPS8qw&@_-Udc(ebxU!g3-ZfX@V8JKV4|bv1Fk
z!Nfp+i~g#{cY4|FL+GXKT~$cd+I~VML>49S=7;JX<#kM8Bm=smkSUbPnIi@<(726?
zxq=_c6c7q4>cx7*oXcYOVe<F27|%?R^*71B>oFmh<n(C;HSVydMDL8<1I2`ZA+I;p
za<lE(QiQoPc-Pw+g~49k;zQ3`<Z_=)p@ej9eLj@Y4e0|s!Vg8ul@&Zfa~26H=F7zR
zWv{kSWxRp$JwZ#}^kV3=v(ij?;t}KUUi{$^^9y-5ZBEhS0|S#&>i&fs<c}DG?gTHw
zqJ5IOZ^!1sI%C8ey4cJ+VsCj-(xU?HcK45%iZHvR$*Q;(E`L12v~%|fP2kgY#Rs25
zRc{xLsH+!l+e?Kr2Rm$VNE8ySM0l3iJxmhs%IhozT~k1RLPq~Oe8&3bvZE1!Fr~mf
z%S?Bz-1U^92eW$-(nHu$Y4+&J_hU{{5#txKZ8o$XmjHb_ROQ`Ni*_1gWQLcV=%YmH
z#<&?J`!BT7kBlBxrx_JjD7P3bZXlClm54@#v4Jl4>eW}a6@FHC7dfdvzwN)h{Z{+0
z%k#mixAIBoxa_DnRNI`4!EVc+;opwB9zxuF8N7~FBCc9w^@O|`yA<f`CD8C@F*~eC
zIB?h^+pH_$YnTkN4E5Q~dDEO}+lqwH-CPfGkl@}1HNDu?c;*<uWaucxcq?#7ca%-y
zfk17LL3@2(IDXjv<!L=pTHmJeowd#CMpKIeM;1Ll+PR}ZPWT-=%SNtcn0r3G+KJ<E
zlSMR)J8&OUY@jo$|7pf|<d*_R?fR>*C@n<n4hlGuV5F<ld<f5{yTEQ5^{4LrZ~9-Y
zy2NnPf@4Dt@YKmx%N^x<@4-HxfTGo_aV<U9mmovAF6ec&Pf>OfQcvVWCj#maB#5a@
zZlx9u4GNi#dXeu_hD8<*G2%yTuE^KHzPmL33{k)je%o0yNp@WjKSC9YH%Ab?%FFUO
z508Z`LRZ$*HDxo`C*9Ba5{4qa$^3$1*bt8AONh=c7&FbkSUo*xZS4bK6#=8{G&7tc
zwG+}0yy68EU1;=vw(}}lnNI0@L+v!dGO}OME`{rFz%s*!qr{Ow@H6Ynvyc<$Yisi+
zgC%?Xhxx#d^W9Rfk#~J_zDT~_6nfxN_bylm9+2Om|7Frg+{Rautu4*FcW`j8p|Z|B
z@rst{0(Ac!FB`J{6$)3Y8|3%bBi>PxXDj|zd$pVmW1)a8RYfoFUOdNm?07Ts<b)cH
zmOd0dc}ddRZ)X~eJkg!`MQAzF3rgmPMQS9TR_$GQdnBEuynh{nUM#S{<0JRz=XT($
zrvt@GVq1|C8;jLPCq4Uqm~$EEmEt&6uw#nRX@5^-Rxl=7(3MvEK-Ox+NY0-_VVM(2
zpj*GxM|5{w@#cPkhqds&$gzU<oN}P;chpi^zl?|q2X$8GRSh=SSMu~3hPPTHl13AR
zy*WzL=(2h@FnLJ!TA_@UHTf;*3p&{lhf9d#yx!#}wwZz|=ib+8CN*fQrgphK?`2~*
zjxepXmm;u*1go?TeIxMexY3+nY9nM;4+i-|mcj_-d0A_;PoZ@&uhuYDOYhM|RVceE
zqdi%IIg*naWk+0IG}_Y)&#<nWlK3j2xmDCQ7mQ8u;4pHS9;-pzogZcC9fPeZD5c(J
zI<Q}p7#T)5`Pr*x@*5<Q+82Wv#KRu-4?B%0di*d+SG{D-TN-gF(!Ek=vuU_1Dz=tV
zy4xvDbNr4g0c}*t{o-K6MhJ~aeK51mLRimgf_q(ksKxeK>mjV}{F|xGPYho|c~l;x
z1j=g>WfE~|f$}||@rNOMP5}kO@-4ew!du?Dd<F7ZjK@*eed8Ew9aA|SlUf}!{WUf}
z1cIuAm1b7dB7%fxR_$vB`R3v}Uyn6yu82h|6!mfiw6(3NhBiUMS3S^v;_4lhT$(<;
z%svUl_JZ0MLiE}$I>1`hD_Ob}(@j4D##u<#9kiVv#kR_?M#Nr}EfsDr{L;@E%JKtc
z6ANt4zjW^Ms+M2F#ry?qZ~<u9T+@7gE7AKgmsF`FG@rBO{zxU29qN0t?Xd4O>hmKJ
zE6&c|()LGH^YdG%gV7skcceje1og1ugJqHdlO@Q^9Uhr4S@HN2Zh%$umL;E0ey)dN
zyr-MmzKumQcUt_js`3zT<xSj^`LYRKTRFI!BG$+#!l@)AUo)&RPk6FRG3&Z0Z?@6?
zu;fyn5#vXV)t4G-#hddpJlwXP5@~~p>Hci>OH@Biz3&HoxtXbmR;CwORZHO!jS!jo
z+9VR|V({=K(iI+v$Y5V{hA`;XVk)lSxl;ZR?a;=1fNNbkl#wl)qH{;h8E}i{KHD3s
ztj*$=vAayC2(9=TIgbxD$*mPaET;1ej*LW?7lK5c(!&qIP}aRvlwOVE({+6MObWN*
z=bQ165<1P6*NGL(Czt<k7;8Q<ETf|&recc-778KGDQC&4?1uAM@;c}3PD{~!0>sbu
zxxuYxNedZL#zxV16Ds*Ae26bSOJ3SlvS)QcwF+l_kDD3PDDNA$r_T~z@@~;tl9Tvu
z&ra5{adbc>3ZK#ewJAKJ15$z^R*D`7r_h}qh@cQp57eRX13l1^LO27^io(=?xy%5x
zrtIYzfzA}>FajMZ++qZxC{$wtdQe!x1oWnm5d;jRFa`v)r*H}cH2>eEh?QmrA_XYH
zQEN1Y*^UkXU;zUF3TL7ApQY^1mSHX%kUh5>&x!3~20|z%bId?qsvL_mUBelYyJ*1)
zwKN4%aZvwHR!+GxBw&6EaSi~u#0UV${btDI{BI+_^#5=2jom+`A*X2|xl!x4CM>p>
z1!ztg&dN$2e&~hmV*x7VBE8xF%j6l2N#6oFnzxfp<bN}9!j`ZCwfQOEOY=f%#S{nt
z6p;(fe=ADDumPPYgPhsOgAgH<LDJX?HXxWHKBtJJgnzGuFIO%R^k1LueQSBu>^uOF
zO1?|A-@G&N|29fu(O@7G#V`X*HdLsh=-6&B5PtS=Or>n5e<mNl4Fmu{e{*oJ{nvpL
zi(vofNLK7*2V8S*-?jiYiyg>Aajm9kW!q#;346l+&m<-evKGBd*2Hsrc0t(d9RKKk
W6#e3NvMz>g-~e*b2Gfx*2Jjy$dwBl<

delta 4388
zcmY+HcQ{;Y*T!e-gHc9{7J|`xi;^fw5WR~o`XGArGD(a+1S3X?UJj#^L>DAlbV5W4
z(Q*V~j;N9NjPvGu-|Xw!&+mHHx}UY4z4l-CPzBL&1reozHX#u`2t-B(@(fF*<RiFP
zWwc?QVeuBAi-!QeTs(vquOnQH5cG$<Q~)m@7rR)|03daNMp>YW0M9kT&%}84g9ixl
zOogaja+YS22*0mlNCWUxVG6(0b+T<!T*modU&cKJ0aE<lM}qe<pD8Ow2*%$khK!|Q
z2R$w?jbL+TIPZ`i<Y}9dUVKqHZ`2xHqB|+Ay&Gt(HRUv4R-*Y)mr&&X^KW`-p4X-9
zU0*T9a^>-_JXYy2ps)1f7ty6lh$}B&j^-*aSc&)?-Q=+K!zB>i(I#-J5%_vPV)v}$
zC?bbX@8);1M~Uz#B(&#jyx<<#<FxZQ<$4Kg%nD*>;s`tEVruM|P|?qm4&87Pai5ZT
zV<J7}Q^1ynBxio+LxVly|3U9<GC|V5*mhKY4Q<dVTBJ67fD|}@bUfo6kSr@o5SJ=D
z>^E@~|EY2-!ga>?v9*vDTY29@uqd-krfPFaliSzMxX-2#n3p63*Zm+H`*~W;HEX#|
zSrS3><tMETw+@HFh$pt<g-{vv{c3%R)~vzOxCK$ExVJ==$ft+o!!yFqx$R$3Uf-Yz
zSEEVHNiDAqe$9AwhC90@N`tb8(xpy>#ZboIScikW{9eClR6uB4KnZoo%YpH4&9qnf
z9Fa$JCQu41+bm8<ZibA=Mr&+zUpl{bkmv?NQ%=7xJeaIz8%8AHa2y*m5|uF$1kTA9
zTP1k!r;MfEE7Q9vyDU@mQ|K^Q@!&BaGh_5P8VU0Zy}@z_Z{6H{3b)rENL!$rI6at6
zah9ZRx*=hu!1r~6v(T{5LArj+d6Fl+qCRu4JnJBrE|OW=k=C<7?bt!89V(h$Pd|hp
zV_KVn2UWsPJ&pXvIsQH%Jw1D@67<Lb^MPt6RFOpZsrfZWm>KQD8;Jn(_=;CAdy5{q
zQ~Jx*ZxMg>XVsY|;mZEX5YEHYL?7UDyA~;fEZy{oH5Gww3`|PfIwsCee41f2<+`oj
z<IiRe8GOuGh4x8B9W-YeSfPe!1!tWRQP-4^bt*`sJlz@SjE<13792f6rEG88J*}hY
zz-#DW7J&^5<mt0|K8q58DmXnD@fl0TRZkW;JggwqsefhMC;O0AOXliwu(pxz<2pw0
zJVkSCucc=#G^vv6AvY&?+*K>c%zfSo<hlGr;t-Fus3Tt>?Mz47UD)vYR09ezyO?h<
zzhV7rN#5-*IIXR3DXMZ$Fxd&l#!Kl!U?|}<y74!8d-m-c^w)JF2J&zrH7$B7U0$^3
z*LsTBZn?}GAv+Qx!Gw||v;xc1gLk*&`Ay7crXu3=e>&OQ#_HL4ySdk*_+w@l<pMS*
zBHUGH_2wgD3gi`kZn8nZdOdUqma494)ad5w5AKcoRxxG7+pLm0v_i(SA9=Rvn6Fdk
z%ld@v3{Oh{OH^-tRr*xf9FioTB?sC!opE+Mz~C<$i9SevvOG{}6rj<#NyFkagdK@t
zaqgbpJIwsV5sziJ=d0=W;AuDOg9NkZ`?whB-oKaBB|0shIc<ivfd?%hoEk-jnUySV
zQ?+09PT5mu_U_363-LWW3LA!VttV!e$k028rqLk_&yvyDB8SNcOX76;Hz>-APlsy-
z<&|D(IJ5R7ZDqqp=A9`$=pDvkcNP+F<Cu`GdEZ22P~74!kFb~-scbKj#H)O)!19in
zu*vS4Rz4&*+dVY4SsH?<{LvmpX|wMI2@Fc&+jeia>Z>Lg$nDXGaM$!H^iVCt%)=J0
zt%`rrHaD&c7HHKTkmI8_4zb8EiV|%5%pF}QEN^rLmav~msrF?rMyf3N<`3Q7nW50W
z6W5&%4vv&PRpy|T+sGNN7wKJf^mcbMr7J{7Wfdu9c(uCU>OiXzWZkDv`flV<P74V~
zU{Ft&i;?~htUOIx9we5UqkJ^-o>UtQ<f?|W=%jFPig12+@$I{RBGFfEecx>;Ews>Y
zdG#2H)PL7ZdgN!IKO0tDqhT7op5Edh^B(6l8XAhBJ6bh{Dv7KDYz%)f1tc~K!YW7Z
z{y00|vo*fE6@qI-kWJAG7D+<Tf)ev<s+}uu9ka!XvVSU>RrIt>&#g9Qh)Kww{GcB~
zMa;w@X?s?}T}!Uqi1&c1Q>07F8qbh)Hs^QUUYUtZs}p)Xw<A(fBg34^8Y;BM99R+8
zHC88LoS!loKel2B&PU^}DCuWrliWr^JM!t^5rHQe#RWr%cPjljwQC<%QDd%YLuP8c
z<OzQ(CyNaoljm`oWSwT@<?YZly?_yuXQ)oG9hQl@Ms_CDY96<uyq9y(196AdQUJmW
zh|rSui>poANxd?3vwL*?Bzkzm1qx29O<v-X-q4lQOg<yMg$>xR?V3W8Y?0TBNZynk
z4}S0gXP%8X<f)ivST_z<?`!1hSEvfQ(iaDqrhi|egZ(@Ldn5{O`ZJtB^O(G?+&)*a
zVuL(_#`Amjs6!^+=0vTRx=~)Ikj;N11&y?}zN+0)q-#B9M0F<6y;K?|yc*h`=cT94
zzLO`b$Q%-LZ1#ng=Z3H$4|Y4bq3l)yZzgN<CZiof;3<bPllv+0e0g1VD2d}~r0S60
zw%z9s&`9pprr=a5tBssNUfA2r@DzhVMop#S_ob7ra?+H^tyN5Hok)_E?7P<NEJ6Z3
zq_4<FMb2d27VDdE%vJ9m@D|uX_8IlNI2JxFGJHR>II8T-%boujQSIsZ>wcY>@2a0O
zMgOBzMED~e>-rq>akm}!U5exDxC9Z+?3b%UR$-w8?5siGkAEmU>1O|RnEn&huBNOe
z`yHw^|6ROMvKsAJA*A%eD(Qf%+G@<^8f>o8r^`oK!rYxo-CT&GL4SaAge+YrMb?`3
zo7hG!ynz9CF0@ZRoxamJl78MIyv|VCYsq2NipUn{{y<0l1#Pg=D;cqQ><HUZS|7ZB
zmfdtFtaZ!fU7elrMt<SmE8ADbyHl%QM(MS)aCh(4zq_X$=X334i5VZ!U>x7o>B@8z
z>k7&`pqSrge{pexp(=|Rbc^mN^~9AQb(~gGlF_TpXH!dl+nJ$^Xs-9AtFULeo8$p$
zqCFyM&RfoS<h@ZmU5Krbyr58-Y0*{whmnEm59(Lie4r~bp6Kwhu~ZAoD%Ub(&ictu
zE>Z;_96Reh4M&`Lx0%G$)rfuN#L`02dCv4-6vGXJgyi;S3Iz?mbOo(2QnIR{A<NEt
z*o=cG69pB>LqB<VYDW2E1G}n79!u-xZaD<33}%^jn3I*e#PbiYUCq>rMN#Q<CkkZs
zogt~EaVbaBqGv?AJa3GPrilf+x0_d=cr8dl;=_BV^)jZ@1Rv1ByXN~h>ndv;qdqFb
z6doKc(bKBeYU*c>-16NnU`K68R9YG`e|uN;o`9Nc9rR9I<BYSnW68Jn`D?`3lGhmm
zK&&0+H`_dMTtEmEpMOdJ^~NWjL$c*&^tm98Depw6Nfu`fMkuoA7gYJ;eC0UmX3mq8
zE3009DNfg~UE4n&?XWm>KO;ORs>&$PS~z9;HR7++_?{Xp1#0z<Z+l2Ir7kgbZ$p%|
zd*MxH2t9>$fTOv|ld@uS$%J+4=Wo9va{20J?sYm5DcME0t@u_2+(X@us-3ivkI_ZG
zDQBwICVN^m&(|^}(%|Jrgh{s70IT~%*Pab*{zbf_6m)VWU4YYW-4IDUXt+(gLoBLG
z^I0IMw9WcKJxMG&YS?bu@U2GO(iijXRu{?-&$_-mR9q-6Zl2&v<X&oMcB8-k15wtR
zyH>NDRpI4vY*QTkv^F8^S#fZF+k2b!3=N$9(u>}jHW9&Mxdv>g%Ypr{S2&H{4A{Hc
zPqE*}PCmIHJ$$OyDSB&`HoYbJ#G21H{EO!E+0DF-yhsAan%Kn}!yA4Cc6-y!9_o8A
zmz6<ovg3C|=Sz$zM8Az}%x(s+DI%0eXlIZkZji%SZ}b%(f~yZ9>%2gfQ8_(n8a`FA
zYQo#8c1~j_aK|n@@z+jp_t(T-qaoeoqIl)4&vyvj$Kyh*|NiigIeR<2&#0<PvZ~kb
z!Md3kV#_?qqmJZ5G4XYKcCR;T&2(G7)UpjVbH`~r{pjt?F$XEzw~T?S)pCg5nV=#x
zwm#|WxZ1(2UZszKO#*1A=h?7l%IUG6EQ<X_{*Tyk?GG!Gt<0FI>V?<riksqr6N}AH
zzV(`B2)#yr9Dd3wwyL~c$C^2BEH{$;t;9=jgDo0f#w%DTP?g2-B1Nl$l41B@-(=MB
z+3=PPk0Ehvmt%93p#1Ff;Uf{m+I_uVQ=EF5n_z5z;&^#NnQ!KE2R*EtLK!Z>%g+#k
zwMcW8j&gBO7&6vw%uGlu#g_QPW!=roKCYF?^E<lT@epmI+HcMob^ayyHtq4<qlp^|
z`b1n!8)yxrKojHm30GW805IK9JB>5Sy7y61)X6<Dc+E`CPCXatuP=p|l;cT3Zo#ma
zajwGbSQw5_$Py+?78|nf#>RC1E+uH%J)Q;To>p#AL;<tpogm-vh`Lj08-rH13i(G`
zQOAM=G7<Jw3p|EfqL6|^{LS9Qm?x6E+l$OUdf7$58Y9k>w1VlcQ(0!PNH+J<9Z>^U
z(_K+#nh2#RBwK`+CQ=)o*!`~?YdlsjA;VjyJpEv5Jg?ZrUs|VPC%a4QMFe*w!N=Xa
z_%8QpzArDWmZpCREk3@BtYF78yQuimdMRT?FLmD4QkUmS8p###`MRCyON$q~mv?F9
z_zukIF5(yj86bn_D>6U@&tozG?+h^lVBk8Q4q)IWo`qmQ70)#=V1TDAIbeuq{C~JW
z4jAG0;uL@#o~aaoIi6b-fDWGWlz=my1(X0BPjU$0jb|7HFvD{S0_gqMDq;kw04+|u
zb5tG)r!pl2fvBM%kkqBC{dXyOyrYg$r2?*?IW^cZgH!<Jr97i_{V#TE5a@sl1XBJ(
zj@C!h0(59aJ7)BpJ_81Rae@QiV1QH4?<O$_bd>@G693}_1Y=JPC|{QKh}=IXy0Fv0
zh49a^nNFBO8bBDW0tci2cA}&*&;|(T34eQY3^fhFMsVW#Tf-*wXFlGdg-Ek|?!vG)
zUsRU(qrEMrfCf;xY)|w?a9JAwf$}bddVh#weg7>z>dS*Mpam%LqqL>H=&9t7PY7ZD
zq6MJ%U>iQThWtG;8Z=+@{|o`{xA<9?6a-4Rn6knj4W43Dp@1g70t$LjK^ptt3PD)L
z%Q0SF@qPSP)Yio}yn=v0!hck7s{a2Ym>YEe-o}9LqE=QT{*Pd8&;t-mG9AEzZ-T`q
qN_T!I=rOzhNl?&VB*OQ8Cq(dK4}6U6;4=1{9uOe$BfA(9=>Gr?wWD_c